TL;DR: The Quest Diagnostics data breach came to light on October 22, 2026, when the lab giant told the SEC that on October 21 it “learned of unauthorized access to its Quanum LSM system,” the portal doctors’ offices use to order lab tests and look up results. Quest says an outsider accessed certain patient records, including protected health information (PHI) and personally identifiable information (PII), but it hasn’t said how many patients or which data fields were taken. As of 7:00 pm ET on October 23, Quest says the incident is remediated and Quanum LSM is back online. Quest says the attack is not related to the PHP2Shell flaw. Affected patients will get notification letters offering credit and identity monitoring; federal HIPAA rules set an outer limit of 60 days from discovery (around December 20, 2026). Until then: ignore unexpected “Quest” calls and texts, watch your medical bills and insurance statements, and consider a free credit freeze.
Last updated: October 24, 2026. By Veer. Facts checked against Quest’s Form 8-K filed with the SEC (signed October 22, 2026), Quest’s Quanum incident notice and FAQ (the “as of 7:00 pm ET, October 23, 2026” version, plus the earlier 8:00 am ET version), CourtListener docket listings, the HIPAA breach notification rule at 45 CFR 164.404, the FTC’s medical identity theft guide, and reporting by TechCrunch, BleepingComputer and CNBC. This is a researched explainer for patients and providers, not an analysis of the attack itself.
What happened in the Quest Diagnostics data breach?
On October 21, 2026, Quest Diagnostics discovered that an unauthorized party had gotten into Quanum Lab Services Manager (LSM), its online system for test orders and results, and accessed “certain patient records.” Quest paused the system, called in outside cybersecurity experts, notified federal law enforcement and disclosed the incident in an SEC Form 8-K signed on October 22.
The 8-K filing is short. It says Quest “promptly initiated its cybersecurity incident response procedures to contain the activity,” that “the full scope of unauthorized access remains under investigation,” and that the incident “has not materially disrupted the Company’s business operations or its ability to serve patients.”
Quest’s incident notice adds the patient-facing detail. Asked whether PHI or PII was part of the unauthorized access, Quest answers: “Yes, but we are still investigating to determine the specific data affected.” Elsewhere it says that “based on our investigation to date, personal information and patient records were affected.”
Quest hasn’t said when the intruder first got in, how they got in, or whether anyone has demanded a ransom. TechCrunch reported that a Quest spokesperson did not answer those questions and pointed to the notice. BleepingComputer said on October 23 that it could not find a threat group claiming the attack.
One detail worth knowing: TechCrunch noted that Quest’s notice page carries a “noindex” tag, which tells search engines not to list it. If you’ve been searching for Quest’s own statement and can’t find it, the direct link is questdiagnostics.com/links/quanum-notice.
What is Quanum LSM?
Quanum Lab Services Manager (LSM) is Quest’s web portal for healthcare providers, not patients. Doctors’ offices, hospital staff and clinics use it to place lab test orders, check order status and look up results. Patients normally see their results through the separate MyQuest app or their doctor’s patient portal.
According to TechCrunch, Quest’s own materials say Quanum is used by about half a million clinicians in thousands of locations across North America. BleepingComputer, citing Quest, reports that the company serves one in three U.S. adults each year. That reach is why this incident matters even though the number of affected patients isn’t known yet.
What patient data was exposed?
Quest says “personal information and patient records” in Quanum LSM were accessed, and that this included PHI and PII, but it has not yet listed the specific data types. It has not said whether Social Security numbers, insurance member IDs, test results or payment details were involved.
