Quest Diagnostics Data Breach: What to Do If Your Lab Records May Be Exposed

Last checked: Oct 23, 2026. Based on Quest Diagnostics' SEC 8-K filing and reports by AP, CNBC, Cybernews, Fox Business, and MedTech Dive.

On October 21, 2026, Quest Diagnostics discovered unauthorized access to Quanum Lab Services Manager, the system certain clients use to place test orders and look up patient results. The company says certain patient records were accessed, but the specific data and the number of affected people are still being determined.

Quest serves one in three American adults each year, according to its own figures reported by Cybernews. That scale, combined with the sensitivity of lab test results, makes this breach especially concerning. Here's what's known, what's still under investigation, and what you should do if you've used Quest for lab work.

#What is Quanum Lab Services Manager?

Quanum Lab Services Manager (Quanum LSM) is the system certain Quest clients use to order lab tests and retrieve patient results. According to Quest's October 22, 2026 SEC Form 8-K filing, it's the platform "which certain clients use to place test orders, receive and look up results."

In practical terms, this is the system your doctor or clinic may use to:

• Order your blood work, urine tests, or other lab tests
• Retrieve your results once Quest has processed them
• Review your lab history

If you've had lab work done through Quest, your results may have been accessed through this system.

#What Quest has confirmed

According to Quest Diagnostics' SEC Form 8-K filed October 22, 2026 (reporting an event on October 21, 2026):

What Quest said in its own words:

"While the full scope of unauthorized access remains under investigation, at this time the Company believes that an unauthorized party accessed certain patient records."

Quest's website notice says it will make notifications as required by law once it determines the specific data and affected individuals.

#What's still unknown

As of October 23, 2026, Quest has not disclosed:

• How many people are affected
• What specific data was accessed (test results, diagnoses, personal identifiers)
• Who was behind the breach
• How the attacker gained access
• Whether data was exfiltrated or just viewed

Quest's October 22 SEC filing and its website notice (as reported by Cybernews, Fox Business, and MedTech Dive) say the investigation is ongoing and the company is still determining which data and how many people are involved.

Do not assume you are affected, and do not assume you are not. Wait for Quest to release more details or send breach notifications.

#Why this breach is getting attention

1. Quest's scale is enormous. Quest says it serves one in three American adults each year and half of US physicians and hospitals, according to Cybernews' October 23, 2026 report citing Quest's own figures.

2. Lab results are deeply personal. Your test results reveal diagnoses, prescriptions, lifestyle details, and conditions you may not have shared with anyone outside your doctor's office.

3. Scams can feel unnervingly real. Ross Filipek, CISO at Corsica Technologies, told Cybernews that a scam referencing real test results "can feel far more credible than a generic phishing email."

4. You can't change your medical history. Filipek also noted that patients can't simply replace their medical history after an exposure, according to Cybernews. Unlike a credit card you can cancel, your health records are permanent.

5. Mainstream coverage grew fast. AP, CNBC, Fox Business, Cybernews, and MedTech Dive all reported the breach on October 22-23, 2026, signaling it's a developing national story.

#The phishing risk: scams that reference your real test results

The most immediate danger isn't the data itself. It's what scammers will do with it.

Expect messages that feel disturbingly accurate:

• "Your recent lab test for [condition] requires follow-up. Click here to schedule."
• "There's an issue with your [specific test name] results. Verify your account."
• "Quest needs you to update your insurance for your recent [real test type]."

The scam feels real because it mentions details only you and your doctor should know.

Red flags to watch for:

• Texts, emails, or calls claiming to be from Quest or your doctor's office asking you to click a link, verify your account, or provide payment information.
• Messages with urgent language: "Immediate action required" or "Your results are ready, confirm now."
• Requests to download an attachment or enter personal information like payment details.

The rule: Never click links in unsolicited messages. If you need to check your Quest results, go to questdiagnostics.com or your doctor's patient portal by typing the URL yourself. If someone calls claiming to be from Quest, hang up and call Quest's customer service at the number on their official website.

#What to do if you're a Quest patient

#1. Watch for phishing that references your lab work

For the next few weeks, be suspicious of any unsolicited message that mentions:

• Your test results or lab orders
• Your doctor's office or clinic
• Quest Diagnostics or Quanum
• A need to "verify" your account or "update" your information

Do not click links. Go to the official site yourself.

#2. Monitor your accounts and credit

Once Quest determines what data was accessed, watch for:

• Unauthorized medical appointments or prescriptions in your name
• Medical bills for services you didn't receive
• New accounts or credit inquiries you don't recognize

Check your credit report at AnnualCreditReport.com (the official free site for US consumers). You're entitled to one free report per year from each of the three major bureaus: Equifax, Experian, and TransUnion.

Check your Explanation of Benefits (EOB) from your health insurer. Look for claims you don't recognize.

#3. Consider a credit freeze

If Quest later confirms your records were exposed and included sensitive personal identifiers, consider placing a credit freeze with all three credit bureaus:

• Equifax: equifax.com/personal/credit-report-services/credit-freeze
• Experian: experian.com/freeze/center.html
• TransUnion: transunion.com/credit-freeze

A freeze prevents anyone from opening new credit accounts in your name. It's free, and you can lift it temporarily when you need to apply for credit yourself.

