{"id":"quest-diagnostics-quanum-lsm-breach-oct-2026","category":"breach","status":"live","title":"Quest Diagnostics confirms intruder accessed patient records through Quanum Lab Services Manager","tldr":"Quest Diagnostics says an intruder accessed patient records in Quanum LSM, the system clients use to order tests and get results. Quest says it is remediated, but the data and patient count are unknown. Watch for phishing and wait for a Quest letter.","summary":"Quest Diagnostics told the US securities regulator on 22 October 2026 that an unauthorised party had accessed certain patient records in Quanum Lab Services Manager (LSM). Some Quest clients use LSM to place test orders, receive results and look up results. Quest says it learned of the access on 21 October, started incident response, told federal law enforcement and brought in outside cybersecurity experts. BleepingComputer reported that the LSM system was stopped, with customers told to use paper requisitions or Quanum eLabs, and that access to Essential Insights and LabHQ was paused as a precaution. Quest said direct-customer lab interfaces and electronic medical record connections were not affected. By its notice of 26 October, Quest said the incident had been remediated. It has not said how many patients were affected or what information was taken, and says the investigation continues. It will notify affected providers and patients by letter, which will describe credit and identity monitoring. BleepingComputer found no group claiming the attack. Nothing is stated about charges or recovery of data.","action":"You don't need to do anything yet. Watch for a Quest letter, and treat unexpected calls, texts or emails about lab results, breach notices or credit monitoring as possible scams. Check them by contacting Quest directly through its website.","product":"Quest Diagnostics Quanum Lab Services Manager (LSM)","audience":"both","severity":"high","patch":"na","exploited":true,"cves":[],"tags":["quest-diagnostics","data-breach","healthcare","patient-records","quanum","lab-results","sec-filing"],"affected":[],"fixed":[],"matches":[],"sources":[{"kind":"advisory","title":"Quest Diagnostics Form 8-K","url":"https://www.sec.gov/Archives/edgar/data/1022079/000094787126000941/ss6979200_8k.htm","by":"Quest Diagnostics (SEC filing)","date":"2026-10-22"},{"kind":"advisory","title":"Quanum LSM security notice","url":"https://www.questdiagnostics.com/links/quanum-notice","by":"Quest Diagnostics","date":"2026-10-26"},{"kind":"news","title":"Quest Diagnostics confirms data breach exposed patient records","url":"https://www.bleepingcomputer.com/news/security/quest-diagnostics-confirms-data-breach-exposed-patient-records/","by":"BleepingComputer","date":"2026-10-23"}],"started":"2026-10-22","closed":null,"created":"2026-11-03T21:37:46.659Z","updated":"2026-11-03T21:37:46.659Z","cve_notes":[],"timeline":[{"at":"2026-10-26","added":"2026-11-03T21:37:06.107Z","kind":"other","text":"Quest's notice, current as of 8:00 am ET, said the incident had been remediated. The types of data and number of people affected were still not stated, and credit monitoring was not yet offered. Quest said it would notify affected providers and patients by letter.","url":"https://www.questdiagnostics.com/links/quanum-notice","by":"Quest Diagnostics","patch":"na"},{"at":"2026-10-23","added":"2026-11-03T21:37:06.107Z","kind":"other","text":"BleepingComputer reported that Quanum LSM had been stopped, with customers told to use paper requisitions or Quanum eLabs, and that access to Essential Insights and LabHQ was paused. It found no group claiming the attack and no record count.","url":"https://www.bleepingcomputer.com/news/security/quest-diagnostics-confirms-data-breach-exposed-patient-records/","by":"BleepingComputer","patch":"na"},{"at":"2026-10-22","added":"2026-11-03T21:37:06.107Z","kind":"other","text":"Quest filed an 8-K with the SEC saying certain patient records were accessed and the full scope was still under investigation. It gave no patient count and said business operations had not been materially disrupted.","url":"https://www.sec.gov/Archives/edgar/data/1022079/000094787126000941/ss6979200_8k.htm","by":"SEC filing (Quest Diagnostics)","patch":"na"},{"at":"2026-10-21","added":"2026-11-03T21:37:06.107Z","kind":"disclosed","text":"Quest Diagnostics learned that an unauthorised party had accessed its Quanum Lab Services Manager (LSM), the system some clients use to order tests and get results. It started its incident response procedures and told federal law enforcement.","url":"https://www.sec.gov/Archives/edgar/data/1022079/000094787126000941/ss6979200_8k.htm","by":"SEC filing (Quest Diagnostics)","patch":"na"}],"url":"https://hard.fyi/live/quest-diagnostics-quanum-lsm-breach-oct-2026/","json":"https://hard.fyi/api/live?id=quest-diagnostics-quanum-lsm-breach-oct-2026"}