Quest Diagnostics confirmed hackers reached patient records through its Quanum lab platform

Quest Diagnostics told the Securities and Exchange Commission on Oct. 22 that an unauthorized party had accessed certain patient records through Quanum, the platform some of its clients use to order lab tests and read results. The company said it learned of the incident on Oct. 21, started its incident response procedures, notified federal law enforcement and hired outside cybersecurity experts. As of Oct. 24, Quest had not said how many patients are affected.

Tech news in one quick read: Get the most interesting stories in startups, tech and programming, each with a short TLDR, in one daily email from TLDR.

Subscribe to TLDR →

We may earn a commission if you sign up.

The filing is a short Item 8.01 “other events” disclosure on Form 8-K, signed by Corporate Secretary Sean D. Mersten, and it names the system as the Quanum Lab Services Manager, called Quanum LSM. Quest’s separate notice for clients adds operational detail, including a pause on access to the system and a list of workarounds for providers who normally order through it.

What Quest told the SEC about the Quanum LSM system

In its Form 8-K dated Oct. 22, Quest describes Quanum LSM as a system certain clients use to place test orders, receive results and look results up. The company says the full scope of the incident is still under investigation but that it believes an unauthorized party accessed certain patient records. TechCrunch, which first reported the filing’s contents on Oct. 23, characterized it as a confirmed cyberattack and data breach, and noted that Quest says Quanum is used by about half a million clinicians at thousands of locations across North America.

Quest also told investors that the incident has not materially disrupted its business operations or its ability to serve patients. The filing puts no dollar figure on the cost and folds the incident into the company’s forward-looking risk language.

A paused platform and paper requisitions at Quest’s notice page

Quest’s own notice on Quanum was posted on Oct. 22 at noon Eastern time. It says access to Quanum LSM has been paused, that the company sees no further access to the system, and that the investigation continues. Two other products, Essential Insights and LabHQ, were also paused as a precaution, although Quest says no data was accessed in either. The company said it expected full functionality to return as soon as Oct. 23 and that the incident is unrelated to the PHP programming language issue that had been circulating among security teams.

Clients who could not use the platform were told to send paper requisitions by fax to a local patient service center, or to order and retrieve results through Quanum eLabs with the same credentials. Providers with direct laboratory information system interfaces or electronic medical record connections could keep ordering through those channels.

TechCrunch reporter Zack Whittaker observed that the notice page carries a “noindex” tag, which asks search engines not to list it and makes it harder to find. A Quest spokesperson did not respond to the outlet’s request for comment, and neither the filing nor the notice says whether any group has claimed the attack or made demands. Quest says only that some patient data in the system was accessed and that it is still working out exactly which data, and that patient health and identifying information may be involved.

How the 2019 billing-vendor breach differs from Quanum

Quest has been here before, but not in this way. In 2019, the American Medical Collection Agency, a billing contractor, told Quest that an unauthorized user had reached its systems, and CBS News reported in June of that year that nearly 12 million patients were involved, with credit card numbers, bank account numbers, Social Security numbers and medical information exposed but not test results. TechCrunch puts the figure at 11.9 million patient records and calls the new incident Quest’s second known major breach in a decade.

The difference is where the weakness sat. The earlier exposure came from a third party that handled collections. Quanum is Quest’s own ordering and results platform, which means the data at risk is the clinical workflow itself: which tests a physician ordered, for which patient, and what came back. Quest has not said whether results were among the records accessed, and its 8-K stops at the phrase certain patient records. Until the company completes its review and files notices, the practical question for patients is which of their providers ordered tests through Quanum LSM, something only those clinics and Quest can answer.

What notification will look like for patients and providers

Quest says it will notify affected parties as required by applicable law and is working to identify the patients and providers involved. In the United States, the framework for those notices is the HIPAA breach notification rule, which governs how covered entities report breaches of unsecured protected health information to individuals and regulators. Because Quest has not quantified the exposure, the size of any regulatory filing and the number of letters that follow remain open questions.

Scale is hard to infer from the outside. TechCrunch cited a 2026 Quest case study in which a single health system with more than 6 million patients could hold hundreds of millions of medical documents and charts, and it noted that how many records Quanum itself holds is unclear. The outlet also listed other 2026 healthcare incidents, among them the mass wiping of employee devices at Stryker in March, a Boston Scientific hack in August that took its network offline for weeks, and breaches at CareCloud, Craneware and McKesson. None of those incidents is tied to Quanum in the reporting, and Quest has not linked its own incident to any of them.

This article was produced with the assistance of AI and reviewed by Morning Overview editors prior to publication.

Tech news in one quick read: Subscribe to TLDR →

We may earn a commission if you sign up.