Quest Diagnostics says an unauthorized party accessed its Quanum Lab Services Manager, a portal some healthcare providers use to order tests and retrieve results. Its October 23 notice says personal information and patient records were affected. The company is still identifying the patients and specific information involved.

The company’s 8-K, signed October 22, says Quest learned of the access on October 21. It engaged outside cybersecurity experts and notified federal law enforcement. Discovery on that date does not establish when the intrusion began.

What is known about exposure

Evidence status: company-confirmed unauthorized access, with the scope of patient-record access still under investigation. Quest’s FAQ acknowledges that protected health information and personally identifiable information were involved. Neither the notice nor the filing supplies an affected-patient count.

Zack Whittaker at TechCrunch and Bill Toulas at BleepingComputer report the disclosure. Both identify unresolved scope questions. Quest’s overall customer base is not a count of this incident’s victims.

Quest says the incident is unrelated to the PHP programming-language issue. It has not publicly identified the entry point or attacker in the reviewed notice. These sources do not establish ransomware deployment, a ransom demand or publication of stolen records.

Portal containment and continued testing are different things

Quest paused access to Quanum LSM. It also temporarily paused Essential Insights and LabHQ as a precaution, while saying no data was accessed in those other systems.

The company says core operations remain running. Providers using direct laboratory-information-system interfaces or electronic medical records can continue ordering through those unaffected interfaces. That operational statement coexists with an unavailable portal; it does not mean every customer workflow is unchanged.

For Quanum LSM customers, Quest lists paper requisitions or Quanum eLabs as alternative ways to place orders and receive results. Its FAQ directs providers to established customer-service channels for results and assistance.

Use the published routes and wait for individual findings

  • Providers: follow the alternatives in Quest’s own notice. Confirm replacement workflows through established contacts before sending patient information to a new destination.
  • Patients: Quest says it will notify those determined to be affected. It plans to describe available resources, including credit and identity monitoring, in individual notification letters.
  • Treat unexpected outreach cautiously. Navigate to Quest’s site or use a known contact rather than an unsolicited message offering breach support. This is a precaution against impersonation, not evidence of a phishing campaign tied to this incident.

The notice still describes restoration as anticipated, using inconsistent relative-day wording. It does not establish that Quanum LSM has been restored. Check the current notice before relying on portal availability.

Caveat: the incident account is primarily Quest’s own investigation update; affected-patient totals, exact data fields and the original access method remain undisclosed.