Quest Diagnostics data breach: patient records accessed through the Quanum LSM ordering system in October 2026

Date	Event
October 21, 2026	Quest learns of unauthorized access to Quanum LSM
October 22, 2026	Form 8-K, Item 8.01, filed with the SEC
October 26, 2026, 8:00 a.m. ET	Quest's notice says the incident is remediated and Quanum LSM is restored
November 14, 2026	No Quest notice yet on the California or Washington attorney general lists

What happened in the Quest Diagnostics breach?

The 8-K says Quest started its incident response procedures to contain the activity and investigate its scope. It told federal law enforcement and brought in outside cybersecurity experts. The filing says the incident did not materially disrupt Quest's business or its ability to serve patients.

Quest's notice page fills in the next days. As of 8:00 a.m. Eastern on October 26, 2026, Quest says it had remediated the incident and securely restored Quanum LSM for clients. It says it ended the unauthorized access and contained the incident. Two other client systems, Essential Insights and LabHQ, were paused as a precaution. Quest says no data was accessed in them, and both have been restored. Providers who order through their own lab information system or electronic medical record interfaces were not affected.

The filing went in under Item 8.01, the item for other events, not Item 1.05, which a company uses for a cybersecurity incident it has judged material. The guide to Item 8.01 versus Item 1.05 explains the difference, and health data in 8-K cyber filings compares how other health companies have described the same kind of event. Two weeks later another laboratory company, Myriad Genetics, filed its own Item 8.01 report after detecting unauthorized access on November 2, 2026 (the Myriad Genetics entry).

What information was taken in the Quest breach?

Quest has not yet said which data fields were involved. Its patient FAQ says that, based on the investigation so far, personal information and patient records were affected. Asked directly whether protected health information (PHI) or personally identifiable information was part of the access, Quest answers yes and says it is still working out the specific data. It says the patient data was within Quanum LSM and that other systems were not affected.

How many people were affected?

That is not known yet. The Associated Press reported on October 22 that how many patients and which records were affected was still unknown. When this page was checked on November 14, 2026, neither the California attorney general's list nor the Washington attorney general's list carried a Quest Diagnostics notice. This entry will add the count when a regulator records it.

When will Quest notify patients?

Quest calls itself the covered entity and says it will make notifications as required by law. The HIPAA rule requires a covered entity to notify each affected person without unreasonable delay and no later than 60 calendar days after it discovers a breach. If October 21, 2026, the day Quest learned of the access, is also the day the breach counts as discovered, 60 calendar days runs to December 20, 2026. The HIPAA Breach Notification Rule entry explains the clock and the HHS report. Quest says the letters will describe the help on offer, including credit and identity monitoring. What healthcare data breach letters tell patients shows what such letters usually contain.

Is the Quest breach related to the PHP vulnerabilities?

No, according to Quest. Its notice says the incident is not related to a PHP programming language issue. The AP reported the same answer from Quest on October 22. Quest's FAQ puts the question that way because federal officials had been urging firms that use PHP to make urgent security updates.

What should Quest patients and providers do now?

Quest warns that phishing and voice-phishing attempts can follow an incident. It asks patients and providers to check any message about lab services or Quest, including breach-notification, credit-monitoring or settlement scams. Providers who need their Quanum LSM credentials reset are told to call the IT Connectivity Help Desk at 1-800-697-9302. Results for orders placed through Quanum eLabs are also available in Quanum LSM.

Has Quest Diagnostics had a data breach before?

Yes. In June 2019, Quest said that American Medical Collection Agency (AMCA), a billing collections provider working for its contractor Optum360, had reported unauthorized access to AMCA's system. AMCA told Quest the affected system held information on approximately 11.9 million Quest patients, but not laboratory test results. The AP also recalls a 2016 breach that exposed lab results and contact details of about 34,000 people. The 2026 incident is different from both: by Quest's account it involved Quest's own Quanum LSM system, not a vendor's. The largest healthcare data breaches of 2026 reported to HHS will show where this one ranks once Quest files its HHS report.