Quest paused access to the portal, brought in outside incident responders and told federal law enforcement. Its 8-K says the business was not materially disrupted. Clinics that order through their own lab or medical record systems, rather than the portal, weren't affected, and portal users have been moved to paper requisitions by fax or to the separate Quanum eLabs site in the meantime. Quest also told reporters this incident did not involve the PHP2Shell flaws everyone is patching this week.
Why this one matters: Quest says it serves about one in three American adults each year, and TechCrunch notes Quanum is used by roughly half a million clinicians. A portal that clinics log into from thousands of offices is a big, spread-out set of passwords. That's a very different risk from one hacked server inside a data center, even before anyone knows how many records were touched.
What I'd do this week if I ran security at a practice that uses a lab portal like this: reset the shared portal logins, turn on multi-factor sign-in if the vendor offers it, and warn front-desk staff about calls and emails that quote real test details. Scams that mention a real result are far more convincing than a generic phish. If you're a hospital or clinic CISO, ask Quest directly whether your accounts show up in its investigation, because the notices to patients will lag.
Context: this is Quest's second big data incident in a decade. In 2019 it lost about 11.9 million patient records through a breach at a third-party billing company.