Key takeaways
- Quest Diagnostics told the SEC it learned on October 21, 2026 that an unauthorized party accessed its Quanum Lab Services Manager platform.
- Offices that rely on Quanum LSM are being told to place orders on paper forms or through Quanum eLabs, according to BleepingComputer.
- Quest has not said how many patients are affected or which types of data were taken, so nobody outside the company can say whether a given patient is in the pool.
- Patients don't need to do anything dramatic yet, but watching insurance statements and unexpected messages is sensible while the investigation runs.
Quest Diagnostics says someone got into Quanum Lab Services Manager (Quanum LSM), an online platform where certain clients order tests and look up results. The company learned of it on Wednesday, October 21, 2026, and disclosed it to the U.S. Securities and Exchange Commission the next day. That matters if your doctor sends samples to Quest.
What Quest told the SEC
Quest reported that an unauthorized party accessed Quanum LSM and viewed some patient records. SecurityWeek, which quotes the filing, says the company believes “certain patient records” were accessed and that the full scope is still under investigation.
Quest notified law enforcement and is working with outside cybersecurity experts. It also posted an alert on its website. The company has not said how many patients or clients are affected, and it hasn’t said when the intrusion began.
One detail is worth flagging. TechCrunch reports that Quest’s notice says protected health information was taken, including “personal information and patient records”, while adding that specific data types are still being investigated. SecurityWeek and BleepingComputer describe the data types as undetermined. Treat the TechCrunch wording as the more worrying reading, and the exact contents as unknown.
How do offices order tests while Quanum LSM is down?
According to BleepingComputer, Quest shut down Quanum LSM and is telling customers to place orders on paper requisition forms or through Quanum eLabs, which also returns results. Quanum eLabs is a separate Quest product, so that’s the route most practices will reach for first.
BleepingComputer also reports that Quest put a short-term hold on Essential Insights and LabHQ as a precaution. Staff who use those tools may find them unavailable.
Quest told BleepingComputer the incident hasn’t disrupted customer-facing operations, and that users of direct-customer LIS interfaces and EMRs weren’t affected. That’s Quest’s account, and it’s reported by one outlet. A practice that has to fall back to paper will still feel the slowdown, whatever the label.
What patients can do right now
For most patients, the honest answer is: stay alert, don’t panic. Quest hasn’t said who is affected, and it hasn’t said when or how affected people will be told. Whether it will offer credit monitoring is not yet reported.
A few sensible habits while that plays out:
- Read your insurance explanation-of-benefits statements and look for lab services you don’t recognize.
- Treat unexpected calls, texts or emails about your Quest results or billing with suspicion. Go to the lab’s website or your doctor’s office yourself rather than clicking a link.
- Keep any letter from Quest or your provider. If a notice arrives, it should explain what was taken, and that’s the point to decide on steps like a credit freeze.
Quest says it reaches one in three American adults annually, so plenty of people have had samples run there. But being a Quest patient doesn’t mean your records sat in this platform. Quanum LSM is used by certain clients, and the company hasn’t said whose records were viewed.
A to-do list for practice managers
Quest’s own materials say about 500,000 clinicians use Quanum across thousands of locations. If your office is one of them, the first job is operational: get paper requisitions on hand, confirm staff know how to sign in to Quanum eLabs, and check how results are reaching you now.
Then look at the paperwork side. Your practice may have obligations to patients depending on what Quest confirms later, so keep a record of what you ordered through Quanum LSM and when. Ask your Quest account contact directly whether your practice’s data is involved, and write down the answer.
It’s also a good moment to tighten your own doors. How the attacker got into Quanum LSM hasn’t been reported, so nobody can say what would have stopped it. Still, if staff log into lab, billing or EHR portals with passwords alone, a hardware security key such as the YubiKey 5 NFC is cheap protection where the portal supports one. Pair it with a quick check on who in your office still has access to Quest accounts.
