Patient Data Likely Accessed in Quest Diagnostics Hack
Quest Diagnostics, a Secaucus, New Jersey-based Fortune 500 diagnostic testing company, has notified the U.S. Securities and Exchange Commission (SEC) that it has identified unauthorized access to its Quantum Lab Services Manager (LSM) system and suspects patient records have likely been compromised. The scale of the data breach has yet to be determined. No threat group appears to have claimed responsibility for the intrusion.
In its October 22, 2026, Form 8-K filing, the company said the unauthorized access was first identified on October 21, 2026. An investigation has been launched to determine the nature and scope of the unauthorized activity, although the incident appears to be limited to its LSM system, which is used by certain clients to place test orders and receive and look up test results.
Upon detection, the company initiated its incident response protocol to contain the activity, and remedial measures have been implemented to prevent further unauthorized access. Third-party cybersecurity experts have been engaged to assist with the investigation, and federal law enforcement authorities have been notified. The incident has not affected the company’s ability to serve patients or impacted its business operations. Quest Diagnostics explained in a website notice that it temporarily paused access to the LSM system while the incident is investigated. Customers can continue to place orders and receive test results via fax, paper, or direct-customer LIS interfaces or EMRs.
Avail of a Free 30-Minute
Cybersecurity Consultation
with Blue Team Alpha
Review your security program, get advice on a specific cybersecurity concern, identify risk-reduction priorities, or take the first step toward your annual HIPAA Security Risk Assessment.
Learn More About This Offer
Quest Diagnostics is one of the largest clinical diagnostic laboratory companies in the United States. The company operates more than 7,700 patient access points in North America, including around 2,000 patient service centers in 51 U.S. states and territories. The company serves around one-third of adult Americans, half of U.S. physicians and hospitals, and has around $11 billion in annual revenue.
The company has experienced a major data breach in the past via its debt collection vendor, American Medical Collections Agency (AMCA). Hackers breached AMCA systems between August 2018 and March 2019 and gained access to the protected health information of approximately 11.9 million Quest Diagnostics patients. While Quest Diagnostics has confirmed that patient records were accessed in the latest incident, it is unlikely to be on a similar scale, as only certain customers use the impacted system. Quest Diagnostics will release further information on the incident as the investigation progresses.
