Threat reportData BreachTL-2026-4282
Quest Diagnostics Quanum LSM Unauthorized Access Exposes Patient Records
Quest Diagnostics Quanum LSM Unauthorized Access Exposes (TL-2026-4282), also tracked as Quest Diagnostics Quanum LSM breach, is a high-severity data breach, first published 2026-10-23. It has no confirmed attribution, affects Quest Diagnostics Quanum Lab Services Manager (LSM), maps to 5 MITRE ATT&CK techniques (T1078, T1190, T1213), and is covered by 9 detection rules and 11 indicators of compromise.
- Severity
- HIGHAssessed severity
- CVEs
- 0None referenced
- Techniques
- 5MITRE ATT&CK
- Actors
- 0Not attributed
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 11Indicators of compromise
Key facts for TL-2026-4282
- Threat ID
- TL-2026-4282
- Also known as
- Quest Diagnostics Quanum LSM breach
- Severity
- HIGH
- Status
- ACTIVE
- Category
- DATA_BREACH
- First published
- Last reviewed
- Attribution confidence
- LOW
- Motivation
- UNKNOWN
- Target sectors
- health
- Target regions
- North America
- Detection rules
- 9
- Indicators of compromise
- 11
How Quest Diagnostics Quanum LSM Unauthorized Access Exposes works
Quest Diagnostics disclosed on 2026-10-22 (SEC Form 8-K) that an unauthorized party accessed certain patient records in its Quanum Lab Services Manager (LSM) system, discovered on 2026-10-21. Affected data types and victim count are undetermined and no threat actor has claimed the intrusion.
On 2026-10-21 Quest Diagnostics Incorporated learned of unauthorized access to Quanum LSM, an online platform that physicians, hospital personnel and medical office staff use to manage laboratory services, place test orders, track status, look up results and order supplies. The company activated its cybersecurity incident response procedures, temporarily paused access to Quanum LSM to contain the activity, notified federal law enforcement and engaged external cybersecurity experts. Quest states it believes an unauthorized party accessed certain patient records; the full scope remains under investigation.
Quest reported the incident in an SEC Form 8-K (Item 8.01) dated 2026-10-22, stating it has not materially disrupted business operations or its ability to serve patients, and that direct laboratory system connections and electronic medical records were not affected. Customers were directed to alternative ordering channels (paper requisitions, fax, direct interfaces, Quanum eLabs); access to the related Essential Insights and LabHQ offerings was also temporarily paused. Quest told local media the incident was not related to the widely reported PHP vulnerability.
No initial access vector, vulnerability/CVE, malware, tooling, network indicators or threat actor has been disclosed, and BleepingComputer and HIPAA Journal found no group claiming the attack. The data types exposed and the number of affected individuals have not been disclosed. The MITRE mappings below are low-confidence, generic techniques for unauthorized access to a web-based patient-records platform and are NOT confirmed by any source; they should be revised when Quest publishes forensic details. Context: Quest was previously affected by the 2019 American Medical Collection Agency (AMCA) third-party breach (about 11.9 million patients), which led to consolidated multidistrict class-action litigation. Quest serves roughly one in three U.S. adults per year, operating about 7,700 points of service, with about 65,000 employees and over $11 billion in annual revenue.
MITRE ATT&CK techniques used in TL-2026-4282
Initial Access
T1078 Valid Accounts; T1190 Exploit Public-Facing Application
Collection
T1213 Data from Information Repositories; T1530 Data from Cloud Storage
Exfiltration
Affected products and versions in Quest Diagnostics Quanum LSM Unauthorized Access Exposes
- Quest Diagnostics — Quanum Lab Services Manager (LSM)
Vulnerable versions: Not disclosed - Quest Diagnostics — Essential Insights and LabHQ (access temporarily paused)
Remediation for Quest Diagnostics Quanum LSM Unauthorized Access Exposes
Immediate actions
- Quest customers: use paper requisitions, fax, direct interfaces or Quanum eLabs while Quanum LSM, Essential Insights and LabHQ access is paused
- Review Quanum LSM user accounts and audit logs for anomalous logins, bulk result lookups and exports around 2026-10-21
- Reset credentials and enforce MFA for all Quanum LSM/LabHQ/Essential Insights users when access is restored
Workarounds
- Use alternative ordering channels until Quest restores Quanum LSM
Longer-term hardening
- Monitor Quest Diagnostics notices and SEC 8-K amendments for confirmed data types and affected counts
- Assess HIPAA breach notification obligations for client practices if patient data of their patients was exposed
- Apply third-party/vendor risk review to lab-ordering and results portals
Timeline of Quest Diagnostics Quanum LSM Unauthorized Access Exposes
- Earlier Quest Diagnostics incident in 2016 exposed data on approximately 34,000 people (per WMBF; exact date not stated, historical context only)
- Quest Diagnostics discloses the earlier AMCA third-party billing-vendor breach affecting about 11.9 million patients, later consolidated into multidistrict class-action litigation (historical context)
- Quanum LSM access is temporarily paused to contain the activity; Essential Insights and LabHQ access also paused; customers directed to paper requisitions or Quanum eLabs
- Quest Diagnostics learns of unauthorized access to its Quanum LSM system and initiates incident response procedures
- Quest files an SEC Form 8-K (Item 8.01) stating an unauthorized party accessed certain patient records, that federal law enforcement was notified and external cybersecurity experts engaged
- BleepingComputer and HIPAA Journal report the breach; scope and victim count undetermined and no threat group has claimed responsibility
Sources cited for Quest Diagnostics Quanum LSM Unauthorized Access Exposes
- Quest Diagnostics confirms data breach exposed patient records (BleepingComputer)
- Quest Diagnostics Form 8-K (Item 8.01) - unauthorized access to Quanum LSM
- Patient Data Likely Accessed in Quest Diagnostics Hack (HIPAA Journal)
- Quest Diagnostics reports 'unauthorized access' to its Quanum Lab Services Manager (WMBF)
- Quest Diagnostics reports unauthorized access to lab system, says patient information may have been compromised (WRNJ Radio)
- Quest Diagnostics Reports Unauthorized Access of Patient Records (Gizmodo)
Detection coverage for TL-2026-4282
As of 2026-10-23, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-4282 across Splunk SPL, Microsoft KQL and Sigma, covering 11 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.