Quest learned of the unauthorized access on October 21 and paused the platform clinicians use to order tests and look up results.

 

What happened

Quest Diagnostics, one of the largest clinical laboratory companies in the United States, confirmed that an unauthorized party accessed its Quanum Lab Services Manager system, BleepingComputer reported. Clinicians and healthcare organizations use the system to place test orders and receive and look up results. Quest learned of the access on October 21 and said in its filing with the Securities and Exchange Commission that it believes certain patient records were affected. The company has not yet said how many patients are involved or which types of information were taken. A lab ordering platform holds the same kind of patient data that moves through clinical email every day, including names, test orders, and results.

 

Going deeper

Quest paused access to the Quanum Lab Services Manager after discovering the activity and also paused other tools for healthcare professionals, including Essential Insights and LabHQ use paper requisitions or a separate Quest ordering tool in the meantime. The company activated its incident response plan, brought in outside cybersecurity experts, and notified federal law enforcement. Quest said it will notify affected patients, healthcare providers, and health plans once its investigation is complete. The company stated in its SEC filing that the incident has not materially disrupted its business operations or its ability to serve patients.

 

What was said

“On October 21, 2026, Quest Diagnostics Incorporated learned of unauthorized access to its Quanum LSM system, which certain clients use to place test orders, receive and look up results,” the company said in its SEC filing. Quest said the breach was not related to a vulnerability in the PHP programming language disclosed the same week, NBC News reported. Quest has not said when the unauthorized access began or whether any group has contacted it with demands.

 

In the know

Lab disruptions during cyberattacks have been tied to patient harm. A systematic review of hospital cyberattacks published in September in the Journal of Medical Internet Research found increased blood test turnaround times delayed diagnosis and management, according to the study. One staff member quoted in the social media data the researchers collected described a cardiac blood test delayed by four hours. Lab staff in one published case also reported more quality problems during the outage, including specimens labeled with incorrect names and case numbers. Oncology specialists described laboratory delays as a critical problem for patients on high-dose methotrexate, a chemotherapy that requires close lab monitoring.

 

The big picture

Clinics that order tests through Quest’s portal are now working around it on paper, which is where the risk moves from patient data to day-to-day care. The Joint Commission and the American Hospital Association launched a Cyber Resilience Readiness program in May 2026 to help healthcare organizations keep care safe when technology they depend on is unavailable, according to the Joint Commission. The program focuses on clinical continuity rather than IT recovery alone, and was built from lessons learned in real cyberattacks on hospitals. A lab ordering portal going offline is the kind of disruption that planning covers. Practices relying on a single lab platform can check that staff know how to place and track orders on paper, how results will reach them while the portal is down, and how to confirm patient identifiers on every specimen.

 

FAQs

What is the Quanum Lab Services Manager?

A Quest platform that clinicians and healthcare organizations use to order lab tests, receive results, and look up past results.

 

Were patients' test results exposed?

Quest hasn't said yet. It confirmed certain patient records were affected and is still investigating which data was involved.

 

Can clinicians still order tests from Quest?

Yes. Quest advised using paper requisitions or a separate ordering tool while the platform is paused.

 

When will patients be notified?

Quest said it will notify affected patients, providers, and health plans once its investigation is complete. HIPAA generally requires notice within 60 days of discovering a breach.

 

What should patients watch for?

Unexpected calls or emails claiming to be from Quest about the breach. Verify any such contact through Quest's official website before sharing information.