Quest Diagnostics confirms Quanum LSM breach: 8-K says patient records accessed, scope unknown

Quest Diagnostics, one of the largest clinical laboratory companies in the United States, disclosed on 22 October 2026 that an unauthorised party accessed its Quanum LSM system, which medical practices use to order lab tests and look up results. The company says it believes "certain patient records" were accessed. It has not said how many patients are affected, what kinds of data were taken, or who was behind the attack, and the investigation is ongoing.

Key points

• Quest learned of unauthorised access to its Quanum LSM system on 21 October 2026 and disclosed it in a Form 8-K filed with the SEC on 22 October.
• The filing says Quest believes an unauthorised party accessed certain patient records, and that the full scope is under investigation.
• Quest has notified federal law enforcement and engaged outside cybersecurity experts; it says the incident has not materially disrupted its business operations or its ability to serve patients.
• BleepingComputer reports Quest also paused access to two other systems, Essential Insights and LabHQ, as a precaution, and advised clients to use paper requisitions or Quanum eLabs meanwhile.
• No number of affected patients, no list of data types and no responsible group had been published as of 23 October.

What to do

Quest has not published guidance for patients in the material we reviewed, and has not yet said which patients are affected. Until it does:

• Watch for a notification letter or email from Quest or from your doctor's office. Companies usually notify affected people once an investigation establishes who they are; none has been announced yet.
• Treat unexpected messages with care. After health-data breaches, scammers often pose as the provider. Do not click links or give details in a message you did not expect; use the phone number on Quest's official website or on a bill you already have. This is general security practice, not something Quest has said.
• Review explanation-of-benefits statements and bills for services you did not receive, and consider a credit freeze if a notice later says identifiers such as Social Security numbers were involved. At the time of writing, Quest has not said what data types were taken.
• If you work in a practice that uses Quanum LSM, follow Quest's customer instructions (paper requisitions or Quanum eLabs, per BleepingComputer), and ask your account contact whether your practice's data is in scope.

What happened

According to Quest's Form 8-K, filed on 22 October 2026 and signed by its Vice President and Corporate Secretary, the company learned on 21 October 2026 of unauthorised access to its Quanum LSM system, which clients use to submit test orders and to receive and look up results. Quest says it started its cybersecurity incident response procedures to contain the activity, notified federal law enforcement and engaged external cybersecurity experts. The filing says that, while the full scope remains under investigation, the company believes an unauthorised party accessed certain patient records. It adds: "This incident has not materially disrupted the Company's business operations or its ability to serve patients." The filing is made under Item 8.01 (Other Events) only; it does not cite Item 1.05, the SEC's item for material cybersecurity incidents.

TechCrunch, which reported the story on the morning of 23 October, described Quanum as a platform that lets doctors' offices, hospitals and practices request lab tests for patients and handle billing, and that stores a large amount of patient health records along with associated diagnostic and billing data. It says Quest's website and materials put Quanum's use at about half a million clinicians in thousands of locations across North America. TechCrunch also reports that Quest's separate website security notice says some patients' protected health information was taken, including "personal information and patient records", but that the company is still investigating which specific data were taken. (The 8-K is more cautious, saying "accessed".) TechCrunch noted that the notice page carried a "noindex" tag, which asks search engines not to list it.

BleepingComputer, citing Quest's posting, adds operational detail: Quanum LSM, short for Lab Services Manager, is used by physicians, hospital staff and medical-office personnel to place orders, view and look up results, track status and order supplies. The outlet says Quest stopped the Quanum LSM system and, as a precaution, temporarily paused access to Essential Insights and LabHQ. Customer-facing operations were not disrupted, and users of direct-customer laboratory-information-system interfaces or electronic medical records were not affected, Quest says. Customers were advised to use paper requisitions or Quanum eLabs.

Background

This is not Quest's first breach. In 2019, an attack on the American Medical Collection Agency (AMCA), a third-party billing collections provider, exposed data on about 11.9 million Quest patients. BleepingComputer says that incident led to at least 19 class-action lawsuits, consolidated into multidistrict litigation that it describes as unresolved. TechCrunch calls the new incident Quest's second known major breach in a decade.

TechCrunch places the incident in a year of repeated healthcare attacks. It lists a mass-wiping of employee devices at medical-technology maker Stryker in March, a hack at medical-implant manufacturer Boston Scientific in August that it says forced the network offline for weeks, and separate breaches of patient data at CareCloud, Scotland-based Craneware and the pharmaceutical distributor McKesson. It describes health-technology companies as prime targets for financially motivated criminals who steal data and threaten to publish it unless paid. That is TechCrunch's characterisation of the sector; for Quest, no ransom demand or claim has been reported.

What it means

The affected system sits between medical practices and the laboratory, so a compromise reaches data from many practices at once. That is why the number of affected clients, not only patients, will matter: practices that rely on Quanum LSM will need to know what Quest holds on their behalf and whether they have notification duties of their own. Lab ordering platforms also hold more than results; TechCrunch notes they store billing and diagnostic data, the kind of combination that is useful for fraud as well as for privacy harm.

For Quest's customers, the immediate effect is operational: the system was stopped, with paper requisitions as the fallback. Quest's statement that business operations were not materially disrupted is the company's own assessment and has not been independently verified.

What we don't know yet

• How many patients and practices are affected. Neither the filing nor Quest's notice gives a number.
• Which data was taken. The 8-K says records were "accessed"; the website notice, as reported by TechCrunch, says protected health information was "taken". Quest is still determining the data types.
• When the intrusion began and how the attacker got in. TechCrunch says Quest did not say when the breach began.
• Who is responsible. BleepingComputer found no group claiming the attack, and TechCrunch says Quest did not say whether any group had contacted it with demands.
• Whether Essential Insights and LabHQ were compromised or only paused as a precaution; BleepingComputer describes the pause as precautionary.

What to watch next

Watch for Quest's follow-up filings, notifications to state attorneys general and the U.S. Department of Health and Human Services breach portal (which typically list the number of people affected once a breach is reported), a claim or leak-site post by a criminal group, and any update from Quest on when Quanum LSM returns. We will add a dated update to this article when the company publishes figures.

Sources

• Quest Diagnostics Form 8-K, filed 22 October 2026 (SEC)
• TechCrunch: Lab testing giant Quest Diagnostics confirms patients' personal and health data was compromised during breach
• BleepingComputer: Quest Diagnostics confirms data breach exposed patient records