Quest Diagnostics has confirmed a major cybersecurity breach involving sensitive patient information, but the company still cannot say how many people were affected or exactly what medical records were exposed.
The Quest Diagnostics breach became public after the company disclosed unauthorized access to its Quanum Lab Services Manager system, a platform healthcare providers use to order laboratory tests and retrieve patient results.
According to a filing with the U.S. Securities and Exchange Commission, Quest discovered the unauthorized access on Wednesday, October 21, 2026. The company reported the incident to federal regulators the following day and acknowledged that an unauthorized party had accessed “certain patient records.”
By Friday, October 23, the situation had become more concerning. In an official security notice, Quest confirmed that protected health information and personally identifiable information were involved. The company also acknowledged that “personal information and patient records” were affected, although investigators have not determined the specific information compromised.
That leaves patients facing serious unanswered questions about their privacy.
Quest has not disclosed the number of affected individuals, which healthcare organizations were impacted, or how long the unauthorized access may have continued before discovery. The company has also not publicly established whether the accessed records were downloaded, distributed, or used for fraudulent activity.
For anyone who has undergone bloodwork, medical screenings, or other diagnostic testing through Quest, the uncertainty creates an immediate concern. However, receiving services from Quest does not automatically mean a patient’s information was involved in this incident.
The affected Quanum system plays an important role in everyday medical care. According to Quest’s description of its laboratory services platform, physicians, hospitals, and medical office employees use the technology to submit testing requests, monitor orders and review laboratory results.
That connection to patient care makes the breach particularly sensitive. Depending on which records were accessed, medical information can potentially reveal private details about someone’s health, testing history, or treatment. Quest has not confirmed that any particular diagnosis, laboratory result or category of sensitive medical information was taken.
The possible consequences extend beyond personal embarrassment or unwanted disclosure.
According to the Federal Trade Commission, stolen medical information can be used in identity theft schemes, including attempts to obtain healthcare services or submit fraudulent insurance claims under another person’s identity.
The agency warns that victims may discover suspicious medical bills, unfamiliar insurance claims, or incorrect information appearing in their health records. Such problems can become especially complicated when inaccurate records affect future medical treatment.
Patients should also remain alert to suspicious messages claiming to come from Quest, their doctor’s office, or an insurance company. The FTC advises consumers not to provide medical information to unexpected callers or through unfamiliar email and text links. Instead, patients should contact healthcare organizations using verified contact information.
Meanwhile, Quest says it has taken steps to contain the intrusion.
Its regulatory filing confirms that federal law enforcement authorities were notified and outside cybersecurity specialists were brought in to investigate. The company also activated its incident response procedures to determine the scope of the unauthorized activity.
Quest temporarily suspended access to Quanum Lab Services Manager. Its official notice states that other systems, including Essential Insights and LabHQ, were also temporarily paused as a precaution, although the company reported no unauthorized data access in those systems.
Healthcare providers who normally rely on the affected platform were directed to use paper requisitions or Quanum eLabs while restoration efforts continued. Quest said other electronic systems used by healthcare providers to order testing were unaffected.
The company maintains that its core business operations remain functional and that its ability to serve patients has not been materially disrupted.
However, keeping laboratory services operational does not resolve the questions surrounding patient privacy.
Quest’s online security notice contained a “noindex” directive, which instructs search engines not to display the page in search results. That could make the company’s explanation harder for concerned patients to discover through ordinary searches.
The incident comes during another difficult year for healthcare cybersecurity.
In August, medical device manufacturer Boston Scientific disclosed a cyberattack that caused “global disruption” to its operations, according to the company’s SEC filing. The incident interfered with business applications and the processing and shipment of medical products.
Earlier in March, medical technology company Stryker also experienced a major cybersecurity incident that interrupted portions of its operations. These separate incidents illustrate how attacks against healthcare companies can create both operational problems and concerns about sensitive information.
Quest also has a troubling history involving patient data.
In June 2019, the company disclosed a security incident involving American Medical Collection Agency, a third-party billing collections provider. Information associated with approximately 11.9 million Quest patients was potentially exposed.
At the time, the company said the affected information could include Social Security numbers, financial records, and other personal medical information, although laboratory test results were not involved in that incident.
The latest Quest Diagnostics breach involves a different system, and investigators have not announced a comparable number of affected patients.
For people concerned about the current incident, monitoring medical billing statements and insurance explanations of benefits can help identify unfamiliar activity. The FTC also recommends reviewing credit reports and considering additional identity protections when sensitive personal or financial information has been compromised.
Quest says it will notify individuals determined to have been affected in accordance with applicable law. The company also plans to send notification letters explaining available resources, including credit and identity monitoring.
