Quest Diagnostics Data Breach: Unauthorized Access to the Quanum Lab Ordering System
Part 2 of 8 in Recent Cyberattacks: Fall 2026 Briefings
Quest Diagnostics, one of the largest U.S. laboratory-testing companies, disclosed in an SEC filing that it learned on October 21, 2026 of unauthorized access to Quanum Lab Services Manager (LSM), a system clinics and hospitals use to order tests and view results (Quest Form 8-K). Quest says certain patient records were accessed and that the incident has been contained (Quest notice). For medical practices that rely on vendor portals, the case is a reminder that patient data lives in many systems you do not run yourself.
| Organization | Quest Diagnostics, U.S. laboratory-testing company |
|---|---|
| When | Quest learned of the access on October 21, 2026 (Quest Form 8-K) |
| System | Quanum LSM, used by clients to place test orders and receive results (Quest Form 8-K) |
| Data | Quest says some patient data in Quanum LSM was accessed and other systems were not affected (Quest notice) |
| Business impact | Quest says operations and its ability to serve patients were not materially disrupted (Quest Form 8-K) |
| Status | Access terminated and contained; system restored as of October 26 (Quest notice) |
Each item is linked to its source. Verification status reflects the strongest source available on the verification date.
What happened
- Oct 21. Quest learns of unauthorized access to Quanum LSM, notifies federal law enforcement and engages outside experts (Quest Form 8-K).
- Oct 22. Quest files a Form 8-K describing the incident (Quest Form 8-K). Quest tells the Associated Press the breach is not related to a PHP programming-language issue (AP).
- Oct 23. BleepingComputer reports that Quanum LSM and two related tools were paused and clients were directed to paper requisitions or another Quest ordering tool (BleepingComputer).
- Oct 26. Quest’s notice says the unauthorized access was terminated, the incident contained and the system securely restored (Quest notice).
What Quest has told clients and patients
Quest says it will notify affected patients and providers and report to regulators, and it warns people to watch for phishing and voice-phishing attempts, including fake breach-notification and settlement messages (Quest notice). Quest says providers using direct lab interfaces or EMR connections were not affected (Quest notice).
What is still unknown
- How the unauthorized party got in, and when the access began.
- How many patients are affected and exactly which data types were involved.
- Who is responsible. No group had claimed the attack as of the reporting reviewed (BleepingComputer).
- Whether data was copied out of the system or ransomware was involved.
How clinics and practices can reduce vendor-portal risk
These are general HIPAA-aligned practices for any organization that uses an outside portal for patient data.
- Keep an inventory of every vendor portal that holds patient data, with an owner and the list of staff who have accounts.
- Require MFA on every portal that offers it, and remove accounts for staff who leave the same day.
- Include each portal in your HIPAA risk analysis and confirm a business associate agreement is in place.
- Prepare staff for follow-on scams: after a public breach, criminals send fake notices and settlement offers that mention the breach.
- Know your downtime procedure: how you order tests, prescribe and bill when a vendor system is offline.
How OC Security Audit can help
We help healthcare organizations find gaps in identity, vendor access and HIPAA safeguards before an incident tests them.
- HIPAA compliance: risk analysis and safeguard review
- Cybersecurity for healthcare clinics: practical controls for small and mid-size practices
- Third-party vendor risk management: portal and vendor-access review
- HIPAA Security Readiness Assessment: free self-assessment tool
Ali Hassani, CISSP, C|CISO, is based in Irvine and works with organizations on-site across Southern California and remotely nationwide.
Schedule a consultationCall 949-777-5567An audit shows where your controls are weak and what to fix first. No audit or service can guarantee that an organization will not be attacked; the goal is to lower the likelihood and the impact.
More in this series
See all briefings and their verification status in the recent cyberattacks and data breaches tracker.
Sources
- Quest Diagnostics, SEC Form 8-K, October 22, 2026. https://www.sec.gov/Archives/edgar/data/0001022079/000094787126000941/ss6979200_8k.htm
- Quest Diagnostics, October 26, 2026. https://www.questdiagnostics.com/links/quanum-notice
- Associated Press (via NY1), October 22, 2026. https://ny1.com/nyc/all-boroughs/ap-top-news/2026/10/22/quest-diagnostics-reports-cyber-breach-affecting-certain-patient-records
- BleepingComputer, October 23, 2026. https://bleepingcomputer.com/news/security/quest-diagnostics-confirms-data-breach-exposed-patient-records
About this briefing. This page summarizes publicly available information from the sources linked above, as of the verification date shown. OC Security Audit was not involved in responding to any incident described here and has no inside knowledge of them. Organization names are used only to identify the subjects of the cited public reports. Statements made by attackers are labeled as claims and are not treated as fact; details that the sources do not confirm are marked as unknown. Facts may change as investigations continue.
This content is for general educational purposes. It is not legal advice, a forensic conclusion or a finding about any organization’s security practices. See our editorial standards. To report an error, contact support@OCsecurityAudit.com and we will review it and publish a dated correction where needed.