Quest Diagnostics questdiagnostics.com Quest Diagnostics data breach: what happened and what to do
Quest Diagnostics told HHS that an employee misconfigured a website, making the health information of 1,062 people viewable by others. It included names, addresses, health insurance details and treatment information.
View all 13,115 breaches- Breach date
- 25 Oct 2024
- Made public
- 25 Oct 2024
- Affected
- 1,062
- Data exposed
- Names, Physical addresses, Health insurance information, Treatment information
- Last updated
Quest Diagnostics, the lab testing company, reported to the US Department of Health and Human Services that a website misconfiguration let other people see health information on 1,062 individuals. HHS listed the report on October 25, 2024.
What happened
According to HHS's summary, an employee misconfigured a website, and as a result the protected health information of 1,062 people became viewable by others. HHS lists the cause as unauthorized access or disclosure. The summary doesn't say how long the information was visible or who looked at it. This was a configuration error, not a criminal attack.
What was exposed
The information included names, addresses, health insurance information and treatment information. Insurance details such as a member ID can be used to file false claims, and treatment information is sensitive in its own right.
The company's response
Quest notified HHS and the affected individuals. It added administrative, technical and security safeguards, and gave staff additional cybersecurity training.
What this means for you
A small exposure like this one often carries lower risk than a large theft, but you can't tell from the outside. If Quest wrote to you, read the letter, because it describes your own case. The practical risks are claims fraud using your insurance details and phishing that mentions a real test or provider.
What to do if you were in it
- 1
Read your notice letter
Quest wrote to affected people. It explains what was visible in your case.
- 2
Check your insurance statements
Read the explanations of benefits your insurer sends. Report claims for care you didn't receive to the insurer, and ask whether to get a new member ID.
- 3
Expect scams that mention the breach
Emails, texts and calls that quote real details about you, or offer help with the breach, are a common follow-up. Don't click links in them. Go to the company's own site or phone number instead.
- 4
Check whether your email or phone is in this and other breaches
Run a free Serus scan. Serus monitors breach databases and the dark web for your details and alerts you when they show up in a new leak.
Frequently asked
Was I affected by the Quest Diagnostics breach?
If you were, Quest notified you directly. HHS lists 1,062 people.
Was this a hack?
No. HHS's summary describes an employee misconfiguring a website, which made the information viewable by others.
What was exposed?
Names, addresses, health insurance information and treatment information.
Sources
Something wrong or out of date? Tell us and we'll re-check it.
