VULNpocalypse
HighBreach / campaignOngoing

Quest Diagnostics confirms unauthorized access to Quanum LSM and patient records

Quest Diagnostics says an unauthorized party accessed patient records in its Quanum LSM ordering system; scope and data types are still not confirmed.

Published
Updated
Exploitation
Yes, Quest says an unauthorized party accessed certain patient records in Quanum LSM (SEC 8-K filing)

What happened

Quest Diagnostics learned of unauthorized access to its Quanum LSM system on October 21, 2026, according to its SEC Form 8-K filing. The system is one that certain clients use to place test orders, receive results and look up results. Quest says it started its incident response procedures to contain the activity, notified federal law enforcement and engaged external cybersecurity experts. The filing says the full scope remains under investigation, but the company believes an unauthorized party accessed certain patient records. It also says the incident has not materially disrupted business operations or its ability to serve patients.

TechCrunch reports that Quanum lets doctors’ offices, hospitals and healthcare practices request lab tests while also handling billing, and that the platform stores a large amount of patient health and medical records plus related diagnostic and billing data. According to TechCrunch, Quest’s security notice says some patients’ protected health information was taken, including “personal information and patient records,” but the company is still investigating which specific kinds of data were taken. TechCrunch also reports that Quest’s website says Quanum is used by about half a million clinicians in thousands of locations across North America.

Malwarebytes reports that Quest paused access to the platform and began investigating, and that Quest says it will notify affected patients, healthcare providers and health plans. Malwarebytes says Quest has not specified whether Social Security numbers, insurance identifiers, payment information, particular test results or account passwords were involved.

Not confirmed in the sources:

  • The number of affected patients or clients.
  • When the intrusion began.
  • How the attackers got in.
  • Whether any group has claimed responsibility or made demands. TechCrunch says Quest did not say whether a hacking group has contacted it.

Am I affected?

You may be affected if you are a healthcare provider, hospital or practice that uses Quanum LSM to order tests or view results, or a patient whose tests were ordered through such a client. Quest has not published a count of affected patients or a complete list of the information accessed, so affected status is not confirmed for any individual.

Quest says it will send notification letters to affected patients once its investigation is complete, per Malwarebytes. A breach does not automatically mean your information has been misused.

No CVE, software version or patch is mentioned in the sources. This is a data breach of a hosted service, not a vulnerability you can fix by updating software.

What to do now

  1. Read Quest’s breach notice and its FAQs for updates. Malwarebytes points to the FAQs posted in that notice. TechCrunch notes the notice page carried “noindex” code, so it may not appear in search results; reach it from Quest’s official website.
  2. If you are a client organization, contact your Quest account representative for details on your exposure. The sources do not describe any client-side remediation steps, so treat specifics as not confirmed.
  3. If you receive a notification letter, read it carefully and follow its instructions, including any offered credit and identity monitoring.
  4. Verify unexpected messages about the breach independently. Do not click links, share sensitive information or make payments because of a message. Go to Quest’s official website yourself or use contact details you already trust.
  5. Review medical bills and insurance Explanation of Benefits statements for appointments, tests, prescriptions or services you did not receive, and report discrepancies to your healthcare provider and insurer.
  6. Review your credit reports for unfamiliar accounts or debts and dispute errors. Free reports are available through AnnualCreditReport.com.
  7. If you find signs of identity theft, visit IdentityTheft.gov for a recovery plan. If someone received care in your name, ask the providers involved for copies of your records and request corrections in writing.

Sources