Quest Diagnostics disclosed in an Oct. 22, 2026 SEC filing that it learned on Oct. 21 of unauthorized access to Quanum LSM, a system its clients use to order tests and look up results. Its own incident notice now says personal information and patient records were affected. If you have had lab work done, here is what to do.
What Quest has said
According to the filing:
- Quest learned of the access on Oct. 21, 2026.
- It started its incident response process, notified federal law enforcement and brought in outside cybersecurity experts.
- It believes an unauthorized party accessed "certain patient records," and says the full scope "remains under investigation."
- It says the incident has not materially disrupted its business operations or its ability to serve patients.
Quest's notice, dated as of 8:00 a.m. ET on Oct. 23, adds:
- It paused access to the system, and its FAQ says "there is no more access to the system."
- Providers who order through direct lab-system interfaces or their own EMR can keep placing orders there; those interfaces were not affected. Core operations are up and running.
- Quest's patient FAQ says it "believes patient data may have been affected," and that "based on our investigation to date, personal information and patient records were affected." It is still working out the specific data.
- Quest says it will notify affected patients as required by law. After the investigation ends, it will send letters describing resources "including credit and identity monitoring." It gives no date for the letters.
- The notice lists no patient call line. The phone number it gives is for providers, not patients.
What is not known yet
- Which data fields. Beyond "personal information and patient records," the notice does not say whether it was names, contact details, insurance or billing data, test results or something else.
- How many people are affected. Neither the filing nor the notice gives a count.
- When letters will go out. Quest gives no date.
- When the access began. The filing gives only the date Quest learned of it.
What to do
The exposure cannot be undone, but these steps can reduce the risk of misuse.
- Watch for a letter from Quest in the mail. Quest says it will describe credit and identity monitoring. Read its notice and Patient FAQs by typing the questdiagnostics.com address yourself rather than following a link in a message.
- Ask your doctor's office. Quest runs tests for many clinics, so you may not know your sample went to Quest. Ask whether they use Quest and Quanum.
- Read your insurer's explanation of benefits. Look for claims, providers or services you do not recognize, and report them to your insurer.
- Freeze your credit. A freeze is free and blocks new credit accounts from being opened in your name. You can lift it when you need credit. Freeze at Equifax, Experian and TransUnion. If you would rather not freeze, a fraud alert is a lighter option.
- Expect phishing that mentions the breach. Messages claiming to be from Quest, a lab or your insurer may ask you to "verify" details or pay a bill. Do not click; call the number on your card or statement. Our checklists on scam protections in Google Messages and Chrome's suspicious-site warning can help.
- Do not share personal details with callers who contact you first, even if they know you had a lab test.
The notice does not list Social Security numbers, financial data or test results as involved, and does not rule them out, so do not assume either way. We will update this story if Quest says more.
Why it matters
Lab records tie your identity to health and billing details, and they cannot be changed the way a password can. Until Quest says which data was reached, a credit freeze and watching your insurance statements are the practical protection.
