Quest Diagnostics Quanum LSM Breach: Defending Laboratory Information Systems Against Unauthorized Access

Quest Diagnostics, one of the largest clinical laboratory networks in the United States, has confirmed that a threat actor gained unauthorized access to its Quanum Laboratory Information Management (LSM) system, resulting in the exposure of patient records. This breach represents a critical failure in the protection of Protected Health Information (PHI) and highlights the persistent targeting of healthcare infrastructure by financially motivated and state-aligned actors.

For security teams operating in healthcare environments, this incident is not merely a third-party risk notification—it is an operational imperative. Laboratory Information Systems (LIS) like Quanum LSM sit at the intersection of clinical workflows, electronic health records (EHR) integrations, and billing systems. A compromise here cascades across the healthcare delivery ecosystem, affecting patient privacy, regulatory standing under HIPAA, and potentially clinical decision-making if data integrity is compromised.

The breach underscores a harsh reality: legacy healthcare applications, often running on-premises or in hybrid configurations, frequently lack the granular access controls and comprehensive audit logging necessary to detect and prevent sophisticated unauthorized access. Defenders must immediately assess their exposure to similar access control failures and implement robust detection capabilities for abnormal data access patterns.

Technical Analysis

Affected System and Architecture

Product: Quanum Laboratory Information Management (LSM)
Vendor: Quest Diagnostics
Environment: Web-based laboratory information system managing patient demographics, test orders, results, and billing data

Quanum LSM serves as a central hub for clinical laboratory operations, interfacing with EHR systems via HL7/FHIR standards, billing platforms, and physician portals. The system typically stores highly sensitive PHI including patient identifiers, diagnostic results, genetic information, and insurance data.

Attack Vector Analysis

While specific technical details regarding the initial access vector remain limited in public disclosures, breaches of LIS platforms typically follow one of several patterns:

Credential-Based Intrusion: Compromise of legitimate user credentials through phishing, password spraying, or credential stuffing attacks against web-facing authentication portals.
Session Hijacking: Exploitation of weak session management, including session fixation, insufficient session timeout configurations, or lack of multi-factor authentication (MFA) on privileged accounts.
Broken Access Control: Exploitation of Insecure Direct Object Reference (IDOR) vulnerabilities or insufficient authorization checks allowing horizontal or vertical privilege escalation within the application.
Insider Threat or Third-Party Compromise: Malicious or negligent actions by authorized users, or compromise of downstream vendors with system access.

Exploitation Status

This breach represents confirmed unauthorized access to production systems containing live PHI. The exact scope of records exposed, duration of unauthorized access, and specific technical indicators of compromise (IOCs) have not been fully disclosed in initial reports. However, the confirmation of data exposure indicates successful exfiltration or unauthorized viewing of patient records.

From a threat intelligence perspective, healthcare data remains a high-value target for ransomware operators, data brokers, and nation-state actors seeking intelligence on specific individuals or populations. Laboratory data is particularly sensitive as it can reveal diagnoses, genetic markers, and other intimate health details not always present in standard EHR records.

Detection & Response

The following detection content is designed for healthcare SOC teams to identify suspicious access patterns to LIS platforms, abnormal data exfiltration behaviors, and indicators of credential compromise. These rules should be tuned to your specific environment's baseline access patterns.

