Quest Diagnostics says an unauthorized party accessed certain patient records in Quanum Lab Services Manager, the system some of its clients use to order lab tests and look up results, and that it learned of the access on October 21, 2026. In the Quest Diagnostics breach, the company paused the system, shut off two neighboring tools as a precaution and moved affected clients to fax and a separate portal. It has not said how many patients are affected or which specific data was taken.
The Quest Diagnostics Breach Was Reported in an 8-K Filed Under Item 8.01
Quest disclosed the incident in a Form 8-K filed with the US Securities and Exchange Commission and signed on October 22 by Sean D. Mersten, vice president and corporate secretary. The filing says Quest started its incident response procedures, notified federal law enforcement and brought in outside cybersecurity experts. It says the incident has not materially disrupted Quest’s operations or its ability to serve patients, and it does not say whether Quest has judged the incident itself to be material. Quest filed the report under Item 8.01, “Other Events.” The SEC’s 2023 rules require material cybersecurity incidents to be reported under Item 1.05. In a May 21, 2024 statement, Erik Gerding, then director of the SEC’s Division of Corporation Finance, encouraged companies to use another item, such as 8.01, for incidents not yet found material, and said a later finding of materiality calls for an Item 1.05 filing within four business days.
Quest Paused Quanum LSM and Two Other Systems to Contain the Access
Quest’s incident notice, updated as of 8 a.m. Eastern on October 23, says the company paused access to Quanum LSM once it confirmed the intrusion and that the unauthorized access has stopped. It also paused Essential Insights and LabHQ, two other Quest systems, while stating that no data in them was accessed. The notice confirms that protected health information and personally identifiable information were part of the access, and says Quest, as the covered entity, will notify affected patients and providers as the law requires. Quest also says the incident is unrelated to the PHP vulnerabilities that federal officials have urged companies to patch.
Doctors Kept Ordering Tests Through Fax, eLabs and Their Own EMRs
Quest says its core business operations kept running after Quanum LSM went offline, and its notice lists the ordering channels that did not depend on the system. Providers that order through their own electronic medical records or direct lab interfaces were unaffected, according to the notice. Quanum LSM users were told to fax paper requisitions to their local patient service center, to get results by phone or eFax, or to use Quanum eLabs, a separate portal. Quest says Quanum LSM is redirecting clients to eLabs, where they sign in with the same credentials. Its FAQ anticipated full service returning as soon as October 23. TechCrunch’s Zack Whittaker reported that Quest’s own materials describe Quanum as used by about half a million clinicians across North America, and that Quest lost 11.9 million patient records in 2019 through an attack on a third-party billing company.
Why This Matters for Engineering Leadership
Quest’s first containment step was to take a customer-facing system offline, and the notice could immediately point clients to ordering channels that did not depend on it. That kind of option has to exist before an incident. For every system that holds sensitive data, engineering leaders should settle three questions in advance: who has the authority to take it offline, which adjacent systems get paused with it, and what customers use while it is down. Fallback paths deserve their own security review. Quest has not said how the intruder got in, and where a fallback accepts the primary system’s credentials, any decision to rotate those credentials has to cover both. The second lesson is scope. Two days after discovery, Quest could confirm that patient records were accessed but not how many. How quickly a team can answer that question depends on whether its systems log which records each session read, and that answer feeds the materiality decision behind any Item 1.05 filing. For another breach where containment depended on prior preparation, see our report on the Railway breach and secret rotation.
FAQ
What happened in the Quest Diagnostics breach?
An unauthorized party accessed Quest’s Quanum Lab Services Manager system, which clients use to order tests and look up results. Quest says certain patient records were accessed and learned of the access on October 21, 2026.
What patient data was taken from Quest Diagnostics?
Quest says protected health information and personally identifiable information were part of the access. It is still investigating which specific data was affected.
How many patients are affected by the Quest breach?
Quest has not said. It states it will notify affected patients and providers as required by law once its investigation identifies them.
Is the Quest Diagnostics breach related to the PHP vulnerabilities?
No. Quest’s incident notice says its investigation found the incident is not related to a PHP programming language issue.
Can doctors still order tests from Quest?
Yes. Providers ordering through their own EMRs or direct lab interfaces were unaffected, and Quanum LSM users can fax paper requisitions or use the Quanum eLabs portal.