Quest Diagnostics reports unauthorized access to patient records via Quanum LSM platform

Quest Diagnostics, a major U.S. clinical laboratory operator, has confirmed that a threat actor obtained unauthorized access to its Quanum LSM system, resulting in exposure of patient records. The company detected the intrusion on October 21 and immediately activated incident response procedures to halt the unauthorized activity, determine the scope of the compromise, and deploy corrective actions.

According to a filing with the U.S. Securities and Exchange Commission (SEC), "On October 21, 2026, Quest Diagnostics Incorporated learned of unauthorized access to its Quanum LSM system, which certain clients use to place test orders, receive and look up results."

Quest Diagnostics operates 7,700 locations across North America, maintains a workforce of 65,000 employees, and generates annual revenue exceeding $11 billion. The company serves approximately one in three American adults annually through its diagnostic testing and clinical laboratory services.

The Quanum LSM (Lab Services Manager) platform enables physicians, hospital staff, and medical office personnel to manage laboratory operations, retrieve test results, monitor order status, and procure supplies. The system represents a critical tool for Quest Diagnostics' client base.

While the investigation remains ongoing, Quest Diagnostics has determined that certain patient records were compromised, though the specific categories of exposed data have not yet been identified. Third-party security experts are assisting with the investigation, and law enforcement has been notified of the incident.

The breach has not affected customer-facing operations, and users accessing direct-customer LIS interfaces or EMRs experienced no disruption. As a precautionary step, Quest Diagnostics has suspended access to additional systems, including Essential Insights and LabHQ.

The Quanum LSM system remains offline. Customers have been advised to submit orders and obtain results through paper requisitions or the Quanum eLabs platform as alternatives.

No threat group has publicly claimed responsibility for the attack as of the time of reporting.

This incident echoes a 2019 breach at American Medical Collection Agency (AMCA), a billing collection provider, which compromised data belonging to approximately 11.9 million Quest Diagnostics patients. That breach triggered at least 19 class-action lawsuits against Quest Diagnostics, which were consolidated into multidistrict litigation that remains unresolved.