Quest Diagnostics confirms patient data accessed in Quanum breach
Quest Diagnostics confirmed, in a security notice and a Form 8-K filed with the SEC, unauthorized access to the Quanum Lab Services Manager portal, with certain patient records and personal information accessed. Access was terminated and the service securely restored on October 23, 2026, at 7:00 pm ET; the investigation continues and the number of affected people has not been disclosed. LSM users needing credential resets must contact Quest's IT Connectivity Help Desk.
What happened
Quest Diagnostics confirmed unauthorized access to Quanum Lab Services Manager, a portal used by doctors' offices and hospitals to order lab tests and handle billing. The company says certain patient records and personal information were accessed. Access was terminated on October 23, 2026, and the service was securely restored.
Why it matters
Protected patient health information was compromised; Quest is still investigating what kinds of data were taken and has not said how many patients or customers are affected. Quest materials cited by TechCrunch say Quanum is used by about half a million clinicians in thousands of locations across North America. TechCrunch notes this is Quest's second known major breach in a decade, after 11.9 million patient records in 2019.
What to do
If your staff uses Quanum LSM, have users reset credentials through Quest's IT Connectivity Help Desk. Review lab orders, results, and billing from the incident window and track Quest's notifications about which data was affected.
For the technical team
- Affected
- Quest Diagnostics Quanum Lab Services Manager (portal de pedidos e resultados de laboratório) · Quanum Lab Services Manager (LSM), which stores patient health records, diagnostic data, and billing data; access to Essential Insights and LabHQ was also disrupted and later restored. Affected patients and providers not yet identified.
- Exploitation
- Unauthorized access confirmed by Quest itself in a security notice and a Form 8-K (Item 8.01) filed with the SEC. No attribution to any group or country in the sources; no ransom demand reported. Quest notified law enforcement and is investigating.
- Fix
- No software patch: unauthorized access was terminated and Quanum LSM securely restored as of October 23, 2026, 7:00 pm ET, with Essential Insights and LabHQ access restored. LSM users needing credential resets must call the IT Connectivity Help Desk.
- Vector
- Unauthorized access to the Quanum Lab Services Manager web portal; the initial entry vector was not disclosed by Quest.
- More details
- Quest learned of the attack on October 21, 2026, a Wednesday, per the 8-K as reported by TechCrunch. Accessed data includes personal information and patient records; specific data types remain under investigation. Spokesperson Amanda Rivera did not answer TechCrunch's questions and pointed to the security notice, which TechCrunch reports carries noindex code. TechCrunch also cites a 2026 case study on Quest's site in which a single health system with more than 6 million patients holds hundreds of millions of related medical documents and charts.
Timeline
Incident opened.
Sources 6 sources
- An update on an incident involving one of our systems Quest Diagnostics
- Quest Diagnostics confirms data breach exposed patient records BleepingComputer
- Form 8-K, Item 8.01 (Quanum LSM unauthorized access) U.S. SEC
- Quest Diagnostics hit by a cyber breach, with patient records likely accessed AP News
- Lab testing giant Quest Diagnostics confirms patients' personal and health data was compromised during breach TechCrunch
See all 6 sources
- Quest Diagnostics (Hacked) Hacker News