#4. If Quest notifies you, read the details

If you receive an official breach notification from Quest, read it carefully. The notification will typically tell you:

• What data of yours was exposed
• Whether Quest is offering free credit monitoring or identity protection services
• How to contact Quest with questions
• What steps Quest recommends

Do not click links in the notification email. Go to questdiagnostics.com yourself and look for a breach information page, or call Quest customer service at the number on their official website.

Keep the notification for your records. You may need it if you later have to dispute fraudulent medical bills or credit accounts.

#5. Review your patient portal and billing

Log in to your Quest MyQuest account (by going to questdiagnostics.com yourself) and check:

• Your recent test orders and results
• Any changes to your contact information or account details
• Billing statements for tests you didn't authorize

If you see anything suspicious, call Quest customer service immediately using the number on their official website.

#6. Report fraud if it happens

If someone uses your information for fraudulent medical claims, prescriptions, or credit accounts:

1. File a report with the FTC at IdentityTheft.gov. This creates an official identity theft report and gives you a recovery plan.
2. Contact your health insurer and dispute any fraudulent claims on your Explanation of Benefits.
3. Notify your doctor's office so they can flag your records and watch for unusual activity.
4. Dispute fraudulent credit accounts with the three credit bureaus.
5. Contact your state Attorney General or health department if you believe your medical records were misused.

#Reduce your exposure: remove your data from people-search sites

Here's the connection most people miss. When scammers have breach data plus your contact details from people-search sites and data brokers, they can craft phishing that's even more convincing.

UndoLeak erases your data from data brokers and keeps it off. Fewer public listings mean fewer ways scammers can reach you. Run our free people-search check to see where your phone number and address are listed, then opt out.

#A fictional example

Maria Santos, a teacher in Phoenix, had routine bloodwork done through Quest in August 2026. On October 23, she saw news of the Quest breach and realized her results might be in the system.

She:

1. Made a note in her phone to ignore any unsolicited texts or emails about her lab results.
2. Went to AnnualCreditReport.com and requested her free credit report from Equifax. She saw no unfamiliar accounts or inquiries.
3. Checked her health insurer's website and reviewed her recent Explanation of Benefits. Everything matched her actual appointments.
4. Saved Quest's customer service number from questdiagnostics.com in her contacts so she'd recognize a real call.
5. Ran a people-search check and found her phone number and address listed on three sites. She opted out of each.

Four days later, Maria got a text: "Your recent Quest lab results require follow-up. Review now: [link]." The message looked official and mentioned Quest by name, but Maria had not had any recent tests. She deleted it without clicking and logged in to her MyQuest account directly. There were no alerts. The text was a scam.

#How healthcare breaches happen

Healthcare organizations are frequent targets because they hold some of the most sensitive data that exists: your diagnoses, prescriptions, test results, and personal identifiers in one place.

Common causes of healthcare breaches include:

Quest has not disclosed how the attacker gained access to Quanum LSM or whether ransomware was involved. The company's SEC filing focused on the fact of unauthorized access, not the method.

#Quest's response

According to Quest Diagnostics' SEC Form 8-K filed October 22, 2026, Quest:

1. Discovered the unauthorized access on October 21, 2026.
2. Notified federal law enforcement.
3. Engaged external cybersecurity experts to investigate.

According to Quest's website notice as reported by Cybernews, Fox Business, and MedTech Dive:

4. Paused access to Quanum Lab Services Manager after discovering the breach.
5. Committed to make notifications as required by law once the investigation determines the specific data and number of people affected.

Quest has not said whether affected customers will receive free credit monitoring, identity protection, or other support services. That information may come once Quest issues formal breach notifications.

#Timeline

#If you're not a Quest patient

Even if you've never used Quest, this breach is a reminder to:

• Never click links in unsolicited medical messages. Always go to your doctor's portal or lab website yourself.
• Check your credit and medical EOB regularly so you catch fraud early.
• Remove your contact details from people-search sites so scammers have less information to work with when they craft phishing messages.

#Sources

1. Quest Diagnostics Incorporated, SEC Form 8-K, Item 8.01 (filed Oct 22, 2026; date of report Oct 21, 2026). https://www.sec.gov/Archives/edgar/data/1022079/000094787126000941/ss6979200_8k.htm
2. Cybernews, "Quest Diagnostics breach puts patient data at risk" by Stefanie Schappert (Oct 23, 2026). https://cybernews.com/news/quest-diagnostics-patient-data-breach/
3. Fox Business, "Quest Diagnostics confirms patient information accessed in cyberattack, systems temporarily shut down" (Oct 23, 2026). https://www.foxbusiness.com/technology/major-medical-testing-company-quest-diagnostics-hit-cyberattack-patient-records-risk
4. MedTech Dive (Oct 23, 2026). https://www.medtechdive.com/news/quest-diagnostics-hit-by-cyberattack/833785/
5. AP (Oct 22, 2026). https://apnews.com/article/quest-cyber-breach-82dbe1fa6ba06cf6514bc16f73e64fe1
6. CNBC, "Quest Diagnostics reports cyber breach affecting 'certain patient records'" (Oct 22, 2026). https://www.cnbc.com/2026/10/22/quest-diagnostics-reports-cyber-breach-of-certain-patient-records.html
7. FTC IdentityTheft.gov, data breach and identity theft recovery. https://www.identitytheft.gov/
8. AnnualCreditReport.com, official source for free credit reports. https://www.annualcreditreport.com/

Maria Santos and her details are fictional.