Scammers like a story like this one. Tell front-desk staff that anyone calling to verify lab accounts should be verified in return.
Is this like the 2019 Quest breach?
Not quite. In 2019, a breach at the billing collector American Medical Collection Agency (AMCA) exposed data on about 11.9 million Quest patients. That happened at a third-party vendor, not inside Quest’s own systems. This time, Quest says the access was to its own Quanum LSM platform.
The 2019 fallout hasn’t ended. BleepingComputer reports at least 19 class-action lawsuits were filed afterward and consolidated into multidistrict litigation that is still unresolved. SecurityWeek adds that in 2016 Quest said an online breach exposed lab results and contact details of about 34,000 people.
Outlets don’t frame this history the same way. TechCrunch calls 2019 Quest’s second known major breach in a decade, while SecurityWeek’s mention of 2016 suggests the count may be higher. Either way, patients have seen this before.
On timing, Quest told The Associated Press the breach isn’t related to a newly found, AI-assisted discovery of PHP vulnerabilities. That’s Quest’s own statement, relayed by SecurityWeek, and it hasn’t been independently verified.
What we don’t know yet
A lot. Quest hasn’t said how many patients or clients are affected, or which data types were taken. Names, test results, billing details, Social Security numbers and insurance information are all open questions, and so is how and when affected people will be told.
Nobody has said when the intrusion started, how long the attacker had access, or how they got in. BleepingComputer says no threat group had claimed the attack when it published. Quest hasn’t said whether any group has contacted it with demands, so whether this is ransomware or data-theft extortion is unclear.
There’s also no timeline for restoring Quanum LSM, Essential Insights and LabHQ, and nothing yet on new regulatory action or lawsuits.
Quest’s communications haven’t helped. TechCrunch says a spokesperson didn’t answer its questions and pointed to the security notice, and that the notice page carried code that keeps it out of search results. Quest spokesperson Amanda Rivera was named in the AP’s coverage. If you want the company’s notice, you may need to go to Quest’s site and look for it.
Healthcare has had a rough year. TechCrunch lists Stryker’s device wiping in March, Boston Scientific’s network outage in August, and data breaches at CareCloud, Craneware and McKesson. Patients and offices should expect more updates on Quest, and I’d treat anything beyond the SEC filing as provisional until the company publishes specifics.
Tools & products mentioned
- YubiKey 5 NFC on Amazon — Check current price
Disclosure: some links in this article are affiliate links or our editor's own courses and book. If you buy through them, TechyCluster or its editor may earn money at no extra cost to you. This does not influence what we cover or how we cover it. As an Amazon Associate, TechyCluster earns from qualifying purchases.
Frequently asked questions
What is Quanum LSM?
Quanum Lab Services Manager is an online platform where certain Quest clients place test orders and receive or look up results. BleepingComputer says physicians and office staff also use it to check test status and order supplies. TechCrunch adds that it handles billing.
Was my information exposed in the Quest Diagnostics breach?
Unknown. Quest says certain patient records were accessed and hasn't said how many people are affected or whose records. Watch for a notice from Quest or your provider.
Is Quest still processing lab orders?
BleepingComputer reports Quest says customer-facing operations haven't been disrupted. Offices that used Quanum LSM are being told to order on paper forms or through Quanum eLabs.
When did Quest find out about the breach?
Quest says it learned of the unauthorized access on Wednesday, October 21, 2026, and filed with the SEC on Thursday, October 22. It hasn't said when the intrusion began.
Get the next one in your inbox. One email a day with the tech stories that matter, explained in plain English. Subscribe free.
Sources
This article was compiled from reporting by the following outlets. Links go to the original reports.
- SecurityWeek: Quest Diagnostics Data Breach Exposed ‘Certain Patient Records’
- BleepingComputer: Quest Diagnostics confirms data breach exposed patient records
- TechCrunch: Lab testing giant Quest Diagnostics confirms patients’ personal and health data was compromised during breach
