American clinical laboratory company Quest Diagnostics revealed that patient records were exposed after a threat actor gained unauthorized access to its Quanum LSM system.
The company learned about the breach on October 21 and implemented its incident response protocol “to contain activities, assess and investigate the nature and scope of the incident and take appropriate corrective measures.”
“On October 21, 2026, Quest Diagnostics Incorporated learned of unauthorized access to its Quanum LSM system, which some customers use to place test orders, receive and search results,” the company said in a filing with the US Securities and Exchange Commission (SEC).
Quest Diagnostics is a leading clinical laboratory company in the United States, providing diagnostic tests and services for a wide range of medical conditions.
It operates 7,700 locations across North America, employs 65,000 people, and generates more than $11 billion in annual revenue. Company said It serves one-third of US adults each year.
When LSM (Laboratory Services Manager) is the company’s online platform that doctors, hospital staff, and medical office staff use to manage lab services, access test results, track status, and order.
Company Disclose violations to the SEC and provide more information in notifications on its website.
The company is still investigating the incident but believes some patient records have been exposed. The type of data affected has not yet been determined.
Outside experts are assisting with the ongoing investigation, and Quest Diagnostics has also notified relevant law enforcement authorities.
Yes The company said That the event does not disrupt the performance of its customer facing and users of the direct customer LIS interface or EMRs are not affected.
As a precautionary measure, Quest Diagnostics has temporarily suspended access to other systems, including Essential Insights and LabHQ.
Currently, the Quanum LSM system has been discontinued, and customers are advised to use paper requests or Quanum eLabs to place orders and receive results.
As of writing, BleepingComputer was unable to locate the threat group that claimed to be attacking Quest Diagnostics.
In 2019, data on approximately 11.9 million Quest Diagnostics patients was compromised in a billing breach at the American Medical Collection Agency (AMCA).
After the disclosure, at least 19 class action lawsuits were filed against Quest Diagnostics. The case was included in a multi-city lawsuit, which remains ongoing and unresolved.
Overall defense scores can hide what happens after initial access. When attackers are using valid credentials, defenses are greatly reduced.
The Blue Report 2026 measures defense technique by technique across 338 million simulations run in customer production environments.
