Quest Diagnostics, which operates more than 7,500 locations across the U.S. and Texas, experienced a cyber breach of one of its systems. Upon detection, the company initiated its incident response protocol to contain the activity, and remedial measures have been implemented to prevent further unauthorized access.

On October 22, 2026, Form 8-K filing, the company said the unauthorized access was first identified on October 21, 2026. An investigation has been launched to determine the nature and scope of the unauthorized activity, although the incident appears to be limited to its LSM system, which is used by certain clients to place test orders and receive and look up test results.

Quest Diagnostics, a Secaucus, New Jersey-based diagnostic testing company, has notified the U.S. Securities and Exchange Commission (SEC) that it has identified unauthorized access to its Quantum Lab Services Manager (LSM) system and suspects patient records have likely been compromised. The scale of the data breach has yet to be determined. No threat group appears to have claimed responsibility for the intrusion.

The information involved may include:

• Patient records, including protected health information
• Health and medical records maintained in the Quanum platform
• Associated diagnostic, test-result, and billing data

Third-party cybersecurity experts have been engaged to assist with the investigation, and federal law enforcement authorities have been notified. The incident has not affected the company’s ability to serve patients or impacted its business operations. Companies frequently keep the names of their retained digital forensics and incident response (DFIR) firms confidential during the active phases of a breach investigation.

The hack affected the Quanum Lab Services Manager system (LSM), which doctors can use to place test order and receive results. Per a notice on the Quest Diagnostics website which states, “Upon discovery of the incident, we paused access to the system and we are continuing to investigate the incident. Our core business operations are not impacted and remain up and running. We take privacy and security very seriously and are committed to full restoration of our systems as soon as possible.”

Customers can continue to place orders and receive test results via fax, paper, or direct-customer Laboratory Information System (LIS) interfaces or Electronic Medical Record systems(EMRs). Quest Diagnostics explained that it temporarily paused access to the LSM system while the incident is investigated.

The company said it is working with law enforcement to determine the source of the breach and will identify affected patients and providers.

The specific scope of affected patients is currently under investigation.

DATA BREACH HISTORY

While this newly disclosed 2026 incident involves Quest’s internal Quantum platform, history shows that Quest Diagnostics has frequently been tied to massive third-party vendor data breaches, most notably a devastating 2019 incident involving its collection agency.

In 2019, Quest confirmed that patients’ Protected Health Information (PHI) and personally identifiable information (PII) were compromised. American Medical Collection Agency (AMCA), a third-party billing collections vendor used by Quest was breached by hackers. AMCA’s systems were attacked exposing the data of 11.9 million Quest Diagnostics patients. Financial information (credit cards and bank accounts), and social security numbers were exposed.

The breach was so massive that AMCA’s parent company filed for bankruptcy shortly after, and Quest faced numerous class-action lawsuits regarding third-party vendor oversight.

In 2016, Quest experienced an unauthorized intrusion through a third-party application shortcut on its MyQuest patient portal. Name, date of birth, lab results, and phone numbers for approximately 34,000 individuals was exposed.