Because Quanum LSM is a lab ordering and results system, the kinds of records it handles include patient names, test orders and results. That is a description of what the system does, not a confirmed list of what was taken. The confirmed list will come in Quest’s notification letters.
| Question | What Quest has said (as of Oct 23, 7:00 pm ET) |
|---|---|
| Which system was breached? | Quanum Lab Services Manager (LSM) |
| Was patient data accessed? | Yes: “certain patient records,” including PHI and PII |
| Which data fields? | Not disclosed; “still investigating” |
| How many patients? | Not disclosed |
| Were Essential Insights and LabHQ hit? | “No data was accessed in these other systems”; access was paused as a precaution and has been restored |
| Is the attack still active? | No: “We terminated the unauthorized access and contained the incident” |
| Is it linked to PHP2Shell? | No: “the incident is not related to a PHP programming language issue” |
| Will patients be notified? | Yes, by letter, “as required by applicable law,” including credit and identity monitoring |
| Law enforcement? | Federal law enforcement notified |
Source: Quest Quanum notice and FAQ and Form 8-K.
How many people are affected?
Nobody outside Quest knows yet. Quest has not published a patient count, and it says it is “working diligently to identify the impacted patients and providers.” Treat any specific number you see on social media or in law firm ads as unconfirmed until it appears in a Quest letter, an SEC filing or a regulator listing.
The number should eventually show up on the U.S. Department of Health and Human Services breach portal. Under HIPAA, a covered entity must report any breach affecting 500 or more people to HHS, and that report becomes public on the HHS Office for Civil Rights list (often called the “wall of shame”). Quest describes itself in the notice as “the covered entity” for this incident.
Was my data affected, and how will I find out?
You’ll find out by letter. Quest says it “will notify patients determined to be affected as required by applicable law,” and that those letters will describe the help available, “including credit and identity monitoring.” Quest hasn’t published a lookup tool, so there’s nothing to check online yet.
The HIPAA breach notification rule (45 CFR 164.404) requires notice “without unreasonable delay and in no case later than 60 calendar days after discovery of a breach.” Counting from Quest’s October 21 discovery date, that outer limit falls around December 20, 2026. The rule allows a delay if law enforcement asks for one, and large companies sometimes notify in waves, so letters could arrive earlier or later than that.
You are more likely to be in scope if a doctor’s office or clinic ordered Quest lab work for you through Quanum LSM. You can’t tell that from your side, though, because the ordering system your doctor used isn’t shown on your results. Quest says providers that order through their own electronic medical record (EMR) or a direct lab interface “were not affected,” but that doesn’t tell you which route your doctor took.
What should Quest patients do now?
Right now the best moves are cheap and defensive: be suspicious of anything claiming to be Quest, watch your medical paperwork for services you didn’t get, and freeze your credit for free. None of these steps depends on knowing whether your record was in the breach.
1. Treat unexpected “Quest” calls, texts and emails as suspect
Breach news is a gift to scammers. Expect fake “Quest Diagnostics” messages about your “compromised records,” overdue lab bills or a “refund.” Don’t click links or call numbers in a message you didn’t expect. If you need Quest, use the number on a bill you already have or 1-866-MYQUEST, the customer service line Quest lists in its notice. Quest says affected patients will get notification letters.
2. Check your Explanation of Benefits and medical bills
Medical identity theft is when someone uses your details to get care, prescriptions or insurance payouts. The FTC’s warning signs include bills or Explanation of Benefits statements for services you didn’t get, debt collectors chasing medical debt you don’t owe, and unfamiliar medical collections on your credit report. Read every EOB from your insurer for the next few months.
3. Freeze your credit (it’s free)
A credit freeze at Equifax, Experian and TransUnion stops new credit accounts from being opened in your name. It costs nothing and you can lift it when you need to apply for credit. Quest hasn’t said whether Social Security numbers were involved, but a freeze is a sensible default after any health data breach. Our Citizens Bank breach guide walks through freezing at all three bureaus.
4. Pull your free credit reports
You can get free reports from all three bureaus at AnnualCreditReport.com. Look for accounts you didn’t open and medical collections you don’t recognize. If you find any, the FTC recommends creating a recovery plan at IdentityTheft.gov.
5. Secure your MyQuest and patient portal logins
Quest says the unauthorized access was in Quanum LSM and that “other systems were not affected.” Even so, if you reuse your MyQuest or doctor’s-portal password anywhere else, change it to a unique one and turn on two-step verification wherever it’s offered. Our guide to SMS codes vs authenticator apps vs passkeys explains which second factor to choose.
