Quest Diagnostics Data Breach: What We Know About the Quanum Hack

Quest Diagnostics, the largest clinical lab testing company in the United States, disclosed on October 22, 2026 that it discovered unauthorized access to its Quanum LSM (Lab Services Manager) system the day before — and that it believes an unauthorized party reached certain patient records. The company has not yet said how many patients are affected or what categories of data were exposed, and it has told federal regulators that the full scope of the intrusion is still under investigation.

The disclosure came in a Form 8-K filed with the U.S. Securities and Exchange Commission, the mechanism public companies use to tell investors about events — including cybersecurity incidents — that could be material to the business. Here is what Quest has confirmed, what remains unknown, and why some of the numbers already circulating online about this incident almost certainly belong to a different, older Quest breach.

What Quest Diagnostics told the SEC

According to the 8-K filing, Quest Diagnostics Incorporated "learned of unauthorized access to its Quanum LSM system" on October 21, 2026. The filing states that the company "promptly initiated its cybersecurity incident response procedures to contain the activity," and that it is working to "assess and investigate the nature and scope" of the intrusion and to "implement remedial measures."

Quest says it has notified federal law enforcement authorities and engaged external cybersecurity experts to assist with the investigation and response. Crucially, the filing is careful about what it does and doesn't confirm: "the full scope of unauthorized access remains under investigation," but "at this time the Company believes that an unauthorized party accessed certain patient records." The 8-K also states that the incident "has not materially disrupted the Company's business operations or its ability to serve patients." No number of affected individuals, no list of exposed data fields, and no attribution to a specific threat actor appear anywhere in the filing.

What is Quanum LSM, and who uses it?

Quanum Lab Services Manager is Quest's web-based ordering and results portal, built for physician practices and other clinical clients rather than for consumers directly. Per Quest's own product description, it lets healthcare providers place new lab orders in a few clicks, view graphed results in real time, manage supplies, and handle billing follow-ups — all through a single login. A companion mobile app, Quest Lab Alert for Physicians, pushes real-time notifications when a patient's priority or STAT results come back.

Because Quanum LSM sits between ordering clinicians and Quest's lab infrastructure, it is a repository of exactly the kind of data attackers prize: patient identifiers, ordering-physician information, and — depending on how deep access went — the lab results themselves. That is also why the system's exact exposure is hard to pin down quickly: a portal used by many different practices can hold records tied to patients who have no direct relationship with the hospital or clinic whose login was compromised.

Quest's response so far

Quest's public posture mirrors a fairly standard incident-response playbook for a regulated healthcare company: contain first, then investigate, then notify. The 8-K describes containment steps already underway, a call to federal law enforcement, and the hiring of outside forensic and cybersecurity specialists — all common early moves meant to preserve evidence, close off further access, and get an independent read on what actually happened before the company commits to specific numbers publicly.

What Quest has not done, at least not yet in any filing or statement we could verify, is name a suspected attacker, confirm whether ransomware or data theft (or both) was involved, or give any timeline for when a fuller accounting will be available. That is consistent with how early this disclosure is: the 8-K was filed the day after discovery, which is fast by the standards of past healthcare breaches, several of which took weeks or months between discovery and public notice.

What we don't know yet — and the number you may have already seen

Quest has not yet said how many patients are affected by the Quanum LSM incident, and it has not specified which data types — names, Social Security numbers, insurance information, specific test results, or something narrower — were accessed. Any article, social post, or aggregator stating a precise patient count for this October 2026 incident is going beyond what Quest itself has disclosed.

That matters here specifically because a number is already floating around that does not belong to this breach: roughly 11.9 million patients. That figure comes from a 2019 Quest Diagnostics disclosure involving a completely different incident — unauthorized access at American Medical Collection Agency (AMCA), a third-party billing collections vendor used through Quest's contractor Optum360, between August 2018 and March 2019. The AMCA breach exposed financial and some medical information tied to roughly 11.9 million Quest patients; lab test results themselves reportedly were not held by AMCA and were not part of that exposure. It is a real, serious, and separate episode in Quest's security history, but it is not a confirmed, or even estimated, count for the new Quanum LSM intrusion disclosed in October 2026. Until Quest publishes an updated figure — likely in a follow-up 8-K, a 10-Q disclosure, or formal breach notification letters — any specific patient count attached to this incident should be treated as unverified.

