Quest Diagnostics Data Breach: How to Check If You're Affected and What to Do

Quest Diagnostics, one of the largest medical lab companies in the United States, says an unauthorized party accessed patient records through its Quanum Lab Services Manager system, a portal doctors use to order tests and look up results. The company discovered the intrusion on October 21, 2026, and has not yet said how many people are affected or exactly what data was taken.

That uncertainty is why so many patients are now searching for answers. If you have had blood work or other lab tests through Quest, this guide explains what is confirmed, how notification will work, and the free steps you can take today without waiting for a letter.

Key facts at a glance

• Discovery date: Quest learned of unauthorized access to its Quanum Lab Services Manager (LSM) on October 21, 2026, according to its Form 8-K filing with the SEC.
• What was accessed: Quest says patient health information and personally identifiable information were part of the access, but it is still working out the specific data, per its incident notice.
• Scale: No number of affected patients has been released. The Washington Post reported the scope "was not immediately clear."
• Notification: Quest says affected patients will get letters describing the help available, including credit and identity monitoring.
• Lawsuits: At least two proposed class actions were filed in New Jersey federal court on October 22 and 23.

Why people are searching for this now

Quest disclosed the incident in an SEC filing dated October 22, signed by Vice President and Corporate Secretary Sean D. Mersten. The filing says the company "believes that an unauthorized party accessed certain patient records," notified federal law enforcement and brought in outside cybersecurity experts.

The disclosure drew wide attention because the affected system handles lab orders and results. MedTech Dive noted that Quest did not share more details during its third-quarter earnings call on Thursday, October 22, which left patients with more questions than answers.

The incident also lands in a crowded year for health-sector attacks. MedTech Dive lists Stryker, Boston Scientific, Medtronic, Abbott, Intuitive, iRhythm and AdaptHealth among companies that have disclosed cyberattacks in 2026.

What Quest has confirmed so far

The affected system

Quanum LSM is used by certain Quest clients, such as doctors' offices, to place test orders and receive results. Quest says it paused access as soon as it confirmed the intrusion. It also paused two other tools, Essential Insights and LabHQ, as a precaution, but says no data was accessed in them.

Providers that send orders through their own lab interfaces or electronic medical records were not affected, according to the company. Quest also says the incident is not related to the PHP security flaws that federal officials have urged organizations to patch.

The data involved

Asked directly whether patient health information or identifying information was involved, Quest's notice answers "Yes, but we are still investigating to determine the specific data affected." It adds that, based on the investigation so far, "personal information and patient records were affected."

Quest has not confirmed specific data types, such as Social Security numbers, insurance details or test results. Some of those items appear in lawsuit allegations, covered below, but they are claims, not findings.

Who is affected

Right now, nobody outside Quest can say for certain. Based on the company's description, the people most likely to be involved are patients whose tests were ordered or whose results were viewed through Quanum LSM. Many patients will not know which system their doctor used, so it is reasonable for any recent Quest patient to take the basic precautions below.

Quest says it will notify patients, providers and health plans once it determines who was affected. It also lists phone lines for clients: the Connectivity Help Desk at 1-800-697-9302 for Quanum account issues, and National Customer Services at 1-866-MYQUEST for results.

How notification will work

Quest is a HIPAA "covered entity," which means federal breach rules set how and when it must tell you. Under the HHS Breach Notification Rule:

• Notices must go out without unreasonable delay and no later than 60 days after a breach is discovered. Counting from October 21, that outer limit falls around December 20, 2026.
• Letters arrive by first-class mail, or by email only if you agreed to electronic notices.
• Each notice must describe what happened, the types of information involved, steps you should take, and how to contact the company.
• If contact details are out of date for 10 or more people, the company must post a notice on its website home page for at least 90 days or use major print or broadcast media, plus a toll-free number active for at least 90 days.
• If more than 500 residents of a state are affected, the company must also notify prominent media outlets there.

