Quest Diagnostics learned on 21 October 2026 of unauthorised access to Quanum Lab Services Manager, the system some clinics use to order tests and look up results. The catalog entry was added the same week from the company's SEC 8-K and its public notice. Quest believes some patient records were accessed. It has not published a count or a complete field list. Personal information and patient records were affected, the notice says. Core lab operations kept running. Direct LIS and EMR interfaces used by some providers were not the system that was reached. This post is the missing notice article for that already indexed row, not a second catalog incident.
By 26 October Quest said it had remediated the incident, restored Quanum LSM, and brought back systems that had been paused as a precaution, including Essential Insights and LabHQ, where it said no data was accessed. It is still investigating scope and said it will notify affected patients and providers and report to regulators. Quanum is used by a large set of US clinicians. That installed base is not a victim count.
What happened in the Quest Diagnostics data breach?
Quest's 8-K is short. On 21 October it learned of unauthorised access to Quanum LSM, started incident response, called federal law enforcement, and hired outside experts. At filing time it believed an unauthorised party accessed certain patient records. It said the event had not materially disrupted operations. The start of access is unpublished. No group has been named in Quest's materials.
Quanum LSM is a provider portal, not the consumer results app. The people at risk are patients whose orders and results sat in that portal, plus the clinics that log into it. TechCrunch noted this is Quest's second major patient-data event after the 2019 AMCA billing-vendor breach that hit about 11.9 million people. That 2019 row is already in the catalog as quest-diagnostics2019. Do not add 11.9 million to the 2026 event. The 2026 census is still unpublished.
Healthcare portals with unpublished counts sit next to EyeMed's 19,425-person letter, which at least has a filing total. Quest's letter wave has not started in public at the same level of detail. Watch the HHS OCR breach portal and state AG lists for a number. Until then the catalog stays at zero records, company confirmed.
What data may have been exposed?
Quest says personal information and patient records in Quanum LSM were affected. It confirms PHI and PII were in the unauthorised access. It has not said whether that includes Social Security numbers, insurance IDs, specific test results, or passwords. Order portals typically hold identifiers, test codes, results and sometimes billing data. Do not invent a menu. If you later receive a letter, that letter's field list is the one that counts.
Quest said other named provider tools did not have data accessed even though they were paused. That is a containment statement, not a second breach.
Who is affected?
Patients whose records were in Quanum LSM during the unpublished access window, and the provider organisations that use that portal. If your clinician orders Quest tests through a hospital EMR or a direct LIS, Quest said those interfaces were not the reached system. You can still be in Quanum if the clinic also looks up results there. There is no public tool to look yourself up. Notification is Quest's job as the covered entity.
What should I do?
- Use Quest's notice page and the letter if one arrives. Do not trust a PDF that arrives from a consumer mailbox with a "Quanum password reset."
- Providers who need a credential reset should use the IT Connectivity Help Desk number on Quest's notice, 1-800-697-9302, not a number in unsolicited mail.
- Read lab bills and insurer explanations of benefits for tests you did not take. Medical identity theft often shows up as a claim, not as a drained checking account.
- A credit freeze is reasonable while the field list is unknown. It is essential if a later letter lists an SSN.
- Keep any 2019 AMCA letter separate. That was a billing vendor. This is Quanum LSM in 2026.
The Mavis Tire SSN notice shows what a later state filing looks like when the field list finally lands. Quest is still in the earlier stage.
Frequently asked questions
How many patients were affected?
Unpublished as of the 26 October operations update. The catalog records zero until Quest or a regulator files a census.
Were other Quest systems reached?
Quest said data was not accessed in Essential Insights and LabHQ. Those tools were paused and then restored. Direct LIS and EMR order interfaces were not the system that was reached.
Is this the 2019 Quest / AMCA breach?
No. The 2019 event was a third-party billing vendor and a multi-million patient census. This is Quanum LSM in October 2026.
Did Quest stop drawing blood?
The company said core operations were not materially disrupted. Provider portal access was the interrupted piece.
Has a ransomware group claimed this?
Quest's public materials do not name an actor. Treat leak-site posts as unverified until Quest says otherwise.
Sourcing note: dates and the patient-record finding come from Quest's 8-K and the Quanum notice page, including the 26 October restoration update. The 2019 comparison uses the existing catalog row, not a new census.