Quest Diagnostics Quanum LSM Incident: System Restored, Patient Data Scope Still Under Investigation

Status (25 October 2026, 08:19 Cyprus time (UTC+2)): Monitoring. Quest Diagnostics says it has remediated the unauthorized access to its Quanum Lab Services Manager (LSM) system, and that LSM and the other systems it paused as a precaution are restored. Quest believes some patient data in LSM was accessed. It is still working out which data and which patients. Quest says its core business operations were not affected. There is no CVE for this incident.

Quest Diagnostics, the US clinical laboratory company, learned on 21 October 2026 of unauthorized access to Quanum LSM. Quest describes LSM as the system "certain clients use to place test orders, receive and look up results" (Quest SEC Form 8-K). In its latest update, "as of 7:00 pm ET, October 23, 2026", Quest says it has "remediated the security incident", that LSM "has been securely restored and is available to clients", and that it will notify affected patients and providers (Quest notice and FAQ).

The good news first: by Quest's account, the intruder's access has been cut off, ordering through direct lab and EMR interfaces never stopped, and two other systems that were paused had no data accessed. The open question is the data. Quest says personal information and patient records were affected, but it has not said how many patients or providers are involved, which kinds of data were involved, or how the intruder got in. What to do now: if your organisation uses Quanum LSM, make sure your users' credentials are reset, and ask Quest for findings that are specific to your organisation.

Technical Information

What Quest has said happened (Quest SEC Form 8-K, filed 22 October 2026; Quest notice and FAQ, update as of 23 October, 7:00 pm ET):

• On 21 October, Quest "learned of unauthorized access to its Quanum LSM system" and "promptly initiated its cybersecurity incident response procedures to contain the activity".
• Quest says it "terminated the unauthorized access and contained the incident". It has engaged external cybersecurity experts and notified federal law enforcement.
• Quest says LSM is "securely restored and is available to clients". Systems "temporarily paused as a precautionary measure have also been restored and are operating securely".
• Quest's FAQ names two of those paused systems, Essential Insights and LabHQ, and says "no data was accessed in these other systems".
• Quest says its core business operations "were not impacted by this incident and remain up and running". The 8-K says the incident "has not materially disrupted" its operations or its ability to serve patients.
• Asked whether the incident relates to the recent PHP vulnerabilities, Quest's FAQ says: "Based on our investigation, the incident is not related to a PHP programming language issue." (For background on the PHP flaws, see our PHP advisory.)

What Quest has said about data. The 8-K says Quest "believes that an unauthorized party accessed certain patient records". The FAQ says: "We believe some patient data within Quanum LSM was accessed, but other systems were not affected." Asked whether "Patient Health Information (PHI) or Patient Identifiable Information (PII)" was part of the unauthorized access, Quest answers: "Yes, but we are still investigating to determine the specific data affected." Its patient FAQ adds that "personal information and patient records were affected". Quest uses the words "accessed" and "affected". It has not said whether data was copied out of its systems.

What is not known yet:

• How many patients, providers or client organisations are affected. Quest has not given a number, and we will not estimate one.
• Which data fields were involved.
• How the intruder got in, when the access began, and who was behind it. TechCrunch reports that Quest did not say when the breach began or whether anyone had made demands. The Record reports that a Quest spokesperson declined to comment on the nature of the incident. The Record and BleepingComputer each reported that no group had claimed the attack at the time they wrote.

Timeline (all 2026, Cyprus time; Cyprus was on UTC+3 until clocks went back at 04:00 on 25 October and is on UTC+2 since; source times in brackets):

• 21 October: Quest learns of the unauthorized access to Quanum LSM (8-K).
• 22 October, 13:53 UTC+3 (06:53 EDT): The SEC accepts Quest's Form 8-K, filed under Item 8.01 ("Other Events").
• 23 October: The press reports the filing. The Record and BleepingComputer report that LSM access was paused, that other systems were paused as a precaution, and that clients were directed to paper requisitions in the meantime (BleepingComputer also names Quanum eLabs).
• 24 October, 02:00 UTC+3 (23 October, 7:00 pm EDT): Quest updates its notice. It says the incident is remediated and LSM and the paused systems are restored.
• 25 October, 08:19 UTC+2: We re-checked Quest's notice. It still shows the update stamped 23 October, 7:00 pm ET, with no newer update.

