Hacker steals data on 34,000 patients in Quest Diagnostics data breach

34,000 patients had sensitive medical data stolen from Quest Diagnostics who say "the risk of harm to patients is low." Impacted patients have been notified.

A hack at Quest Diagnostics, a lab services company, exposed medical test results and personal information for 34,000 patients in the United States.

The breach occurred on Nov. 26, according to a statement from the New Jersey-based firm. Lab results, names, dates of birth, and some phone numbers were exposed but Social Security numbers and financial information was not, they said.

The company says they’ve notified the impacted individuals.

There is no evidence at this point that the stolen data has been used at this point. It’s been less than a month since the theft, however, so that’s little reason to believe it won’t be misused in the future.

“Due to the nature and the limited amount of information that was accessed, we believe the risk of harm to patients is low,” Denny Moynihan, a Quest spokesman, told the Chicago Tribune.

The hacker accessed the MyQuest by Care360 internet application and obtained Protected Health Information (PHI) through a vulnerability that hasn’t been specified by Quest but that has been, they claim, addressed.

“Quest is taking steps to prevent similar incidents from happening in the future, and is working with a leading cybersecurity firm to assist in investigating and further evaluating the company’s systems,” according to the company. “The investigation is ongoing and the unauthorized intrusion has been reported to law enforcement.”

Government

• FBI officials say AI is bolstering adversaries, emphasizing need to focus on cyber basics, patching

• Feds accuse China of ‘systematic’ distillation of U.S. AI models

• CIA’s Michael Ellis says cyber intelligence is changing how the agency operates

• The G7 tells industry to hurry up and prep for post-quantum encryption

Technology

• European parliament members call for slowdown of Serbia’s EU entry over spyware use

• FCC proposes public scorecard to rate telecoms on anti-robocall efforts

• Pegasus, NoviSpy variant spyware found on devices of Serbian activists

• Wyden seeks upgraded NSA security guidance on commercial VPN use

Threats

• Microsoft discloses two actively exploited zero-days among 974 vulnerabilities

• Russian national extradited to US for alleged involvement in bank-account takeover scheme

• Attackers exploit zero-days in consistently besieged SonicWall product

• Jail time for Maine child in 764 marks turning point in federal law enforcement

Policy

• Whistleblower says USPS deploying new, ‘untested’ IT systems governing mail-in ballots

• ‘Watershed 250’ test program in Texas looks to private sector for water cybersecurity help

• Former sexual abuse victims say Grok used their images, videos to train deepfake capabilities

• Cyber threats nudge Trump to sign executive order on foreign equipment in U.S. energy infrastructure