America’s largest clinical lab testing company has become the latest major healthcare player to disclose a security incident.
Quest Diagnostics has confirmed that an unauthorized party gained access to its Quanum Lab Services Manager (LSM) system, a platform that certain clients use to place test orders and receive and look up patient results. In a notice posted on its website and in a filing with the Securities and Exchange Commission, the company said it learned of the incident on October 21, and paused access to the affected system upon discovery while an investigation continues. Quest says its core business operations have not been impacted and remain up and running.
The company has been notably cautious about specifics so far, but has confirmed the basics: patient data within Quanum LSM is believed to have been accessed, and that data does include Protected Health Information (PHI) and Personally Identifiable Information (PII), though the exact scope is still being determined. In its own FAQ on the incident, Quest states plainly that it believes some patient data within Quanum LSM was accessed, while other systems were not affected, and that as the HIPAA-covered entity, it will make notifications as required by applicable law once the investigation establishes exactly whose data and what categories of information were involved.
A Company Built On Scale
What makes any Quest security incident significant is the sheer size of the company’s footprint in American healthcare. Quest serves roughly one-third of the US adult population in any given year, and over a three-year period, it touches about half of all American adults. The company estimates it serves close to half of the physicians and half of the hospitals in the country, processing more than 217 million test requisitions a year through a network that includes laboratories, thousands of patient service centers, and phlebotomists embedded directly in physician offices across the US and in markets including Puerto Rico, Mexico and Brazil.
Financially, Quest has been on a growth tear. The company posted full-year 2025 revenues of $11.04 billion, up nearly 12% from the year before, and recently guided toward further growth in 2026 on the back of large partnerships, including serving more than 200,000 dialysis patients through a tie-up with Fresenius Medical Care and a joint-venture lab arrangement with Corewell Health that’s expected to generate roughly $1 billion in annual revenue this year. The company employs close to 50,000 people worldwide.
That scale is exactly why a system like Quanum LSM is significant. It is not a consumer-facing app used occasionally — it’s enterprise lab-ordering infrastructure used by physician offices and health systems to place orders and pull results day in and day out, which means any compromise has the potential to touch a very large number of patient records very quickly.
Not Quest’s First Brush With A Breach
This is not the first time Quest has had to notify patients about unauthorized access to its systems. The company’s most serious prior incident came in 2019, when a breach at a billing vendor, American Medical Collection Agency, exposed financial and medical information belonging to nearly 12 million Quest patients — one of the largest healthcare data breaches on record at the time. Quest has also disclosed smaller incidents over the years, including a 2016 breach of its MyQuest by Care360 app that affected around 34,000 patients.
The disclosure also lands in the middle of what has been an unusually active stretch for the cybersecurity world more broadly. Just this week, critical vulnerabilities in PHP forced an emergency patch after exploit details leaked online, a flaw severe enough that Japan’s prime minister and the US FBI both issued public warnings, and Cloudflare’s CEO said exploit attempts went from thousands to millions within hours of disclosure. Cloud platform Railway also paused all deployments after disclosing a breach of its own, while Node.js separately patched a critical flaw that allowed remote code execution. Closer to home, Indian certificate authority eMudhra is still reeling from a key-compromise incident that has wiped out roughly ₹1,450 crore of its market value in two trading days.
For now, Quest says investigation into the Quanum LSM incident is ongoing, and that it will share more details, including specifics on what data was affected and who was impacted, as its forensic review progresses. Given the company processes test orders and results for roughly half the country’s physicians and hospitals, the ultimate scope of this incident, once confirmed, is likely to be closely watched.