On October 21, 2026, Quest Diagnostics learned that an unauthorized party had accessed Quanum Lab Services Manager. In a regulatory filing the next day, the laboratory company said it believes some patient records were accessed, without stating how many people or which data categories were involved. The investigation is ongoing.
What Quest’s filing establishes
Some clients use Quanum Lab Services Manager to order tests and receive or look up results. Quest says it began its response procedures, notified federal law enforcement and engaged outside specialists. The company has not described the entry point or how long access lasted.
Quest told the Associated Press that the incident was not related to the PHP vulnerabilities disclosed that same week. Available information does not attribute the access to a group or establish that ransomware was used.
The scope is still unknown
Quest believes some patient records were accessed, but the 8-K does not give a count or name the data types. “Records accessed” does not by itself explain what information was viewed, copied or taken from the system.
Access to the platform was paused during the investigation. Quest said the incident had not materially disrupted its business or its ability to serve patients. That continuity statement does not resolve the scope of the data exposure.
What patients can do
Patients can watch for communications from Quest or their healthcare provider and check that their contact details are current. If an official notice arrives, read which data categories were involved and what steps are offered before following a link. If unsure, contact the laboratory using a number from an official document or website.
Verify an unexpected request for a password, payment or one-time code through another channel. So far, Quest has not said that passwords, payment numbers or specific test results were involved.
What medical practices should check
Clients that used Quanum can follow Quest’s updates and confirm which ordering or results channels are available during the pause. Keep vendor instructions, record work that needs to be resumed and do not send patient information to an unverified address.
If a practice finds unusual activity in its own systems, it should follow its internal response process and preserve relevant logs. Quest’s public filing does not provide technical indicators that its clients can use to search for an intrusion in their own environments.
The connection with Soclyde
Small medical teams can use an encrypted vault to organise professional portal credentials and reduce how often they travel in shared documents. Soclyde does not protect Quanum and does not replace Quest’s controls or each organization’s own obligations.
Explore Soclyde features for managing team secrets with organised access.
What to remember
Quest confirms unauthorized access to Quanum and says it believes some patient records were accessed. The number of people, specific data and method are not public. Follow notices from the vendor and your practice; our guide to securing work passwords helps reduce password reuse.
