Short answer
Quest Diagnostics disclosed in an SEC filing on October 22, 2026 that an unauthorized party accessed its Quanum Lab Services Manager system, which clients use to order tests and look up results. The company says certain patient records were accessed, has not said how many people or what data, and says operations were not materially disrupted.
If you think your details were included, start with our checklist on what to do after a data breach.
Key facts
| Organization | Quest Diagnostics |
|---|---|
| Incident type | Data breach |
| Status | Confirmed by the organization |
| Sector | Healthcare |
| Country | United States |
| Detected | 2026-10-21 |
| Disclosed | 2026-10-22 |
| People or records affected | Not disclosed. Quest says certain patient records were accessed. |
What data was exposed
- Certain patient records held in the Quanum Lab Services Manager (LSM) system
- Specific data types not yet disclosed by Quest
What happened
Quest Diagnostics, the New Jersey based lab testing company, told the U.S. Securities and Exchange Commission on October 22, 2026 that it had a cybersecurity incident. In the Form 8-K, Quest said it learned on October 21 that an unauthorized party had accessed its Quanum Lab Services Manager (LSM) system. The system is used by certain clients to place test orders and look up results.
Quest said it believes the party accessed certain patient records. It said the full scope is still being investigated and that the event has not materially disrupted its business or its ability to serve patients.
How the company responded
According to BleepingComputer, Quest started its incident response procedures, brought in outside cybersecurity experts and told federal law enforcement. The Quanum LSM platform was stopped, and customers were told to use paper requisitions or the Quanum eLabs portal instead. Access to two other tools, Essential Insights and LabHQ, was paused as a precaution. Clients that order through direct lab information system interfaces or electronic medical records were not affected, per the company.
What is still unknown
Quest has not said how many records were accessed, which data fields were involved or how long the intruder had access. It has not named an attacker, and BleepingComputer found no group claiming the attack.
Lab records can include names, dates of birth, contact details, insurance information, test orders and results. Whether any of those were taken is not confirmed. We list only what Quest has stated. In comments quoted by BankInfoSecurity, a Binary Defense executive said that attackers who reach a client portal can reuse the credentials found there, which is why the cause of the access matters.
Why patients should care
According to BleepingComputer, Quest serves roughly one in three U.S. adults each year, so many people have some record with the company. The 2019 AMCA breach exposed data on about 11.9 million Quest patients and led to a long-running multidistrict lawsuit, which shows that notices can take a long time to arrive.
Until Quest says more, the main risk is fraud that borrows the news. Messages about a lab bill, test result or insurance check are a common pattern in phishing messages and urgent-payment scams. Our guide on what to do after a data breach lists the checks worth doing now. Medical data is also valuable for extortion, so do not pay anyone who claims to hold your results.
We will update this page when Quest files a more detailed notice. Our editorial policy explains how updates are marked.
Scams to watch for after this breach
Criminals use breach news as cover. Expect messages that mention the incident, quote real details, or offer help.
- Phishing emails or texts posing as Quest or your doctor's office about 'unpaid lab bills' or 'new test results'
- Calls offering to 'verify' your insurance or lab account details after the news
- Fake credit monitoring or breach-settlement offers that ask for a Social Security number or card
- Extortion messages claiming to hold your lab results, if the data is later used for pressure
What to do if you are affected
- 01Wait for an official notice. Quest has not yet said who is affected, so do not respond to unsolicited messages claiming you are.
- 02If you get a call, text or email about your lab results or a bill, contact Quest or your doctor using a phone number you already have.
- 03Review explanation-of-benefits statements and lab bills for services you did not receive.
- 04Consider a free credit freeze with Equifax, Experian and TransUnion if a notice later says identifiers were involved.
- 05Ask your doctor's office whether it orders through Quanum LSM, and what it is doing in the meantime.
Frequently asked questions
Was my Quest Diagnostics lab data stolen?
Quest has not said. Its SEC filing says an unauthorized party accessed certain patient records in the Quanum LSM system, and the scope is under investigation. Quest has not yet published how many people or which data types are involved.
What is Quanum LSM?
Quanum Lab Services Manager is an online platform used by physicians, hospital staff and medical office staff to order tests, track status, look up results and order supplies. Patients do not log in to it directly.
Is the Quest Diagnostics breach ransomware?
Quest has not called it ransomware and no group has claimed it, according to BleepingComputer. One security executive quoted by BankInfoSecurity said the pattern looks more like data theft and extortion than traditional ransomware, but that is an opinion, not a finding.
Will Quest notify patients?
Quest has not said. Companies in this position usually mail notices once the review finishes, as required by state law and HIPAA. Check your mail and Quest's website for updates.
Has Quest had a data breach before?
Yes. In 2019, a breach at billing collector AMCA exposed data of about 11.9 million Quest patients, according to BleepingComputer. It is a separate incident.
Sources
- Quest Diagnostics confirms data breach exposed patient records, BleepingComputer, 2026-10-23
- Form 8-K, Quest Diagnostics Inc., U.S. Securities and Exchange Commission, 2026-10-22
- Quest Diagnostics reports hack on system used by clients, BankInfoSecurity, 2026-10-22
- Quest Diagnostics reports potential patient data breach, Digital Health News, 2026-10-22
This post summarises public reporting as of 2026-10-30. Details of live incidents change; we update posts when the organization or regulators publish new facts. Spot an error? See our editorial and corrections policy.