Quest Diagnostics says unauthorized users reached certain patient records on its lab ordering platform, and still cannot say how many people were exposed.
New Jersey-based Quest Diagnostics reported unauthorized access to its Quanum Lab Services Manager system and said it believes certain patient records were reached. The company discovered the hack on Wednesday, filed a regulatory notice on Thursday, and told federal law enforcement.
The Associated Press reported that the full scope remains under investigation, with no public count yet of affected patients or which records were touched. Outside cybersecurity experts are assisting the response.
Quanum is the platform certain clients use to place lab test orders and look up results. That is everyday medical workflow, names, orders, and results moving through a system patients never see. When that layer is breached, the risk lands on the people whose information sits inside it.
Quest said it learned of the cyber breach of one of its systems this week. In its Thursday filing posture, the firm described “unauthorized access” and “certain patient records,” while leaving the hard numbers blank.
No intrusion method was disclosed. No window of access was identified. No client list or geography was named. Federal law enforcement was notified, but the specific agency was not identified in the public account.
Quest also confirmed to the AP on Thursday that this incident was not related to a separate PHP software scare that had drawn wider attention the same week. PHP is widely used across the web; Quest closed that door and left the open question where it belongs, on its own lab platform and the patient data tied to it.
This is not Quest’s first trip through the breach cycle. In 2016, the company said data including lab results and contact information for about 34,000 people was exposed in another online incident.
Three years later, the damage was far larger. Personal information belonging to about 11.9 million Quest patients was affected after a separate hack at American Medical Collection Agency, a billing collections provider connected to the company’s work.
The Washington Examiner reported that episode as a potential breach of personal and medical information for nearly 12 million people, including Social Security numbers, after an “unauthorized person” gained access to a system used by that billing vendor.
"Unauthorized person" gained access to a system used by the American Medical Collection Agency, a billing collection vendor for one of the company’s contractors.
That 2019 vendor failure turned a back-office collections system into a pipeline for highly sensitive identity data. Social Security numbers and medical information are exactly the mix identity thieves and fraud rings prize. Patients do not choose the billing vendor. They still live with the fallout when it fails.
Thursday’s disclosure puts the latest incident on the public record. It does not answer the questions that matter most to families who have used Quest labs.
How many patient files were opened? Which fields were taken or viewed, results, contact details, identifiers, or something broader? How long did the unauthorized access last? Who was behind it? Those points remain unresolved while the investigation continues.
Quest is a major medical laboratory operator. Its systems sit between doctors, patients, and test results. When unauthorized access reaches that chain, the burden of uncertainty shifts to ordinary people who never agreed to become breach statistics.
The company has taken the basic steps the public expects after a discovery like this: a regulatory filing, notice to federal law enforcement, and outside cyber help. Those steps do not restore the privacy of a record once it has been reached. They also do not erase a pattern that already includes a 34,000-person exposure and a multi-million-patient vendor failure.
Americans are told to guard their own passwords and freeze their credit. They cannot freeze a lab vendor they never hired. They cannot patch a platform they cannot see. They depend on firms that hold clinical data to keep strangers out, and to say plainly when that duty fails.
Until Quest can state the number of patients, the data fields involved, and the path the intruders used, “certain patient records” remains a warning label without a size. That is not a full accounting. It is a holding statement while the people most exposed wait for answers.
Medical data is not a marketing list. When a national lab’s systems are breached again, patients deserve hard numbers and real accountability, not another open investigation and a shrug about “certain” records.
