Quick answer
Quest says patient records were accessed through a system some doctors' offices use to order lab tests and look up results. It hasn't said how many people are affected or exactly what information was involved. If you've had lab work through Quest, watch your insurance statements for tests you didn't have, and be wary of calls, texts, or emails about "your results" or a lab bill. Quest says it will notify affected patients as required by law.
What happened
Quest says it learned of unauthorized access to Quanum Lab Services Manager (LSM) on October 21, 2026. LSM is a web portal that some of Quest's healthcare clients use to order tests, receive results, and search for earlier results. Quest disclosed the incident in an SEC filing the next day.
Quest says it started its incident response process, brought in outside cybersecurity experts, notified federal law enforcement, and suspended access to the portal while it investigates. It says the incident hasn't materially disrupted its ability to serve patients, and that doctors connected to Quest through their own lab or electronic health record systems can keep ordering tests as usual.
What information was exposed
Quest says the access involved patient records, which may include health information or personal details. It hasn't said which kinds of information, or how many patients, were affected. Lab records can include names, dates of birth, addresses, insurance details, test orders, and results, but Quest hasn't confirmed which of these were involved.
You may see reports that nearly 12 million Quest patients were affected. That number is from a different breach in 2019, involving a billing collections vendor, not this one.
What to do now
- Read your insurance Explanation of Benefits statements. Look for lab tests, visits, or providers you don't recognize, and call your insurer if anything looks wrong. Medical identity theft often shows up here first.
- Expect scams. Breaches like this are often followed by calls, texts, and emails about "your test results," an unpaid lab bill, or a refund. Don't give out information or pay anything from an unexpected message. Call Quest or your doctor's office at a number you look up yourself.
- Trust notices that arrive by mail or through your doctor's office. A real breach notice won't ask for your password, Social Security number, or payment.
- Hold off on a credit freeze unless Quest confirms Social Security numbers were involved. If it does, freezing your credit at Equifax, Experian, and TransUnion is free and is the strongest protection.
- Check back. When Quest sends notices or releases details, we'll update this page with what was taken and any free monitoring it offers.
Your rights with lab records
Lab results Quest handles for your doctor are covered by HIPAA, the federal health privacy law. HIPAA requires Quest to notify affected patients and gives you the right to get a copy of your records, but it doesn't give you a right to have medical records deleted, and state privacy laws generally exempt HIPAA-covered data. Labs also have to keep test records for a set number of years.
What you can still limit is marketing. Many people have a separate MyQuest account or have bought tests directly from Quest. You can close an account you don't use, and if you live in a state with a consumer privacy law, you can ask Quest to delete data it holds outside of HIPAA, such as marketing and website data. See what your state's law requires.
Find every company that has your data
A breach is a good reminder of how many companies hold your information. DataTrail scans your inbox (read-only) to find them all, flags the ones with data breaches, and writes the deletion requests for you to send.
Become a testerSources: Fierce Biotech, Insurance Journal, and Cyber Security News, reporting on Quest's October 22, 2026 SEC filing. DataTrail isn't affiliated with Quest Diagnostics. This page is general information, not legal or medical advice.