Quest Diagnostics: unauthorized access to Quanum LSM exposed patient records
Severity: high · Patch status: no-fix-needed · Since 2026-10-23
Quest Diagnostics disclosed that on October 21, 2026 it learned of unauthorized access to its Quanum LSM system, the online platform clients use to place lab test orders and receive/look up results. The company believes certain patient records were exposed, but the number of affected patients and data types remain under investigation with external experts and law enforcement engaged. Quanum LSM has been taken offline; customers are directed to paper requisitions or Quanum eLabs, and access to Essential Insights and LabHQ was paused as a precaution. Customer-facing operations, direct LIS interfaces, and EMRs were reportedly unaffected. No threat group has claimed the attack, and Quest confirmed the breach is unrelated to the PHP2Shell vulnerabilities. Quest previously suffered breaches in 2016 (~34,000 people) and 2019 via AMCA (11.9 million patients).
What to do
- If you are a Quest Diagnostics client using Quanum LSM, switch to paper requisitions or Quanum eLabs for orders and results as recommended
- Monitor Quest Diagnostics communications for breach scope updates and notification requirements
- Review and rotate any credentials or API integrations tied to Quanum LSM and related Quest portals
- Assess whether your organization's patient data may have been exposed and prepare HIPAA breach-notification obligations
- Apply heightened monitoring for phishing targeting patients or staff referencing the Quest breach
Sources
All live incidents on Threat Watch
