Quest Diagnostics, the American clinical laboratory giant that serves one in three U.S. adults annually, confirmed this week that it was the target of a cybersecurity breach in its Quanum Lab Services Manager (LSM) system. The system was discovered compromised by the company on Wednesday, October 21, and allows doctors, hospitals, and clinics to request laboratory tests, access results, and handle billing for millions of patients.
According to a filing with the Securities and Exchange Commission (SEC), Quest Diagnostics learned about "unauthorized access" to the Quanum LSM system, which approximately half a million healthcare professionals across thousands of locations in North America use daily. The company stated it believes certain patient records were accessed by an unauthorized party, though the full scope of the incident remains under investigation.
"Quest Diagnostics learned of unauthorized access to one of its systems this week, likely compromising some records for patients," the company said in its SEC filing. The company has notified federal law enforcement authorities and engaged external cybersecurity experts to assist in the investigation and response.
The Quanum LSM system has been shut down following the discovery of the intrusion. Clients using the platform are being advised to use paper requisitions or the alternative Quanum eLabs system to place orders and retrieve results temporarily. Quest Diagnostics stated that its core operations remain running normally and that the breach was not related to the PHP vulnerability that has affected other corporate systems in recent months.
The Quanum incident adds to a troubled history of data breaches at the company. In 2016, Quest Diagnostics notified about an incident in which data including lab results and contact information of approximately 34,000 people were exposed. In 2019, another incident involving a third-party billing company — American Medical Collection Agency — affected approximately 11.9 million Quest Diagnostics patients.
A case study published on Quest Diagnostics' own website shows how a single health system with more than 6 million patients can store hundreds of millions of related medical documents. Given the potential scale of records maintained by Quanum, healthcare cybersecurity experts warn that the actual impact could be significantly higher than the initial number of notified patients. Medical records on the dark market can fetch up to $1,000 per record — far more than credit card numbers — making them one of the most valuable data types for cybercriminals targeting the healthcare sector. A breach of this magnitude underscores the fragility of centralized health data systems that continue to grow in complexity and attack surface.
The healthcare sector has been a frequent target of cyberattacks in recent years, with intrusions affecting everything from hospital networks to diagnostic laboratories. The combination of financial value of medical records — which can be resold on dark markets at prices higher than financial data — and the criticality of healthcare services makes the sector particularly vulnerable. As laboratory systems become increasingly digitized and interconnected, the attack surface for cybercriminals expands proportionally, creating a scenario where proactive defense becomes as important as incident response capabilities after a breach occurs.
Sources: AP News, TechCrunch, BleepingComputer, ABC News
✓ Independent sources cross-checked and verified before publishing
