Quest Diagnostics discloses breach of lab-ordering platform, says certain patient records were accessed

Quest Diagnostics, one of the largest medical lab operators in the country, disclosed Thursday, Oct. 22, that an unauthorized party got into one of its systems and that it believes certain patient records were accessed.

The company said it learned of the intrusion on Wednesday, Oct. 21. It reported the incident in a regulatory filing the next day.

What Quest says was hit

The affected platform is the Quanum Lab Services Manager. Certain Quest clients use it to place test orders and to receive and look up results.

Quest said it paused access to the system once it detected the problem. It also paused several other tools for health care professionals "out of an abundance of caution," even though data in those tools was not affected, according to the company.

The company said the access has been discontinued. It described the investigation as ongoing and said it is working with external cybersecurity experts. Quest also said it notified federal law enforcement.

In a statement, Quest said patient health information and personally identifiable information were part of the unauthorized access, but that it is still working to determine which specific data was affected. "Some patient data within Quanum LSM was accessed, but other systems were not affected," the company said.

What Quest has not said

The company has not said how many patients are affected or which records were taken. It has not said how the intruder got in or who was behind it. No ransom demand has been disclosed.

Quest says business is continuing. "Our core business operations are not impacted and remain up and running," the company said. Providers that order tests through direct-customer lab information system interfaces or electronic medical records may keep placing orders, since those channels were not affected.

The company said it expected services to be fully restored by today, Oct. 23.

Quest also told The Associated Press that the breach is not related to the newly disclosed PHP vulnerabilities. Those flaws, found with AI assistance, have forced companies worldwide to patch systems this week. PHP underpins roughly 70% of websites globally.

Not Quest's first time

The New Jersey-based company has been through this before. In 2016, Quest said data including lab results and contact information for about 34,000 people was exposed in an online breach.

In 2019, personal information belonging to about 11.9 million Quest patients was affected after a separate hack at American Medical Collection Agency, a billing collections vendor.

Those incidents ran through different systems and, in 2019, through an outside contractor. The Quanum platform is Quest's own. Quest has said it will make notifications "as the covered entity," which puts the legal responsibility for telling patients on Quest.

A second healthcare breach in the headlines

The Quest disclosure lands the same month another large healthcare data incident came into view. The Texas Attorney General's data breach portal published an entry for Cerner on Oct. 2, 2026, listing 2,992,244 affected Texas residents. Cerner is the electronic health records company Oracle bought in June 2022 for about $28.3 billion, and it now operates as Oracle Health.

A nationwide figure of 19,929,149 people has been reported in connection with that filing. Oracle has not publicly confirmed the national total. The attack reportedly involved legacy Cerner systems and dates to early 2025.

The two cases are separate. Nothing in Quest's disclosure links it to Oracle Health or Cerner.

Lab records carry diagnoses, test results and identifying information in one place. Patients have no say in which vendor's platform their doctor uses. The people exposed in an incident like this usually never chose the company that lost their data.

The filing and Quest's statement give no timeline for determining which data was affected. Federal health privacy rules require covered entities to notify affected individuals after a breach, and Quest has committed to doing so. How many people get those notices, and what information they are told was taken, depends on an investigation that began only on Wednesday.

As of today, Oct. 23, the open questions are the count of affected patients, the categories of data involved and whether Quest's promised full restoration of the Quanum platform arrives on schedule.