What this covers:
Quest Diagnostics, one of the largest laboratory companies in the United States, has confirmed that an intruder reached the system doctors’ offices use to order lab tests and read results.
The company named the system as Quanum Lab Services Manager, or LSM, in an incident notice on its own website. Quest says it learned of the unauthorized access on October 21, 2026.
Here is what the Quest Diagnostics breach has actually confirmed, what Quest has explicitly not confirmed, and what a practice or a patient should do this week.
What the Quest Diagnostics Breach Exposed
Quest’s own wording is careful, and the care is the story. The notice says “personal information and patient records were affected.”
Asked directly whether protected health information and personally identifiable information were involved, Quest answered “Yes, but we are still investigating to determine the specific data affected.”
What Quest has not published matters just as much. There is no patient count, no state-by-state figure and no list of which data elements were touched.
As Malwarebytes noted, Quest has not said whether the records included Social Security numbers, insurance identifiers, payment details, test results or account passwords.
That gap in the Quest Diagnostics breach disclosure is not a small technicality. Each of those elements drives a different kind of harm, and medical identity theft is the slowest kind to notice.
The system itself explains the concern. Quanum LSM lets clinicians order tests, open results, review historical trends and order supplies. TechCrunch reported that the platform also handles billing, so the records inside it tie a person to a diagnosis and to a payment.
The Quest Diagnostics Breach Timeline: October 21 to October 26
Timelines are where breach stories usually get vague, so here is Quest’s own sequence for the Quest Diagnostics breach.
October 21: Quest learned of unauthorized access to Quanum LSM and filed a disclosure with the U.S. Securities and Exchange Commission. Quest appeared to treat that date as a Wednesday.
Containment: Quest says it terminated the unauthorized access and contained the incident. It also paused access to two other systems, Essential Insights and LabHQ, as a precaution.
Workaround: Quanum LSM was taken offline, and clients were told to place orders and collect results through paper requisitions or Quanum eLabs in the meantime.
October 26, 8:00 AM ET: Quest posted the update that changes how this story should be read. It says the incident has been remediated, the LSM system “has been securely restored and is available to clients,” and the paused systems are back and secure.
Quest also said no data was accessed in Essential Insights or LabHQ, and that core business operations were never affected. Practices using their own lab interfaces or EMRs kept ordering through those the whole time.
Three things remain open. The investigation into the scope of patient data is ongoing. Quest is communicating with law enforcement. And notifications to affected patients, providers and health plans have not gone out.
Quest also ruled something out: asked whether the incident was connected to the PHP programming language flaws federal officials have been warning about, Quest said it is not.
No threat group had claimed the intrusion as of BleepingComputer’s reporting, and Quest has named no attacker.
The Quest Diagnostics breach Phishing Wave Is the Next Risk
Quest put an unusual warning inside its own incident notice, and it is the most actionable paragraph the company has published.
It reads, in part: “Sometimes after an incident, there may be phishing and social engineering attempts.” The notice asks people to verify any communication about lab services or Quest, “including breach-notification, credit-monitoring or settlement scams.”
That is the pattern to expect. The verified breach becomes the believable hook, and the fake message arrives dressed as the official notice.
There is a specific reason patients may struggle to check. TechCrunch reported that Quest’s notice page carries “noindex” code, which tells search engines not to list it. A real notice that cannot be found easily is a gift to whoever builds the counterfeit.
The how fake notices followed the real FLHSMV letters is the local version of this problem, and the lesson transfers directly: the document that looks most official is the one worth verifying.
Practices have a second exposure from the Quest Diagnostics breach, because Quest published a real help desk number for clients who need their Quanum LSM credentials reset. A convincing caller offering to “help you reset” is now a plausible pretext.
The real number in Quest’s notice is 1-800-697-9302. Anyone who calls you should be checked against it, not trusted because they used the word Quanum.
What Practices Should Do After the Quest Diagnostics Breach
1. Verify every Quest message out of band. Open no link and dial no number from an email. Reach the help desk with the number printed in Quest’s notice, then ask whether the message is real.
2. Reset deliberately, not urgently. If a credential reset is needed, do it from a known-good device and set a password that exists nowhere else. Pressure to reset this minute is the tell.
3. Kill password reuse between the lab portal and email. A reused credential turns one exposed portal into a mailbox takeover, and a mailbox takeover is how invoices get redirected.
4. Send patient questions to Quest. Quest states that, as the covered entity, it will make notifications as required by applicable law. A practice that invents its own notice risks contradicting the real one.
5. Keep the clinical workaround documented. Paper requisitions and Quanum eLabs kept orders moving during the outage. Write down what your team did, because it is your plan for the next vendor outage.
The broader point is uncomfortable. Quest was not the only organization exposed here; every practice that routes orders through that portal inherited the operational risk.
Our post on what one compromised vendor did to 8.7 million records covers the vendor side, and another Florida health breach that exposed 85,585 patient records shows how routine health data incidents have become in this state.
For patients, the Federal Trade Commission’s guidance still works: an unfamiliar medical bill, or a service you never received appearing on an Explanation of Benefits, is the warning sign. Check credit reports through AnnualCreditReport.com and use IdentityTheft.gov if something is wrong.
Quest Diagnostics Breach FAQ
Was my data taken in the Quest Diagnostics breach? Quest says some patient data within Quanum LSM was likely accessed, but it is still identifying which patients and which data. Nobody can answer that for you yet, and any message that claims to is suspect.
Is Quanum LSM working again? Yes, per Quest’s October 26 update, which says the system was securely restored and is available to clients.
Does the Quest Diagnostics breach involve MyQuest? Quest named Quanum LSM as the system where data was accessed and said the other systems it paused had no data accessed. It has not published a complete list of everything reviewed.
Should I freeze my credit? Quest has not confirmed whether Social Security numbers were involved. Watch for the official notification, and treat any message demanding you act immediately as a scam.
Is this the same as the 2019 breach? No. That incident involved about 11.9 million patients and a billing collections vendor, American Medical Collection Agency, which drew at least 19 class actions consolidated into multidistrict litigation.
What if someone calls claiming to be Quest IT? Verify the number against Quest’s published help desk, 1-800-697-9302, before you share anything or install anything.
Sources: Quest Diagnostics incident notice, updated 8:00 AM ET October 26, 2026; Malwarebytes; BleepingComputer; TechCrunch. Quest has not published a patient count or a confirmed list of exposed data elements.
Using Quanum in your practice? Contact Nextek IT to book a call and we will review how your team verifies vendor messages, resets credentials and spots a fake breach notice before it works.