Quest Diagnostics has reported a data breach that exposed patient records after a cyber attack compromised its Quanum Lab Services Manager (LSM).
With annual revenue of about $11 billion, Quest Diagnostics operates 7,700 centers across North America and employs more than 65,000 people.
Its Quanum LSM system enables healthcare institutions and practices to place test orders, receive and look up results, and handle patient billing. As a result, the lab management system handles troves of patient information, making it a lucrative target for cybercriminals.
Quest Diagnostics data breach leaks patient records
The lab testing giant learned of the data breach on October 21, 2026. It responded by activating its cyber incident response protocols to contain the attack and launched an investigation to determine the scope of the incident.
It also implemented additional remediation measures, notified federal law enforcement agencies and relevant authorities, and hired external cybersecurity experts.
According to a regulatory filing with the U.S. Securities and Exchange Commission, the probe determined that the cyber attack compromised patient records.
“While the full scope of unauthorized access remains under investigation, at this time the Company believes that an unauthorized party accessed certain patient records,” the company told the SEC.
The company also determined that the security breach did not materially impact its operations or patient care.
So far, the number of patient records affected remains undisclosed. However, a single Quanum LSM system holding the personal details of as many as 6 million patients can contain tens or even hundreds of millions of patient records. The nature of the stolen information also remains undisclosed, but the company says it included “personal information and patient records.”
Similarly, the identity of the threat actor remains unknown, and no cybercrime gang has claimed responsibility for the cyber attack. Quest Diagnostics also has not disclosed whether the threat actors have demanded a ransom.
The lab giant has yet to disclose the attack vector exploited. According to a report by the Identity Theft Resource Center (ITRC), more than three-quarters of breaches in Q3 2026 had no attack vector details, leaving victims in the dark.
“I hate seeing incidents like this, especially in healthcare, where some of our most personal information is at stake,” said Darin Fredde, Sr. Director of Technical Marketing Engineering, Ridge Security. “Quest’s containment efforts are an important first step, but containment isn’t the finish line. The real work is establishing how the attacker got in, what they could access, whether they left anything behind, and independently verifying that those paths are closed. We don’t yet know the full scope, and keeping operations running doesn’t necessarily mean patient information is safe. In healthcare, restoring service and restoring trust are two very different tests.”
Medical health technology firms affected by cyber attacks
The health sector was among the most affected by data breaches, with millions of victims as cybercriminals continue to target health providers because patient records fetch a premium on the dark web.
In 2026, the Oracle Health data breach alone potentially compromised the personal and patient records of nearly 19.9 million people, although the incident occurred in 2025.
Still in 2026, the DentaQuest breach potentially exposed sensitive personal and health information belonging to 15 million people, while the iRhythm Technologies breach affected approximately 8.18 million individuals.
Similarly, the AdaptHealth and Medtronic breaches affected approximately 4.12 million and 3.83 million people, respectively, while the Aesto Health breach, which occurred in December 2025 and was disclosed in 2026, exposed patient records of more than 9.5 million individuals.
Quest Diagnostics has also previously experienced data breaches that exposed patient records. In 2019, a data breach affected the lab operator and leaked the personal information of 11.9 million people. In 2016, the company also leaked personal and patient records of 34,000 individuals.
