Quest Diagnostics confirmed that an unauthorized party gained access to patient records by targeting its proprietary Quanum Lab Services Manager (LSM), a platform used by healthcare providers to manage laboratory orders and results.
The breach was first identified on October 21, 2026. In a Form 8-K filing with the Securities and Exchange Commission (SEC) the following day, the company disclosed that the intrusion likely exposed protected health information (PHI). While the exact number of affected patients has not yet been determined, Quest has temporarily suspended access to the Quanum LSM, as well as its Essential Insights and LabHQ systems, as a precautionary measure during the ongoing investigation.
This incident marks a significant shift from previous security challenges faced by the laboratory giant. In 2019, Quest was part of a massive breach involving 11.9 million patients, but that event originated at a third-party billing vendor. The current breach involves Quest’s own physician-facing infrastructure, representing a direct compromise of the systems doctors use to view sensitive medical data.
According to company statements, the unauthorized access appears limited to these specific web-based portals. Quest has clarified that its direct-customer Laboratory Information System (LIS) interfaces and electronic medical record (EMR) integrations remain unaffected. Furthermore, the company stated the incident is not related to the “PHP2Shell” vulnerability that has recently impacted other sectors.
Quest has reported that its core business operations and clinical testing services have not been materially disrupted. However, healthcare providers who rely on the Quanum LSM for time-sensitive results may experience delays while the portals remain offline.
The company is currently working with external forensic experts to determine the full scope of the records accessed. According to reporting from Bleeping Computer, the investigation is focusing on what specific types of medical results or personal identifiers were viewed during the window of unauthorized access.
Patient notification will likely follow once the company identifies the specific individuals whose data was compromised. For now, Quest has not provided a timeline for when the Quanum and LabHQ systems will be fully restored to service.
