Quest Diagnostics says hackers accessed patient records via Quanum lab system

Quest Diagnostics, one of the largest medical laboratory operators in the United States, has disclosed a cybersecurity incident in which an unauthorized party gained access to a platform used by clients to order tests and retrieve results. In a Form 8-K filed with the US Securities and Exchange Commission, the company said it learned on October 21, 2026, of unauthorized access to its Quanum LSM system and that it believes "an unauthorized party accessed certain patient records." The disclosure matters because lab results and associated patient details are among the most sensitive categories of personal data.

What happened

According to the filing, Quanum LSM (Lab Services Manager) is used by certain clients to place test orders and to receive and look up results. Once the intrusion was discovered, Quest said it promptly initiated its incident response procedures, notified federal law enforcement and engaged external cybersecurity experts. The company said the full scope of the unauthorized access remains under investigation.

The Associated Press, in a report published by SecurityWeek, said Quest confirmed that its investigation found the breach was not related to the recently disclosed PHP vulnerabilities, known as PHP2Shell, which have been widely exploited in recent days.

What is still unknown

Quest has not said how many people are affected, what types of data were contained in the accessed records, or how the attacker gained entry. No threat actor has publicly claimed responsibility, according to the AP report. The company stated in the filing that the incident "has not materially disrupted the Company's business operations or its ability to serve patients."

Background

This is not the first time Quest patient data has been exposed. According to the AP, data including lab results and contact information for about 34,000 people was exposed in a 2016 incident, and in 2019 about 11.9 million Quest patients were affected by a hack at American Medical Collection Agency, a billing collections vendor.

What to do

Patients and healthcare providers that use Quest services should watch for official notification letters, which typically follow once the scope of a healthcare breach has been determined. Until then, they should be cautious of unsolicited calls, emails or texts referencing lab tests or results, as attackers often use stolen medical details to make phishing and fraud attempts more convincing. Organizations that access Quanum LSM should review account activity and follow any guidance Quest issues as its investigation progresses.