Quest Diagnostics said an unauthorized party accessed patient records through Quanum Lab Services Manager (LSM), a system its clients use to order laboratory tests and look up results. The company learned of the intrusion on Oct. 21 and disclosed it in a filing with the U.S. Securities and Exchange Commission (SEC) the next day; by Oct. 26 it said the access had been terminated and the incident contained, though the full scope was still under investigation.

In the Form 8-K, signed Oct. 22, Quest said that “at this time the Company believes that an unauthorized party accessed certain patient records,” that it had “promptly initiated its cybersecurity incident response procedures to contain the activity,” and that it had notified federal law enforcement and engaged external cybersecurity experts. The incident “has not materially disrupted the Company’s business operations or its ability to serve patients,” the filing said.

What was taken is still unclear

Quest has not said how many patients or healthcare clients are affected. In an incident notice on its website, updated as of 8 a.m. ET on Oct. 26, the company said: “We believe some patient data within Quanum LSM was accessed, but other systems were not affected.” Asked in its own question-and-answer section whether protected health information or personally identifiable information was involved, Quest answered: “Yes, but we are still investigating to determine the specific data affected.” A separate section addressed to patients states that “personal information and patient records were affected.”

Quanum is used by about half a million clinicians in thousands of locations across North America, Quest told TechCrunch, which reported the confirmation on Oct. 23. The platform stores patient health and medical records along with diagnostic and billing data, according to TechCrunch, though the company has not confirmed which of those categories were accessed. A Quest spokesperson, Amanda Rivera, referred the outlet to the security notice rather than answer its questions. TechCrunch also noted that the notice page carries code that keeps it out of search engine results.

As a precaution, Quest temporarily paused access to two other clinician-facing tools, Essential Insights and LabHQ, which it said were not breached; both have since been restored, as has the LSM system. Providers who order through direct laboratory-information-system or electronic medical record interfaces were not affected and could keep ordering throughout, the notice says. Quest said it does not expect delays in scheduling or test turnaround times, but warned clients and patients to verify any communication about lab services and to be alert for phishing and for scams posing as breach notifications, credit monitoring offers or settlements.

The company said it will send notification letters to affected patients describing available resources, including credit and identity monitoring, and will report to regulatory authorities. No group has claimed responsibility, and Quest has not said whether it received any demand, TechCrunch reported.

Why it matters

Laboratory ordering portals sit at a sensitive junction of the health system: they hold test orders and results for patients from thousands of unrelated practices, so a single intrusion can expose records from many providers at once. For clinicians, the immediate consequences were a pause in some ordering tools and credential resets, with Quest’s help desk warning of long wait times.

For patients, the practical question is what was in the accessed records and whether it includes test results. Quest has not answered that yet. This is the company’s second major known breach in a decade; in 2019, an attack on a third-party billing vendor exposed 11.9 million patient records, TechCrunch reported. The same report lists Stryker, Boston Scientific, CareCloud, Craneware and McKesson among healthcare companies hit by cyber incidents in 2026.

What to watch

Quest said its investigation is continuing and that it will notify affected patients and providers and report to regulatory authorities. The number of people affected, and the categories of data involved, will determine the scale of the breach once it is formally reported.

The caveats

All of the information so far comes from Quest’s own filing and notice and from a single news report. The company’s statements differ in strength: the SEC filing and the provider section of the notice say Quest “believes” records were accessed, while the patient section states it as fact. No figure for the number of affected individuals has been published, the data types remain under investigation, and Quest has not said when the unauthorized access began.

This article is for general information and does not replace advice from a qualified clinician. Corrections: email the editor using the address on the Contact page.