Quest Diagnostics says patient records in Quanum were accessed

On October 21, 2026, Quest Diagnostics learned of unauthorized access to Quanum Lab Services Manager, the system some clinics use to order lab tests and to receive or look up results. In a regulatory filing that day, the company said it believes an unauthorized party accessed certain patient records. Its notice, updated at 8:00 a.m. ET on October 23, says that access has been paused and that the company is still working out which data, and which people, were involved.

If you have had blood work or other tests through Quest, there is nothing to click today. The company says it will write to patients it determines were affected.

What Quest has said

Quest’s notice says Quanum LSM is the system that was accessed. Clinics that order tests through their own electronic medical record, or through a direct interface, were not on that path and can keep ordering as usual. Quest says no data was accessed in Essential Insights or LabHQ, and that it paused those tools anyway while it investigates.

The notice says personal information and patient records were affected, and that protected health information and identifiable information were part of the access. It also says the investigation has not yet determined the specific data. The October 21 filing, reported by the Associated Press, uses the same limit: certain patient records, full scope still under investigation, federal law enforcement notified, outside experts brought in, and day-to-day lab operations not materially disrupted.

Quest has not published a count of patients or clinics. It says it is not tying this incident to the separate warnings about urgent PHP updates.

What to do if you are a patient

1. Wait for a letter from Quest, not a link. The company says it will notify affected patients as required by law, and that those letters will describe resources, including credit and identity monitoring. A text or email that asks you to “confirm” your date of birth, insurance number, or a payment is not that letter.
2. Don’t call a number from an unexpected message. Quest has posted the incident page itself. If someone phones you about this breach and asks for personal or financial details, hang up and use a number you already have for your clinic or for Quest.
3. Your clinic may already be working around the outage. Quest says Quanum LSM clients can use paper requisitions or Quanum eLabs in the meantime, and that it does not expect delays for clinics that never used Quanum LSM. If you are waiting on a result, ask the office that ordered the test. They can see whether their ordering path was affected.
4. A credit freeze is reasonable while the details are unknown. Quest has not said that Social Security numbers or card numbers were taken. Health records plus a name and date of birth are still enough for a convincing scam. Freezing your credit file at Equifax, Experian, and TransUnion stops most new accounts from being opened in your name until you lift the freeze. It does not affect your existing cards.

How Frame helps

Frame keeps a catalog of known breaches and lets you add the ones you know you were part of to a verified email. Frame shows what each one exposed, gives you a short checklist, and counts it in your exposure report. Automatic breach lookups aren’t live yet. We never collect or store the leaked records themselves.

Sources

• Quest Diagnostics, An update on an incident involving one of our systems, October 23, 2026
• Associated Press, Quest Diagnostics hit by a cyber breach, with patient records likely accessed, October 22, 2026
• TechCrunch, Lab testing giant Quest Diagnostics confirms patients’ personal and health data was compromised during breach, October 23, 2026