Quest Diagnostics discloses breach of its Quanum LSM lab-ordering platform

On 23 October 2026, Quest Diagnostics Incorporated — the Secaucus, New Jersey-based clinical laboratory company and one of the largest diagnostic-testing providers in the United States — disclosed in a filing with the U.S. Securities and Exchange Commission that an unauthorized party had accessed its Quanum LSM platform, the online system that certain clients use to place test orders and to receive and look up results. The company said it learned of the unauthorized access on 21 October 2026 and currently believes that the intruder accessed certain patient records, while cautioning that the full scope remains under investigation.

According to Quest's 8-K, the company "promptly initiated its cybersecurity incident response procedures to contain the activity" and "engaged external cybersecurity experts to assist in the investigation and response." Quest also notified federal law enforcement authorities. The filing states that the incident "has not materially disrupted the Company's business operations or its ability to serve patients," and it does not specify how many patients were affected, what types of records were accessed, or when the unauthorized access began.

Systems taken offline

As a precaution, Quest said it paused access to the affected Quanum LSM system and advised clients to use alternative ordering methods — such as paper requisitions or its Quanum eLabs interface — while the investigation continued. The company indicated that users of direct laboratory-information-system interfaces and electronic medical records were not affected by the disruption.

Open questions

With the number of affected patients, the categories of exposed data, and the intrusion's origin all still undetermined, and no threat group having publicly claimed the attack at the time of disclosure, the incident's status is ongoing. Quest has a history of large third-party exposures: in 2019, a breach at its billing-collections vendor AMCA exposed data tied to roughly 11.9 million Quest patients, spawning litigation that remained unresolved years later. The 2026 incident is a separate event centred on Quest's own Quanum LSM platform rather than a vendor system.