Hackers Reached Patient Records Through Quest Diagnostics' Lab Ordering System, and Quest Can't Say How Many

Someone got inside the system doctors use to order lab tests from Quest Diagnostics, one of the biggest medical testing companies in the United States, and Quest believes they reached patient records on the way. How many patients, and which records, the company cannot yet say.

In a Thursday filing with the SEC, Quest reported "unauthorized access" to Quanum Lab Services Manager, the platform where healthcare providers place test orders and receive or look up results. It found the intrusion on Wednesday, notified federal law enforcement and brought in outside cybersecurity experts.

What Quest knows, and what it doesn't

Quest believes "certain patient records" were accessed. The company confirmed to Fox Business that patient health information or personally identifiable information was involved. The specific information, and the number of people behind it, remain under investigation.

Quest says it has stopped the unauthorized access and is working to identify affected patients and providers, who will be notified as the law requires. The New Jersey company, which reported about $11 billion in revenue in 2025, declined further comment and has not said whether the breach will carry financial consequences.

Platforms shut, paper forms out

Quest disabled access to Quanum LSM and expected to restore full functionality as soon as Friday. As a precaution it also paused its Essential Insights and LabHQ systems, though it said no data was accessed on either.

The company says its core operations were not affected and its ability to serve patients was not materially disrupted. Providers can fall back on paper requisitions or the Quanum eLabs platform, and other electronic ordering stays up. Clients who do not use Quanum LSM should see no testing delays.

Not the first time

Lab data is about as personal as data gets, and Quest has lost control of it before. In 2016, the company said lab results and contact details of about 34,000 people were exposed in an online breach.

Three years later came something much bigger. The personal information of about 11.9 million Quest patients was affected through a hack at American Medical Collection Agency, a billing collections vendor. Quest said at the time that its own systems were not involved. This time, the door was Quest's own ordering platform.

Bad timing, different bug

The breach arrived in a rough week for the web. An AI assisted discovery of critical flaws in PHP, the language behind roughly 70% of websites, has set off outages and limited service as companies rush to patch. Quest told the AP that, based on its investigation, its breach was not related to the PHP issue.

That leaves the question Quest has not answered: how the attacker got in, and how far they went before the company shut the door.

Some offers on this page may be paid placements or contain affiliate links.