Quest Diagnostics, one of the largest laboratory testing companies in the United States, says an unauthorized party got into a system that healthcare providers use to order lab tests and look up results, and accessed patient records.
The company disclosed the incident in a Form 8-K filed with the SEC and in a breach notice for patients, which Malwarebytes has broken down for patients. Quest has not said how many people are affected.
The intruder reached the lab ordering portal
According to Quest's filing, the company learned of the unauthorized access on October 21, 2026. The affected system is Quanum Lab Services Manager (LSM), which certain clients use to place test orders and to receive and look up results. The platform also lets healthcare professionals review historical trends and order supplies. Quest paused access to it, activated its incident response procedures, brought in outside cybersecurity experts, and notified federal law enforcement.
Quest says the incident has not materially disrupted its business operations or its ability to serve patients. The full scope of the access remains under investigation, and the company has not attributed the intrusion to any group.
Health data was involved, but the details are still missing
Quest's notice says personal information and patient records were affected, and confirms that both health information and personally identifiable information were involved. It has not yet published a count of affected patients or a complete list of the data accessed, and has not said whether Social Security numbers, insurance identifiers, payment details, specific test results or account passwords were among it.
Diagnostics firms have drawn attackers' attention this year: ransomware crews have also claimed diagnostics maker Hologic on their leak sites. More US breach reporting is tracked on our United States profile.
Wait for Quest's letter, and ignore look-alikes
Quest says it will notify affected patients, healthcare providers and health plans once its investigation is complete, and that the letters will describe available resources, including credit and identity monitoring. Until then, patients can:
- Treat any unexpected email, text or call about the breach with suspicion, and go to Quest's website directly rather than clicking a link.
- Check medical bills and insurers' Explanation of Benefits statements for tests or services they did not receive, which the US Federal Trade Commission identifies as warning signs of medical identity theft.
- Review credit reports for unfamiliar accounts, and report anything suspicious to their provider and insurer.
Lab orders link a person's identity to the tests their doctor thought they needed. That is why the list of exposed data fields Quest eventually publishes will matter as much as the number of patients on it.
This briefing is provided by IntelFusions for informational and defensive purposes only. It is based on sources assessed to be reliable at the time of writing, and analytic judgments carry the confidence levels indicated. Indicators of compromise are defanged; re-arm them only in controlled environments. IntelFusions is not affiliated with the organizations named and makes no warranty as to completeness or accuracy.