Quest Diagnostics, one of the largest clinical lab companies in the United States, says an unauthorized party got into a system that its clients use to order lab tests and read results, and that the intruder accessed patient records. The company disclosed the incident in a Form 8-K filed with the Securities and Exchange Commission on Thursday, October 22, 2026, a day after it says it learned of the access.
The filing is short and leaves out a lot. Quest has not said how many patients are affected, which kinds of records were viewed or taken, or how the intruder got in. Below we cover what the company has confirmed, what it hasn't, and what healthcare providers and security teams that rely on Quest should do now.
What did Quest actually disclose?
According to the 8-K filing, Quest learned on October 21, 2026 of unauthorized access to its Quanum LSM system, which certain clients use to place test orders and to receive and look up results. The Associated Press reports that LSM stands for Lab Services Manager. Because the system is described as one that certain clients use, the people most directly connected to it appear to be ordering organizations such as physician practices rather than patients, though the filing does not say who those clients are.
The key sentence in the filing is this one: "at this time the Company believes that an unauthorized party accessed certain patient records." Quest says it started its cybersecurity incident response procedures, notified federal law enforcement authorities and engaged external cybersecurity experts. It says the full scope of the unauthorized access remains under investigation.
Quest also says the incident has not materially disrupted its business operations or its ability to serve patients. So this is a data-access incident, not an outage like the ransomware attacks that have shut down hospital systems and pharmacy networks in recent years.
Why is it filed under Item 8.01 and not Item 1.05?
This is a detail of SEC filing rules, but it tells you something. Item 1.05 of Form 8-K is the section public companies use to disclose cybersecurity incidents they have determined to be material. Item 8.01 ("Other Events") is a general section for events a company chooses to report.
Quest filed under Item 8.01. That suggests Quest had not, as of the filing, treated the incident as a material cybersecurity incident under Item 1.05, though the filing does not say so directly. That is consistent with its statement that operations were not materially disrupted. It does not mean the breach is small for the patients involved. Materiality under securities law concerns investors, not how sensitive the exposed data is. The filing does not explain how Quest made that call.
How many people are affected, and what data?
Nobody outside Quest knows yet, and the reporting says the number is still unknown. The Associated Press story carried by NBC News reports that the number of affected patients and the records involved are still unknown. The same AP story, republished by SecurityWeek, says the same. Note that these two links are one report from one wire service, not two independent confirmations.
Based on Quest's own description of the system as one for test orders and results, the records it holds would naturally include lab orders and results. But Quest has not said which fields the intruder accessed. Any specific claim about diagnoses, Social Security numbers or insurance details is speculation until the company or regulators say otherwise. No group has publicly claimed responsibility in the sources we reviewed, and Quest has not named a suspect.
Is this connected to the PHP vulnerability problems?
According to the AP, no. Quest confirmed to the AP on Thursday that, based on its investigation, the breach is not related to the PHP issue that has been in the security news this week. Quest has not disclosed the actual intrusion vector, so for now the cause is officially unknown.
Has this happened to Quest before?
Yes, twice, according to the AP's reporting in SecurityWeek. In 2016, Quest said data including lab results and contact information of about 34,000 people was exposed in another online breach. In 2019, personal information belonging to about 11.9 million Quest patients was affected after a hack at the American Medical Collection Agency (AMCA), a billing collections service provider.
The three incidents happened in different places. The 2019 breach was at a third-party vendor. The new incident, according to Quest's filing, involves a Quest system that certain clients use directly. The common thread is that a big lab company sits in the middle of a lot of healthcare data, and every portal, vendor and integration around it is a possible way in.
What It Means for Defenders
Quest's sources give no patch, no fixed version and no indicators of compromise. So defensive work right now is about preparation and hygiene, not remediation. Here is a sensible priority list.
Who is affected. The people most directly exposed are patients whose records sit in the affected system, and the clients (for example physician practices, clinics and other ordering organizations) that use it to order tests and read results. If your organization uses Quanum LSM, assume you may get a notification from Quest about your patients, and get ready for it now.
- Review and rotate Quanum LSM credentials. Quest has not said whether client accounts were the entry point. Still, rotating passwords for every staff account with access, removing accounts for former employees and turning on any multi-factor authentication option available are cheap and reasonable steps.
- Audit who has access. Lab portals tend to collect shared logins and over-provisioned users over time. Cut access down to the people who actually order tests or review results.
- Pull whatever activity logs you can. If your practice management or EHR integration logs lab portal activity on your side, keep those logs now, before retention windows expire. If Quest later releases a time window for the intrusion, you'll want to check it against your own records.
- Prepare your HIPAA breach workflow. If Quest notifies you that your patients' records were involved, your privacy officer will need to decide on notification duties under your business associate arrangements. Find your BAA with Quest and confirm who your contact is.
- Warn front-desk and billing staff about phishing. Publicized healthcare breaches often bring a wave of fake "breach notification" emails and calls, some aimed at patients and some at providers. Staff should verify any message claiming to come from Quest through a known contact, not through links or phone numbers in the message.
- Tell patients what you know, carefully. If patients ask, the accurate answer today is that Quest has reported unauthorized access to some patient records through a system certain clients use, and is still investigating scope. Don't guess about what data was involved.
For security teams generally: this is another reminder that third-party portals connected to clinical workflows are part of your attack surface even when you don't run them. Make sure your vendor risk register includes lab, imaging and billing portals, which accounts your staff hold on each, and whether those accounts require MFA.
What happens next
Expect more detail in stages. Quest says the investigation is ongoing. If it determines that protected health information was compromised, US health privacy law generally requires notices to affected individuals and to federal regulators, and large breaches are typically posted on the HHS breach portal. Quest may also update its SEC disclosure as the investigation develops. We'll update this story when Quest releases the number of patients affected, the data types involved or the cause of the intrusion.
