Quest Diagnostics: Quanum LSM breach reaches patient records

Quest Diagnostics, one of the largest clinical laboratory groups in the United States, has disclosed unauthorized access to Quanum Lab Services Manager (Quanum LSM), the portal some of its clients use to order tests and look up results. The company believes certain patient records were accessed, but has not yet said how many or of what kind. The news is reported consistently by SecurityWeek (with an Associated Press story), BleepingComputer, The Record and TechCrunch.

What happened

According to its filing with the SEC (Form 8-K), Quest learned of the access on 21 October 2026 and activated its incident response protocol to contain the activity, investigate the nature and scope of the event and implement remedial measures. External cybersecurity experts are involved and federal law enforcement has been notified.

The operational measures, described in the notice Quest published on its website and reported by the outlets:

• Quanum LSM has been shut down; clients are asked to use paper requisitions or, according to BleepingComputer, Quanum eLabs to place orders and receive results. The Record reports the company’s commitment to bring the system back by Friday 23 October;
• other systems were paused as a precaution: BleepingComputer names Essential Insights and LabHQ;
• according to the company, customer-facing operations were not disrupted and users of direct LIS interfaces or electronic medical record (EMR) integrations were not affected.

Quest also stated, to the Associated Press and in its notice, that the incident is not related to the recent PHP vulnerabilities keeping many security teams busy these days.

The affected system

Quanum LSM is the online platform physicians, hospital staff and medical offices use to manage laboratory services: ordering tests, tracking their status, accessing results and ordering supplies. TechCrunch adds that the portal also handles billing and stores patients’ health and diagnostic data together with related billing data, and that according to Quest’s materials it is used by about half a million clinicians across North America. Quest says it serves one in three US adults every year.

This matters: a portal like this concentrates, in a single web service reachable by thousands of external users, the health data of patients from a very large number of different providers.

What is still unknown

The sources agree on several open points:

• access vector: not disclosed. A spokesperson declined to comment on the nature of the incident (The Record); it is not known whether stolen credentials, an application vulnerability or something else was involved. For this reason no specific MITRE ATT&CK techniques can be mapped;
• start of the activity: Quest has not said how long the attacker had access (TechCrunch);
• data involved: the notice mentions “personal information and patient records”, but data types and the number of people are still being determined;
• claim of responsibility: at the time of the reports no group had claimed the attack (BleepingComputer, The Record), and Quest has not said whether it received ransom demands.

TechCrunch also notes that the notice page contains noindex code, which keeps it out of search engines.

It is not the first incident for Quest: in 2019 the data of about 11.9 million patients was caught up in the breach of billing collections provider American Medical Collection Agency; SecurityWeek also recalls a 2016 case involving about 34,000 people.

Why it matters in Europe too

Quest operates in North America and the sources do not point to direct consequences for European patients. The pattern, however, is common here as well: laboratories, diagnostic centres and reporting platforms expose web portals for physicians, partner facilities and patients, often run by third parties.

For healthcare providers and laboratories within the scope of NIS2, an incident like this requires an early warning within 24 hours and a notification within 72 hours; since health data is involved, the GDPR obligation to notify the supervisory authority within 72 hours also applies. The Quest case shows two things that make a difference: the separation between the affected portal and direct integrations (LIS and EMR), which stayed out of the incident, and the existence of fallback procedures (paper requisitions, a second channel) that made it possible to shut the system down without stopping the service.

What to do now

If your organisation uses external laboratory or reporting portals:

• check which company accounts are active on suppliers’ portals, close those no longer needed and require multi-factor authentication;
• ask the supplier for the access logs of your accounts and look for bulk lookups of results, access from unusual countries or at unusual hours, anomalous exports;
• prepare a documented fallback procedure to order tests and receive results if the portal is switched off.

If you run a portal holding health data:

• monitor access patterns: the same user viewing many patients in a short time, sessions from new addresses, access outside working hours;
• keep the portal segmented from internal systems and direct integrations, and be ready to pause connected systems, as Quest did;
• check whether portal users’ credentials appear in known breaches and force a password change when they do;
• apply updates to exposed components and regularly review your external attack surface.

How ARXDOME can help

ARX Sentry collects logs and events from servers and firewalls and groups them into families, including bursts of login attempts, failed logins and night-time access, which help spot anomalous use of accounts. ARX Expose shows the external attack surface, known vulnerabilities on public services and company accounts involved in breaches. ARX Horizon enriches every event with country, operator and threat lists, to tell legitimate access from suspicious access faster.

Last updated: 23 October 2026