Privacy
Quest Diagnostics breach exposes patient records through lab system
Quest Diagnostics says patient records were exposed after attackers accessed its Quanum LSM system. The company is investigating and has paused some systems as a precaution.
Ross GrantUpdated 2 min read
The short version
Quest Diagnostics, a major US lab company, says hackers accessed its Quanum LSM system and exposed some patient records. The company is still investigating what information was taken and how many people are affected. Some systems have been paused as a precaution. If you use Quest Diagnostics, watch for updates and be careful with suspicious messages.
By the numbers
- 7,700Quest Diagnostics locations in North AmericaBleepingComputer
- 65,000Quest Diagnostics employeesBleepingComputer
- $11bnQuest Diagnostics annual revenueBleepingComputer
- 1 in 3US adults served each year by Quest DiagnosticsBleepingComputer
- 11.9 millionPatients affected in 2019 Quest Diagnostics-related breachBleepingComputer
What happened?
Quest Diagnostics has confirmed that patient records were exposed after attackers gained unauthorised access to its Quanum LSM system. The breach was discovered on October 21, 2026. The company has paused some systems and is investigating with external experts. The types of data affected and the number of patients involved are not yet known.
Who is affected
Quest Diagnostics, one of the largest clinical laboratory companies in the United States, has confirmed that patient records were exposed after a threat actor gained unauthorised access to its Quanum LSM system. Quanum LSM (Lab Services Manager) is an online platform used by physicians, hospital staff, and medical office personnel to manage lab services, order tests, and access results. The company serves about one in three U.S. adults each year, operates 7,700 locations, and employs 65,000 people. However, only clients using the Quanum LSM system were affected. Users of direct-customer LIS (Laboratory Information System) interfaces or EMRs (Electronic Medical Records) were not impacted, according to Quest Diagnostics.BleepingComputer (opens in a new tab)
What was taken
Quest Diagnostics has stated that some patient records were exposed in the breach. The company is still investigating the incident and has not yet determined exactly what types of data were accessed. It is not yet clear how many patients are affected or what specific information was involved.
The response
Quest Diagnostics learned of the breach on October 21, 2026, and immediately activated its incident response protocol. This included containing the activity, assessing the nature and scope of the incident, and implementing remedial measures. The company has paused access to several systems, including Essential Insights and LabHQ, as a precaution. The Quanum LSM system itself has been taken offline. Customers are being advised to use paper requisitions or the Quanum eLabs system to place orders and receive results while the investigation continues. External experts are assisting with the investigation, and law enforcement authorities have been notified. Quest Diagnostics says that customer-facing operations have not been disrupted.
Has this happened before?
This is not the first time Quest Diagnostics has faced a data breach. In 2019, data belonging to about 11.9 million patients was compromised due to a breach at its billing collection provider, American Medical Collection Agency (AMCA). That earlier breach led to at least 19 class-action lawsuits, which were consolidated into multidistrict litigation that remains unresolved.BleepingComputer (opens in a new tab)
What you should do
If you are a patient or client of Quest Diagnostics and have used the Quanum LSM system, monitor your accounts and communications for any unusual activity. Be alert for phishing attempts or suspicious messages claiming to be from Quest Diagnostics. The company has not yet said whether it will notify affected individuals directly, but it is standard practice to do so once the investigation has determined who is impacted.
Why it matters
Medical data is highly sensitive and valuable to attackers. Even partial exposure of patient records can lead to identity theft or fraud. The breach also shows that even large, well-known healthcare providers are vulnerable to cyberattacks.
Key points
- Quest Diagnostics confirmed a breach of its Quanum LSM system.
- Patient records were exposed, but the exact data and number affected are unknown.
- The company paused some systems and is investigating with external experts.
- No disruption to customer-facing operations has been reported.
- A previous breach in 2019 affected 11.9 million patients.
Sources
BleepingComputer
Reference
