Quest Diagnostics reports unauthorized access to lab results platform

Quest Diagnostics said in a filing with the Securities and Exchange Commission on Thursday that an unauthorized actor accessed its Quanum Lab Services Manager platform. The company discovered the incident on Wednesday and reported it to federal law enforcement, according to the filing. Quest said it believes "certain patient records" were accessed. The full scope of the exposure is still being investigated, and the company has brought in external cybersecurity experts to help. Quest did not say how many people were affected. The company told The Associated Press the breach was unrelated to the PHP vulnerabilities disclosed earlier this week.

Quest has reported other breaches of patient information in the past. In 2016, a breach exposed lab results and contact details for about 34,000 people. In 2019, a hack at American Medical Collection Agency, a billing collections vendor, affected information belonging to about 11.9 million Quest patients.

Healthcare data breaches continue at high rates. The HIPAA Journal reported that 2025 set a new annual record with 772 data breaches affecting 500 or more individuals reported to the U.S. Department of Health and Human Services Office for Civil Rights. In 2025, large healthcare data breaches were reported at an average rate of 2.1 per day, and an average of 379,306 individuals were affected each day, according to the publication. Between 2009 and 2025, 7,418 such breaches exposed 1,013,066,481 individuals, a figure that is more than 2.9 times the U.S. population. The largest single breach recorded by OCR was the 2024 Change Healthcare ransomware attack, which affected an estimated 192.7 million people. Anthem's 2015 breach affected 78.8 million, and Conduent Business Services reported 62.2 million affected in 2025, according to The HIPAA Journal.

Other healthcare organizations have faced similar incidents. Ascension Health said that a May 2024 ransomware attack compromised sensitive data of 5.6 million patients, including medical record numbers, lab tests, Social Security numbers and passport details, according to a filing reported by Mashable. The attack disrupted patient portals, files, elective services, and ambulance diversions, according to TechRadar's report on the filing. CNN previously linked the attack to the Black Basta ransomware group, but Ascension did not identify the hackers, Mashable reported. UnitedHealth paid hackers $22 million after a 2024 attack that affected more than 100 million people, Mashable reported. It is not clear if Ascension paid a ransom to get its systems back online, according to Mashable.

Update, October 24, 2026

Quest Diagnostics suspended access to the Quanum Lab Services Manager portal Wednesday after discovering an unauthorized party had entered it, DysruptionHub reported, leaving providers without one channel for ordering tests and viewing results. In its SEC filing, Quest said the intrusion had not significantly interrupted business operations or patient care, but the portal suspension removed that ordering and results channel. The company's incident notice and FAQ state that patient health and personal information was accessed; Quest is still working out which patients and records are affected and says it will inform them. During the outage, providers could place orders through another online platform or send paper orders by fax, and results could be retrieved through that alternative platform, by phone, or by electronic fax, according to the report. Quest also restricted two other platforms as a precaution, saying no data in either was accessed; interfaces linking clients' lab and electronic medical record systems stayed up. The company has not identified an attacker or said how the intruder gained entry. A Friday notice said the unauthorized access stopped, but the service limits remained; Quest had expected full functionality to return by Friday, and the notice did not confirm that happened.