The Quest Diagnostics data breach disclosed on 22 October 2026 still has no published patient count. The clinical laboratory company found unauthorized access to Quanum LSM, the portal doctors use to order lab tests, on 21 October, and paused the system. It has announced no restart date and named no attacker.
What Quest Has Confirmed
Quest Diagnostics Incorporated, the New Jersey-based clinical laboratory group, set out the incident in a Form 8-K filed with the US Securities and Exchange Commission on 22 October 2026 and signed by Sean D. Mersten, its vice president and corporate secretary.
- Discovery: the company learned of unauthorized access to Quanum LSM on 21 October 2026.
- What was reached: the filing says “an unauthorized party accessed certain patient records”.
- Scope: the “full scope of unauthorized access remains under investigation”.
- Response: Quest started its incident response procedures, notified federal law enforcement and engaged outside cybersecurity experts.
- Systems paused: access to Quanum LSM was stopped, and access to two further services, Essential Insights and LabHQ, was paused as a precaution.
Quanum LSM — the initials stand for Lab Services Manager — is the software clinics and hospital staff use to place test orders, look up results, track their status and order supplies. According to TechCrunch, which cited Quest’s own materials, around half a million clinicians across thousands of North American locations use the Quanum platform.
What the Filing Does Not Say
Quest did not file this as a material cybersecurity incident. The disclosure appears under Item 8.01, “Other Events”, rather than Item 1.05, the item the SEC created in 2023 for material cybersecurity incidents, and the company makes no formal materiality determination. It states instead that the incident “has not materially disrupted the Company’s business operations or its ability to serve patients”.
The filing also gives no number of affected patients, no list of the data involved, and no attacker. As of 27 October 2026, no ransomware group or other threat actor has claimed the intrusion, Quest has published no patient count, and it has not announced that Quanum LSM is back online.
Which Data Was Involved, and Where Reports Disagree
This is the point on which coverage splits, and the split matters.
Quest’s own security notice says protected health information was taken, described as personal information and patient records. TechCrunch, which read the notice on 23 October, reports that Quest has not said which specific kinds of data were involved. A Quest spokesperson, Amanda Rivera, referred the outlet to that notice and did not answer its questions.
The Washington Times reported on 24 October that Quest had gone further, saying the exposed information included names, dates of birth, lab results and in some cases phone numbers, and that it did not include Social Security numbers, credit card numbers, or insurance or other financial data. That account is carried by one outlet. Quest’s filing contains no such list, so the narrower reading — that the fields are still undetermined — is the one supported by the primary document.
Lists of stolen data circulating on law-firm pages and social posts, several of which name Social Security numbers, are not supported by anything Quest has published. The pattern is familiar from other recent incidents, where the eventual confirmed set was narrower than the early claims — Capcom, for instance, confirmed 11.77 million email addresses but not passwords.
The 11.9 Million Figure Belongs to a Different Breach
Several pages now circulating give a figure of 11.9 million affected patients. That number is not from this incident. It comes from 2019, when a breach at American Medical Collection Agency, a billing vendor Quest used, exposed data on roughly 11.9 million Quest patients and produced at least 19 class actions that were consolidated into multidistrict litigation still running today.
No source has connected the 2019 figure to the Quanum LSM intrusion. At least one site has run it as a headline while stating inside the article that Quest has published no count.
What Changes for Doctors’ Offices
The immediate practical effect falls on clinics rather than patients. With Quanum LSM paused, Quest told customers to place orders and receive results by other routes:
- Paper requisitions and fax: the fallback for practices that used the portal for everything.
- Quanum eLabs: a separate Quest ordering product that remains available.
- Direct LIS interfaces and EMR integrations: Quest says practices connecting this way were not affected and need change nothing.
Quest says patient-facing operations were not disrupted, which is consistent with its statement on materiality. Patients who gave samples at a Quest site during the period would not see a difference; the disruption sits between the clinic and the laboratory.
When Patients Would Be Told
Under the HIPAA Breach Notification Rule, a covered entity must notify affected individuals without unreasonable delay and no later than 60 calendar days after discovering a breach of unsecured protected health information. Counted from the 21 October discovery, that outer limit falls on 20 December 2026. It is a legal deadline rather than a Quest commitment, and the company could write to people much sooner.
Quest has said it is working to identify which patients and providers were affected, which is the step that has to finish before any count or notification exists. Notices in an incident like this come from the laboratory as the covered entity, not from the clinic that drew the blood.
One practical obstacle is worth noting: TechCrunch found that the page carrying Quest’s security notice includes “noindex” markup, which keeps search engines from listing it. Anyone searching for the company’s own statement is therefore likely to land on secondary coverage instead. Breach counts also tend to arrive late and change — the Pentagon breach disclosed this month settled at 3.05 million only after an initial period with no figure at all, and identity exposure does not always behave the way people expect, as the IDScan incident showed.
Frequently Asked Questions
How Many People Are Affected by the Quest Diagnostics Data Breach?
Quest has not published a number. Its SEC filing says the full scope is still under investigation, and no figure had been released as of 27 October 2026.
Were Social Security Numbers Taken?
Quest’s SEC filing does not list any data fields. One outlet, The Washington Times, reported that Quest said Social Security numbers, card numbers and insurance data were not involved, but no other source has confirmed that account.
Is the 11.9 Million Figure Real?
It is real, but it belongs to a 2019 breach at Quest’s former billing vendor American Medical Collection Agency. It has no established connection to the October 2026 Quanum LSM incident.
Can My Doctor Still Order Quest Lab Tests?
Yes. Quest directed practices to paper requisitions, fax, Quanum eLabs, or their existing direct interfaces. Practices using EMR or LIS connections were not affected.
When Will Quest Notify Affected Patients?
The HIPAA Breach Notification Rule sets an outer limit of 60 days from discovery, which would be 20 December 2026. Quest has not given a date of its own.
