Quest Diagnostics discloses unauthorized access to Quanum Lab Services Manager (LSM), exposing patient records; LSM paused

Linha do tempo

1. bleepingcomputer.com ↗ · pub. 23/10/2026 13:40 · coletado 23/10 14:00

   Quest Diagnostics confirms unauthorized access to Quanum LSM platform, exposing patient records

   ler a análise desta fonte ocultar

   Quest Diagnostics disclosed in an SEC filing that an unknown threat actor gained unauthorized access to its Quanum LSM (Lab Services Manager) system, which clients use to place test orders and look up results. The company learned of the intrusion on October 21, 2026 and activated its incident response protocol. It believes some patient records were exposed, but the data types affected have not been determined. No threat group has claimed the attack, according to BleepingComputer. Quest says customer-facing operations were not disrupted and that users of direct-customer LIS interfaces or EMRs were not impacted.

   Technical Details

   • Affected system: Quanum LSM, an online portal used by physicians, hospital staff and medical office staff to manage lab services, view results, track status and order supplies.
   • As a precaution, Quest temporarily paused access to other systems, including Essential Insights and LabHQ.
   • The Quanum LSM system has been stopped. Customers are advised to use paper requisitions or Quanum eLabs to place orders and receive results.
   • The initial access vector, the threat actor and the scope of the data have not been disclosed.
   • External experts are assisting the investigation and law enforcement has been notified.
   • Context: in 2019, a breach at billing provider AMCA compromised data on about 11.9 million Quest patients and led to at least 19 class-action lawsuits, now consolidated in ongoing multidistrict litigation.

   Remediation

   • Clients should use paper requisitions or Quanum eLabs while Quanum LSM is offline.
   • Follow Quest's website alert for updates on the scope of exposed data and on restoration of the paused systems.
2. techcrunch.com ↗ · pub. 23/10/2026 12:00 · coletado 23/10 12:00

   Quest Diagnostics confirms breach of Quanum lab testing platform exposing patient records

   ler a análise desta fonte ocultar

   Quest Diagnostics disclosed in an 8-K filing with the SEC that it detected a cyberattack on Wednesday targeting Quanum, its platform for ordering lab tests and handling billing. The company confirms unauthorized access to "certain patient records", including protected health information described as "personal information and patient records". The number of affected patients and customers, the start date of the intrusion and the exact data types are still unknown. Quest has notified law enforcement and is investigating. No threat actor has been named, and it is unclear whether any ransom demand has been made.

   Technical Details

   • Affected system: Quanum, used by about half a million clinicians across thousands of locations in North America. It stores health records, diagnostic data and billing data.
   • The initial access vector, malware and attribution have not been disclosed.
   • Quest's web notice reportedly carries a "noindex" tag, which makes it harder to find through search engines.
   • Context: this is Quest's second known major breach in a decade, after the 2019 compromise of a third-party billing company that exposed 11.9 million patient records. The healthcare sector has seen many incidents in 2026, including Stryker, Boston Scientific, CareCloud, Craneware and McKesson.
3. hipaajournal.com ↗ · pub. 23/10/2026 09:25 · coletado 23/10 10:01

   Quest Diagnostics discloses unauthorized access to Quantum Lab Services Manager system, patient records likely compromised

   ler a análise desta fonte ocultar

   Quest Diagnostics, a Fortune 500 diagnostic testing company based in Secaucus, New Jersey, told the SEC in a Form 8-K filed on October 22, 2026 that it detected unauthorized access to its Quantum Lab Services Manager (LSM) system on October 21, 2026. The company suspects patient records were compromised, but the scale of the breach has not been determined. No threat group has claimed responsibility. The incident appears limited to LSM, which certain clients use to place test orders and receive and look up results. Quest says patient services and business operations were not affected.

   Technical Details

   • The intrusion was first identified on October 21, 2026. The initial access vector and the attacker's methods have not been disclosed.
   • The affected system is the LSM platform, used only by certain clients. This limits the likely scope compared with the earlier AMCA breach, which exposed about 11.9 million patients' data between August 2018 and March 2019.
   • Quest has not stated which data types were accessed. Test orders and results suggest protected health information, but the article does not confirm this.

   Remediation

   • Quest started its incident response protocol, applied remedial measures to prevent further unauthorized access, and temporarily paused access to LSM.
   • Third-party cybersecurity experts were engaged and federal law enforcement was notified.
   • Customers can continue to place orders and receive results by fax, paper, or direct-customer LIS interfaces or EMRs.
   • Quest will publish further details as the investigation progresses.
4. gbhackers.com ↗ · pub. 23/10/2026 08:36 · coletado 23/10 10:00

   Quest Diagnostics discloses unauthorized access to Quanum LSM, possible exposure of patient records

   ler a análise desta fonte ocultar

   Quest Diagnostics disclosed in a Form 8-K that an unidentified party gained unauthorized access to its Quanum LSM (Lab Services Manager) system and may have accessed certain patient records. The company became aware of the incident on October 21, 2026. Quest paused access to the affected platform, activated incident response procedures, notified federal law enforcement and engaged external cybersecurity experts. The company states the incident has not materially disrupted business operations or its ability to serve patients.

   Technical Details

   • Quanum LSM is a provider-facing platform that lets certain healthcare clients place lab test orders, receive results and retrieve prior results.
   • No threat actor, initial access technique or software vulnerability has been identified or disclosed.
   • There is no indication of ransomware, an extortion demand or deployment of malicious software.
   • The number of affected individuals, the data types involved and the duration of access have not been disclosed.
   • It is not confirmed whether records were downloaded, exfiltrated, published or sold. Unauthorized access and confirmed data theft remain distinct findings.
   • Providers that order tests through direct-customer laboratory information system interfaces or electronic medical records are unaffected. The confirmed operational impact is limited to the Quanum LSM platform.

   Remediation

   • Quest has suspended access to the affected system; no restoration timeline has been given.
   • Healthcare clients should use the unaffected ordering channels (direct LIS interfaces or EMR integrations) in the meantime.
   • Clients should watch for further Quest updates on scope, patient notifications and any protective services offered.
5. securityweek.com ↗ · pub. 23/10/2026 05:25 · coletado 23/10 07:00 primeiro registro

   Quest Diagnostics discloses unauthorized access to Quanum Lab Services Manager exposing certain patient records

   ler a análise desta fonte ocultar

   Quest Diagnostics disclosed in a Thursday regulatory filing that it detected unauthorized access to its Quanum Lab Services Manager, a platform where certain clients place test orders and look up results. The company discovered the intrusion on Wednesday and notified federal law enforcement. It believes "certain patient records" were accessed, but the number of patients and the specific data involved are still unknown while the investigation continues. Quest Diagnostics is working with external cybersecurity experts and confirmed to the Associated Press that the breach is not related to the recently disclosed PHP vulnerabilities (PHP2Shell). Earlier incidents include a 2016 exposure affecting about 34,000 people and the 2019 American Medical Collection Agency breach that affected about 11.9 million patients.

   Technical Details

   • Affected system: Quanum Lab Services Manager, a client-facing portal for test orders and results.
   • Initial access vector, threat actor, malware and data volume have not been disclosed.
   • The company states the incident is unrelated to the PHP flaws.

   Remediation

   No customer guidance has been published yet. Healthcare clients using the platform should watch for notifications from Quest Diagnostics and review access to the portal.