Quest Diagnostics Data Breach: Unauthorized Party Accessed Patient Records in Lab Ordering System. What Patients Need to Know

Quest Diagnostics, a national lab testing company, says someone got into a system that doctors use to order lab tests and look up results. The company believes patient records were accessed.

What Quest Diagnostics Has Disclosed

On October 21, 2026, Quest Diagnostics Incorporated learned of unauthorized access to its Quanum LSM system. The next day, the company reported the incident in a Form 8-K filing with the U.S. Securities and Exchange Commission (SEC). A Form 8-K is a public report that publicly traded companies file to announce major events.

According to the filing, Quest started its cybersecurity incident response plan, notified federal law enforcement and hired outside cybersecurity experts. The company states that the full scope of the access is still under investigation. Even so, Quest believes an unauthorized party accessed certain patient records.

Quest also states that the incident has not materially disrupted its business operations or its ability to serve patients.

Source: Quest Diagnostics Form 8-K, filed October 22, 2026 (SEC)

Why Patients May Not Know They Used This System

Quanum LSM is not a patient app. According to Quest’s filing, certain Quest clients use the system to place test orders and to receive and look up test results. In practice, that means a doctor’s office, clinic or other provider may have sent a patient’s lab order through this platform without the patient ever logging in or seeing it.

This matters because affected patients may not realize their information was in the system at all. Quest has not named which clients use Quanum LSM or which client accounts were involved.

Quest has not disclosed how many people were affected. The 8-K gives no count, and no state attorney general or federal health regulator filing for this incident has been located as of October 22, 2026.

What Information Was Exposed?

Quest has not yet said what types of information were involved. The 8-K refers only to “certain patient records.” It does not list specific data fields, such as names, dates of birth, Social Security numbers, insurance information or test results.

Lab ordering and results systems typically handle information like patient names, test orders and results. However, Quest has not confirmed which of these, if any, were in the accessed records. This post will be updated when Quest or a regulator releases the actual list.

What Is Quest Diagnostics Offering Affected Patients?

Quest has not announced credit monitoring, identity protection or any other services for affected patients. The company also has not described when or how it will notify individuals. Anyone who receives a notice letter should read it closely for any enrollment instructions and deadlines.

Your Information Is at Risk

Patient records from a lab can be sensitive. Depending on what was taken, they may tie a person’s identity to their health information, insurance details or medical history. Criminals can misuse this kind of data for medical identity theft, which means using someone else’s identity to get medical care, prescriptions or insurance payments. They can also use it to make phishing messages (fake emails, texts or calls) look more believable.

Quest has not reported any misuse of patient data. Still, Quest patients may want to take these steps:

• Review Explanation of Benefits (EOB) statements from your health insurer for services you did not receive.
• Watch for emails, texts or calls that mention Quest Diagnostics or this incident and ask for personal or payment information.
• Check your credit reports for free at AnnualCreditReport.com.
• Consider placing a fraud alert or credit freeze with Equifax, Experian and TransUnion.
• Keep any notice letter you receive from Quest Diagnostics.

Do You Have Legal Options?

Healthcare companies that collect and store patient information have a legal duty to protect it. When that duty is not met, affected individuals may have legal rights and remedies. Emery | Reddy is investigating the Quest Diagnostics data breach on behalf of patients whose information may have been accessed.

Contact the Data Breach Attorneys at Emery | Reddy today for a Free Case Review.

Your Personally Identifiable Information (PII) includes information that can be used to identify you, such as your name and other personal details. Organizations that manage healthcare data are legally required to safeguard this information. When PII is exposed in a data breach, it can potentially be used by cybercriminals to commit identity theft, financial fraud, or other misuse.

Much of the information involved in this incident may also qualify as Protected Health Information (PHI). PHI includes medical or healthcare-related data protected under federal and state privacy laws. When PHI is compromised, it can be misused for medical identity theft or insurance fraud.

Frequently Asked Questions

How many people were affected by the Quest Diagnostics data breach?

Quest has not said. Its SEC filing gives no number and says the full scope is still under investigation. A count may come later in a federal or state regulator filing.

What information was exposed?

Quest has only said that “certain patient records” were accessed. It has not listed the specific types of information. If you get a notice letter, it should list what was involved for you.

I never used Quanum. Could my information still be involved?

Possibly. Quanum LSM is used by Quest’s clients, such as healthcare providers, to order tests and get results. If your provider sent your lab order through Quest, your information may have been in the system even though you never logged in yourself.

When will I find out if my information was involved?

Quest has not announced a notice date. Under federal HIPAA rules, a healthcare provider generally must notify affected patients without unreasonable delay and no later than 60 days after discovering a breach. Quest says it learned of this incident on October 21, 2026.

What should I do right now?

• Save any letter or email you get from Quest Diagnostics about this incident.
• Review insurance statements for care you did not receive.
• Check your credit reports at AnnualCreditReport.com.
• Consider a fraud alert or credit freeze.
• Call Emery | Reddy at 206.207.8929 for a free case review.

How can I protect myself from scams that mention this breach?

Scammers often use news of a real breach to make fake messages look official. Be careful with any call, text or email that mentions the breach and asks you to:

• Confirm your Social Security number, insurance ID or date of birth
• Click a link to “check” whether you were affected
• Pay a fee to receive protection services

When in doubt, contact the company using a phone number or website you already know is real.

Why is a medical data breach different from other breaches?

You can cancel a credit card, but you cannot change your medical history. Health information can be used for medical identity theft, insurance fraud or targeted scams. Errors from medical identity theft can also end up in your health records, which can affect future care.

Do I have a legal claim?

You may. Healthcare companies have a duty to protect patient information and to tell patients promptly when it is exposed. If Quest Diagnostics did not meet those duties, you may be entitled to compensation. Contact Emery | Reddy at 916.995.5968 or visit emeryreddy.com for a Free Case Review to see what you may qualify for. No Fee Unless We Recover.