Ross Filipek, CISO at Corsica Technologies, comments, “Quest’s Quanum platform sits at a sensitive intersection of patient information and everyday lab work. Depending on what was accessed, those records could give criminals material for identity fraud or convincing messages about someone’s care. A scam referencing a real test can feel far more credible than a generic phishing email, and patients can’t simply replace their medical history after an exposure.

“This incident also illustrates healthcare data’s enduring appeal to attackers. They don’t establish a common cause across these breaches. The potential payoff remains substantial for anyone seeking sensitive information at scale. For healthcare organizations, the practical lesson is to examine how much patient information each account can reach. Monitoring needs to catch unusual access before a legitimate workflow becomes a route to records.”

This has been a challenging year for healthcare cybersecurity, with security experts raising concerns about the state of the sector’s cyber posture and research showing that ransomware attacks doubled for the industry since the same time last year. 

Tim Mackey, Head of Software Supply Chain Risk Strategy at Black Duck, adds, “Whenever a healthcare, or telehealth, cyberattack occurs, I’m reminded of one key differentiator — health information is arguably the most sensitive personal data available. Cybercriminals can use that information in very targeted attacks — after all if you receive a phone call and someone purporting to be from your clinic asks for payment and knows what your care plan looks like, you’ll likely pay up. That’s assuming payment is the primary goal. Poisoning your data might be another — for example, if you have hypertension and the medication dosage were changed, that modification to your treatment plan could be catastrophic. All this to say that everyone involved in healthcare, from device manufacturers through to providers, needs to invest in threat modelling risks knowing that cybercriminals don’t seem to care about patient health.”