Quest Diagnostics confirmed a data breach affecting patient records after a threat actor gained unauthorized access to its Quanum LSM laboratory management platform, the company disclosed in an SEC filing on October 23.
Quest Diagnostics disclosed Friday that patient records were exposed after a threat actor gained unauthorized access to its Quanum LSM system, the company's online platform used by physicians and hospital staff to manage laboratory services and access test results.
The breach, first reported by BleepingComputer, was confirmed through a filing with the U.S. Securities and Exchange Commission. Quest Diagnostics said it learned of the unauthorized access on October 21, 2026, and immediately activated its incident response protocol to contain the activity and assess the scope of the incident.
"On October 21, 2026, Quest Diagnostics Incorporated learned of unauthorized access to its Quanum LSM system, which certain clients use to place test orders, receive and look up results," the company said in its SEC filing.
The company said the specific types of patient data affected have not yet been determined. External experts are assisting with the ongoing investigation, and Quest Diagnostics has also notified law enforcement authorities.
Quest Diagnostics operates 7,700 locations across North America, employs 65,000 people, and generates more than $11 billion in annual revenue. The company says it serves one in three U.S. adults each year, making the potential scale of the exposure significant.
As a containment measure, Quest Diagnostics has temporarily suspended access to the Quanum LSM system and paused access to several related platforms, including Essential Insights and LabHQ. The company is directing affected customers to use paper requisitions or its Quanum eLabs platform to place orders and retrieve results in the interim.
Quest Diagnostics said the incident has not disrupted its customer-facing operations, and that users of direct-customer laboratory information system interfaces or electronic medical records were not affected.
No threat group had publicly claimed responsibility for the attack as of Friday afternoon.
The disclosure comes as Quest Diagnostics continues to deal with the legal fallout from a prior breach. In 2019, data belonging to approximately 11.9 million patients was compromised through a breach at billing collection provider American Medical Collection Agency. At least 19 class-action lawsuits followed, which were consolidated into multidistrict litigation that remains unresolved.
The company's response will be closely watched given that prior litigation history, and the breadth of the Quanum LSM platform — which serves physicians, hospital personnel, and medical office staff across its network — underscores the potential reach of any data compromise. Regulators and plaintiff attorneys are likely to scrutinize the timeline between the October 21 discovery and public disclosure as the investigation continues.
TechEchelon Staff bylines are produced collectively by the newsroom for short, breaking, and wire-style coverage. Longer-form reporting is published under the responsible reporter's name.
More from the Staff →Capcom confirmed unauthorized access to its CAPCOM ID platform exposed data from more than 11.7 million customer accounts, including email addresses, login metadata, and for a small subset, additional personal details.
The PHP security team released emergency patches for two critical unauthenticated remote code execution vulnerabilities, CVE-2026-109618 and CVE-2026-109619, affecting all PHP installations that serve web requests, with early exploitation already observed in the wild.
A Nigerian national was sentenced to eight years in prison for spearphishing attacks on U.S. tax preparation businesses between 2019 and 2021, stealing more than $3 million through fraudulent tax refunds and SBA loan applications.
Written for readers who already know the basics — markets, AI, and the policy decisions that shape both.