No. 002Your Medical Records Are Only as Secure as the Systems Behind Them

Reporting

Your medical record might be the most personal file that exists about you. It holds your diagnoses, your prescriptions, your test results, your insurance details, sometimes your Social Security number. You can change a password. You can’t change your medical history.

So when Quest Diagnostics, one of the largest lab companies in the country, told federal regulators on October 22 that an unauthorized party had accessed “certain patient records,” people paid attention. Within hours, the story online had grown well past what Quest actually said: AI hackers, a flaw in the code behind most of the internet, a cloud company leaking passwords, millions of patients exposed.

Some of those things really did happen this week. The evidence doesn’t show they’re one attack. So I did what I do with any business problem: I followed it back to the source. Here’s what’s confirmed, what’s being repeated, and what you can do about it.

What actually happened at Quest

This is the timeline Quest has put on the record, mostly in an October 22 filing with the Securities and Exchange Commission.

• Wednesday, Oct. 21Quest learns of “unauthorized access” to its Quanum Lab Services Manager (Quanum LSM). It says it promptly began its incident response, and it has since notified federal law enforcement and brought in outside cybersecurity experts.
• Thursday, Oct. 22Quest discloses the incident in a Form 8-K, the same day it reports quarterly earnings. It believes an unauthorized party accessed “certain patient records,” says the full scope is still under investigation, and says the incident “has not materially disrupted the Company’s business operations or its ability to serve patients.”
• Thursday, Oct. 22According to Fox Business, Quest disabled access to Quanum LSM, said it had stopped the unauthorized access, and paused two other systems, Essential Insights and LabHQ, as a precaution, saying no data was accessed on those. Providers who normally use Quanum LSM can order on paper or through Quanum eLabs, and Quest expects to restore full access as soon as Friday, Oct. 23.

Two details matter. First, Quanum LSM isn’t the app patients use to see their own results. It’s a tool some of Quest’s clients, like doctors’ offices and other healthcare organizations, use to place orders, receive results and look up past results. Second, Quest filed this under the SEC’s “other events” item, not the item for incidents a company has determined are material. That doesn’t make the breach small. It means that, when Quest filed, it hadn’t concluded the incident was material to its business.

What information may have been exposed

This is where the headlines and the evidence split the furthest. Security incidents happen in stages, and each one means something different for you:

• Unauthorized access: someone got into a system they shouldn’t have. Confirmed by Quest.
• Records viewed: Quest “believes” certain patient records were accessed. Confirmed as Quest’s belief, with the scope still under investigation. Fox Business reports Quest confirmed that patient health information or personally identifiable information was involved, without saying which.
• Data copied out: Not publicly confirmed.
• Data posted publicly or sold: No public evidence as of this writing.
• Data used for fraud: No public evidence.

Quest hasn’t said how many people are affected. If you see “11.9 million” attached to this story, that number belongs to a different incident: a 2019 breach at a billing collections vendor, the American Medical Collection Agency, which affected about 11.9 million Quest patients. It has nothing to do with October 2026. One site’s headline also said attackers “ordered tests and viewed results.” I found no statement from Quest or any official source supporting the claim that tests were ordered.

Under federal health privacy rules, organizations must notify affected people no later than 60 days after discovering a breach, generally by first-class mail. Quest told Fox Business it is identifying affected patients and providers and will notify them as required by law. If your information is involved, that letter is how you should expect to find out.

Did AI actually play a role?

Not in any way the evidence shows. Here’s how the two got tangled together.

On October 21, the same day Quest discovered its breach, the PHP project released emergency fixes for two critical flaws nicknamed “PHP2Shell.” PHP is the programming language behind a huge share of the web, including WordPress. The flaws could let an attacker run code on a vulnerable server without logging in. Researchers at Wiz, a company called Calif and OpenAI found them, and say AI models were central to understanding the flaws and turning them into working exploits, compressing work that would normally take a team months into about a week for one researcher. Details leaked before the planned disclosure, several European governments and companies from Japan to Ireland took websites offline as a precaution, and security firms reported attack attempts within hours.

That’s a real story. But the Associated Press reports that Quest confirmed its breach “was not related to the PHP issue.” Quest hasn’t said how the attackers got in, and no credible source has said AI was used against Quest. As of October 23, I also haven’t seen a confirmed break-in anywhere publicly tied to PHP2Shell. What’s been reported are attempts.

Two other stories got pulled into the same narrative:

• Railway. On October 21, the cloud platform Railway disclosed that an unauthorized party may have accessed customers’ encrypted environment variables, the stored settings that often hold passwords and API keys, and decrypted some of them. It told all users to replace their keys. Railway believes it was part of a series of attacks on platform companies aimed at ultimately compromising AI inference providers. TechCrunch reports it appears separate from PHP2Shell. Nothing public connects it to Quest.
• AI and encryption. Anthropic, the AI company, has published defensive security research, including an October 20 study using its AI to find unnecessary exposure in open-source software, and July research on theoretical weaknesses in two cryptographic schemes. Anthropic says neither finding affects systems in use today. None of it is connected to Quest.

The honest takeaway: AI is changing how fast software flaws are found, by defenders and attackers alike. That’s a reason to take security seriously. It isn’t evidence of who breached Quest.

Every connection is a door

Healthcare runs on connections. A single lab result can pass through a clinic’s ordering tool, a lab system, a results portal, a billing vendor and an insurer. Each connection makes care faster. Each one is also another door, and another organization’s security you’re now depending on. That’s why some of the biggest healthcare breaches happen somewhere patients have never heard of: a collections agency in 2019, a client ordering portal now.

It’s an operational dependency too. When Quest switched off Quanum LSM, the offices that relied on it went back to paper. One system’s problem became everyone’s workflow problem.

