One of the largest clinical lab networks in the United States has taken its physician-facing ordering system offline after catching an intruder inside it. Quest Diagnostics said on October 22 that it found unauthorized access to Quanum Lab Services Manager the day before, and that “certain patient records” were probably touched. Victim counts have not been established.
The portal is the pipe through which hospitals, clinics, and independent practices submit test orders and pull results back. Quest shut it down and told clients to fall back on paper requisitions or Quanum eLabs. Two adjacent services, Essential Insights and LabHQ, were paused as a precaution. Direct LIS and EHR interfaces were untouched, customer operations never stopped, and specimens kept running.
What the filing does not say
Quest disclosed the event in an SEC Form 8-K and a customer FAQ, engaged outside forensics help, briefed federal law enforcement, and declined to describe the intrusion’s mechanics. No extortion group had claimed it as of Friday. The company ruled out the PHP2Shell web-server flaws now roiling infrastructure, which matters since its customer portal is exactly the kind of application those bugs target.
Scale is the open question. Quest operates about 7,700 patient access points, serves roughly one-third of American adults and half the nation’s physicians, and booked $11B in revenue. When its billing vendor AMCA was compromised in 2019, records for 11.9 million patients spilled. The blast radius should be narrower this time because only a subset of clients route through LSM.
For lab-dependent health systems
Ordering downtime is a clinical workflow problem. Confirm paper requisition paths, verify result-routing through your LIS, and log the outage window for delayed diagnostics. Track the 8-K for an amended victim count before sizing notification obligations.
