Quest Diagnostics Confirms Hackers Reached Patient Records Through Its Quanum Lab Platform
A filing with the SEC says an unauthorised party got into the system doctors use to order tests and see results, but Quest has not said how many patients are affected or what was taken.
Outspoken Digest Technology Desk
Monday, October 26, 2026/2 min read
When a doctor orders a blood test through Quest Diagnostics, the request and the result often pass through a platform called Quanum. This week, the company told investors that someone who should not have been there got into it.
In a filing with the US Securities and Exchange Commission, Quest said it learned of unauthorised access to its Quanum LSM system on Wednesday 21 October. The company said it believes an unauthorised party accessed certain patient records, according to the 8-K filing, which is signed 22 October.
What did Quest say happened?
The filing is short and preliminary. Quest says Quanum LSM is a system that certain clients use to place test orders and view results. It activated its incident response procedures to contain the activity, notified federal law enforcement and brought in outside cybersecurity experts. It says the full scope is still under investigation, and that the incident has not materially disrupted its business or its ability to serve patients.
What is still unknown?
A great deal. TechCrunch reports that Quest has not said how many patients or healthcare customers are affected, when the intrusion began, which kinds of data were taken, or whether any hacking group has made demands. A company security notice says some patients' protected health information was taken, including personal information and patient records, but the company is still working out the specific types of data. A spokesperson did not answer TechCrunch's questions and pointed to the notice. TechCrunch also found that the archived notice carried code telling search engines not to list it.
The scale could be large. Quest says Quanum is used by about half a million clinicians at thousands of locations across North America, and TechCrunch notes a Quest case study describing one health system with more than 6 million patients and hundreds of millions of medical documents in the platform. How many of those records the intruder reached is not known.
Is this Quest's first breach?
No. TechCrunch calls it the company's second major known breach in a decade. In 2019 it lost 11.9 million patient records in an attack on a third-party billing company. The latest incident also joins a run of 2026 health-sector attacks that TechCrunch lists: Stryker, whose employee devices were mass-wiped in March, Boston Scientific, hacked in August with its network offline for weeks, and patient-data breaches at CareCloud, Craneware and McKesson.
What should patients do now?
For now, little that is specific. Quest has not said whether it will write to patients, so the sensible course is to watch for a letter or email from Quest or your doctor's office, and to treat unsolicited calls or messages that mention a lab result with suspicion. Quest's own security notice is the place to look for updates.
The next real information will come when Quest finishes its investigation and counts the records involved. Regulators and plaintiffs' lawyers will be waiting for that number, and so will the doctors whose patients' results sit in the system.
Published in The Outspoken Digest
Editorial desk
Outspoken Digest Technology DeskSoftware, hardware, artificial intelligence and what they change for everyone else.
Newsletter
The Digest, in your inbox
One edition, sent when it is ready. No noise, and your address is never passed on.
Read Next
More Technology →
NASA's Dragonfly Flies Its Hardest Titan Manoeuvre, Autonomously, in Its Most Thorough Simulation Yet
Oct 26, 2026/2 min read
Instacart Is Reportedly Exploring a Sale, With DoorDash and Uber Said to Have Held Talks
Oct 26, 2026/2 min read
NASA Ends the Swift Mission After Nearly 22 Years as Its Orbit Decays and Re-Entry Looms
Oct 25, 2026/2 min read
Ukraine Says Starlink and Starshield Speeds Are Restored, as Musk Claims Kyiv Broke the Terms
Oct 24, 2026/2 min read