Cyber Incident Victim: Quest Diagnostics
Date:
Nov 2016
Location:
United States of America
Summary
A medical laboratory company experienced unauthorized access to its mobile health app, compromising personal health information of approximately 34,000 individuals. The breach exposed patient names, dates of birth, lab results, and some telephone numbers, but did not involve Social Security numbers, credit card details, or financial data. The organization notified all affected parties and found no evidence of misuse of the stolen information during its investigation into the incident.
| CIA Posture | Motives | Tactics, Techniques & Procedures |
|---|---|---|
| Available to members | 2 motives | 1 technique |
| Threat Actors | Type | Location |
|---|---|---|
| 0 actors | Available to members | Available to members |
Description
On November 26, 2016, an unauthorized third party breached a mobile health application operated by Quest Diagnostics, a medical laboratory company headquartered in Madison, New Jersey. The intrusion exposed personal health information belonging to approximately 34,000 individuals. Compromised data included patient names, dates of birth, laboratory test results, and telephone numbers in certain cases. The breach specifically occurred through the app’s infrastructure, which provided patients with digital access to lab results and related medical information. Notably, the incident did not involve the theft of Social Security numbers, credit card details, insurance information, or financial records. Quest Diagnostics publicly disclosed the breach on December 12, 2016, confirming an ongoing investigation into the incident’s circumstances and extent.
The company initiated direct notifications to all 34,000 affected individuals following internal verification of the breach’s scope. Quest Diagnostics emphasized in its statement that forensic reviews found no evidence suggesting misuse of the exposed health data. While the attacker’s identity, intrusion methodology, and detection timeline remained undisclosed, the organization confirmed the breach was confined to the mobile application system. No additional systems or databases were reported as compromised. The incident marked a significant exposure of protected health information through a patient-facing digital platform, though financial fraud risks were mitigated by the absence of monetary or insurance data in the stolen records.