For healthcare organizations, the practical question is simple: did our staff use Quanum LSM? The breach is in a Quest system, so the exposure follows whoever placed orders or looked up results there. Quest has said its other electronic ordering systems remain operational, according to Fox Business. Organizations unsure of their exposure should ask Quest directly.

And the clock is getting shorter. Amazon’s threat intelligence team reported a probe for the PHP2Shell flaws on October 17, four days before it was public. When AI helps turn an obscure bug into a working attack in days, organizations that patch once a month are working on yesterday’s schedule.

Guidance

The Security Basics Healthcare Organizations Cannot Afford to Ignore

Most of this comes straight from the federal government’s Cybersecurity Performance Goals for healthcare. None of it is exotic. Too much of it gets skipped.

1. Long, unique passwords for every important account.Use an approved password manager. Never reuse a password across email, patient management systems, billing platforms or administrator accounts. One reused password can open all of them.
2. No passwords on sticky notes.Not on monitors, desks or notebooks, and not sent in casual texts or emails. Give every person their own account, and use a secure credential-sharing tool when access genuinely has to be shared. Unique accounts are also how you spot unusual activity. Source: HHS performance goals: unique credentials
3. Multifactor authentication everywhere it’s offered.Email, EHR systems, admin accounts and cloud platforms first. For high-risk accounts, use passkeys or hardware security keys, which resist phishing. Text-message codes are the weakest form of MFA, though still better than none. Source: CISA on MFA
4. Treat email as your front door.Email is one of the most common ways attackers get in. Use email filtering with anti-phishing and anti-malware protection. Set up SPF, DKIM and DMARC so criminals can’t easily send email pretending to be you. Watch for suspicious forwarding rules, which attackers set up to quietly copy your mail. Monitor sign-ins, train staff, and limit which outside apps can connect to your email. Filters reduce risk. They don’t guarantee it. Sources: HHS: email security, CISA: SPF, DKIM and DMARC
5. Restrict access.People should reach only the systems and information their job requires, known as least privilege. Give administrators separate accounts for admin work. Review access when someone changes roles, and remove it the day they leave. Source: HHS: revoke credentials, separate privileged accounts
6. Keep software updated.Patch operating systems, browsers, servers, plugins and business applications, starting with anything reachable from the internet. Keep a list of what you run, so when a PHP2Shell happens you know within hours whether you’re exposed. Source: HHS: mitigate known vulnerabilities, asset inventory
7. Secure integrations and AI agents.Every API key and service account is a password that never takes a vacation. Give each integration and AI agent the narrowest access it needs, rotate its keys, log what it does, and require a person to approve anything consequential. Railway’s advice to its customers this week was exactly this: replace every key.
8. Protect the data itself.Encrypt sensitive data, keep tested backups somewhere attackers can’t reach, and don’t keep data longer than you need it. Hold vendors to security requirements, and have an incident response plan before you need one. Source: HHS: encryption, incident planning, vendor requirements
9. Train your people.Staff should know how to recognize phishing, how to report something suspicious without fear of blame, and why sharing a login is never a shortcut. Source: HHS: basic cybersecurity training
10. Verify, don’t assume.Do regular risk assessments, monitor for unusual activity, and test your defenses, including penetration testing where it fits. HIPAA requires security safeguards, but compliance alone doesn’t mean you’re secure. Source: HHS: cybersecurity testing, centralized logs

What You Can Do to Protect Yourself Today

None of these steps can undo an exposure that has already happened. They make the information that’s out there harder to use against you, and they protect the accounts that matter most.

1. Secure your main email account first.It can reset every other password. Give it a unique password and strong sign-in protection, and check that the recovery phone number and backup email are still yours.
2. Use unique passwords and a password manager.Start with email, banking and any patient portal. Source: CISA, Secure Our World
3. Turn on MFA or passkeys.Passkeys or a security key are strongest, then an authenticator app. Text-message codes are the weakest option, so use them only if nothing else is offered. Source: CISA
4. Update your devices.Use your phone’s or computer’s own settings, and turn on automatic updates. Never install an “update” from a link in a message. Source: CISA
5. Don’t click breach-notification links.Scammers send fake breach notices after every big headline. Go to the company’s website or call a number you already know. Real HIPAA notices generally arrive by mail. Source: FTC on phishing
6. Read your medical bills and Explanation of Benefits statements.Look for tests, visits or prescriptions you didn’t receive. Source: FTC on medical identity theft
7. Watch for medical identity theft.Other signs: medical debts you don’t recognize on your credit report (free at AnnualCreditReport.com), or a collector calling about care you never got. If you suspect it, request your records, report errors in writing, and make a recovery plan at IdentityTheft.gov. Source: FTC
8. Rely on official notices.Trust notices from Quest, your doctor or your insurer, not screenshots on social media. Large health breaches are also listed on the HHS breach portal.
9. Know when a credit freeze helps.If a provider confirms your Social Security number or financial information was exposed, a credit freeze is free, doesn’t affect your score, and stays until you lift it. You contact each of Equifax, Experian and TransUnion. A fraud alert is a lighter option that lasts a year. Source: FTC
10. If your data is confirmed exposed, follow the notice.Read it carefully, use any services it offers through the contact details it lists, and start with steps 6, 7 and 9.

Reporting

What investigators still need to establish

• How many patients, and which clients, are affected?
• What was in the accessed records: names, test results, insurance details, Social Security numbers?
• Was data copied out of the system, or only viewed?
• How did the attacker get in, and when did the access begin?
• Who is responsible, and has anyone claimed the attack or demanded a ransom?
• When will individual notices go out?

I’ll update this piece as Quest and investigators release more.

Find the problem. Understand the evidence. Build better systems. Protect the people who depend on them.