Quest Diagnostics data breach: what patients should do now

If your doctor orders lab work from Quest Diagnostics, the Quest Diagnostics data breach disclosed last week may involve your records. Quest confirmed on October 22, 2026, that an unauthorized party accessed Quanum Lab Services Manager (LSM), the portal clinics use to order tests and view results, and that the access reached personal information and patient records. It hasn’t yet said whose records, or which data fields, the attackers took.

Below: what Quest has confirmed, what’s still unknown, and the steps that protect you now, before any notification letter arrives. We checked the facts against Quest’s incident notice and FAQs, its SEC filing, and reporting from BleepingComputer, TechCrunch and Malwarebytes, most recently on October 27, 2026.

What happened in the Quest Diagnostics data breach

Quest says it learned of the unauthorized access on Wednesday, October 21, 2026. The next day it filed a Form 8-K with the U.S. Securities and Exchange Commission and paused Quanum LSM. As a precaution it also paused two other provider tools, Essential Insights and LabHQ, and says the attackers didn’t reach data in those.

Note that Quanum LSM is not the app patients use. It is a web platform for physicians, hospital staff and medical office staff to order lab tests, track their status and pull results. TechCrunch reports Quest describes Quanum as used by about half a million clinicians across North America, which is why the pool of potentially affected patients could be large even though Quest has not given a number.

Quest says the unauthorized access has ended, and a later October 23 update to its notice described the incident as “remediated” and the system as restored for clients. Quest also says the incident isn’t related to the PHP vulnerability federal officials warned about the same week.

What the Quest Diagnostics data breach exposed, and what’s still unknown

Quest’s FAQ says that, so far, the incident affected personal information and patient records. Everything below the first two rows of this table is unconfirmed as of October 26, 2026.

Question	Status (Oct 26, 2026)
Was patient data accessed?	Yes. Quest confirmed the incident affected personal information and patient records.
Which system?	Quanum Lab Services Manager (LSM). Quest says the attackers didn’t access Essential Insights or LabHQ data.
How many people?	Not disclosed.
Social Security numbers, insurance IDs, test results?	Not disclosed. Malwarebytes notes Quest hasn’t said whether the stolen data includes any of these.
Who did it?	No group had claimed the attack as of BleepingComputer’s October 23 report.
Will Quest notify me?	Quest says affected patients will get letters describing resources, including credit and identity monitoring. HIPAA requires notice without unreasonable delay and within 60 days of discovery, which points to about December 20, 2026, at the latest.

That gap matters, because the risks differ. A leak of names and test orders creates a phishing risk. By contrast, a leak that includes insurance member IDs creates a medical identity theft risk, where someone bills care to your plan. Until Quest says which applies, the sensible move is to cover both.

Who the Quest Diagnostics data breach might affect

The exposure involves orders and results that moved through Quanum LSM, so the patients most at risk are those whose doctor’s office or clinic used that portal to order Quest tests. Quest says the breach didn’t touch orders placed through a provider’s own electronic medical record (EMR) system or a direct lab interface. Since you usually can’t see which method your clinic used, if you had Quest lab work recently, assume you could be in scope until a letter says otherwise.

6 steps to take after the Quest Diagnostics data breach

Block scams and check for misuse

1. Ignore unsolicited breach messages. Quest says it will notify affected patients by letter. If a call, text or email claims to be from Quest and asks you to confirm your date of birth, insurance number or a payment, hang up or delete it. To check anything, type questdiagnostics.com into your browser yourself or call 1-866-MYQUEST (1-866-697-8378), the number Quest lists on its notice. Our guide to spotting fake delivery texts covers the same red flags these scams use.
2. Read your insurance statements. Log in to your health plan’s site or app and open your Explanation of Benefits (EOB) history for the last few months. Then look for lab tests, visits or prescriptions you didn’t get. Report anything odd to your insurer’s fraud line and to the provider that billed it.
3. Check your credit reports. Get free reports from Equifax, Experian and TransUnion at AnnualCreditReport.com, the official site. In particular, look for accounts or hard inquiries you don’t recognize.

Lock down your credit and accounts

4. Consider a credit freeze. A freeze is free at all three bureaus and stops anyone opening new credit in your name. Also, it doesn’t affect your current cards or your credit score, and you can lift it temporarily when you apply for credit. This only matters if the stolen data turns out to include Social Security numbers, but it costs nothing to set up now.
5. Lock down the accounts scammers will target next. Turn on two-step verification for your email and your insurance portal. Here’s how to set up two-step verification on Google and Microsoft accounts.
6. When the letter arrives, verify it, then enroll. Quest says the letters will explain what the attackers accessed and offer credit and identity monitoring. Before using any enrollment code, compare the letter’s details with Quest’s official incident notice. Real breach letters never ask you to pay to enroll.

If you spot signs of identity theft

Go to IdentityTheft.gov, the Federal Trade Commission’s site, to report it and get a step-by-step recovery plan. For medical identity theft, also ask the provider that billed the fake service for a copy of your records. Under HIPAA you have the right to request copies and to ask in writing for the provider to amend incorrect entries, which keeps someone else’s diagnoses or tests out of your file.

FAQ

Was the MyQuest app or patient portal hacked?

Quest’s notice names Quanum LSM, a provider-side system, and doesn’t say the attackers reached MyQuest patient accounts. If you reuse your MyQuest password elsewhere, changing it is still good practice.

Will the breach delay my lab results or appointments?

Quest says it does not expect delays in appointment scheduling or result turnaround. Meanwhile, Quest told clinics that used Quanum LSM to switch to paper requisitions or Quanum eLabs while the portal was offline.

How many patients did the Quest Diagnostics data breach affect?

Quest hasn’t said. As of October 27, 2026, it had not published a number. Its 2019 incident, a breach at billing vendor AMCA, involved about 11.9 million Quest patients, but that was a different system and a different company, so it says nothing about the size of this one.

Is there a class action lawsuit?

Several law firms announced investigations within days of the disclosure. Even so, that doesn’t change the steps above, and you don’t need to sign up with a firm to receive Quest’s notification letter or any monitoring it offers.

What to do today

First, open your health insurer’s app today and scan your recent claims; it takes five minutes and catches the most damaging kind of misuse first. Then bookmark Quest’s Quanum notice page, which Quest says it will update as the investigation continues. We’ll update this guide if Quest discloses the affected data types or numbers.

Related guides

• Capcom Data Breach: What to Do If You Have a CAPCOM ID
• SkyKick Breach: How to Check Your Microsoft 365 Tenant
• AI agents hacked 100+ online stores: how to check yours

Sources

• Quest Diagnostics: Quanum incident notice and FAQs (updated Oct 23, 2026)
• BleepingComputer: Quest Diagnostics confirms data breach exposed patient records (Oct 23, 2026)
• TechCrunch: Quest confirms patients’ personal and health data was compromised (Oct 23, 2026)
• Malwarebytes: Patient records exposed in Quest breach (Oct 26, 2026)
• Fox Business: Quest confirms patient information accessed (Oct 22, 2026)