Quest Diagnostics has confirmed that patients’ personal and health data was compromised in a cyberattack on its Quanum lab-ordering system. The company learned of the unauthorized access on October 21, 2026, and disclosed it in a filing with the US Securities and Exchange Commission.
What did Quest Diagnostics confirm?
In an 8-K filing with the SEC, Quest Diagnostics said it learned on October 21, 2026, of unauthorized access to Quanum LSM, the platform doctors’ offices, hospitals, and other healthcare practices use to order lab tests, retrieve results, and handle billing. The company said it currently believes an unauthorized party accessed certain patient records, though it has not yet determined the exact scope of what was taken.
Quest said it activated its cybersecurity incident response procedures to contain the activity, notified federal law enforcement, and brought in outside cybersecurity experts to investigate. That response typically includes isolating the affected systems, preserving logs for forensic review, and working with investigators to determine how the intrusion happened before systems are fully restored to normal operation. A company spokesperson did not answer questions from TechCrunch and instead pointed reporters to Quest’s own security notice page.
How big is Quest Diagnostics?
Quest Diagnostics reported full-year 2025 revenue of about 11.04 billion US dollars, up 11.8 percent from 2024, according to the company’s own fourth-quarter earnings release. Its regulatory filings say it serves roughly one-third of the US adult population in a given year, and about one-half over a three-year span, making it one of the largest clinical lab testing companies in the country. The company employs more than 55,000 people across its operations, including its LifeLabs business, according to its own investor materials. That scale is part of why a breach of its Quanum ordering system, used by around half a million clinicians, draws attention well beyond its own customer base.
How many patients are affected?
Quest has not said how many patients or healthcare customers were affected by this incident, and the full scope remains under investigation, according to the company’s SEC filing. Quanum LSM is used by roughly half a million clinicians across thousands of locations in North America, which gives a sense of the system’s reach even though it does not indicate how many individual patient records were actually touched.
Is this part of a wider pattern of healthcare breaches?
This is Quest Diagnostics’ second major known data breach in less than a decade. In 2019, a cyberattack on a third-party billing vendor, the American Medical Collection Agency, exposed roughly 11.9 million patient records tied to Quest. That earlier breach involved a billing partner’s systems, not Quanum, so the two incidents are separate.
TechCrunch’s reporting also notes several other healthcare-sector breaches disclosed in 2026, at companies including Stryker, Boston Scientific, CareCloud, Craneware, and McKesson, pointing to a year of sustained attacks on the health technology supply chain rather than an isolated incident at one company.
| Detail | 2019 breach | 2026 breach |
|---|---|---|
| System affected | Third-party billing vendor (AMCA) | Quest’s own Quanum LSM platform |
| Patients affected | About 11.9 million | Not yet disclosed |
| Disclosure method | Vendor and SEC filings | Quest’s own SEC 8-K filing |
| Status as of Oct 24, 2026 | Closed, long resolved | Active investigation |
What should Quest patients do now?
Quest has not yet sent individual breach notifications, since it says the scope of affected records is still under investigation. Patients who have used a Quest-affiliated clinic, hospital, or lab in the past can watch for an official notification letter from Quest once that review concludes, and should treat any such letter as the authoritative source rather than unsolicited calls or emails claiming to be from the company.
What happens next
Quest says its investigation into the breach’s scope is ongoing, and that it will notify affected individuals as required once that scope is determined. No ransom demand or responsible hacking group has been publicly identified so far. The company’s regulatory filing leaves open the possibility of further disclosures as the investigation continues, which is standard practice for an active breach case under SEC reporting rules.
Frequently asked questions
What system was breached?
Quanum LSM, the lab-ordering and results platform Quest Diagnostics provides to clinicians and healthcare practices.
When did Quest learn of the breach?
Quest says it learned of the unauthorized access on October 21, 2026, and disclosed it to the SEC two days later.
Is this the same as Quest’s 2019 breach?
No. The 2019 incident involved a third-party billing vendor and exposed about 11.9 million records. This one involves Quest’s own Quanum system, and the number of affected patients has not been disclosed.
Has law enforcement been involved?
Yes. Quest’s SEC filing says the company notified federal law enforcement and engaged outside cybersecurity experts to investigate the incident alongside its own internal response team.
Leave a Reply