Medical testing giant Quest Diagnostics discovered “unauthorized access” to its systems on Wednesday, according to an SEC filing Thursday. The company believes attackers accessed patient records but has not disclosed the potential scope of the breach.
The unauthorized access occurred in the company’s Quanum Lab Services Manager, which is used by clients to place orders and check test results. The company is working with law enforcement to investigate the hack according to the 8-K filing, which is mandated by law when a cyberattack occurs.
“While the full scope of unauthorized access remains under investigation, at this time the Company believes that an unauthorized party accessed certain patient records,” the filing explained. “This incident has not materially disrupted the Company’s business operations or its ability to serve patients.”
Quest Diagnostics didn’t immediately respond to questions about how the intrusion was discovered. It’s not clear if the breach was related to the critical vulnerabilities discovered in the PHP programming language, first warned about on Tuesday, which allow hackers to fully take control of affected servers.
Patches to fix the issues were released Wednesday, and systems administrators around the world have rushed to fix them, sometimes even pulling critical websites offline while they work to address the problems. The PHP flaws were publicized widely on social media before patches were released, giving hackers a head start.
There have been millions of hacking attempts since the discovery of the flaws, according to Cloudflare CEO Matthew Prince, who tweeted about the issue on Wednesday.
“In the 10 hours before it was publicly announced, across the @Cloudflare network we saw thousands of attempts to exploit it,” tweeted Prince. “That jumped to tens of thousands in the 45 minutes post announcement, hundreds of thousands within 2 hours, and millions now.”
Again, it’s unclear if the unauthorized access at Quest Diagnostics is related to the PHP issues, but those vulnerabilities are obviously front of mind as the world races to fix these bone-headed mistakes. And as companies turn their attention to cybersecurity, it’s entirely possible some will discover unrelated breaches that went unnoticed.
As Reuters notes, there have been other high-profile attacks on the health care sector recently that have nothing to do with the PHP issue. Some hackers are motivated by extracting large sums of money, while others are working on behalf of state actors with their own motivations.
For example, U.S. medical equipment company Stryker experienced a global outage in March after the Iran-linked hacking group Handala claimed responsibility. The hackers said it was “in retaliation for the brutal attack on the Minab school,” a reference to the U.S.-led bombing of Iran and attack on a school that killed 168 people, most of them children, at an all-girls elementary school.
Gizmodo will update this article when we hear back from Quest Diagnostics.
