Quest Diagnostics Discloses Patient Data Breach

Quest Diagnostics disclosed unauthorized access to its Quanum Lab Services Manager in a regulatory filing this week. The company said “certain patient records” were among the data accessed. That’s the full confirmed picture for now.

Quanum Lab Services Manager is a client portal that healthcare providers use to place laboratory test orders with Quest. Records handled there include patient identifying information and order data. Quest has not specified whether the breach extended to test results or diagnoses, or whether only ordering metadata was exposed. The distinction matters quite a bit for how many people face downstream risk.

The company has not disclosed when the intrusion was discovered, how long access persisted, or how many patients are involved. Under HIPAA, Quest faces a 60-day notification window after determining the breach’s scope. Individual patient notifications tend to follow the initial regulatory filing by weeks, not days.

Quest is one of the largest clinical laboratory companies in the United States, processing tests for tens of millions of patients annually through a network of physicians, hospitals, and health systems. This is not the company’s first major breach. In 2019, an unauthorized party accessed systems at AMCA, a third-party billing collections vendor Quest used, and exposed data belonging to nearly 11.9 million Quest patients. That incident drew regulatory investigation and resulted in a class-action settlement.

This breach is structurally different: the platform in question is Quest’s own client-ordering infrastructure, not a third-party vendor. Ordering systems hold patient demographics, physician information, and insurance details in addition to test orders. The liability picture and the type of data at risk are both different from a collections-vendor compromise.

SecurityWeek reported the filing on October 23, 2026. Scope details remain unconfirmed.

Organizations using Quanum Lab Services Manager should watch for direct communication from Quest and review access logs for the platform where available. Patients who have had tests ordered through Quest should expect notification letters in the coming weeks and should stay alert to phishing attempts that use the breach as a pretext.

Healthcare sector breaches carry a fixed regulatory timeline whether or not the company is ready to characterize the scope. HIPAA starts the clock at discovery. What “certain patient records” actually means in practice is the open question, and Quest has not answered it yet. When they do, that answer will determine whether this registers as a contained incident or something considerably larger.

Related coverage: Storm-0940 Hits ConnectWise Cloud Backup with AI Attacks | BigCommerce Merchants Breached via Ribon App Credentials | Feds Allege Ransom Negotiator Ran ShinyHunters Site