Good morning everyone,
This week’s developments put vendor access and recovery readiness in focus. Quest Diagnostics restored its affected laboratory platform while continuing to investigate patient-data access. ConnectWise continued recovery work following a compromise involving cloud-backup application credentials. Both warrant close coordination among operational, security, and privacy teams.
The five updates below cover developments reported or updated October 20–26, including urgent PHP security guidance, a healthcare breach settlement, and Parkview’s service restoration. Our practical focus is on verifying remediation, maintaining patient communications, and documenting what remains unresolved before closing an incident.
Regulatory & Legal Updates
Washington Gastroenterology’s $4.6 million breach settlement moves through approval process (Reported October 23, 2026)
What happened: New reporting detailed a $4.6 million proposed settlement over Washington Gastroenterology’s 2024 cyberattack, which potentially exposed information belonging to 583,741 individuals. Data included medical and insurance information, Social Security numbers, and financial information. The court has granted preliminary approval; final approval remains pending, with a hearing scheduled for January 29, 2027. The organization denies wrongdoing. Eligible class members have until January 10, 2027, to submit claims. This is private litigation, not an OCR penalty.
Why it matters: The settlement is a useful prompt to revisit the full financial and administrative consequences of a breach. Our takeaway: incident planning should include litigation support, notification records, and the evidence needed to explain security decisions long after systems recover.
Recommended actions:
· Have legal and risk management review cyber-insurance notice requirements, litigation support arrangements, and responsibility for preserving incident records.
· Keep a dated chronology linking detection, investigation findings, affected-population decisions, and notices; preserve the evidence behind each decision.
· Review high-risk remediation items with leadership and retain documented approvals, completion evidence, and any accepted residual risk.
Sources: HIPAA Journal, October 23 · Official settlement website
Breach & Incident Notices
Quest restores Quanum while patient-data investigation continues (Status reviewedOctober 26, 2026)
What happened: Subsequent reporting citing Quest’s incident notice indicates that Quanum Lab Services Manager and other temporarily paused systems were restored, while the investigation into affected patient data continued. Quest believes some patient data within Quanum LSM was accessed; the specific data and affected population remain under investigation. Core operations and direct laboratory-information-system/EHR ordering interfaces were unaffected. Quest says it will notify affected patients and providers and report to relevant regulators. The company states that the incident is unrelated to the PHP vulnerabilities discussed below.
Why it matters: For organizations using Quest, restored access should prompt workflow validation while privacy follow-up continues. Avoid telling patients that their information was unaffected unless an organization-specific assessment supports that statement.
Recommended actions:
· Ask Quest for an organization-specific impact determination, affected data fields, notification arrangements, and a contact for investigation updates.
· Reconcile orders and results handled during the interruption; check for missing results, duplicate orders, and delayed clinical follow-up.
· Give staff an approved response script and verify incident-related messages through known Quest channels before resetting credentials or following links.
Sources: Quest incident notice and FAQs
Parkview reports full restoration after network disruption (Restoration reported October 22; status checked October 26, 2026)
What happened: Becker’s reported October 22 that Parkview Health had restored MyChart and its provider-search tool after taking its network offline in response to suspicious activity. Billing and video visits were still unavailable at that stage. Parkview’s current website notice now states that all services have been restored and no patient information was compromised. The notice does not provide the underlying technical findings or a precise full-restoration date.
Why it matters: Our operational takeaway is to measure recovery by patient-facing functions. Portal access, prescription requests, billing, and video visits may need separate checks, even when the main application is available. Keep availability findings and the privacy assessment clearly documented.
Recommended actions:
· Maintain a recovery checklist covering messaging, refill requests, appointment reminders, billing, and telehealth; assign a business owner to validate each function.
· Test telephone and alternate scheduling procedures, including how staff prioritize urgent requests when portal messaging is unavailable.
· After restoration, reconcile queued requests and document the technical and privacy findings supporting closure and public communications.
Sources: Becker’s, October 22 · Parkview current service notice
Vendor & Supply Chain Risk
ConnectWise recovery continues as Microsoft details AI-assisted application abuse (October 21–26, 2026)
What happened: ConnectWise continued recovery following unauthorized access to application credentials associated with Cloud Backup, formerly SkyKick. Its October 26 update says it is preparing phased partner onboarding, with access to restore existing backups preceding full re-enrollment. Affected connections should remain disabled until service-specific instructions are issued. Separately, Microsoft’s October 21 research attributed the compromise to Storm-0940 and described AI-assisted abuse of previously authorized applications to access Microsoft 365 environments without interactive user sign-in. This is Microsoft’s assessment.
Why it matters: Our healthcare takeaway is to include vendor application identities in access reviews and incident exercises. The investigation must address potential unauthorized activity inside your own environment as well as the supplier’s restoration status.
Recommended actions:
· Confirm whether your organization or managed-service provider uses affected services, including older SkyKick integrations; identify the administrator responsible for each environment.
· Use ConnectWise’s investigation guide to review application sign-ins, added credentials, permission changes, privileged roles, and mailbox changes; preserve evidence before remediation.
· Record the last successful backup and test available recovery alternatives. Reconnect only under applicable vendor instructions, then verify both new backups and restoration.
Sources: ConnectWise status and investigation guidance · Microsoft research, October 21
Cybersecurity & Threat Intelligence
Critical PHP flaws require urgent updates and follow-through (October 21; follow-up guidance October 23–26, 2026)
What happened: PHP released fixes October 21 for CVE-2026-109618 and CVE-2026-109619, which can permit unauthenticated remote code execution. NSA urged immediate inventory and patching of affected services. Fixed PHP releases include 8.5.12, 8.4.27, 8.3.36, and 8.2.35. PHP subsequently issued session-upload-progress guidance on October 23 and updated Windows packages on October 26 for a separate Brotli vulnerability. Teams should check the latest package and configuration guidance when validating remediation.
Why it matters: For healthcare teams, the practical priority is identifying PHP dependencies in hosted websites, portals, and vendor products. Ask for deployment-specific evidence that the running service has been updated and reviewed for suspicious activity.
Recommended actions:
· Inventory internal and vendor-managed PHP services; record the product owner, internet exposure, running version, and supported patch path.
· Apply current PHP or vendor-supported fixes, restart affected services as directed, and verify the running build. Include the October 23 configuration guidance and October 26 Windows rebuilds where applicable.
· Preserve and review relevant web-server and application logs. If prompt patching is impossible, coordinate isolation or temporary shutdown with clinical operations and document the fallback plan.
Sources: PHP security and release advisories · NSA advisory, October 21
Closing Thoughts
For the coming week, prioritize a few checks your team can complete and demonstrate: verify relevant PHP remediation, review vendor application access, and test a critical patient workflow after restoration. Give each action an owner, a completion date, and a place to retain supporting evidence.
Connect the findings to your risk analysis and remediation plan. Keep encryption, access controls, monitoring, workforce training, vendor oversight, and breach-notification readiness in that review. Document what is known, what remains uncertain, and who owns the next decision. That discipline makes compliance more defensible and incident response easier to coordinate. Have a productive week.