Quest Diagnostics confirms data breach exposed patient records
American clinical laboratory company Quest Diagnostics disclosed that patient records have been exposed after a threat actor gained unauthorized access to its Quanum LSM system.
The company learned about the breach on October 21 and deployed its incident response protocol "to contain the activity, assess and investigate the nature and scope of the incident and implement appropriate remedial measures." “On October 21, 2026, Quest Diagnostics Incorporated learned of unauthorized access to its Quanum LSM system, which certain clients use to place test orders, receive and look up results,” the company says in a filing with the U.S.
The company disclosed the breach to the SEC and provided more information in an alert on its website.
American clinical laboratory company Quest Diagnostics disclosed that patient records have been exposed after a threat actor gained unauthorized access to its Quanum LSM system.
McKesson discloses breach after ShinyHunters claims patient data theft IQVIA fined $7.8 million for failing to properly anonymize health data
The company says that the incident has not disrupted its customer-facing operations and users of direct-customer LIS interfaces or EMRs were not impacted.
As a cautionary measure, Quest Diagnostics has temporarily paused access to other systems, including Essential Insights and LabHQ.
The company is still investigating the incident but believes some patient records were exposed.
As of writing, BleepingComputer could not find a threat group claiming the attack on Quest Diagnostics.
Following the disclosure, at least 19 class-action lawsuits were filed against Quest Diagnostics.
Once attackers are using valid credentials, prevention drops sharply.
What happened
The company learned about the breach on October 21 and deployed its incident response protocol "to contain the activity, assess and investigate the nature and scope of the incident and implement appropriate remedial measures." “On October 21, 2026, Quest Diagnostics Incorporated learned of unauthorized access to its Quanum LSM system, which certain clients use to place test orders, receive and look up results,” the company says in a filing with the U.S.
The company disclosed the breach to the SEC and provided more information in an alert on its website.
What changed
American clinical laboratory company Quest Diagnostics disclosed that patient records have been exposed after a threat actor gained unauthorized access to its Quanum LSM system.
McKesson discloses breach after ShinyHunters claims patient data theft IQVIA fined $7.8 million for failing to properly anonymize health data
Who is affected
The company says that the incident has not disrupted its customer-facing operations and users of direct-customer LIS interfaces or EMRs were not impacted.
As a cautionary measure, Quest Diagnostics has temporarily paused access to other systems, including Essential Insights and LabHQ.
Why it matters
The company is still investigating the incident but believes some patient records were exposed.
As of writing, BleepingComputer could not find a threat group claiming the attack on Quest Diagnostics.
Technical details
Following the disclosure, at least 19 class-action lawsuits were filed against Quest Diagnostics.
Once attackers are using valid credentials, prevention drops sharply.
Response
External experts are aiding the ongoing investigation, and Quest Diagnostics has also informed the applicable law enforcement authorities.
Currently, the Quanum LSM system has been stopped, and customers are recommended to use paper requisitions or Quanum eLabs to place orders and receive results.
Attribution
BleepingComputer: American clinical laboratory company Quest Diagnostics disclosed that patient records have been exposed after a threat actor gained unauthorized access to its Quanum LSM system.