# Quest Diagnostics Quanum LSM Unauthorized Access Exposes Patient Records

> Quest Diagnostics disclosed on 2026-10-22 (SEC Form 8-K) that an unauthorized party accessed certain patient records in its Quanum Lab Services Manager (LSM) system, discovered on 2026-10-21. Affected data types and victim count are undetermined and no threat actor has claimed the intrusion.

- **Published:** 2026-10-23T16:50:02Z
- **Last reviewed:** 2026-10-23T16:50:02Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-4282
- **ID:** TL-2026-4282
- **Severity:** HIGH
- **Category:** DATA_BREACH
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 11 (full data via the Threadlinqs MCP server — Purple tier)

## Description

On 2026-10-21 Quest Diagnostics Incorporated learned of unauthorized access to Quanum LSM, an online platform that physicians, hospital personnel and medical office staff use to manage laboratory services, place test orders, track status, look up results and order supplies. The company activated its cybersecurity incident response procedures, temporarily paused access to Quanum LSM to contain the activity, notified federal law enforcement and engaged external cybersecurity experts. Quest states it believes an unauthorized party accessed certain patient records; the full scope remains under investigation.

Quest reported the incident in an SEC Form 8-K (Item 8.01) dated 2026-10-22, stating it has not materially disrupted business operations or its ability to serve patients, and that direct laboratory system connections and electronic medical records were not affected. Customers were directed to alternative ordering channels (paper requisitions, fax, direct interfaces, Quanum eLabs); access to the related Essential Insights and LabHQ offerings was also temporarily paused. Quest told local media the incident was not related to the widely reported PHP vulnerability.

No initial access vector, vulnerability/CVE, malware, tooling, network indicators or threat actor has been disclosed, and BleepingComputer and HIPAA Journal found no group claiming the attack. The data types exposed and the number of affected individuals have not been disclosed. The MITRE mappings below are low-confidence, generic techniques for unauthorized access to a web-based patient-records platform and are NOT confirmed by any source; they should be revised when Quest publishes forensic details. Context: Quest was previously affected by the 2019 American Medical Collection Agency (AMCA) third-party breach (about 11.9 million patients), which led to consolidated multidistrict class-action litigation. Quest serves roughly one in three U.S. adults per year, operating about 7,700 points of service, with about 65,000 employees and over $11 billion in annual revenue.

## MITRE ATT&CK

- T1190 Exploit Public-Facing Application
- T1078 Valid Accounts
- T1213 Data from Information Repositories
- T1530 Data from Cloud Storage
- T1567 Exfiltration Over Web Service

## Sources

- [Quest Diagnostics confirms data breach exposed patient records (BleepingComputer)](https://www.bleepingcomputer.com/news/security/quest-diagnostics-confirms-data-breach-exposed-patient-records/)
- [Quest Diagnostics Form 8-K (Item 8.01) - unauthorized access to Quanum LSM](https://www.sec.gov/Archives/edgar/data/0001022079/000094787126000941/ss6979200_8k.htm)
- [Patient Data Likely Accessed in Quest Diagnostics Hack (HIPAA Journal)](https://www.hipaajournal.com/quest-diagnostics-data-breach-2026/)
- [Quest Diagnostics reports 'unauthorized access' to its Quanum Lab Services Manager (WMBF)](https://www.wmbfnews.com/2026/10/22/quest-diagnostics-reports-cyber-breach-affecting-certain-patient-records/)
- [Quest Diagnostics reports unauthorized access to lab system, says patient information may have been compromised (WRNJ Radio)](https://wrnjradio.com/quest-diagnostics-reports-unauthorized-access-to-lab-system-says-patient-information-may-have-been-compromised/)
- [Quest Diagnostics Reports Unauthorized Access of Patient Records (Gizmodo)](https://gizmodo.com/quest-diagnostics-reports-unauthorized-access-of-patient-records-2000829419)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-4282