SIGMA Rules

YAML

---
title: Quanum LSM Unusual Data Export Activity
id: 8a2f4c91-3e5d-4b7a-9c1e-5f8d2a6b4c7e
status: experimental
description: Detects bulk export or unauthorized extraction of patient data from Laboratory Information Systems, particularly focusing on after-hours activity or unusual volume patterns consistent with the Quest Diagnostics Quanum LSM breach.
references:
  - https://attack.mitre.org/techniques/T1530/
  - https://attack.mitre.org/techniques/T1048/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.exfiltration
  - attack.t1530
  - attack.collection
logsource:
  category: application
  product: healthcare_lis
detection:
  selection:
    EventType: 'data_export'
    TargetFilename|contains:
      - 'patient'
      - 'result'
      - 'phi'
      - 'export'
      - 'download'
  filter_working_hours:
    EventTime|gte: '08:00:00'
    EventTime|lte: '18:00:00'
  condition: selection and not filter_working_hours
falsepositives:
  - Legitimate after-hours batch processing for reporting
  - Emergency access by on-call laboratory directors
level: high
---
title: LIS Authentication Anomaly - Impossible Travel
id: 9b3e5d82-4f6a-5c8b-0d2f-6g9e3b7d5e8f
status: experimental
description: Identifies authentication attempts to LIS platforms from geographically impossible locations or rapid succession logins from disparate IP addresses, indicating potential credential compromise as seen in the Quest Diagnostics incident.
references:
  - https://attack.mitre.org/techniques/T1078/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.initial_access
  - attack.t1078
  - attack.persistence
logsource:
  category: authentication
  product: healthcare_lis
detection:
  selection:
    EventType: 'login_success'
    Application|contains:
      - 'quanum'
      - 'lis'
      - 'laboratory'
      - 'lsm'
  condition: selection
falsepositives:
  - VPN usage by remote workers
  - Mobile workforce accessing systems while traveling
level: medium
---
title: Unusual Database Query Volume from LIS Application
id: 7c1f3e94-5g7b-6d9c-1e3g-7h0f4c8e6f9g
status: experimental
description: Detects abnormal database query patterns from LIS service accounts, including bulk SELECT statements against patient tables or queries bypassing normal application logic, potentially indicating direct database access following application-layer compromise.
references:
  - https://attack.mitre.org/techniques/T1213/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.collection
  - attack.t1213
  - attack.exfiltration
logsource:
  category: database
  product: mssql
detection:
  selection:
    database_name|contains:
      - 'lis'
      - 'quanum'
      - 'laboratory'
    query|contains:
      - 'SELECT * FROM patients'
      - 'SELECT * FROM results'
      - 'BULK INSERT'
      - 'OPENROWSET'
      - 'sp_executesql'
  filter:
    client_hostname|contains: 'appserver'
    application_name|contains: 'Quanum'
  condition: selection and not filter
falsepositives:
  - Database maintenance windows
  - Legitimate reporting tools accessing data directly
level: high

KQL (Microsoft Sentinel / Defender)

The following KQL queries hunt for indicators of unauthorized access to LIS systems and potential data exfiltration patterns. These assume ingestion of application logs, network traffic, and authentication data into Microsoft Sentinel.

KQL — Microsoft Sentinel / Defender

// Hunt for excessive failed authentication attempts followed by success on LIS platforms
// Indicates potential brute force or credential stuffing targeting Quanum LSM or similar systems
let TimeFrame = 24h;
let FailedThreshold = 5;
SecurityEvent
| where TimeGenerated > ago(TimeFrame)
| where EventID == 4625  // Failed login
| where TargetUserName !endswith "$"
| summarize FailedCount = count(), 
            SourceIPs = make_set(IpAddress), 
            LastFailed = max(TimeGenerated)
    by TargetUserName, Computer
| where FailedCount >= FailedThreshold
| join kind=inner (
    SecurityEvent
    | where TimeGenerated > ago(TimeFrame)
    | where EventID == 4624  // Successful login
    | project SuccessTime = TimeGenerated, TargetUserName, Computer, IpAddress
) on TargetUserName, Computer
| where SuccessTime > LastFailed
| project TargetUserName, Computer, FailedCount, SourceIPs, IpAddress, SuccessTime
| extend Suspicious = iff(FailedCount > 10, "High", "Medium")
| where Suspicious == "High"
| sort by SuccessTime desc;

// Detect bulk data access patterns from LIS application servers
// Identifies potential mass export of patient records
CommonSecurityLog
| where TimeGenerated > ago(7d)
| where ApplicationProtocol contains "HTTP" or ApplicationProtocol contains "HTTPS"
| where RequestURL contains "quanum" or RequestURL contains "lis" or RequestURL contains "laboratory"
| where RequestMethod == "GET" or RequestMethod == "POST"
| extend FileExtension = extract(@"\.([a-zA-Z0-9]+)(\?|$)", 1, RequestURL)
| where FileExtension in ("csv", "xlsx", "pdf", "json", "xml", "hl7")
| summarize TotalRequests = count(), 
            UniqueFiles = dcount(RequestURL),
            TotalBytesSent = sum(SentBytes),
            Users = make_set(SourceUserID)
    by SourceIP, DestinationHostName
| where TotalBytesSent > 100000000  // 100MB threshold
| extend RiskScore = case(
    TotalBytesSent > 1000000000, "Critical",
    TotalBytesSent > 500000000, "High",
    "Medium"
)
| project TimeGenerated, SourceIP, DestinationHostName, TotalRequests, TotalBytesSent, RiskScore, Users;

