Quest Diagnostics disclosed in an SEC filing dated October 22, 2026, that it detected unauthorized access to its Quanum Lab Services Manager system on October 21. Clients use Quanum LSM to place test orders and retrieve results. Quest paused access to the system when it found the activity, notified federal law enforcement, and engaged outside cybersecurity forensics.
The company believes an unauthorized party accessed certain patient records, but it has not said how many, what specific data, or how long the access lasted. Quest told investors the incident has not materially disrupted its business operations or its ability to serve patients, a line it repeated on its third quarter earnings call the same week without adding further detail.
This is not Quest's first vendor adjacent breach disclosure. In 2019 the company disclosed that American Medical Collection Agency, a billing collections vendor, had exposed data on up to 11.9 million Quest patients, including Social Security numbers and payment information. That incident sits behind the $2.3 million settlement Labcorp, also an AMCA client, reached with 44 state attorneys general this fall. The new incident runs through Quest's own systems rather than a vendor's, a different exposure than 2019, but it lands in the same year the regulatory consequences of the last one finally closed.
Quest's disclosure adds to a run of 2026 cyber incidents at diagnostics and device makers that already includes Stryker, Boston Scientific, Medtronic, Abbott, Intuitive Surgical, iRhythm, and AdaptHealth. Lab services carry a wide attack surface of their own: ordering portals, result delivery systems, and HL7 feeds into hospital systems, all authenticating against the same patient identifying context that device manufacturers worry about protecting on the device side.
Disclosing before a scope figure exists is standard practice now. Investors and regulators increasingly accept an evolving investigation posture in a first filing, so long as the company follows up once the picture firms up. What to watch is whether Quest's next filing narrows certain patient records into an actual count, and how long that takes.