Quest Diagnostics says patient records exposed in Quanum LSM breach

Past-week coverage · Original source published 2026-10-23.

Quest Diagnostics has confirmed that patient records were exposed after a threat actor gained unauthorized access to its Quanum LSM system, the portal clients use to place test orders and look up results.

In a filing with the U.S. Securities and Exchange Commission, the company said it learned of the unauthorized access on October 21, 2026, and activated its incident response protocol to contain the activity and investigate its nature and scope. It disclosed the breach to the SEC and posted an alert on its website.

Quest says it is still investigating and believes some patient records were exposed, but the types of data affected have not been determined. External experts are assisting, and the company says it has notified law enforcement.

Quanum LSM has been stopped. Quest recommends customers use paper requisitions or Quanum eLabs to place orders and receive results. As a precaution, it also temporarily paused access to other systems, including Essential Insights and LabHQ.

The company says the incident has not disrupted customer-facing operations and that users of direct-customer LIS interfaces or EMRs were not affected. BleepingComputer reported it could not find a threat group claiming the attack.

For healthcare defenders, the case is a reminder that ordering and results portals hold sensitive data and often sit outside the clinical record systems teams watch most closely. Until Quest publishes more detail, affected clients should follow its guidance on alternate ordering channels and watch for phishing that references the outage.