Breaches

Quest Diagnostics breach: patient records accessed via lab portal

Quest Diagnostics says an intruder accessed patient records via its Quanum clinician portal. What it means for UK pathology supply chains.

Illustration of a laboratory server with a warning symbol representing the Quest Diagnostics patient data breach

Quest Diagnostics, the US lab testing giant, has told regulators that an intruder got into the web portal clinicians use to order tests and view results, and that patient records were accessed. For UK healthcare, the warning is clear: the supplier portal that sits between a clinic and its pathology lab is now a front-line target.

What happened

On Wednesday 21 October 2026, Quest Diagnostics found that an unauthorised party had gained access to Quanum Lab Services Manager (LSM). Doctors’ offices, hospitals and practices use this system to submit lab orders and look up results. A day later, on 22 October, the New Jersey-based company filed an 8-K report with the SEC, the US markets regulator. It said it believes the intruder accessed “certain patient records”, that it has triggered its incident response procedures, brought in outside specialists and informed federal law enforcement.

A notice and FAQ on Quest’s website go further than the filing. Quest says it paused LSM as soon as it confirmed the intrusion and that the attacker no longer has access. Two related client tools, Essential Insights and LabHQ, were also taken offline as a precaution, although Quest says no data in them was touched. The FAQ confirms protected health information and personal data were involved, with the exact fields still being established. Affected patients will be offered credit and identity monitoring.

Core laboratory operations are unaffected, and practices ordering through their own record systems carry on as normal. LSM users have been sent to faxed paper requisitions or a sister portal, Quanum eLabs, with full service expected back as soon as 23 October. Quest says the incident is unrelated to the PHP security issues federal officials have been warning about.

Quest has not said how many patients or clients are affected, how the attacker got in, when access began, or whether anyone has demanded money. TechCrunch noted that the notice page carries a “noindex” tag, keeping it out of search results.

The technical picture

What little is known points to an attack on the application layer, not a ransomware event that cripples the whole network. GBHackers notes there is no named threat actor, no stated entry point and no sign of extortion so far. That pattern, a contained compromise of one internet-facing portal with record access but no wider outage, usually means one of a small set of root causes: stolen or reused clinician credentials, a session or authorisation flaw that lets one account see records belonging to another, or a vulnerability in the portal’s own code.

The scale is why this matters. According to Quest’s own marketing, which TechCrunch cites, Quanum serves roughly half a million clinicians at thousands of sites across North America. Safeguard’s breakdown of the incident points out that a companion mobile app for physicians signs in with the same LSM credentials. One password can therefore open more than one door. Quest has not linked the app to the incident.

Quest filed under Item 8.01, “other events”, not Item 1.05, which covers incidents a company has judged material. HIPAA gives it at most 60 days from discovery to notify individuals, putting the outer limit at 20 December 2026.

Timeline of the Quest Diagnostics Quanum portal breach from discovery on 21 October to the 20 December HIPAA notification deadline

Why it matters for UK organisations

Quest’s Quanum client base is in North America, and no UK patients have been named as affected. The lesson still applies here. British clinicians who have worked through the 2024 Synnovis attack will recognise the shape of it. NHS England records that ransomware struck Synnovis, the pathology partnership co-owned by Guy’s and St Thomas’, King’s College Hospital and SYNLAB, on 3 June 2024. Over 11,000 planned and outpatient appointments in south-east London were pushed back, stolen files were leaked on 20 June, and the data may relate to patients of hospitals, GP practices and clinics across England.

Synnovis was a full encryption attack and Quest looks like a portal intrusion, but the lesson is the same. Pathology is a concentrated dependency. Many GP surgeries, private clinics, occupational health providers and NHS trusts send orders to, and receive results from, a small number of laboratory networks through web-based order communications tools. If one is compromised, patients who never dealt with the supplier are exposed, and their own clinic becomes the face of the breach.

Under UK GDPR, a UK clinic or trust using a supplier portal is normally the controller for its patients’ data, and the lab is a processor. The controller still has to assess the breach, report it to the ICO within 72 hours where it creates a risk to individuals, and decide whether patients must be told. Your contract decides how fast you find out. TechCrunch also lists Scotland-based Craneware among this year’s healthcare breach victims, so UK firms sit on both sides of this supply chain.

Expert view

In my experience, clinician-facing portals are among the weakest-tested assets in healthcare. Accounts get shared at reception desks, leavers keep live logins, and multi-factor authentication is often optional because suppliers fear friction. When we test these systems, the findings that matter most are seldom exotic. Usually it is an authorisation gap that lets one practice pull another’s results by changing an identifier, or a missing rate limit that lets one stolen login download records in bulk unnoticed.

I would also watch the fallback. Moving users to a sister portal with the same credentials keeps patient care going, which is the right clinical instinct, but until the root cause is known nobody should assume those credentials are clean. Outages also bring a wave of password resets and “verify your account” emails, ideal cover for phishing.

What to do now

  1. Map your pathology and diagnostics portals. List every supplier web portal your staff use to order tests or view results, who holds an account, and whether it is personal or shared. Remove leavers and shared logins this week (Cyber Essentials: user access control).
  2. Insist on multi-factor authentication. Where the supplier offers it, make it mandatory. Where it does not, put the question in writing and record the risk (Cyber Essentials: user access control).
  3. Check your contract and data processing terms. Confirm the supplier’s deadline for telling you about suspicious access, what audit data you are entitled to, and who contacts patients. The ICO’s 72-hour window runs from your awareness, not the supplier’s investigation.
  4. Brief front-line staff on phishing. Warn staff that messages citing a lab breach or password reset may be fraudulent, and give them a known-good supplier number.
  5. Rehearse a pathology outage. Test your alternative ordering and results route using Synnovis as the scenario, and record it in your continuity plan and Data Security and Protection Toolkit evidence.
  6. If you run a portal, test it like an attacker would. Test authorisation between tenants, bulk export limits and per-account anomaly alerts, and patch promptly (Cyber Essentials: security update management, secure configuration).

Bottom line

Quest has caught the intrusion, closed the door and promised to notify patients, but the important numbers are still missing. For UK providers the story is a structural weakness: diagnostic supplier portals hold vast amounts of sensitive data behind huge numbers of loosely managed accounts. Synnovis showed a pathology supplier going down; Quest shows data can leak while the lab keeps running.

Sources

Related Posts