Step-by-step: what to do now

You do not need to wait for a letter to protect yourself. These steps are free and come from official FTC guidance.

1. Freeze your credit at all three bureaus. Contact Equifax, Experian and TransUnion. The FTC says a freeze is free, does not affect your credit score, and lasts until you lift it. While it is in place, nobody can open a new credit account in your name.
2. Or place a fraud alert if you prefer. An initial fraud alert makes lenders verify your identity before granting new credit. You only need to contact one bureau, which must tell the other two, and the alert lasts one year.
3. Watch your Explanation of Benefits statements. These insurer statements list each visit, service and cost. Check them for care you did not receive.
4. Treat unexpected calls, texts and emails with caution. The FTC advises against giving medical information to anyone who contacts you unexpectedly. Reach Quest or your insurer using a number or website you already know is real.
5. Keep your medical paperwork secure. The FTC suggests shredding old medical bills and statements and switching to online statements to limit what arrives by post.
6. Save any Quest letter you receive. It should explain the data involved and how to enroll in any monitoring Quest offers.

How to tell if you have been affected

The clearest sign will be a notification letter from Quest. Beyond that, the FTC's guidance on medical identity theft lists warning signs that someone is using your medical information:

• A bill or Explanation of Benefits statement for services you did not get or prescriptions you do not take.
• A debt collector contacting you about medical debt you do not owe.
• Medical collection notices on your credit report that you do not recognize.
• A notice from your insurer saying you have reached your benefit limit.

None of these signs alone proves the Quest incident is to blame, but each one is worth acting on.

What to do if your information is misused

The FTC recommends a short sequence of steps if you spot signs of misuse:

1. Request your records from each doctor, lab, pharmacy and insurer where the thief may have used your details.
2. Report errors in writing, with a copy of the incorrect record, using tracked mail such as certified mail. The FTC says your provider must respond within 30 days and notify other providers that may hold the same mistake.
3. Report billing errors to the credit bureaus if medical debts you do not owe appear on your credit report.
4. Create a recovery plan at IdentityTheft.gov, the FTC's official reporting site. For help in other languages, the FTC lists 1-877-438-4338.

The official view, and the critics

Federal guidance is clear that prevention does not have to wait. "Freezing your credit can help stop identity theft," the FTC says, adding that a freeze is "even more important" when your information is exposed in a breach. On contact from strangers, the agency is equally direct: "Don't give your medical information to someone who calls, emails, or texts you unexpectedly."

Plaintiffs' lawyers are taking a harder line against Quest. According to a summary by Open Class Actions, Johnson v. Quest Diagnostics (No. 2:26-cv-13795) was filed on October 22 by three customers from South Carolina, Florida and California. Ayala v. Quest Diagnostics (No. 2:26-cv-13852) followed on October 23, brought by a Texas patient.

The Ayala complaint alleges Quest stored patient information unencrypted in an internet-accessible environment and that names and Social Security numbers were taken. It asks for at least three years of credit monitoring paid for by Quest. These are unproven allegations: no class has been certified, there is no settlement, and there is nothing for patients to claim or file today.

What happens next

The key milestone is Quest's patient notification, which federal rules require within 60 days of discovery. Those letters should finally answer the questions that matter most: how many people were affected and which data types were involved.

In court, further suits may be filed and cases over the same incident in the District of New Jersey may be consolidated before one judge, according to Open Class Actions. Quest has not publicly responded to the allegations.

Takeaways

• Act now, not later. A free credit freeze at Equifax, Experian and TransUnion is the strongest single step, and you can lift it whenever you need credit.
• Read every insurer statement over the coming months and question any service you do not recognize.
• Verify before you respond. Call Quest or your insurer on a number you already trust rather than one in an unexpected message.
• Watch your mailbox for a Quest notification letter and keep it, since it should explain any monitoring offer.
• Use IdentityTheft.gov if you find signs of misuse, and put any record corrections in writing.