Quest Diagnostics Says Hackers Accessed Patient Records in Its Lab Ordering System: What Patients Should Know

Quest Diagnostics, one of the country’s largest medical testing companies, says hackers got into a system doctors use to order lab tests and look up results, and that patients’ personal information and records were accessed.

The New Jersey-based company disclosed the breach in a filing with the Securities and Exchange Commission on Thursday, Oct. 22. Quest said it learned of the unauthorized access the day before, on Oct. 21, notified federal law enforcement and hired outside cybersecurity experts to investigate. It has not said how many patients are affected or what types of information were taken.

By Friday evening, Quest said it had shut out the intruders and restored the system. The investigation into what was taken is continuing, and the company says it will notify patients once it knows who was affected.

What did Quest disclose about the breach?

The system involved is Quanum Lab Services Manager, or Quanum LSM. Doctors’ offices, hospitals and other clients use it to place test orders and receive and look up results. Quest’s website says the Quanum platform is used by about half a million clinicians, TechCrunch reported, though the company has not said how many records the affected system holds.

In its SEC filing, Quest said that “at this time the Company believes that an unauthorized party accessed certain patient records.” A notice on the company’s website, updated at 7 p.m. ET on Oct. 23, goes further, saying that based on the investigation so far, “personal information and patient records were affected.” Asked whether protected health information or personally identifiable information was involved, Quest’s answer in its provider FAQ is: “Yes, but we are still investigating to determine the specific data affected.”

Quest has not said when the intrusion began, how the attackers got in, or whether anyone has demanded a ransom.

Were Quest’s labs and test results disrupted?

Quest says its core operations were not affected. Patients could still get tested at its locations, and doctors who order tests through their own electronic health record systems or lab interfaces could keep doing so, because those connections were not part of the breach.

As a precaution, Quest temporarily paused two other client systems, Essential Insights and LabHQ, though it says no data in them was accessed. All of the systems have since been restored, according to the company. Clinics that need to reset their Quanum passwords are being directed to Quest’s IT help desk, which the company warned has longer-than-usual wait times.

Has Quest been hacked before?

Yes. In 2019, personal information belonging to about 11.9 million Quest patients was exposed in a breach at American Medical Collection Agency, a billing collections vendor Quest used. In 2016, the company said lab results and contact information for about 34,000 people were exposed in a separate online breach.

The new incident adds to a difficult year for health care cybersecurity. Medical device makers Stryker and Boston Scientific were hit by cyberattacks earlier in 2026, and hackers have claimed to steal patient records from drug distributor McKesson, TechCrunch has reported. At least one proposed class-action lawsuit over the Quest breach was filed in federal court on Oct. 23, according to a law firm that posted the case details.

What should Quest patients do now?

For now, Quest is not asking patients to take any action, and it says it will send notification letters to affected patients once its investigation is finished. Those letters will describe the help available, including credit and identity monitoring, the company says. Under federal HIPAA rules, health care organizations generally must notify affected patients without unreasonable delay and within 60 days of discovering a breach.

In the meantime, patients who have had lab work done through Quest can take a few basic steps:

• Read your health insurance and Medicare statements, and report any tests, visits or equipment you did not receive.
• Be wary of calls, texts or emails claiming to be from Quest or your doctor that ask for your Social Security number, insurance details or payment.
• Consider a free credit freeze with Equifax, Experian and TransUnion if you are worried about identity theft.
• If you spot misuse of your information, report it and get a recovery plan at the Federal Trade Commission’s IdentityTheft.gov.

Patient information is valuable to fraudsters because it can be used to bill insurers for care that never happened. HNC recently covered a $1.8 billion health care fraud takedown in Los Angeles in which prosecutors described schemes that billed for treatment that was unnecessary or never provided.

Key Takeaways

• Quest Diagnostics says hackers accessed its Quanum Lab Services Manager system, which doctors use to order lab tests and view results.
• The company learned of the breach Oct. 21, disclosed it to the SEC on Oct. 22, and says personal information and patient records were affected.
• Quest has not said how many patients were affected. It says it will notify them by letter and offer credit and identity monitoring.
• Testing and Quest’s core operations continued, and the affected system was restored by the evening of Oct. 23.
• Patients should watch insurance statements for unfamiliar charges and be cautious of calls or messages asking for personal information.

Frequently Asked Questions