Quest Diagnostics has disclosed a security incident involving Quanum LSM (Lab Services Manager), a web platform that physicians, hospital staff and medical offices use to order tests, check results and status, and order supplies.

The company says it learned of the unauthorized access on October 21, 2026, activated its incident response process and brought in outside experts. Quest believes some patient records were exposed but hasn’t said what types of data were involved or how many people were affected.

Quest has taken Quanum LSM offline. As a precaution, it also paused access to two other client tools, Essential Insights and LabHQ. Customers are being asked to use paper requisitions or Quanum eLabs to place orders and get results. Quest says customer-facing operations haven’t been disrupted, and clients connected through direct LIS interfaces or EMR integrations weren’t affected.

The company has reported the incident to the SEC and to law enforcement. When BleepingComputer published its report, no ransomware or extortion group had claimed the attack.

Quest has been here before. In 2019, a breach at billing collection vendor AMCA exposed data on roughly 11.9 million Quest patients. That led to at least 19 class actions, now consolidated in ongoing multidistrict litigation.

Why it matters / what to do

The breach hit a clinician-facing portal, not Quest’s core lab systems. Many healthcare organizations have quietly given third-party portals deep access to their workflows, and few track those portals as attack surface.

  • Providers using Quanum: review which staff accounts had LSM access, watch for phishing posing as Quest result or re-authentication notices, and confirm your paper-order downtime procedures actually work.
  • Security leaders in any sector: list the partner portals your staff log into, check that those accounts use MFA and SSO, and confirm your contracts require prompt breach notification.
  • Board reporting: this is another health-sector SEC disclosure filed before the scope was known. That’s now the norm, so your disclosure playbook should assume you’ll file before the facts are complete.

Source: BleepingComputer (Oct. 23, 2026)