6. Enroll when the letter arrives
If you get a Quest notification letter, enroll in the credit and identity monitoring it offers before the deadline printed on it. Those offers usually require an activation code from the letter, so keep it somewhere safe.
Do I need to cancel my Quest appointment?
No. Quest says its “core business operations are not impacted” and that it does not “expect delays in appointment scheduling or turnaround reporting times.” The only warning is that calls to 1-866-MYQUEST may involve longer-than-normal waits.
What should doctors’ offices that use Quanum LSM do?
Quanum LSM has been restored, and Quest says any client that needs help resetting Quanum LSM credentials should call its IT Connectivity Help Desk at 1-800-697-9302. Expect long waits; Quest says call volume is high.
While LSM was paused (October 21–23), Quest told clients to use paper requisitions by fax or Quanum eLabs, which accepted the same login. Quest says results for orders placed through eLabs during that window will also show up in Quanum LSM. Practices that order through their own EMR or a direct LIS interface were not affected and can keep ordering as usual.
Practices should also expect their own patients to call. A short script helps: Quest is investigating, Quest will mail affected patients directly, and nobody needs to call Quest to “check” whether they were affected.
Is the Quest breach related to the PHP2Shell vulnerability?
No. Quest says that “based on our investigation, the incident is not related to a PHP programming language issue.” It answered the question directly because the breach landed the same week PHP shipped emergency patches for the PHP2Shell flaws (CVE-2026-109618 and CVE-2026-109619), which knocked many websites offline as a precaution.
Quest confirmed the same point to the Associated Press, according to CNBC. If you run PHP sites yourself, our PHP2Shell guide covers what to update.
Is there a Quest Diagnostics data breach lawsuit?
Yes, several. CourtListener shows at least 10 new civil cases against Quest Diagnostics Incorporated filed in the U.S. District Court for the District of New Jersey on October 22 and 23, 2026, starting with Johnson v. Quest Diagnostics Incorporated (2:26-cv-13795), filed October 22. Quest is headquartered in Secaucus, New Jersey.
The other cases listed on October 23 are Vasey (2:26-cv-13820), Barcelo Boyker (2:26-cv-13822), Luciano (2:26-cv-13827), Romero (2:26-cv-13837), O’Brien (2:26-cv-13847), Ayala (2:26-cv-13852), Briggs (2:26-cv-13864), Umeda (2:26-cv-13866) and Bishop (2:26-cv-13874). The public docket listings don’t show the complaint text, but their timing matches the breach disclosure, and law firms including Edelson Lechtzin have announced investigations into class claims.
Cases like these are usually consolidated, and any settlement typically takes a year or more. You don’t need to sign up with a law firm to receive Quest’s notification letter or its monitoring offer.
Has Quest Diagnostics been breached before?
Yes. This is at least the third patient-data incident Quest has reported since 2016. Unlike the 2019 incident, which happened at a billing vendor, this one hit a Quest system directly. The 2019 incident remains the largest so far.
| Incident | When disclosed | System | People affected | Data involved |
|---|---|---|---|---|
| MyQuest app breach | 2016 | MyQuest patient app | About 34,000 | Lab results and contact information (per CNBC) |
| AMCA billing vendor breach | June 2019 | American Medical Collection Agency (third-party collections firm) | About 11.9 million Quest patients | Financial data (bank account and card numbers), Social Security numbers and medical information, but not lab test results (per Quest’s 2019 SEC filing, via BleepingComputer) |
| Quanum LSM breach | October 22, 2026 | Quanum Lab Services Manager (Quest’s own provider portal) | Not yet disclosed | “Personal information and patient records,” PHI and PII (per Quest) |
Sources: CNBC, BleepingComputer, TechCrunch, Quest’s notice.
BleepingComputer notes that the 2019 AMCA breach led to at least 19 class actions that were consolidated into multidistrict litigation, which it describes as still unresolved.
How does this compare with other recent breaches?
