# Quest Diagnostics Data Breach: Quanum Records, What to Do

> Quest Diagnostics confirmed unauthorized access to patient records in its Quanum Lab Services Manager on 21 Oct 2026. What is known and what to do now.

Source: https://playciso.com/blog/quest-diagnostics-data-breach-quanum-2026 · Published: 2026-10-30 · Publisher: PlayCISO (https://playciso.com)

Primary source: https://www.questdiagnostics.com/links/quanum-notice

---

**Quest Diagnostics** has confirmed a data breach. On **21 October 2026** it learned of unauthorized access to **Quanum Lab Services Manager (LSM)**, the web system clinics and hospitals use to order Quest lab tests and view results. Quest says **patient records**, including personal and health information, were accessed. It has **not** said how many people are affected or when the access began. As of 26 October, Quest says the system is restored and it will notify affected patients and providers. Clinics using Quanum LSM should reset their credentials and warn staff about phishing. **Who this is for:** Quest patients, practices and hospitals that use Quanum, and the healthcare security and compliance leaders who manage lab vendors. _Independent analysis based on Quest's SEC filing and public notice, and reporting by the Associated Press and TechCrunch. PlayCISO is not affiliated with Quest Diagnostics. Facts are as reported on 30 October 2026 and may change._ Confirmed vs not yet known **Confirmed by Quest:** unauthorized access to Quanum LSM, learned of on 21 October 2026; some patient data accessed, including health and identifying information; incident contained and remediated; LSM restored; federal law enforcement notified; outside experts engaged; core operations not affected; not related to the PHP vulnerability. **Not disclosed:** number of patients or providers affected, exact data fields, when the access started, how the attacker got in, and who was behind it. **No claim found:** as of 30 October, TechCrunch reported no ransomware or extortion claim, and Quest has not said whether anyone has made demands. ## What Quest said In its Form 8-K (Item 8.01, Other Events), Quest says it "learned of unauthorized access to its Quanum LSM system, which certain clients use to place test orders", "promptly initiated its cybersecurity incident response procedures to contain the activity", and "notified federal law enforcement authorities and engaged external cybersecurity experts." It adds: "While the full scope of unauthorized access remains under investigation," it believes an unauthorized party accessed certain patient records, and the incident "has not materially disrupted the Company's business operations or its ability to serve patients." Quest's public notice, updated at 8:00am ET on 26 October, says: "We have remediated the security incident involving unauthorized access to our Quanum Lab Services Manager (LSM) system. The system has been securely restored and is available to clients." Its FAQs add that Quest "terminated the unauthorized access and contained the incident", that "some patient data within Quanum LSM was accessed, but other systems were not affected", and that Essential Insights and LabHQ were paused "out of an abundance of caution" although "no data was accessed in these other systems." Scale matters here. TechCrunch reports that Quest's own materials describe Quanum as used by about half a million clinicians across North America. That is the population of clinics and hospitals who should be checking their side, even though the number of patients whose records were reached is not yet known. ## Timeline When (2026)WhatSource Not disclosedUnauthorized access to Quanum LSM beginsQuest has not said 21 Oct (Wed)Quest learns of the access, starts incident response, pauses LSM and related systems; clients directed to Quanum eLabs or paper requisitionsQuest 8-K; Quest notice; reporting 22 Oct (Thu)Form 8-K signed and filed; AP reports Quest says it is not related to the PHP vulnerabilitySEC EDGAR; AP via NBC News 23 OctQuest's notice confirms "personal information and patient records" were affectedTechCrunch 26 Oct, 8:00am ETQuest says the incident is remediated, LSM restored, and clients can get help resetting LSM credentialsQuest notice ## If you are a Quest patient - Watch for a letter from Quest. Quest says it will notify patients it determines were affected, and the letters will describe resources including credit and identity monitoring. - Expect phishing and phone scams. Quest warns: "Sometimes after an incident, there may be phishing and social engineering attempts." Do not give card details, passwords or codes to anyone who calls or emails about lab results or bills. Call Quest on a number you look up yourself. - Read your medical and insurance statements. Look for tests, visits or claims you do not recognise and report them to your insurer. ## What security leaders should do this week For clinics, hospitals and health systems that use Quanum, this is a third-party breach: the data is yours to account for, but the system is Quest's. - Reset Quanum LSM credentials for every user in your organisation. Quest's notice directs clients who need help to its IT Connectivity Help Desk. Turn on any stronger sign-in option available, and remove accounts for staff who have left. - Open a vendor-breach ticket and ask Quest in writing: were our patients' records in scope, which data fields, over what period, and was any access made with our users' credentials? The Third-Party Breach Intake lists the questions. - Check your business associate agreement for Quest's notification duties to you, timelines and who sends patient letters. Decide now who in your organisation answers patients who call. - Brief front-desk and billing staff on phishing. Attackers who hold patient lists call clinics as well as patients. Remind staff to verify any caller asking for results, credentials or payment details. - Plan for the notification clock. Under the HIPAA Breach Notification Rule, covered entities must notify affected individuals without unreasonable delay and within 60 calendar days of discovering a breach, and breaches affecting 500 or more people must also be reported to HHS. Map who owes what to whom with the Breach Notification Clock Calculator. - Review your lab-portal dependency. Quest's fallback was Quanum eLabs and paper requisitions. Check that your clinics know the downtime procedure, and include a lab-portal outage in your next healthcare tabletop. ## Why this one will be watched Quest has been here before. In 2019, about 11.9 million Quest patients were affected by a breach at the American Medical Collection Agency, a billing collections vendor (AP; TechCrunch). That figure is sometimes repeated as if it were the size of this incident. It is not: no count has been published for the 2026 Quanum breach. The lesson of 2019 still applies, though: a lab's data reaches many systems run by many parties, and each is a place it can leak from. Practise the vendor side of that in the [Vendor Breach Lab](/tools/vendor-breach-lab). ## FAQ ### Was Quest Diagnostics hacked? Yes, according to Quest. Its Form 8-K says that on 21 October 2026 it learned of unauthorized access to Quanum LSM. Quest says it contained the activity, notified federal law enforcement and engaged outside experts. ### What is Quanum LSM? Quanum Lab Services Manager is Quest's web system for ordering lab tests and viewing results. TechCrunch reports Quest's materials say Quanum is used by about half a million clinicians. Essential Insights and LabHQ were paused as a precaution; Quest says no data was accessed in them. ### What patient data was exposed in the Quest Diagnostics breach? Quest says some patient data in Quanum LSM was accessed, including "personal information and patient records", and that health and identifying information was involved. The exact fields are still being determined. ### How many patients were affected by the Quest Diagnostics breach? Quest has not said. The 11.9 million figure online is from the 2019 AMCA breach, not this incident. ### Will Quest notify me if my data was involved? Yes. Quest says it will notify affected patients as required by law, with resources including credit and identity monitoring. HIPAA requires notice without unreasonable delay and within 60 days of discovery. ### Is the Quest Diagnostics breach related to the PHP vulnerability? Quest says no, in its FAQ and to AP. ## Sources - Quest Diagnostics: Form 8-K, Item 8.01 (report date 21 Oct 2026, SEC EDGAR) - Quest Diagnostics: An update on an incident involving one of our systems (notice and FAQs, updated 26 Oct 2026) - Associated Press via NBC News: Quest Diagnostics reports cyber breach affecting "certain patient records" (22 Oct 2026) - TechCrunch: Lab testing giant Quest Diagnostics confirms patients' personal and health data was compromised (23 Oct 2026) - HHS: HIPAA Breach Notification Rule _This article is general information, not legal or medical advice. Follow the instructions in any notification letter from Quest._