Quest says unauthorized party accessed patient records via Quanum

Quest Diagnostics says someone broke into a system that doctors use to order lab tests and view results. In a filing with the SEC, the company said it learned on October 21, 2026, of unauthorized access to its Quanum LSM system.

Quest said it believes "an unauthorized party accessed certain patient records," according to the filing. The company has not said how many patients were affected or what kinds of data were taken.

Key facts

• Quest told the SEC it found unauthorized access to Quanum LSM on October 21, 2026, and says the probe continues.
• The company says it notified federal law enforcement and hired outside cybersecurity experts.
• TechCrunch reports Quanum is used by about half a million clinicians across North America.
• Quest paused access to Essential Insights and LabHQ as a precaution, BleepingComputer reported.
• Quest told the AP the breach was not tied to the PHP flaw officials urged firms to patch.

What Quest disclosed

The Quanum system lets clients place test orders and look up results, Quest said in its SEC filing. Quest said it believes certain patient records were accessed, while the full scope is still being investigated.

The company said it quickly started its incident response procedures to contain the activity and look into how far it reached. It also brought in outside security experts and told federal law enforcement, the filing says.

Quest said the incident has not materially disrupted its business operations or its ability to serve patients.

As a safety step, Quest also cut off access to some other systems for a time. BleepingComputer reported that these included Essential Insights and LabHQ.

Reports have differed on the status of Quanum itself. BleepingComputer reported that Quanum LSM had been stopped. Its status at any later time could not be confirmed from the sources used for this story.

What Quest has not said

Many details are still missing. TechCrunch reports that Quest did not say when the breach began or whether hackers made demands.

Quest spokesperson Amanda Rivera did not answer TechCrunch's questions and pointed instead to the company's security notice, TechCrunch reported.

It is not known who is behind the attack. No group had claimed responsibility in BleepingComputer's reporting. Quest has also not said how many healthcare customers or patients had data stolen, TechCrunch reported.

Background

Quanum is a core tool for many medical offices. TechCrunch says it lets doctors' offices, hospitals and practices order lab tests and manage billing, which means it holds patient health records and billing data.

Its reach is large. TechCrunch says roughly half a million clinicians use Quanum at thousands of sites in North America.

This is not the first time Quest patient data has been exposed. BleepingComputer reported that in 2019, data on about 11.9 million Quest patients was compromised in a breach at billing provider American Medical Collection Agency.

In 2016, Quest said lab results and contact details of about 34,000 people were exposed in a separate online breach.

The new incident is separate from a widely reported PHP flaw. Quest confirmed to the AP that the breach was not related to that PHP vulnerability.

Who is affected

The incident touches two groups: the medical offices that use Quanum and the patients whose records sit inside it. Quest has not said how many of either group had data stolen, TechCrunch reported.

The platform's size explains the concern. Because it stores patient health records and billing data, a breach could reach well beyond one clinic. Still, Quest has described the accessed data only as certain patient records, and the types of data taken are not known.

What it means for you

Patients who have had lab work ordered through a doctor that uses Quest may want to follow this story. Quest has said only that certain patient records were accessed, so it is not yet clear who is affected.

There is no sign yet of which data types were involved. Until Quest says more, patients cannot know whether their own test results or billing details were included.

Practical steps

• Watch for a notice. Quest says that as the covered entity, it will send notifications as required by law once it learns who was affected, TechCrunch reported.
• Check official updates. Quest's SEC filing is the company's formal statement on the incident.

What happens next

Quest says the full scope of the access is still under investigation. The number of affected patients, the data involved and the start date of the intrusion may become clearer as that work continues.

FAQ

Was my Quest lab data exposed? Quest says certain patient records were accessed but has not said how many patients or which records. Its investigation is ongoing.

What is Quanum Lab Services Manager? It is a Quest platform where some clients can place test orders and get or look up results.

Is the Quest breach linked to the PHP bug? No. Quest told the AP the breach was not related to the PHP issue.

Did the breach disrupt lab services? Quest said the incident has not materially disrupted its operations or its service to patients.

Has Quest told the police? Yes. Quest says it notified federal law enforcement and hired outside experts.

Has anyone demanded a ransom? That is not known. TechCrunch reports Quest did not say whether any group contacted it with demands.