Quest Diagnostics confirms breach of lab systems, patient data now at risk

Quest Diagnostics confirmed on its website Thursday that one of its in-house lab management systems was hacked earlier this month, exposing an unknown amount of patient data.

The Secaucus, New Jersey-based medical testing giant says it first became aware of "unauthorized access to our Quanum Lab Services Manager (LSM) system" on October 21st and immediately paused access.

We are continuing to investigate this incident and are working to fully restore the affected system as quickly as possible.

We are working to determine the specific data affected.

Quest Diagnostics posted on its website Thursday.

Ross Filipek, CISO at Corsica Technologies, explains that the Quanum platform sits at the crossroads of sensitive patient information and everyday laboratory operations.

“Depending on what was accessed, those records could give criminals material for identity fraud or convincing messages about someone’s care,” Filipek warns.

The CISO points out that a scam referencing real test results “can feel far more credible than a generic phishing email” and that patients can’t simply replace their medical history after an exposure.

Inside Quest’s lab management platform

The company, which performs more than 200 million clinical lab tests per year, according to its website, said that the Quanum LSM system is used by certain clients to place test orders, receive, and look up test results.

The software application allows local clinical laboratories to connect directly to physician offices, medical clinics, and hospital healthcare systems.

Quanum is Quest's in-house healthcare information technology brand.

Quest says its "core business operations remain up and running," and that other direct-customer interfaces – including its Electronic Medical Records (EMR) and Laboratory Information System (LIS) – were not affected, and health providers may continue to place orders for testing.

As a temporary workaround, Quest says clients can use paper requisitions to place orders and submit them to the company via fax, providing instructions to do so on its website.

Quanum LSM clients are also able to utilize the Quanum eLabs site for orders and test results using their same login credentials, Quest said.

Unknown amount of patient data impacted

Quest operates over 7,700 access points, including roughly 2,000 patient service centers across the US, serving 1 in 3 American adults each year.

"At this time the Company believes that an unauthorized party accessed certain patient records," Quest said in a filing with the US Securities and Exchange Commission (SEC) dated October 21st, 2026.

According to the online breach notice, both patient health information and patient-identifiable information were involved, although Quest says the scope of the intrusion is still being determined – including the number of people compromised.

We are working diligently to identify the impacted patients and providers. As the covered entity, Quest Diagnostics will make notifications as required by applicable law,

Quest Diagnostics said.

Filipek says the Quest breach shows healthcare data’s enduring appeal as a substantial payoff when it comes to sensitive information at scale.

“For healthcare organizations, the practical lesson is to examine how much patient information each account can reach. Monitoring needs to catch unusual access before a legitimate workflow becomes a route to records,” he said.

Quest meanwhile says it has notified federal law enforcement authorities and engaged external cybersecurity experts to assist in the investigation and response.

Although the threat has been contained, it's unclear if patient data was exfiltrated from the system or if ransomware was involved.

Quest did note that the preliminary findings show the incident is not related to a PHP programming language issue.