Overview
American clinical laboratory company Quest Diagnostics disclosed that patient records were exposed after a threat actor gained unauthorized access to its Quanum LSM (Lab Services Manager) system. Clients use the system to place test orders and to receive and look up results.
Quest learned of the access on October 21, 2026, activated its incident response protocol, and disclosed the incident in a filing with the U.S. Securities and Exchange Commission.
What We Know
- Quest believes some patient records were exposed.
- The types of data affected have not been determined, and the number of affected individuals has not been reported.
- As of publication, no threat group had claimed the attack.
Response
- External experts are assisting the investigation, and law enforcement has been informed.
- Access to the Essential Insights and LabHQ systems was temporarily paused as a precaution.
- The Quanum LSM system has been stopped. Customers are advised to use paper requisitions or Quanum eLabs to place orders and receive results.
- Quest says customer-facing operations were not disrupted, and users of direct-customer LIS interfaces or EMRs were not affected.
Background
In 2019, a breach at billing collection provider AMCA exposed data of about 11.9 million Quest patients. At least 19 class-action lawsuits followed and were consolidated into multidistrict litigation that is still ongoing.
Guidance
For healthcare organizations using Quanum LSM:
- Move to the paper or Quanum eLabs workflow Quest recommends until the system returns.
- Ask Quest what data your patients' records contained and what notification obligations apply to you.
- Watch for phishing that references lab results or Quest.
For patients:
- Watch for notification letters from Quest or your provider.
- Be skeptical of unsolicited calls or emails about test results.
- Review insurance statements for services you did not receive.
Details will likely change as the investigation proceeds and Quest updates its SEC filing.