Quest Diagnostics reports unauthorized access to Quanum patient records; scope remains unknown
Quest discovered unauthorized access to Quanum LSM on October 21 and disclosed it on October 22. It believes patient records were accessed, but has not established affected-patient totals or exact data fields. Quest confirmed service restoration on October 23; the data-scope investigation continues.
- Disclosed
- Oct 22, 2026
- Updated Oct 24, 2026
- Severity
- Septic Tank Blew
- No CVE: a breach, not a bug
- Splash zone
- Patient data in Quanum LSM; direct customer LIS / EMR interfaces are unaffected according to Quest
- Quest Diagnostics · healthcare · data breach
- In the wild
- Not applicable
- Unauthorized access confirmed; record scope is still being investigated
What happened
L4 reflects a confirmed intrusion into a major healthcare service and the vendor’s assessment that patient records were accessed. It does not establish a mass-victim count. The attack method, exact records and number of affected people remain unknown. This is a separate incident from Quest’s older breaches.
Essential Insights and LabHQ were paused as a precaution; Quest says no data was accessed there. Its October 23, 19:00 ET update confirms that LSM and these systems have been restored. This supersedes the earlier tentative restoration estimate; it does not establish the full scope of patient-record access.
Crime-scene timeline
Oct 21, 2026
Quest discovers unauthorized Quanum LSM access
The company initiates containment and an investigation with external specialists.
Oct 22, 2026
Quest discloses the incident in an SEC filing
Certain patient records were likely accessed; the company reports no material business disruption.
Oct 23, 2026
Client notice confirms restoration and ongoing data investigation
At 19:00 ET (23:00 UTC), Quest says LSM and precautionarily paused systems are restored. PHI / PII scope remains under investigation; the incident is unrelated to PHP.
Who said what
We list each claim and who made it. Primary sources (the vendor, the researcher, the registry) are marked. Where reports disagree, we grade by the worst credible case.
- Quest Diagnostics SEC Form 8-KPrimaryOctober 21 discovery; patient-record access believed; investigation ongoing; signed October 22
- Quest Quanum notice and FAQsPrimaryOctober 23 19:00 ET update confirms LSM, Essential Insights and LabHQ restored; PHI / PII scope remains under investigation and direct LIS / EMR interfaces were unaffected
- SEC filing indexFiled October 22, establishing disclosure date rather than discovery date