Quest Diagnostics Data Breach Exposes Patient Records

Quest Diagnostics, one of the largest medical laboratory operators in the United States, has reported a cybersecurity breach that exposed certain patient records. The company disclosed the incident in a statement on October 22, confirming that unauthorised access affected its Quanum Lab Services Manager (LSM) system, which healthcare providers use to order laboratory tests and access results.

Quest Diagnostics said it suspended access to the affected system after detecting the breach. The company is investigating the incident to determine what information was accessed and which specific patient records may have been affected. It also confirmed that patient health information (PHI) and personally identifiable information (PII) were involved in the unauthorised access, although the full extent of the exposure remains under investigation.

The company stressed that its core business operations remained operational and that healthcare providers using unaffected laboratory information system (LIS) interfaces or electronic medical records (EMRs) could continue placing test orders. Quest Diagnostics also said it was coordinating with appropriate law enforcement authorities and expected to restore services fully by October 23.

What Happened in the Quest Diagnostics Cybersecurity Breach?

Quest Diagnostics disclosed that a security incident affected its Quanum Lab Services Manager system. The platform is used by certain clients to place laboratory test orders, receive results and look up patient testing information.

According to the company, some patient data stored within Quanum LSM was accessed during the incident. After detecting the breach, Quest Diagnostics discontinued access to the affected system while it investigated the unauthorised activity.

The company has not yet disclosed the precise number of patients whose information may have been affected. It is also investigating which categories of data were accessed and the full extent of the incident.

In its October 22 statement, Quest Diagnostics said its core business operations were not affected and remained up and running. The company added that providers using direct-customer LIS interfaces or EMRs to order laboratory tests could continue using those systems because the interfaces were not affected by the breach.

The incident highlights the importance of cybersecurity for medical laboratory providers, which handle sensitive health information and support diagnostic services for healthcare professionals and patients.

Which Quest Diagnostics System Was Affected?

The cybersecurity incident involved Quanum Lab Services Manager, a system that certain Quest Diagnostics clients use to manage laboratory testing-related activities.

The platform supports several functions, including:

• Placing test orders: Healthcare providers can submit requests for laboratory testing through the system.
• Receiving test results: Clients can access laboratory results through the platform.
• Looking up results: The system allows users to retrieve testing information when required.

Because the platform supports these activities, the unauthorised access raised concerns about the confidentiality of patient information available through the service.

Quest Diagnostics said the breach was limited to data within Quanum LSM and that other systems were not affected. It also confirmed that providers using unaffected direct-customer LIS interfaces or EMRs could continue placing test orders.

The company has not provided a complete technical explanation of how the breach occurred or identified the party responsible. Its investigation remains focused on determining the extent of the unauthorised access and the specific information involved.

What Patient Information Was Exposed?

Quest Diagnostics confirmed that patient health information and personally identifiable information were involved in the unauthorised access to Quanum LSM. However, the company has not yet identified all the specific data elements that were affected.

Patient health information can include information related to an individual’s healthcare, while personally identifiable information refers to details that can identify a person. The precise categories of information exposed in this incident remain subject to the company’s investigation.

Quest Diagnostics said it was working to determine the specific data affected and would make notifications as required by applicable law.

The company has not disclosed the number of patients whose information was accessed, whether particular types of laboratory results were involved or whether all affected records contained both health and identifying information.

Until the investigation establishes the full scope of the incident, the extent of the potential exposure remains uncertain. The available statement confirms unauthorised access to some patient data but does not provide a complete inventory of the records involved.

Quest Diagnostics Suspends Access to the Affected System

After discovering the security incident, Quest Diagnostics paused access to Quanum LSM and discontinued the unauthorised access route, according to its statement.

The company said its core business operations continued without disruption. It also clarified that providers using direct-customer laboratory information system interfaces or electronic medical records to order tests could continue to do so because those interfaces were not affected.

This distinction is important because the reported breach involved a specific system rather than all Quest Diagnostics services. The company said other systems remained unaffected, although its investigation was continuing.

Quest Diagnostics stated that it was committed to restoring its systems as soon as possible and expected services to be fully restored by October 23.

The company also said it was coordinating with appropriate law enforcement authorities regarding the reported security breach. The available information does not identify the agencies involved or provide details about any suspected perpetrators.

Quest Diagnostics Says Core Operations Remain Unaffected

Despite the incident involving Quanum LSM, Quest Diagnostics said its core business operations remained operational.

Healthcare providers who use unaffected LIS interfaces or EMRs to order laboratory testing could continue using those channels. According to the company, these interfaces were not affected by the security breach.

