QUEST Diagnostics has disclosed an unauthorized access incident affecting its Quanum Lab Services Manager (LSM) system. The company said it detected the intrusion on 21 October 2026 and promptly paused access to Quanum LSM while it investigated. In a filing with the SEC, Quest stated that an unauthorized party accessed certain patient records, and that the data involved includes both protected health information (PHI) and personal data. The firm has not disclosed how many patients are affected or the exact data types involved, noting that the investigation is still ongoing.
Quanum LSM is a web platform used by some Quest clients to order lab tests and by doctors’ offices to receive and review results. As a precaution, Quest also paused access to its Essential Insights and LabHQ platforms, though it stressed that no data was accessed in those systems. The company rejected a link to PHP flaws, stating that, based on their investigation, the incident is not related to a PHP programming language issue.
Providers that order through EMRs or direct LIS interfaces were not reported as affected. Quest is collaborating with external cybersecurity experts and law enforcement and will communicate notifications as required by law. Patients are advised to watch for official correspondence and be vigilant for phishing that cites lab tests. Restoration of full service was anticipated for 23 October 2026.