// Hunt for unusual access times and geographic anomalies for LIS admin accounts
SigninLogs
| where TimeGenerated > ago(7d)
| where AppDisplayName contains "Quanum" or AppDisplayName contains "LIS" or AppDisplayName contains "Laboratory"
| extend Hour = datetime_part("Hour", TimeGenerated)
| where Hour < 6 or Hour > 22  // After hours access
| extend Location = strcat(LocationDetails.countryOrRegion, "/", LocationDetails.city)
| summarize AccessCount = count(), 
            Locations = make_set(Location),
            IPs = make_set(IPAddress)
    by UserPrincipalName, bin(TimeGenerated, 1h)
| where array_length(Locations) > 1  // Multiple locations in short timeframe
| extend ImpossibleTravel = true
| project UserPrincipalName, TimeGenerated, Locations, IPs, AccessCount;

Velociraptor VQL

For organizations running Velociraptor for endpoint detection and response, the following artifact hunts for indicators of LIS credential dumping, unauthorized database access tools, and data staging activities on systems with access to laboratory information systems.

VQL — Velociraptor

-- Hunt for suspicious processes accessing LIS-related files or databases
-- Detects potential data staging, credential dumping, or unauthorized database tools
-- Relevant for post-compromise analysis following unauthorized access like the Quest Diagnostics breach

LET LISProcesses = pslist()
WHERE Name =~ '(?i)(sqlcmd|psql|mongo|redis-cli|mysqldump|pg_dump)'
   OR CommandLine =~ '(?i)(select.*from.*patient|select.*from.*result|quanum|lis_backup|export.*patient)'
   OR Exe =~ '(?i)(dbeaver|heidisql|navicat|toad|ssms)'

LET SuspiciousFiles = glob(glob='C:\\**\\*patient*', accessor='file')
WHERE Size > 10485760  // Files larger than 10MB containing "patient" in name
   OR Btime > now() - 604800  // Created in last 7 days

LET NetworkConnections = netstat()
WHERE RemoteAddr !~ '^(10\.|172\.(1[6-9]|2[0-9]|3[01])\.|192\.168\.)'  // External IPs
   AND (Name =~ '(?i)(sql|chrome|firefox|edge|iexplore)' OR CommandLine =~ '(?i)(quanum|lis)')

SELECT 
    Pid,
    Name,
    CommandLine,
    Exe,
    Username,
    CreateTime,
    'Process' as IndicatorType
FROM LISProcesses
UNION ALL
SELECT 
    NULL as Pid,
    NULL as Name,
    FullPath as CommandLine,
    NULL as Exe,
    NULL as Username,
    Btime as CreateTime,
    'FileArtifact' as IndicatorType
FROM SuspiciousFiles
UNION ALL
SELECT 
    Pid,
    Name,
    CommandLine,
    NULL as Exe,
    NULL as Username,
    NULL as CreateTime,
    'NetworkConnection' as IndicatorType
FROM NetworkConnections

Remediation Script

The following PowerShell script provides immediate hardening and verification capabilities for Windows-based LIS application servers and database backends. It checks for common misconfigurations, enables enhanced auditing, and validates access controls.

PowerShell

# Quest Diagnostics Quanum LSM Breach - Immediate Hardening and Verification Script
# Run with administrative privileges on LIS application and database servers

Write-Host "[+] Starting LIS Security Hardening and Verification..." -ForegroundColor Green

# 1. Enable Advanced Audit Policy for Sensitive Data Access
Write-Host "[+] Configuring audit policies for sensitive data access..." -ForegroundColor Cyan
auditpol /set /subcategory:"Sensitive Privilege Use" /success:enable /failure:enable
auditpol /set /subcategory:"Security Group Management" /success:enable /failure:enable
auditpol /set /subcategory:"User Account Management" /success:enable /failure:enable
auditpol /set /subcategory:"Logon" /success:enable /failure:enable

# 2. Check for Unauthorized Local Administrators (potential persistence)
Write-Host "[+] Checking for unauthorized local administrators..." -ForegroundColor Cyan
$AuthorizedAdmins = @("Administrator", "Domain Admins", "Enterprise Admins", "LIS_Service_Account")
$LocalAdmins = Get-LocalGroupMember -Group "Administrators" | Select-Object -ExpandProperty Name
foreach ($Admin in $LocalAdmins) {
    if ($AuthorizedAdmins -notcontains $Admin) {
        Write-Warning "[!] Unauthorized admin detected: $Admin"
        # Uncomment to automatically remove (verify first!)
        # Remove-LocalGroupMember -Group "Administrators" -Member $Admin
    }
}

