Quest Diagnostics told the SEC within a day of discovering that an unauthorized party had accessed patient records, but the company has not said how many people are affected or what data was taken.
In an 8-K filing signed Oct 22, 2026, Quest said it learned on Oct 21 of unauthorized access to Quanum Lab Services Manager (LSM), a system that certain clients use to place test orders and look up results. The company said it started incident response procedures, notified federal law enforcement, and engaged external cybersecurity experts.
What Quest has confirmed so far
Quest says an unauthorized party accessed certain patient records. In an incident notice and FAQ updated as of 7:00 pm ET on Oct 23, the company answered “yes” when asked whether protected health information (PHI) or personal information was accessed, while adding that it is still working out which specific data was affected.
The notice describes the incident as contained and remediated, says access was terminated, and says Quanum LSM has been restored and is available to clients. Quest also paused two other platforms, Essential Insights and LabHQ, as a precaution. It says no data was accessed in those systems and both are back online.
- Providers who order through their own lab information system or EMR interfaces were not affected.
- Quest says it is communicating with the appropriate authorities.
- Quest says it will notify affected patients and providers, report to regulators, and offer credit and identity monitoring once the investigation concludes.
- The company says it expects no delays to appointments or result turnaround.
A disclosure that stops short of a material incident
Quest filed the notice under Item 8.01 of Form 8-K, which covers other events, rather than Item 1.05, the item reserved for material cybersecurity incidents. The filing says the incident has not materially disrupted business operations or the company’s ability to serve patients. That leaves room for an updated filing if the scope turns out to be larger. The filing gives no victim count, data types, start date, or details on how the attacker got in.
CFO Sam Samad addressed the incident on the company’s Q3 earnings call on Oct 22, saying the investigation is in its early stages. He did not give a financial impact estimate.
No claim, no attribution, and a PHP denial
No ransomware or extortion group had claimed responsibility at time of publication, and no leak-site listing or ransom demand had been reported. Quest has not said whether data was stolen or encrypted, or whether stolen client credentials played a role. Clients who need a Quanum LSM credential reset were directed to Quest’s IT help desk, but the company has not said how the attacker gained access.
Quest also stated that the incident is not related to a PHP programming language issue. That denial lands in the same week CISA issued a critical alert on PHP vulnerabilities, which CISA said it had not seen successfully exploited at the time of publication.
Quest’s history with patient data incidents
This is at least the 4th patient data incident tied to Quest or its units since 2016.
- 2016: An attacker obtained PHI for about 34,000 people through the MyQuest by Care360 portal, according to Quest’s notice.
- 2019: The billing collections vendor AMCA told Quest that an unauthorized user accessed its systems for months, exposing financial, medical, and Social Security number data. AMCA put the number of Quest patients at about 11.9 million, a figure Quest said it could not verify, per its 8-K.
- 2021: A ransomware attack hit ReproSource, a Quest subsidiary, with about 350,000 patients potentially affected. Quest said its investigation did not confirm any data was taken, per its 8-K.
Unlike the 2019 and 2021 incidents, this one involves a system Quest operates itself, which puts the investigation’s findings on access method and data scope squarely in the company’s hands. Quest had not disclosed the number of affected patients or the data types involved at time of publication.
