Quest Diagnostics says patient records accessed in Quanum breach

Key takeaways

• Quest Diagnostics told the SEC in a Form 8-K dated October 22, 2026, that it learned on October 21 of unauthorized access to its Quanum Lab Services Manager (LSM) system, which some clients use to order tests and look up results.
• The company believes an unauthorized party accessed "certain patient records", but says the full scope is still under investigation.
• Quest has notified federal law enforcement and hired outside cybersecurity experts. It says the incident has not materially disrupted its business or its ability to serve patients.
• Quest has not disclosed how many patients are affected or what types of data were involved. Under federal HIPAA rules, affected individuals must be notified no later than 60 calendar days after a breach is discovered.

Quest Diagnostics says an unauthorized party accessed certain patient records through its Quanum LSM lab ordering and results platform. The company disclosed the Quest Diagnostics breach in an SEC Form 8-K dated October 22, 2026, saying it learned of the access on October 21.

What the Quest Diagnostics 8-K confirms

Quest filed the disclosure under Item 8.01 ("Other Events") of Form 8-K, not under Item 1.05, the section public companies use for cybersecurity incidents they have judged material. According to the filing, the company learned of the unauthorized access on October 21, 2026, and activated its incident response procedures to contain the activity, investigate, and put remedial measures in place.

The filing describes Quanum LSM as a system "certain clients" use to place test orders and to receive and look up results. Fox Business describes those users as healthcare providers who order lab tests and view results, not patients ordering their own tests. Quest wrote that while the investigation continues, it believes an unauthorized party "accessed certain patient records." The company said it has notified federal law enforcement and engaged external cybersecurity experts.

Quest also said the incident has not materially disrupted its operations or its ability to serve patients. It listed the incident's possible effects among the risks that could affect future results. The disclosure came on the same day Quest reported third-quarter 2026 results: revenue of $3.10 billion, up 10.0% from a year earlier, and diluted earnings per share of $2.78, according to the company's press release.

Timeline of the Quanum incident

Which Quest systems are affected

According to Fox Business, Quest temporarily disabled Quanum LSM on Thursday. As a precaution, it also paused its Essential Insights and LabHQ systems, though the company said no data was accessed on those two platforms. Fox Business reported that providers who normally use Quanum LSM can order tests with paper requisitions or through the separate Quanum eLabs platform, and that Quest's other electronic ordering systems keep working. Quest does not expect testing delays for clients that do not use Quanum LSM, the outlet reported.

The Associated Press reported that Quest confirmed the intrusion is not connected to the PHP vulnerabilities that have pushed website operators to patch urgently this week. Bullquill covered that issue in our guide to the PHP emergency security patches.

What is still unknown

The filing leaves several basic questions open. Quest has not said how many patients are affected or what kinds of information were in the accessed records. Lab records can include names, dates of birth, test orders, results, and insurance details, but Quest has not confirmed which of these were involved. Fox Business reported that Quest confirmed protected health information or personally identifiable information was involved, while the company was still determining what was accessed and for how many people.

Until Quest publishes notification letters or a breach report appears on the HHS Office for Civil Rights portal, any patient count circulating online should be treated as unconfirmed.

Quest's earlier data incidents

This is not the first time Quest patient data has been exposed. In 2019, the company disclosed that a hack at American Medical Collection Agency, a third-party billing collections vendor, affected personal information of about 11.9 million Quest patients; Quest said at the time that its own systems were not involved. The AP also noted a 2016 breach that exposed lab results and contact details of about 34,000 people. The October 2026 incident is different because it hit a platform Quest itself operates.

What HIPAA requires Quest to do next

As a healthcare provider, Quest is a covered entity under HIPAA. The HHS Breach Notification Rule sets the following steps when unsecured protected health information is breached.

Individual notices must, where possible, describe what happened, the types of information involved, the steps people can take to protect themselves, what the organization is doing, and how to contact it. Fox Business reported that Quest said it will notify affected patients and providers as the law requires.

What patients and clinics can do now

Patients do not need to contact Quest to find out whether they are affected; formal notices will come by mail or email once the investigation identifies those involved. Some practical steps are worth taking in the meantime:

• Treat unexpected messages with caution. Breach news often triggers phishing calls and emails that claim to be from the affected company. Check any contact through numbers on Quest's official website, and never share passwords or payment details with unsolicited callers.
• Watch for signs of medical identity theft. The US Federal Trade Commission lists warning signs such as bills or Explanation of Benefits statements for care you never received, and collection notices for medical debt you do not owe.
• Review your credit reports. Free reports are available at AnnualCreditReport.com, and suspected identity theft can be reported at IdentityTheft.gov.
• Secure your health portal logins. Use unique passwords and, where offered, passkeys or two-factor authentication. See how to set up passkeys.

Clinics that use Quanum LSM should follow Quest's instructions on alternative ordering, keep internal records of which orders were placed through the platform, and prepare for patient questions. They should also check their own HIPAA obligations if Quest acts as their business associate for any services.

What it means

A provider-facing ordering and results system holds lab data from many physician practices, so even a short intrusion can reach a wide group of patients. Quest's choice of Item 8.01 suggests that, for now, the company does not consider the incident material to investors. That assessment covers the business impact, not how many patients may be affected. The real scale will become clear only through HIPAA notices and any filing on the HHS breach portal. As with the State Bank of India cyberattack disclosed this week, early company filings confirm an intrusion while leaving the size of the exposure open. Readers should rely on official notices rather than unverified claims online.

Sources

• Quest Diagnostics Form 8-K, October 22, 2026 (SEC EDGAR)
• Quest Diagnostics newsroom: third quarter 2026 financial results
• ABC News (AP): Quest Diagnostics reports cyber breach affecting "certain patient records"
• NBC News (AP): Quest Diagnostics reports cyber breach affecting "certain patient records"
• Fox Business: Quest Diagnostics confirms patient information accessed in cyberattack
• CNBC: Quest Diagnostics reports cyber breach of certain patient records
• HHS: HIPAA Breach Notification Rule
• 45 CFR 164.404: Notification to individuals (Cornell LII)
• FTC: What to know about medical identity theft