# 3. Verify SQL Server (if applicable) security configurations
Write-Host "[+] Checking SQL Server security configurations..." -ForegroundColor Cyan
$SQLServers = Get-Service -Name "MSSQL*" | Where-Object {$_.Status -eq "Running"}
if ($SQLServers) {
    foreach ($SQL in $SQLServers) {
        Write-Host "    Found SQL Instance: $($SQL.Name)" -ForegroundColor Yellow
        # Check for xp_cmdshell (commonly abused)
        $Query = "SELECT value_in_use FROM sys.configurations WHERE name = 'xp_cmdshell'"
        try {
            $Result = Invoke-Sqlcmd -Query $Query -ServerInstance "localhost" -ErrorAction Stop
            if ($Result.value_in_use -eq 1) {
                Write-Warning "    [!] xp_cmdshell is ENABLED - Disable immediately"
                # Invoke-Sqlcmd -Query "EXEC sp_configure 'xp_cmdshell', 0; RECONFIGURE;" -ServerInstance "localhost"
            } else {
                Write-Host "    [OK] xp_cmdshell is disabled" -ForegroundColor Green
            }
        } catch {
            Write-Warning "    [!] Could not query SQL configuration - check manually"
        }
    }
}

# 4. Enable PowerShell Script Block Logging (for detecting malicious PowerShell)
Write-Host "[+] Enabling PowerShell Script Block Logging..." -ForegroundColor Cyan
$RegistryPath = "HKLM:\SOFTWARE\Policies\Microsoft\Windows\PowerShell\ScriptBlockLogging"
if (-not (Test-Path $RegistryPath)) {
    New-Item -Path $RegistryPath -Force | Out-Null
}
Set-ItemProperty -Path $RegistryPath -Name "EnableScriptBlockLogging" -Value 1
Write-Host "    [OK] Script Block Logging enabled" -ForegroundColor Green

# 5. Check for suspicious scheduled tasks (persistence mechanism)
Write-Host "[+] Scanning for suspicious scheduled tasks..." -ForegroundColor Cyan
$SuspiciousTasks = Get-ScheduledTask | Where-Object {
    $_.TaskPath -notlike "\Microsoft*" -and 
    $_.State -eq "Ready" -and
    ($_.Actions.Execute -match "powershell|cmd|wscript|cscript|mshta")
}
if ($SuspiciousTasks) {
    Write-Warning "[!] Found potentially suspicious scheduled tasks:"
    $SuspiciousTasks | Select-Object TaskName, TaskPath, @{Name='Command';Expression={$_.Actions.Execute}} | Format-Table
} else {
    Write-Host "    [OK] No suspicious scheduled tasks detected" -ForegroundColor Green
}

# 6. Verify SMB Signing (prevents relay attacks)
Write-Host "[+] Verifying SMB signing configuration..." -ForegroundColor Cyan
$SMBConfig = Get-SmbServerConfiguration
if ($SMBConfig.RequireSecuritySignature -eq $false) {
    Write-Warning "[!] SMB Signing is not required - enabling..."
    Set-SmbServerConfiguration -RequireSecuritySignature $true -Force
    Write-Host "    [OK] SMB Signing enabled" -ForegroundColor Green
} else {
    Write-Host "    [OK] SMB Signing is properly configured" -ForegroundColor Green
}

# 7. Check for unusual network connections (established)
Write-Host "[+] Checking for suspicious established connections..." -ForegroundColor Cyan
$SuspiciousConnections = Get-NetTCPConnection -State Established | Where-Object {
    $_.RemoteAddress -notmatch "^(10\.|172\.(1[6-9]|2[0-9]|3[01])\.|192\.168\.|127\.)" -and
    $_.RemotePort -notin @(80, 443, 53)
}
if ($SuspiciousConnections) {
    Write-Warning "[!] Suspicious external connections detected:"
    $SuspiciousConnections | Select-Object LocalPort, RemoteAddress, RemotePort, OwningProcess | Format-Table
    $SuspiciousConnections | ForEach-Object {
        $Process = Get-Process -Id $_.OwningProcess -ErrorAction SilentlyContinue
        if ($Process) {
            Write-Host "    Process: $($Process.Name) ($($Process.Path))" -ForegroundColor Yellow
        }
    }
}