Affected Product Versions

This is a service incident, not a software flaw, so there are no product versions to patch. Status per Quest's notice as of 23 October, 7:00 pm ET:

Quest also says it does not expect delays in appointment scheduling or turnaround reporting times for providers who do not use LSM.

Workaround and Mitigation

What Quest has done

• Terminated the unauthorized access, contained the incident and restored LSM and the paused systems.
• Engaged external cybersecurity experts and notified federal law enforcement.
• Committed to notify affected patients and providers and to report to "the relevant regulatory authorities". Quest says that "as the covered entity" it will make notifications as required by law, and that its letters to affected patients will describe the resources on offer, "including credit and identity monitoring".

Quest's guidance for clients

• Reset LSM credentials. Quest says any client that needs help resetting its Quanum LSM credentials should call its IT Connectivity Help Desk at 1-800-697-9302. Quest warns of longer-than-average wait times.
• Use your direct interface if you have one. Providers that order through direct-customer LIS interfaces or EMRs can keep using them; Quest says those were not affected.

Rescana guidance

• Confirm every LSM user has new credentials. List who in your organisation uses Quanum LSM, including any shared or departmental logins, and make sure each one has been reset. Remove accounts for people who no longer need access.
• Ask Quest for organisation-specific findings. Ask whether your users' accounts or your patients' records were in the affected data, and when Quest expects to tell you.
• Check your own notification duties. Quest says it will notify as the covered entity. Even so, confirm with your privacy or legal team what, if anything, your organisation has to do, so you can act quickly when Quest's findings arrive.
• Brief staff on follow-on phishing. Calls or emails claiming to be "Quest support" and asking for LSM passwords are a predictable follow-on to a public incident. Make sure staff use the number on Quest's own notice and report anything unexpected.
• Watch for unusual LSM activity. If LSM exposes user activity or audit information to your administrators, review it for the period around the incident and raise anything unexpected with Quest.

Indicators of Compromise

Quest has published no indicators of compromise, and none appear in its SEC filing or in the press reports we checked. Quest has not described the intrusion technique, and no source maps it to MITRE ATT&CK, so we have not done so either. There is nothing specific to hunt for at this point beyond the account review above.

We found no notice about this incident from CISA, the HHS Office for Civil Rights breach portal, or the California or Texas attorney general breach lists when we checked on 25 October 2026, 08:08–08:12 Cyprus time (UTC+2). The OCR portal's list does not load for automated checks, so we could not rule out an entry there.

What we will update

We will update this post if:

• Quest says how many patients or providers are affected, which data was involved, or whether data was taken out of its systems.
• Quest begins sending notification letters, or the incident appears on the HHS OCR breach portal or a state attorney general's breach list.
• Quest states how the intruder got in, or a group claims the attack.
• Quest publishes indicators of compromise or client-side actions beyond credential resets.
• Quest files a further SEC disclosure about the incident.

Sources

• Quest Diagnostics: "An update on an incident involving one of our systems" and provider and patient FAQs (as of 23 October 2026, 7:00 pm ET; checked 25 October 2026, 08:19 Cyprus time (UTC+2); some visitors may still be shown Quest's earlier 8:00 am ET version of the page); Form 8-K, Item 8.01 (filed 22 October 2026)
• The Record from Recorded Future News: Jonathan Greig, "Quest Diagnostics warns of potential data theft after attack on lab service system" (23 October 2026)
• BleepingComputer: Bill Toulas, "Quest Diagnostics confirms data breach exposed patient records" (23 October 2026)
• TechCrunch: Zack Whittaker, "Lab testing giant Quest Diagnostics confirms patients' personal and health data was compromised during breach" (23 October 2026)

Lab portals like Quanum LSM sit outside your own network, yet they hold your patients' orders and results and your staff's logins. For vendor risk, the useful signal is how quickly a supplier like Quest tells each client what was affected for them, and whether you already know which of your people use the portal.

Forward this to your TPRM owner: If your organisation sends testing to Quest, ask this week whether any of your users work in Quanum LSM, whether their credentials have been reset, and when Quest expects to tell you whether your patients' records were in the affected data (Rescana guidance).

Want a clear, evidence-based view of which suppliers hold your sensitive data and how they handle incidents like this one? Book a demo.