American clinical laboratory company Quest Diagnostics disclosed that patient records have been exposed after a threat actor gained unauthorized access to its Quanum LSM system.
The company learned about the breach on October 21 and deployed its incident response protocol "to contain the activity, assess and investigate the nature and scope of the incident and implement appropriate remedial measures."
“On October 21, 2026, Quest Diagnostics Incorporated learned of unauthorized access to its Quanum LSM system, which certain clients use to place test orders, receive and look up results,” the company says in a filing with the U.S. Securities and Exchange Commission (SEC).
Quest Diagnostics is a major clinical laboratory company in the United States, providing diagnostic testing and services for a wide range of medical conditions.
It operates 7,700 points across North America, employs 65,000 people, and generates more than $11 billion in annual revenue. The company says it serves one in three U.S. adults each year.
Quanum LSM (Lab Services Manager) is the firm’s online platform that physicians, hospital personnel, and medical office staff use to manage laboratory services, access test results, track status, and order supplies.
The company disclosed the breach to the SEC and provided more information in an alert on its website.
The company is still investigating the incident but believes some patient records were exposed. The types of data affected have yet to be determined.
External experts are aiding the ongoing investigation, and Quest Diagnostics has also informed the applicable law enforcement authorities.
The company says that the incident has not disrupted its customer-facing operations and users of direct-customer LIS interfaces or EMRs were not impacted.
As a cautionary measure, Quest Diagnostics has temporarily paused access to other systems, including Essential Insights and LabHQ.
Currently, the Quanum LSM system has been stopped, and customers are recommended to use paper requisitions or Quanum eLabs to place orders and receive results.
As of writing, BleepingComputer could not find a threat group claiming the attack on Quest Diagnostics.
In 2019, data of about 11.9 million Quest Diagnostics patients was compromised in a breach at billing collection provider American Medical Collection Agency (AMCA).
Following the disclosure, at least 19 class-action lawsuits were filed against Quest Diagnostics. The cases were consolidated into multidistrict litigation, which remains ongoing and unresolved.
Once attackers have valid credentials, only 37% of their actions are blocked
Overall prevention scores can hide what happens after initial access. Once attackers are using valid credentials, prevention drops sharply.
The Blue Report 2026 measures defenses technique by technique across 338 million simulations run in customer production environments.