Quest Diagnostics disclosed Thursday that an unauthorized party accessed its Quanum Lab Services Manager, a portal that healthcare providers use to order tests and look up results. The company learned of the intrusion on Wednesday, October 21, and filed its disclosure with the SEC the following day.
The breach arrives during what security professionals have started calling "Black October," a stretch that has included the PHP2Shell vulnerabilities and attacks on French supermarket refrigerators. Quest confirmed to the Associated Press that its incident has no connection to the PHP flaws.
What the Filing Says
In its 8-K filing, Quest stated that it "promptly initiated its cybersecurity incident response procedures to contain the activity, assess and investigate the nature and scope of the incident and implement appropriate remedial measures." The company also said it has notified federal law enforcement and brought in outside cybersecurity experts.
Quest paused access to the Quanum LSM system after discovering the breach. In an update posted to its website, the company acknowledged that patient health information or patient identifiable information was part of the unauthorized access, though it said it is still determining which specific data was affected.
"Core business operations are not impacted and remain up and running," Quest said on its website. The SEC filing used the phrase "not materially disrupted," the standard language for investor disclosures.
Scale Unknown
The scope remains unclear. Quest did not say how many patients may be affected, what type of records the intruder reached, or how the breach occurred. The Quanum LSM system is used by certain clients to place test orders and receive results, which means it could hold names, contact information, and clinical details. The exact footprint is under investigation.
Quest serves half the physicians and hospitals in the United States and roughly one in three American adults annually, according to the company's own statements. It processes about 217 million test requisitions per year. If the breach touched even a fraction of that patient base, the numbers could be significant.
A Pattern
This is not Quest's first breach. In 2016, the company disclosed that an intrusion exposed data including lab results and contact information for approximately 34,000 people. A more serious incident followed in 2019, when hackers compromised American Medical Collection Agency, a billing vendor Quest used. That breach affected about 11.9 million Quest patients. Credit card numbers, medical information, and personal data were among the stolen records.
The healthcare sector has become a frequent target. Insurance Journal reported that the Quest breach "adds to a growing number of cyberattacks on the healthcare sector, including those on medical device makers Abbott, Stryker, Medtronic and Boston Scientific."
Quest did not provide additional details during its third-quarter earnings call, which happened to fall on the same day as the disclosure. The company raised its revenue and earnings guidance for 2026, suggesting the financial impact of the breach has not yet registered in its forecasts. Whether that holds depends on what the investigation uncovers.
The number of affected patients and the nature of the accessed records remain unknown.
