Quest Diagnostics, one of the largest clinical laboratory companies in the United States, has disclosed that someone gained unauthorized access to a platform doctors and medical office staff use to order lab tests and retrieve results. The company said in a filing with the Securities and Exchange Commission and in an alert on its website that it believes some patient records were exposed, though it has not yet said how many people are affected or what categories of data were taken.
The affected system is Quanum LSM, short for Laboratory System Manager, an online tool that clinicians and office staff use to place test orders and manage lab services on behalf of patients. Quest said it learned of the unauthorized activity on October 21, 2026. Once it discovered the intrusion, the company activated its incident response plan, brought in outside security experts, and notified law enforcement.
Quest has taken Quanum LSM offline entirely while the investigation continues. Customers who normally rely on it have been told to fall back on paper requisitions or to use Quanum eLabs, a separate ordering and results platform, in the meantime. As an added precaution, the company temporarily suspended access to two other services, Essential Insights and LabHQ, even though it has not said either was involved in the breach.
The company was careful to draw a line around what was not affected. It said the intrusion did not disrupt its customer-facing operations, and that direct-customer laboratory information system interfaces and electronic medical record integrations used by larger healthcare partners continued to function normally throughout.
As of this writing, no ransomware gang or extortion group has publicly claimed responsibility for the intrusion, and Quest has not described how the attacker got in. Those details, along with the scope of exposed data, are likely to emerge as the investigation progresses and as the company works through its breach notification obligations under US health privacy law.
This is not the first time Quest’s patients have had their information put at risk through a third party. In 2019, a breach at the billing collections firm AMCA exposed data belonging to roughly 11.9 million Quest patients, among millions of others affected across several lab companies that used AMCA’s services. The lawsuits that followed were consolidated into multidistrict litigation that, more than six years later, is still working its way through the courts. Whether this new incident triggers a similar wave of legal action will likely depend on how many patients are ultimately affected and what kind of data was exposed.
Healthcare providers remain one of the most frequently targeted sectors by cybercriminals, in part because medical and lab records combine the kind of personal, financial, and insurance details that are valuable on underground markets, and because many clinical organizations run a patchwork of older systems that are expensive to replace. Patients who have used Quest’s ordering and results platforms in the past may want to watch for breach notification letters and keep an eye on their insurance statements and any accounts tied to the information typically collected during lab testing, such as names, dates of birth, and insurance identifiers.
Source: BleepingComputer, “Quest Diagnostics confirms data breach exposed patient records”.
