Quest Diagnostics breach: patient records accessed via Quanum Lab Services Manager
Quest Diagnostics Quanum Lab Services Manager (lab ordering and results portal)
Quest Diagnostics says it learned on Oct 21 2026 of unauthorized access to its Quanum Lab Services Manager (LSM), the system some clients use to place lab test orders and receive and look up results. Quest believes some patient data in Quanum LSM was accessed and confirms PHI/PII was involved; the specific data affected is still being investigated. Quest paused access to Quanum LSM (and, as a precaution, Essential Insights and LabHQ, where no data was accessed), notified federal law enforcement and engaged outside experts. Core operations are not materially disrupted, and Quest says the incident is not related to the PHP vulnerabilities.
Why this severity: Patient health and personal information accessed at a major US lab; scope still unknown
- Started
- Oct 21, 2026
Affected
- Quanum Lab Services Manager (LSM) patient data; affected patients and providers not yet identified
Fixed in
- Access to Quanum LSM paused and the unauthorized access discontinued; full restoration expected as soon as Oct 23
Timeline3
8-K filing: Quest believes an unauthorized party accessed certain patient records; federal law enforcement notified and outside experts engaged; operations not materially disrupted.
SourceQuest FAQ confirms PHI/PII was involved, pauses Essential Insights and LabHQ as a precaution, says the incident is not PHP-related, and expects Quanum LSM back as soon as Oct 23. Clients can use paper requisitions or Quanum eLabs meanwhile.
SourceQuest learns of unauthorized access to Quanum LSM, starts incident response and pauses access to the system.
Source
Advisories2
News & write-ups2
Posts2
Quest Diagnostics confirms patient information accessed in cyberattack, systems temporarily shut down t.co/exvlCOF4u1
Quest Diagnostics on Thursday said it learned of unauthorized access to its Quanum LSM system, which some clients use to place test orders, receive and look up results. t.co/tvqxrMZHmo
Notes & caveats
How the attacker got in and how many patients are affected have not been disclosed. Quest says it will notify affected patients and providers as required by law. Providers ordering through LIS interfaces or EMRs were not affected.
Get an email when a new major security incident drops. No spam, unsubscribe any time.
