The Challenge
Quest Diagnostics faced a healthcare organization's worst nightmare: unauthorized access to a system processing patient data for one in three U.S. adults annually. On October 21, the company discovered attackers had breached Quanum LSM, the online platform used by physicians and hospital staff to order tests, retrieve results, and manage lab services across Quest's 7,700 North American locations.
This breach presented an immediate operational dilemma. Quanum LSM wasn't peripheral; it was a primary interface for thousands of healthcare providers. Shutting it down would force a return to paper requisitions. Leaving it running risked further data exposure while investigators assessed the situation. Quest's incident response team had to act before fully understanding what data was compromised or how the attackers gained access.
This is the incident response paradox: you must act decisively with incomplete information, knowing both action and inaction carry risks.
The Environment and Constraints
Quest operates at a scale that amplifies every incident response decision. With 65,000 employees and over $11 billion in annual revenue, the company processes millions of patient records through interconnected systems. Quanum LSM connects directly to physician offices, hospital networks, and medical facilities that rely on real-time lab ordering and results delivery.
The regulatory environment added pressure. Healthcare data breaches trigger Breach Notification Requirements under HIPAA, imposing strict timelines for notifying affected individuals and the Department of Health and Human Services. The company also disclosed the incident to the SEC, reflecting the materiality threshold for publicly traded healthcare organizations.
Quest's recent history complicated the response. In 2019, approximately 11.9 million patient records were compromised through a third-party billing vendor, leading to 19 class-action lawsuits. The incident response team knew every decision would be scrutinized by regulators and plaintiffs' attorneys.
The company couldn't wait for forensic certainty before taking action. External experts were brought in to support the investigation, but determining the full scope of exposed data takes weeks, not hours. Meanwhile, the system remained a potential vector for continued unauthorized access.
The Approach Taken
Quest prioritized containment over continuity. The company stopped the Quanum LSM system entirely, directing customers to alternative ordering methods: paper requisitions or Quanum eLabs. This wasn't a graceful failover; it was a hard stop that disrupted workflows across thousands of provider locations.
Simultaneously, Quest deployed its "incident response protocol to contain the activity, assess and investigate the nature and scope of the incident, and implement appropriate remedial measures." This reflects the three-phase structure most healthcare incident response plans follow: contain the breach, investigate what was accessed, and implement controls to prevent recurrence.
Quest took a selective approach to system suspension. While Quanum LSM was shut down, Quest also paused access to Essential Insights and LabHQ as a precaution. Critically, the company confirmed that "customer-facing operations" continued and that "users of direct-customer LIS interfaces or EMRs were not impacted." This suggests the incident response team had mapped system dependencies and isolated the breach to specific platforms.
Quest notified law enforcement and regulatory bodies while the investigation was still in progress. This early disclosure is required under CIRCIA for critical infrastructure operators, but it also documents your response timeline before plaintiffs' counsel can characterize delays as negligence.
Results and Metrics
Quest contained the breach without disrupting core diagnostic testing operations. The company stated that customer-facing operations remained functional, meaning specimen collection, testing, and results delivery continued. This outcome demonstrates the value of architectural segmentation; the breach affected ordering systems but didn't spread to laboratory information systems or electronic medical record interfaces.
The operational cost was workflow friction. Healthcare providers accustomed to electronic ordering had to revert to paper requisitions or adopt Quanum eLabs. This creates documentation burden, slows order processing, and increases transcription error risk, but it preserves the fundamental service: patients still get tested, and physicians still receive results.
Quest's disclosure noted that investigators were still determining "the types of data affected." This is typical for healthcare breach investigations. Initial containment happens in hours or days; understanding the full scope of exposed data requires weeks of forensic analysis. The company's willingness to disclose the breach before completing that analysis reflects a shift in incident response philosophy: transparency beats certainty when managing stakeholder trust.
What They Would Do Differently
Quest's response followed established incident response doctrine, but the breach itself points to a preventable failure. Unauthorized access to Quanum LSM suggests either credential compromise or an exploited vulnerability in a system accessed daily by thousands of external users. Healthcare organizations with similar platforms should run continuous Attack Surface Scanning and enforce multi-factor authentication for all remote access.
The 2019 AMCA breach revealed gaps in vendor risk management. A more aggressive vendor access review might have identified weaknesses in externally accessible platforms like Quanum LSM.
Quest's decision to pause Essential Insights and LabHQ "as a cautionary measure" suggests the incident response team lacked complete visibility into lateral movement paths. If those systems shared authentication infrastructure or network segments with Quanum LSM, that should have been documented in the organization's Cyber Maturity Assessment and reflected in network segmentation controls.
Takeaways for Your Team
Build containment playbooks before you need them. Quest's ability to redirect customers to alternative systems within hours suggests pre-planned failover procedures. Your incident response plan should document which systems can be shut down, which alternative workflows exist, and who has authority to make that call. Don't wait for a breach to discover your "critical" system has no backup process.
Separate disclosure timelines from investigation timelines. Quest disclosed the breach to the SEC and notified law enforcement while still investigating. This approach protects you from allegations of delayed notification and establishes a documented response timeline. Your Breach Notification Requirement obligations start when you discover unauthorized access, not when you finish forensic analysis.
Map your architectural blast radius. The fact that Quest could isolate the breach to Quanum LSM without disrupting other systems demonstrates effective segmentation. If a breach in your ordering system can propagate to clinical systems, you have an architecture problem, not just an incident response problem.
Pre-negotiate your external expert relationships. Quest brought in external investigators immediately. If you're waiting until after a breach to find forensic support, you're adding days to your containment timeline. Your Stand-Alone Cyber Policy likely includes breach response services; confirm that your insurer's panel firms have healthcare-specific expertise and can deploy quickly.
Quest's response worked because the company made the hard containment decision quickly, even though it meant operational disruption. Your incident response team will face the same choice: protect continuity or protect data. The organizations that recover fastest are the ones that decide in advance which systems they're willing to shut down.
