01What is known
Quanum is used by roughly half a million clinicians across North America. Quest said other systems were not affected by data access and core operations kept running. It has not said how the attacker got in, who was responsible, or how many patients and providers were affected.
Quest paused access to Quanum and, as a precaution, to related tools, moving clients to paper requisitions, another portal, phone and eFax. It notified law enforcement and engaged outside experts. This is the company's second major incident in a decade, after a 2019 incident involving 11.9 million patient records.
02Why client portals are high-value
Customer-facing portals connect many outside users to sensitive data. Each clinic account is a possible entry point, and a single weak password or reused credential can be enough.
Require strong MFA for portal users, monitor for unusual bulk lookups or downloads, and limit what each account can see to what it actually needs.
03Plan for switching it off
Quest could shut the platform down because it had alternative ways to keep working. Many organizations do not. Decide in advance which systems you may need to turn off and how the business will run without them for days.
Write down the manual workflow, who approves the shutdown and how customers will be informed.
Sources & further reading
Security Boulevard — Top 10 breaches of the week (Quest Diagnostics)