Quest Diagnostics says someone got into the online system many medical and dental offices use to order lab tests and pull up results. In a Form 8-K filed with the SEC on Oct. 22, 2026, Quest said that on Oct. 21 it "learned of unauthorized access to its Quanum LSM system, which certain clients use to place test orders, receive and look up results."
Quest has since posted a notice on its website and an FAQ for customers. If your office logs in to Quanum, here's what Quest has said and what we'd do this week.
What Quest has confirmed
- The system involved: Quanum LSM, which Quest describes as the system clients use to place test orders and to receive and look up results (8-K).
- Patient records: "While the full scope of unauthorized access remains under investigation, at this time the Company believes that an unauthorized party accessed certain patient records" (8-K). In its customer update, as reported by Fox Business and others, Quest said protected health information or personally identifiable information was involved. It hasn't said what data, or how many people.
- Access paused: Quest's website notice says that when it discovered the incident, "we paused access to the system." Quest told customers it also paused its Essential Insights and LabHQ systems as a precaution and says no data was accessed in those two, according to Fox Business.
- Response: Quest says it started its incident response procedures to contain the activity, notified federal law enforcement, and brought in outside cybersecurity experts (8-K).
- Operations: Quest says the incident "has not materially disrupted" its business or its ability to serve patients (8-K), and that providers ordering through direct LIS interfaces or EMRs can keep doing so (website notice).
- Workarounds: Quest is directing Quanum LSM users to paper requisitions sent by fax, or to Quanum eLabs using their existing username and password (Cybernews). As of Thursday, it expected full functionality back as soon as Friday, Oct. 23 (Fox Business). Quest also told the AP the breach was not related to the recently disclosed PHP vulnerabilities.
Quest hasn't said how the unauthorized party got in, whose records were involved, how many, or whether any client logins played a part. No group had claimed the incident as of Thursday afternoon, The Record reported. We won't guess. Until Quest says more, your office's Quanum accounts are worth checking.
Step 1: Clean up who has a Quanum login
Lab portals collect accounts over the years: a front-desk hire from three years ago, a temp, a shared "frontdesk" login everyone knows. Each one is a door. And because Quest says the same username and password work on Quanum eLabs during the outage, an old login that still works isn't limited to one system.
- Pull the list of every user your office has in Quanum. Whoever administers your office's account should be able to see it.
- Disable anyone who no longer works for you. Today, not at the next staff meeting.
- Replace shared logins with named, one-person accounts so you can tell who did what.
- Have current users change their Quanum passwords once Quest's systems allow it, especially anyone who reuses that password elsewhere.
Step 2: Confirm MFA is actually on
Check whether multi-factor authentication is available and turned on for your office's Quanum accounts, and for the email accounts those users rely on for password resets. If someone can get into a staff member's email, they can often reset that person's portal password too. If you aren't sure, have your IT provider confirm it.
Step 3: Brief staff on Quest-themed phishing
When a big name is in the news, fake emails follow, and a real outage with a real workaround makes them easier to believe. Tell your team to expect messages that look like Quest:
- "New lab results are ready, log in to view"
- "Your Quanum password has expired," "Verify your account," or "Use this link to reach eLabs during the outage"
- Calls or texts claiming to be Quest support and asking for a login or a code
The rule: don't log in from a link in an email or text. Use your saved bookmark or type the address yourself, and call Quest at a number you already have if something looks off. Nobody legitimate needs your MFA code.
A HIPAA note for practices
Quest is running its own investigation. It says it is working to identify the affected patients and providers and, "as the covered entity," will make notifications as required by applicable law (Cybernews). Your practice's piece is narrower: your own users and your own access. If your review turns up anything that suggests your staff's Quanum credentials could have been involved, such as a login nobody recognizes, a password shared with an ex-employee, or a user who clicked a suspicious link, then:
- Write down what you checked, when, who did it, and what you changed. That record matters whatever you find.
- Bring in your compliance or privacy officer (or the outside firm that fills that role) before you decide anything.
- Review your agreements with Quest, including any business associate agreement, and any updates Quest sends you, so you know who is responsible for what.
Whether your practice has any notification duty depends on facts Quest hasn't released yet. That's a call for your privacy officer or healthcare attorney, not a blog post. What you can do now is have your own review done and documented when those facts arrive.
Clear takeaway
Quest says an unauthorized party accessed its Quanum LSM system and, it believes, certain patient records. If your office uses Quanum, do three things this week: remove logins for anyone who has left, confirm MFA is on, and warn staff about fake Quest result, password, and "outage workaround" emails. Document the review, and loop in your privacy officer if anything looks off.
Brotherly Technology helps dental and medical practices across Rome, Northwest Georgia and the Southeast audit vendor portal logins and set up MFA. If you'd like a second set of eyes on yours, give us a call.
Sources:
- Quest Diagnostics Form 8-K, Item 8.01 (filed Oct. 22, 2026; SEC accession 0000947871-26-000941).
- Quest Diagnostics: "An update on an incident involving one of our systems" (website notice, checked Oct. 23, 2026).
- Fox Business: "Quest Diagnostics confirms patient data accessed in cyberattack" (Oct. 22, 2026). Source for the paused systems, workarounds, and restoration timing.
- Cybernews: "Quest Diagnostics confirms breach of lab systems, patient data now at risk" (Oct. 23, 2026). Source for the fax and eLabs workarounds and the covered-entity notification quote.
- The Record: "Quest Diagnostics warns of potential data theft after attack on lab service system" (Oct. 23, 2026).
- Reuters: "Laboratory operator Quest reports cyber breach affecting patient records" (Oct. 22, 2026, via Yahoo Finance).
- AP: "Quest Diagnostics hit by a cyber breach, with patient records likely accessed" (Oct. 22, 2026). Source for the PHP statement.