The Quest breach is in the same pattern as other big breaches this month: the company confirms an intrusion fast, but the count and data list come later. For students, the ETS data breach exposed California public school records. For bank customers, the Citizens Bank breach included Social Security numbers. For gamers, the Capcom breach exposed 11.7 million CAPCOM ID email addresses.
Health data is harder to “reset” than a password or a card number. You can’t change your medical history, which is why watching your EOBs matters more here than after a typical retail breach.
Quest Diagnostics data breach timeline
| Date (2026) | Event |
|---|---|
| October 21 (Wednesday) | Quest learns of unauthorized access to Quanum LSM, pauses access and starts incident response |
| October 22 | Form 8-K signed and filed: “an unauthorized party accessed certain patient records”; first lawsuit (Johnson, 2:26-cv-13795) filed in D.N.J. |
| October 22–23 | Quest FAQ: PHI/PII involved; Essential Insights and LabHQ paused as a precaution; clients told to use paper requisitions or Quanum eLabs; incident “not related to a PHP programming language issue” |
| October 23 | Nine more suits against Quest listed in D.N.J. on CourtListener |
| October 23, 7:00 pm ET | Quest: incident “remediated,” Quanum LSM “securely restored,” paused systems restored; credential resets via 1-800-697-9302 |
| By about December 20 | HIPAA’s 60-day outer limit for notifying affected individuals, counted from October 21 (law-enforcement delays allowed) |
FAQ
What is the Quest Diagnostics data breach?
The Quest Diagnostics data breach is an October 2026 incident in which an unauthorized party accessed Quest’s Quanum Lab Services Manager (LSM), the portal providers use to order lab tests and view results. Quest discovered it on October 21, 2026, disclosed it to the SEC on October 22, and says certain patient records, including protected health information, were accessed.
What information was stolen in the Quest data breach?
Quest says “personal information and patient records” were affected and that this included PHI and PII, but as of October 23, 2026 it had not listed the specific data fields. It has not said whether Social Security numbers, insurance details or test results were included; affected patients will find out from Quest’s notification letters.
How many patients were affected by the Quest breach?
Quest has not disclosed a number. It says it is working to identify affected patients and providers and will notify them as required by law; under HIPAA, breaches affecting 500 or more people must also be reported to HHS, where the count becomes public.
How do I know if my Quest Diagnostics data was breached?
You will get a letter from Quest if your data was involved. Quest says it will notify affected patients as required by law and that letters will describe the resources available, including credit and identity monitoring; HIPAA sets an outer limit of 60 days from discovery, around December 20, 2026.
Is it safe to get lab work at Quest right now?
Yes. Quest says its core operations were not affected and it does not expect delays in appointments or result turnaround, and as of 7:00 pm ET on October 23, 2026 it says the incident is remediated and Quanum LSM is restored.
Is there a class action lawsuit against Quest Diagnostics?
Yes. CourtListener lists at least 10 new civil cases against Quest Diagnostics filed in federal court in New Jersey on October 22 and 23, 2026, starting with Johnson v. Quest Diagnostics Incorporated (2:26-cv-13795). You don’t need to join a lawsuit to receive Quest’s notification letter or monitoring offer.
Sources
- Quest Diagnostics, Form 8-K, Item 8.01 (date of event October 21, 2026; signed October 22, 2026)
- Quest Diagnostics, Quanum incident notice and provider/patient FAQs (versions as of 8:00 am ET and 7:00 pm ET, October 23, 2026)
- CourtListener federal docket search, District of New Jersey, cases 2:26-cv-13795 through 2:26-cv-13874 (checked October 24, 2026)
- eCFR, 45 CFR 164.404, notification to individuals
- FTC, What To Know About Medical Identity Theft; IdentityTheft.gov
- TechCrunch, Quest Diagnostics confirms patients’ personal and health data was compromised (October 23, 2026)
- BleepingComputer, Quest Diagnostics confirms data breach exposed patient records (October 23, 2026)
- CNBC, Quest Diagnostics reports cyber breach affecting ‘certain patient records’ (October 22, 2026)
- Edelson Lechtzin LLP via PR Newswire, class action investigation announcement
