U.S. Patient Records Exposed in Latest Quest Diagnostics Data Breach

You might have used Quest Diagnostics for routine bloodwork, lab testing, or follow-up results through your doctor. Now, sensitive health and personal information tied to some patient records could have been accessed.

Quest Diagnostics learned of unauthorized access to its Quanum Lab Services Manager system on October 21, 2026, and disclosed it in an SEC filing the next day without saying how many patients were affected.^[1]

The company believes certain patient records were accessed, and its website notice says patients' protected health information and personally identifiable information were involved. Quest is still investigating the specific kinds of data involved.^[2]

Here's what happened, what it means, and what steps to take.

What happened in the Quest Diagnostics data breach

According to its SEC filing, Quest Diagnostics learned of unauthorized access to its Quanum Lab Services Manager system on October 21, 2026. The company said it promptly started its incident response procedures to contain the activity and investigate the scope of the breach.

The affected Quanum Lab Services Manager platform is used by certain Quest clients to place test orders and receive or look up results. That means the potentially affected group is patients whose records were stored in or accessed through that system.

While the full scope remains under investigation, the company believes certain patient records were accessed. The broad data categories reported so far are:

• Protected health information
• Personal information
• Patient records

A notice on Quest's website says some patient data within the system was accessed and confirms that protected health information and personally identifiable information were involved. The company is still working to determine the specific data affected.

Federal law enforcement has been notified, and external cybersecurity experts are helping with the investigation. After discovering the breach, Quest temporarily paused access to the Quanum Lab Services Manager system. As of the evening of October 23, the company said it had remediated the incident and restored the system for clients.

Quest says its core business operations weren't affected and that the incident isn't related to the PHP vulnerability federal officials have urged companies to patch.

No hacking group had publicly claimed responsibility for the incident as of Thursday afternoon, according to The Record.

What this means for Quest Diagnostics patients

Health data is personal in a way a credit card number isn't. Lab records can reveal medical conditions, medications, tests, doctors, insurance relationships, and other details that can be used to scam you or impersonate you.

Medical data can fuel highly believable scams. A criminal doesn't need every detail in your chart to make a fake billing call, insurance email, or lab-results message sound real.

Personal information can also be combined with other exposed data from the dark web or data brokers. That can make phishing, account takeover attempts, and medical identity theft harder to spot.

According to an identity theft survey by All About Cookies, data breaches are the leading cause of identity theft. Nearly two in five identity theft victims (38%) said a data breach was how criminals accessed their information.

The risk can last. You can replace a payment card, but you can't easily replace a medical history. If your patient data was exposed, you might need to watch health care statements, insurance claims, and suspicious messages for months or longer.

What to do right now

If you recently used Quest Diagnostics or your provider uses Quest for lab testing, take these steps now.

1. Watch for Quest or provider notices. Quest has not yet disclosed how many patients were affected, so check your mail, email, patient portal, and messages from your doctor or lab provider. HIPAA generally requires notice within 60 days of discovering a breach. Quest says its notification letters will include credit and identity monitoring resources, so follow the enrollment instructions before any deadline.
2. Review your health care and insurance records. Look for lab tests, claims, bills, prescriptions, or explanation-of-benefits notices you don't recognize. If something looks wrong, contact your insurer, provider, or Quest through a verified phone number, not a link in an email.
3. Monitor your identity and credit. Health data can be used with other personal details to open accounts or commit fraud. Consider a reputable identity theft protection service, especially if future notices say more sensitive identifiers were involved.
4. Be alert for medical phishing. Treat unexpected messages about lab results, overdue bills, insurance problems, or refund requests as suspicious. Don't click links or provide personal details until you independently confirm the request with Quest, your doctor, or your insurer.
5. Tighten your account security. Reused passwords can turn one breach into a bigger problem. Update reused passwords on health care, insurance, and email accounts, turn on two-factor authentication, and use a password manager to create unique logins.
6. Reduce the personal data scammers can find about you. A data removal service can help limit information exposed by data brokers, which could make targeted scams less convincing. If you see signs that someone is using your identity, act quickly and keep records of every call, claim, and dispute.

Bottom line

Quest Diagnostics says patient health information or patient-identifiable information was involved in unauthorized access to its Quanum Lab Services Manager system. The system is back online, but Quest is still working to identify which patients and data were affected.

Watch for a direct notice, review your medical and insurance records, and be skeptical of messages about lab results or bills. Quest says its notification letters will include credit and identity monitoring resources, so enroll before the stated deadline.

4.8

AllAboutCookies writers and editors score products based on a number of objective features as well as our expert editorial assessment. Our partners do not influence how we rate products.

Editorial Rating

See Price

On Aura Identity Theft's website

2026 Editors’ Choice

Best Overall Identity Theft Protection Service

Identity Protection

Aura Identity Theft

• ID theft protection that monitors your SSN, bank accounts, credit cards, and brokerage and retirement accounts for suspicious activity
• Every plan includes the full feature set, so no additional cost to unlock monitoring, insurance, or restoration
• Bundles data removal with identity theft protection, antivirus, VPN, and a password manager in one subscription

Author Details

Kalleigh Lane

About the Author

Kalleigh Lane is the Managing Editor at All About Cookies, where she helped develop the site's star rating system for product reviews and specializes in testing VPNs, ad blockers, and parental controls on Android and PC. She brings more than five years of experience editing and writing across cybersecurity, tech, and finance, and she has authored and edited over 300 articles for All About Cookies. Before joining AAC, she worked as a journalist and editor at CTV News and the Globe and Mail, and she holds a Master of Arts in English Literature from the University of Toronto.