# 8. Generate Security Report
$ReportPath = "C:\Security_Hardening_Report_$(Get-Date -Format 'yyyyMMdd_HHmmss').txt"
Write-Host "[+] Generating security report: $ReportPath" -ForegroundColor Cyan
"LIS Security Hardening Report - $(Get-Date)" | Out-File $ReportPath
"========================================" | Out-File $ReportPath -Append
"Local Administrators: $($LocalAdmins -join ', ')" | Out-File $ReportPath -Append
"SMB Signing Required: $($SMBConfig.RequireSecuritySignature)" | Out-File $ReportPath -Append
"Suspicious Tasks Found: $($SuspiciousTasks.Count)" | Out-File $ReportPath -Append
"Suspicious Connections: $($SuspiciousConnections.Count)" | Out-File $ReportPath -Append

Write-Host "[+] Hardening script completed. Review $ReportPath for details." -ForegroundColor Green
Write-Host "[!] CRITICAL: Review all findings and change passwords for all LIS service accounts immediately." -ForegroundColor Red

Remediation

Immediate Actions (24-48 Hours)

Credential Reset: Force password resets for all Quanum LSM user accounts, particularly those with administrative or broad data access privileges. Implement immediate session invalidation to terminate any active unauthorized sessions.
Access Review: Conduct an emergency review of all user accounts with access to the LIS platform. Disable or remove accounts that are inactive, unnecessary, or cannot be attributed to current staff. Pay special attention to service accounts and third-party vendor access.
MFA Enforcement: Verify that Multi-Factor Authentication is enforced for all remote access to LIS platforms. If not already implemented, deploy MFA immediately for all user accounts, prioritizing administrative and privileged accounts.

Technical Hardening (1-2 Weeks)

Network Segmentation: Ensure the LIS environment is properly segmented from general corporate networks. Implement strict firewall rules limiting access to the LIS application and database servers to only necessary IP ranges and ports.
Database Activity Monitoring (DAM): Deploy or enhance DAM solutions to monitor all queries against patient data tables. Implement alerting for bulk SELECT statements, after-hours access, and queries originating from non-application servers.
Enhanced Logging: Verify that comprehensive audit logging is enabled for the LIS application, including:
- All authentication events (success and failure)
- Data access logs (who viewed which patient records)
- Administrative actions (user creation, permission changes)
- Data export activities
Vulnerability Assessment: Conduct an authenticated vulnerability scan and penetration test of the LIS environment, focusing on web application vulnerabilities, broken access controls, and privilege escalation paths.

Vendor Coordination and Third-Party Risk

Quest Diagnostics Engagement: If your organization utilizes Quest Diagnostics services, immediately contact their security team to determine if your patient data was involved. Request specific IOCs related to the breach for threat hunting purposes.
Business Associate Agreement (BAA) Review: Review BAAs with all laboratory service providers to ensure they meet current security standards and include specific breach notification timelines and security control requirements.
Supply Chain Assessment: Evaluate other laboratory and diagnostic service providers for similar architectural patterns that might present the same risks. Request attestation of security controls and recent penetration test results.

Regulatory and Compliance Response

HIPAA Breach Notification: If your organization's data was involved, ensure compliance with HIPAA Breach Notification Rule requirements (45 CFR §§ 164.400-414). Notify HHS and affected individuals within required timeframes based on the number of records exposed.
State Notification Requirements: Be aware of state-specific breach notification laws (e.g., California CCPA/CPRA, Texas Identity Theft Enforcement Act) that may have shorter notification windows or additional requirements beyond HIPAA.
Risk Analysis Update: Update your organization's HIPAA Security Rule risk analysis to reflect the threat landscape revealed by this breach. Document new safeguards implemented in response.

Long-Term Strategic Improvements

Zero Trust Architecture: Migrate LIS access to a Zero Trust model requiring continuous verification, least privilege access, and micro-segmentation.
Data Loss Prevention (DLP): Deploy DLP solutions capable of identifying PHI in motion and at rest, with specific rules to alert on bulk access or transmission of laboratory data.
Deception Technology: Consider deploying honeytokens (fake patient records) within the LIS database to detect unauthorized access through unique identifiers that should never be accessed.

Related Resources

Security Arsenal Healthcare Cybersecurity AlertMonitor Platform Book a SOC Assessment healthcare Intel Hub