Quest Diagnostics, one of the largest clinical laboratory companies in the United States, has confirmed that an unauthorized party accessed one of its systems and that certain patient records were exposed. In a filing with the Securities and Exchange Commission, the company said it learned of the intrusion on October 21, 2026.
The affected system is Quanum Lab Services Manager, a platform that doctors’ offices, hospitals and other practices use to order lab tests, view results and handle billing. As a precaution, Quest said it paused access to that system and to two related services, Essential Insights and LabHQ.
The company has not said how many patients or healthcare customers were affected, or exactly which types of data were taken, and says its investigation is ongoing. Quest said it notified law enforcement and brought in outside cybersecurity experts, and that its core operations and ability to serve patients have not been materially disrupted. Quest told the Associated Press the incident is not related to the newly disclosed PHP2Shell vulnerabilities.
It is not the first time Quest patients have been caught up in a breach. In 2019, a compromise at a billing vendor, AMCA, exposed data tied to about 11.9 million Quest patients.
What patients can do now
Quest has said it will notify affected individuals. Until then, patients should watch for unexpected bills or explanation-of-benefits statements, treat unsolicited calls and emails about lab results with caution, and never share login codes or payment details with anyone who contacts them first.
Sources: TechCrunch, BleepingComputer, NBC News.
Image: illustration created for AABEAT TV. It does not depict the people, places or products named in this story.
