Quest Diagnostics Quanum breach hit patient records

Key Takeaways

The system	Quanum Lab Services Manager lets some clients order lab tests and look up results. Quest paused access after it found unauthorized use.
The records	Quest says certain patient records were accessed, including personal information. It has not said how many people are affected or which fields were opened.
The response	The company learned of the access on Wednesday, Oct. 21, 2026, told federal law enforcement, and filed on Thursday, Oct. 22. It says core lab operations kept running.
Still unknown	The filings do not name an attacker, a start date, or a ransom demand. Patient letters, including credit monitoring, are promised after the investigation.

Quest Diagnostics said an unauthorized party accessed certain patient records in Quanum, the system some clients use to order lab tests and look up results. The company learned of the Quest Diagnostics Quanum breach on Wednesday, Oct. 21, 2026, and told federal law enforcement, its Thursday, Oct. 22, filing says.

What the Quest Diagnostics Quanum breach filing says

Quest Diagnostics Incorporated reported the incident in a Form 8-K signed Thursday, Oct. 22, by Sean D. Mersten, vice president and corporate secretary. The Secaucus, New Jersey, company trades on the New York Stock Exchange as DGX. The Form 8-K says certain clients use Quanum LSM to place test orders and to receive and look up results.

The filing says Quest started its cybersecurity response and hired outside experts. "While the full scope of unauthorized access remains under investigation, at this time the Company believes that an unauthorized party accessed certain patient records," the 8-K says. It adds that the incident "has not materially disrupted the Company's business operations or its ability to serve patients."

Reuters moved the filing the same morning Quest posted quarterly results. Citing LSEG, Reuters put third-quarter revenue at $3.10 billion, against an estimate of $3.05 billion, and said the shares fell 3.7 percent to $230 in premarket trading on Thursday, Oct. 22.

What the Oct. 23 notice told patients

A Quest notice timestamped 8:00 a.m. ET on Friday, Oct. 23, 2026, says the company paused Quanum LSM after it found the access and was still investigating. Orders sent through laboratory interfaces and electronic medical records were not affected, the notice says, and core operations kept running. The page still carried that 8:00 a.m. ET timestamp when it was loaded again on Friday, Oct. 23.

Asked whether protected health information or patient-identifiable information was part of the access, the notice answers, "Yes, but we are still investigating to determine the specific data affected." A later answer says that, "based on our investigation to date, personal information and patient records were affected." Quest says that when the review is finished it will write to affected patients and describe credit and identity monitoring. It does not give a head count.

The notice also says the breach is separate from the critical PHP flaws disclosed on Wednesday, Oct. 21. "Based on our investigation, the incident is not related to a PHP programming language issue," Quest wrote. CNBC reported that Quest gave the Associated Press the same account on Thursday, Oct. 22.

Earlier hacks at Quest

CNBC reported two earlier cases involving Quest patient information. In 2016, the company said lab results and contact details for about 34,000 people were exposed. In 2019, personal information for about 11.9 million Quest patients was affected after a hack at American Medical Collection Agency, a billing vendor. TechCrunch called the 2019 case Quest's second known major breach in a decade. This 8-K does not rank the new incident against either one.

TechCrunch described Quanum as a platform that also handles billing. The 8-K and the Oct. 23 notice describe it as a system for placing orders and looking up results. TechCrunch also reported that spokesperson Amanda Rivera did not answer questions and pointed reporters to the notice. That page carries a noindex tag, which asks search engines not to list it.

What the documents leave open

The 8-K and the notice do not name an attacker, say when the access started, or mention a ransom demand. They do not say which data fields were opened. Quest says it will notify regulators and the patients and providers it determines were affected. Until those letters are sent, the company's own account stops at certain patient records.