One of America’s largest lab diagnostic companies said Thursday morning it had been the subject of a cybersecurity breach that it believed led to unauthorized access of patient records.
Quest Diagnostics disclosed in a filing to shareholders that it learned Wednesday of unauthorized access to a system used by doctors and other health care professionals to order tests and view lab results. The company later said that it had paused access to the impacted system, known as the Quanum Lab Services Manager. It also paused access to several other tools meant for health care professionals where data was not impacted out of “an abundance of caution.”
It was not immediately clear how many people or what specific records might have been impacted. The company said it had notified federal law enforcement and was working with external cybersecurity experts to investigate and respond.
Quest Diagnostics said in its filing that the incident had not “materially” disrupted its business operations or ability to serve patients. The company said that doctors and other customers could continue to place test orders or receive results via fax, paper or a different online tool. It said it could restore “full-service functionality” as soon as Friday.
The company’s reach is massive; Quest Diagnostics claims to serve one-third of adult Americans and half of physicians and hospitals in the U.S. every year, with about 2,000 patient locations nationwide. It has been impacted by breaches of sensitive information before.
In 2019, an unauthorized user gained access to financial data, Social Security numbers and medical data in a breach affecting about 11.9 million Quest Diagnostics patients. The breach occurred through a third-party billing collections service provider, which said at the time that laboratory test results were not accessed.
In 2016, Quest disclosed that an unauthorized user accessed sensitive information — this time via a patient portal — for some 34,000 people that included names, birthdays, lab results and in some cases, phone numbers. In that case, Social Security numbers and financial information were not accessed.
The news follows major cybersecurity vulnerabilities disclosed Wednesday that impacted various other websites, including a severe security issue in a programming language used in as much as 70 percent of websites on the internet. The issue, known as php2shell, was so severe that cybersecurity officials in the U.S. and elsewhere recommended that websites that could not immediately fix it should temporarily go offline.
The cause of the breach at Quest Diagnostics was not immediately clear, but the company said it was not related to the php2shell vulnerability.
The post Major medical lab operator believes cyber breach exposed patient records appeared first on Washington Post.
