Quest Diagnostics

A data breach has impacted Quest Diagnostics and over 11.9 million patients are potentially impacted. The American Medical Collection Agency informed Quest Diagnostics that an unauthorized user had gained access to billing system. The data leaked contains social security numbers, medical information and financial data. At this point the specific financial data leaked is not known. The company has hired a third party firm to investigate the scope of the attack.

Recommendations

• Enable the Social Security rule to monitor for any leaked social security numbers of users within your organization
• Monitor announcement from Quest Diagnostics in order to determine if your information was a part of the breach

Details

On Monday June 3, 2019, Quest Diagnostics announced that there had been a data breach of potentially 11.9 million patient records containing social security numbers, medical information and financial data. Quest Diagnostic's collection company, American Medical Collection Agency, was the target of the attack and a billing web page was the vector of the intrusion. Currently, the scope of the financial data is not known. It is unclear from the breach what type of medical records were leaked, but at this point it is believed that no laboratory results have been compromised. Quest was made aware of the breach on May 14, but currently claims they have not been able to verify the scope of the attack on AMCA. As a result, Quest has hired a third party firm to investigate the scope of the attack and the attack vector used to gain a foothold in the system. When the scope of the breach is better understood impacted customers will be notified.