If you have had lab work through Quest Diagnostics, watch your mail for a breach letter and act now. Quest confirmed on October 22, 2026 that an intruder accessed "certain patient records" in its Quanum Lab Services Manager platform. Until the scope is known, freeze your credit, check your insurer's Explanation of Benefits statements, and beware of Quest-themed phishing.
What Happened in the Quest Diagnostics Data Breach?
Quest Diagnostics, one of the largest clinical lab companies in the United States, disclosed the incident in an SEC 8-K filing and a public notice. Here is what has been confirmed so far:
- October 21, 2026: Quest learned of unauthorized access to Quanum Lab Services Manager (LSM), the web platform doctors' offices, hospitals and clinics use to order tests and look up results.
- October 22, 2026: Quest filed an 8-K stating it believes an unauthorized party "accessed certain patient records" and that "the full scope of unauthorized access remains under investigation." It notified federal law enforcement and brought in outside cybersecurity experts.
- October 23, 2026: Quest's public notice said personal information and patient records were affected. It took Quanum LSM offline and paused access to two other provider tools, Essential Insights and LabHQ, as a precaution, although it reported no data was accessed in those two.
Quest says the incident did not disrupt its customer-facing operations, that providers using direct lab interfaces or electronic medical record (EMR) connections were not affected, and that the attack was unrelated to a PHP vulnerability disclosed the same week. As of this writing, no hacking group has publicly claimed the attack.
The Numbers Are Not Known Yet
Quest has not said how many patients are affected or exactly which data fields were exposed. According to Quest's own figures cited by TechCrunch, Quanum is used by roughly half a million clinicians across thousands of North American locations, so the pool of potentially exposed patients is large. Treat the guidance below as precautionary until your notification letter tells you exactly what was taken.
What Data Could Have Been Exposed?
Quanum LSM sits between your doctor and the lab, so the records it holds typically include:
- Full name, date of birth, address and phone number
- Health insurance member and group numbers
- Ordering physician and practice details
- Test orders, diagnosis codes and lab results
- Billing information tied to those orders
Quest has not confirmed whether Social Security numbers or payment card data were included. Even without them, an insurance ID plus date of birth is enough for medical identity theft: someone billing procedures, prescriptions or equipment to your health plan.
Is This Quest's First Breach?
No. In 2019, a cyberattack on the American Medical Collection Agency (AMCA), a billing collections vendor, exposed records of about 11.9 million Quest patients. That incident led to consolidated class-action litigation. The 2026 incident is different in one important way: it hit a Quest-run platform directly rather than a third-party vendor.
Is your data already out there?
Leaked data ends up on broker sites and in scammers' hands. Run a free 60-second scan to see your exposure — then let us remove it.
Run a free scan★★★★★ 4.8/5 · Trusted by thousands of families
What to Do Right Now: 6 Steps
Step 1: Freeze your credit at all three bureaus
A freeze is free, takes about 15 minutes, and stops anyone from opening new credit in your name even if your SSN later turns out to be in the data. Follow our guide to freezing your credit at Equifax, Experian and TransUnion. You can lift it temporarily whenever you need to apply for credit.
Step 2: Review your Explanation of Benefits statements
Log in to your health insurer's member portal and read every Explanation of Benefits (EOB) from the past six months and going forward. Look for tests, visits, prescriptions or medical equipment you never received. Report anything unfamiliar to your insurer's fraud line right away.
Step 3: Treat every "Quest" message as suspicious
Breach news is followed by phishing within days. Expect fake emails and texts about "your lab results," "breach compensation" or "verify your identity for credit monitoring." Do not click links in unexpected messages. Check status only through Quest's official site or by calling the number printed on your official letter.
Step 4: Watch for your official notification letter
Quest says it will notify affected patients by mail as required by law and that the letters will describe available resources, including credit and identity monitoring. When yours arrives, note the enrollment code and deadline and sign up promptly. Free breach monitoring is worth taking, but it only alerts you after something happens.
Step 5: Request your medical records if you see red flags
Under HIPAA you have the right to get copies of your records from your doctors and from Quest. If you find a diagnosis or test you never had, request an amendment so fraudulent entries do not follow you into future treatment or insurance decisions.
Step 6: Remove your data from people-search sites
Stolen health records are most damaging when criminals can match them to your current address, phone number, email and relatives. Data brokers sell exactly that, and they make a convincing "Quest Diagnostics billing" phone scam far easier to pull off. Removing your listings cuts that link.
Close the Gap Attackers Exploit
PrivacyOn removes your personal information from 100+ data broker and people-search sites, monitors 24/7 for re-listings, and includes dark web monitoring that alerts you if your details turn up in breach dumps. Plans start at $8.33/month, with family coverage for up to 5 people. Run a free scan to see where you are exposed today.
Can You Sue Quest Diagnostics?
Law firms have already announced investigations into the incident, which is typical after a breach disclosure at a company this size. Lawsuits usually wait for the notification letters, because those letters confirm who was affected and what data was involved. You do not need to do anything now to preserve a claim. Keep your letter, plus records of any fraud and the time or money spent dealing with it.
How This Fits the 2026 Healthcare Breach Wave
Quest joins a long list of healthcare incidents this year, including the CareCloud breach that exposed records of about 3.7 million patients. The pattern is consistent: medical data is permanent, it cannot be reissued like a credit card, and it gets resold for years. That makes the long-term defenses (credit freezes, EOB reviews and keeping your contact details off broker sites) more valuable than any single response. Our general guide on what to do after a medical data breach covers those habits in more depth. For a side-by-side look at removal tools, see the best data removal services of 2026.
Frequently Asked Questions
Was I affected by the Quest Diagnostics data breach?
Quest has not yet published a list or a count of affected patients. It says it is identifying impacted patients and providers and will notify them by mail. If you had tests ordered through a doctor's office that uses Quest, assume you could be affected and take the precautionary steps above until you hear otherwise.
What information was stolen in the Quest breach?
Quest has confirmed only that "personal information and patient records" in Quanum Lab Services Manager were accessed. It has not said whether Social Security numbers, insurance identifiers or payment data were included. Your notification letter should list the exact data types for your record.
Is Quest offering free credit monitoring?
Quest says its notification letters will describe available resources, including credit and identity monitoring. Enrollment details and deadlines will be in the letter itself. Never sign up through a link in an unsolicited email or text claiming to be from Quest.
Were MyQuest patient app accounts hacked?
Quest's disclosures name the provider-facing Quanum Lab Services Manager platform, not the MyQuest patient app. There is no public indication that MyQuest passwords were taken. Still, if you reuse your MyQuest password anywhere else, change it and turn on two-factor authentication.
How do I protect myself from medical identity theft after the breach?
Review every Explanation of Benefits from your insurer, ask your health plan to flag your account for fraud, request your medical records if you see unfamiliar services, and freeze your credit. Removing your address and phone number from data broker sites with a service like PrivacyOn makes it harder for criminals to use stolen records against you.
Is this the same as the 2019 Quest data breach?
No. The 2019 incident came from AMCA, a third-party billing collections vendor, and exposed about 11.9 million Quest patients. The October 2026 incident involves unauthorized access to Quest's own Quanum LSM platform and is a separate event.