Used Quest Diagnostics? What we know about their data breach
Quest says someone got into the system doctors use to order lab tests and view results. Here's what's known so far and what you can do now.
If you've had blood drawn in the last few years, there's a good chance the tube went to Quest. You probably never picked them. Your insurance did, and the results showed up in a portal a few days later.
On Thursday, October 22, Quest Diagnostics told the SEC that someone gained unauthorized access to Quanum Lab Services Manager. That's the system doctors and clinics use to order lab tests and look up results. Quest says it believes "certain patient records" were accessed.
What Quest has said so far
Not much yet. The company found the intrusion earlier this week, notified federal law enforcement, and brought in outside cybersecurity experts. Its filing says the full scope is still under investigation and that the incident hasn't disrupted its ability to serve patients.
What it hasn't said is how many people are affected or what was in those records. Names, birth dates, test orders, results, insurance details, Social Security numbers - we don't know which, if any, of those were taken. Quest also told the Associated Press the breach isn't related to the PHP vulnerability that made news earlier this week.
One thing worth understanding: Quanum is the system your doctor's office logs into, not you. So you could be affected even if you've never created a MyQuest account or visited a Quest location. If a provider sent your sample to Quest, your record could be in there.
This also isn't the first time. In 2019 a hack at American Medical Collection Agency, a billing collector Quest used, affected about 11.9 million Quest patients. In 2016 lab results and contact information for about 34,000 people were exposed.
What you can do now
- Watch for a letter or email from Quest. Be careful with any message that claims to be from Quest and asks for passwords, payment, or personal details. Breach news brings out the scammers fast. If you get something, go to Quest's official website yourself instead of clicking a link.
- Review the Explanation of Benefits statements from your insurer for tests or services you didn't receive. Medical identity theft shows up there before it shows up anywhere else.
- If Quest later confirms that Social Security numbers were taken, consider freezing your credit with Equifax, Experian, and TransUnion. A freeze is free, and you can lift it whenever you need to apply for credit.
Under HIPAA, Quest has up to 60 days from discovering the breach to notify the people affected, so it could be a while before letters go out. I'll update this post when Quest says more.
You can't choose which lab handles your bloodwork, and you can't choose how well they protect it. What you can do is keep an eye on your own records, and not trust the next email that says it's from Quest.
Sources: Associated Press via ABC News · Gizmodo · The Washington Post