Quest's broader breach history

This is not Quest's first disclosed security incident, and the AMCA episode above is not the only prior one either — the company and its lab-industry peers have been repeat targets over the years, reflecting how attractive clinical and billing data is to attackers. Large-scale breaches at utilities and cloud infrastructure providers this year have shown a similar pattern: a single compromised vendor or platform exposing records belonging to people who often don't even know the company was holding their data. For background on Quest Diagnostics as a company, including its scale and prior incidents, see its Wikipedia entry, which tracks the company's corporate history and past security events as they're documented.

Why a lab-portal breach is different from a typical consumer breach

Clinical lab data carries a particular kind of sensitivity: it can include not just identity information but details about a person's health conditions, medications being tested for, pregnancy status, infectious disease results, and more — categories of data that are protected under HIPAA and that can't simply be reissued the way a credit card number can. A compromised ordering portal like Quanum LSM also touches the provider side of the relationship, meaning exposure can ripple from a single clinic's login into records for patients across that clinic's full patient base.

That is part of why regulators and plaintiffs' attorneys move quickly after healthcare breach disclosures, and why companies like Quest tend to be deliberately conservative in early statements — overstating or understating scope both carry legal risk under HIPAA's breach notification rule and SEC disclosure rules alike.

What Quest patients should do right now

Since Quest has not published a list of affected individuals, there is no way for a given patient to self-confirm inclusion yet beyond waiting for official notice. In the meantime, security practitioners generally recommend:

• Watch for an official notice from Quest. If you're affected, Quest (or its clinician/clinic partners who use Quanum LSM) is expected to notify you directly, by mail or a dedicated notification site, as is required for breaches involving protected health information.
• Be skeptical of unsolicited contact. Scammers often use breach news cycles to send fake "verify your account" emails or calls. Don't share your Social Security number, insurance ID, or payment details with anyone who contacts you first — verify by calling Quest or your provider directly through numbers you look up independently.
• Check your insurance explanation-of-benefits statements for any lab orders or tests you don't recognize, which can be an early sign of medical identity misuse.
• Consider a credit freeze or fraud alert if Quest's eventual notice indicates financial identifiers (like Social Security numbers) were involved — not every healthcare breach exposes this category of data, so wait for specifics where possible.
• Keep any notification letter or email you receive; it typically documents what was exposed and whether free credit monitoring or identity-protection services are being offered.

The U.S. Department of Health and Human Services maintains a public breach portal listing larger healthcare breaches reported under HIPAA, which is typically where a Quanum LSM entry would eventually surface once Quest files formal notification. For general identity-theft recovery steps, the FTC's IdentityTheft.gov is a standard starting point regardless of which company's breach prompted the concern.

What clinicians and Quest's enterprise clients should watch for

Practices that use Quanum LSM to place orders should expect direct communication from Quest about any account resets, forced password changes, or temporary access restrictions tied to the investigation — the 8-K's reference to "remedial measures" typically includes exactly this kind of account-level containment. Clinics should also review their own HIPAA business-associate obligations: if patient data tied to their practice was among the "certain patient records" Quest says were accessed, the clinic may have separate notification duties to its own patients depending on the final scope Quest reports. For a sense of how other recent breaches played out from disclosure through remediation, see our breakdown of what to do after a breach affecting a different sector.

The regulatory and legal angle

Quest's 8-K filing itself is an SEC disclosure obligation, separate from — but related to — its HIPAA obligations as a covered entity. Under HIPAA's breach notification rule, healthcare organizations generally must notify affected individuals and HHS once a breach's scope is confirmed, with the clock and reporting thresholds depending on how many people are affected. Because Quest says the investigation is ongoing, the formal HIPAA notification and any specific affected-count are both still pending as of this writing. Public companies that are the target of class-action litigation after breaches — as Quest was after the 2019 AMCA incident — often see similar suits filed within days to weeks of a new disclosure, well before the company itself has finished scoping the incident.

What's next

The near-term things to watch are straightforward: whether Quest files a follow-up 8-K or addresses the incident in its next quarterly report with updated scope; whether the company issues direct patient notifications and, with them, a first concrete number; and whether security researchers or law enforcement disclosures surface attribution to a specific hacking group. Pandromeda will update this story as Quest provides additional confirmed detail. Until then, the responsible reporting line is simple: a breach happened, Quest is investigating and has told the SEC it believes patient records were accessed, and no patient count or data-type breakdown has been confirmed — whatever number you may see elsewhere attached to this specific incident should be treated with caution unless it traces back to Quest's own disclosures.

Written bySana Qureshi

Sana Qureshi runs the security and privacy desk. She reports on actively exploited vulnerabilities, vendor patches and data breaches, and covers the password managers, VPNs and authentication tools readers use to protect themselves. Her alerts cite vendor advisories, CISA and the CVE record directly.

More from Sana QureshiAll Security & Privacy coverage