The statement suggests that the disruption was concentrated on the Quanum LSM platform rather than the company’s entire testing and diagnostic service infrastructure. However, the company has not provided a detailed breakdown of the operational impact on individual clients.

Quest Diagnostics said its priority was to investigate the incident, determine which data had been affected and restore the impacted system. It also reiterated its commitment to privacy and security.

Quest Diagnostics’ Previous Data Breaches

The New Jersey-based company has previously reported incidents involving the exposure of patient information. The latest breach follows earlier events in 2016 and 2019 that affected records associated with Quest Diagnostics patients.

2016: Data of Approximately 34,000 People Exposed

In 2016, Quest Diagnostics disclosed a Data Breach that exposed information belonging to approximately 34,000 people. The affected data included laboratory results and contact information.

The incident demonstrated the risks associated with the handling and storage of sensitive medical information, particularly when unauthorised parties gain access to systems containing patient records.

2019: Breach Affecting Approximately 11.9 Million Patients

In 2019, personal information belonging to approximately 11.9 million Quest Diagnostics patients was affected by a separate breach involving American Medical Collection Agency, a billing and collections service provider.

That incident was distinct from the latest cybersecurity breach involving Quanum LSM. The 2019 event involved a third-party service provider, while the October 2026 disclosure concerns unauthorised access to patient data within Quest Diagnostics’ Quanum Lab Services Manager system.

The earlier incidents provide context for the company’s history of reported data security problems, but the available information does not establish a connection between those breaches and the latest event.

What Is Quest Diagnostics Doing After the Breach?

Quest Diagnostics has outlined several immediate steps in response to the incident. These include suspending access to the affected system, investigating the unauthorised activity, assessing which patient information was accessed and coordinating with law enforcement authorities.

The company has also said it will notify affected parties as required by applicable law. The timing and scope of any notifications will depend on the findings of the investigation and the relevant legal requirements.

The principal actions announced by the company include:

• Restricting access: Access to Quanum LSM was paused after the breach was detected.
• Investigating the exposure: The company is working to determine the specific patient data affected.
• Maintaining operations: Core business activities continued, and unaffected LIS and EMR interfaces remained available for test orders.
• Coordinating with authorities: Quest Diagnostics said it was working with appropriate law enforcement agencies.
• Restoring services: The company expected full restoration by October 23.
• Providing notifications: The company said it would make notifications as required by applicable law.

The available statement does not provide further technical details about the cause of the breach, the identity of those responsible or the final number of affected patients.

What Patients and Healthcare Providers Should Know

The breach has raised concerns because the information involved includes patient health information and personally identifiable information. However, Quest Diagnostics has not yet published a complete account of the specific records affected.

Patients whose information may have been stored in Quanum LSM may need to await further information from the company as the investigation progresses. Quest Diagnostics has said it will make notifications where required by applicable law.

Healthcare providers should also distinguish between the affected platform and the company’s other services. Quest Diagnostics said providers using direct-customer LIS interfaces or EMRs could continue ordering tests through those unaffected channels.

At this stage, the company has not disclosed enough information to determine the full impact on individual patients or clients. Further updates may clarify the types of information involved, the number of people affected and any additional steps required following the investigation.

Key Takeaways From the Quest Diagnostics Data Breach

• Incident disclosed: Quest Diagnostics reported a cybersecurity breach in a statement issued on October 22.
• Affected system: The incident involved Quanum Lab Services Manager, which certain clients use to order tests and access results.
• Patient information: The company confirmed that patient health information and personally identifiable information were involved in the unauthorised access.
• Extent remains unknown: Quest Diagnostics is investigating which specific data was affected and has not disclosed the number of patients involved.
• Other systems unaffected: The company said its other systems were not affected and its core business operations remained operational.
• Access suspended: The company paused access to the affected platform after detecting the breach.
• Law enforcement coordination: Quest Diagnostics said it was coordinating with appropriate authorities.
• Restoration timeline: The company expected services to be fully restored by October 23.
• Previous incidents: Quest Diagnostics reported earlier data exposure incidents in 2016 and 2019, including the 2019 breach involving American Medical Collection Agency.

Quest Diagnostics is continuing to investigate the cybersecurity breach involving its Quanum Lab Services Manager platform. Although the company has confirmed that some patient data was accessed without authorisation, the precise information involved and the number of affected individuals remain unclear. The company says its core operations are continuing, unaffected test-ordering interfaces remain available, and notifications will be made as required by law.