Quest Diagnostics Says Patient Records Were Accessed

Quest Diagnostics says an unauthorised party accessed patient records through Quanum LSM, a system that some of its clients use to order laboratory tests and look up results. The US laboratory company disclosed the breach in a Form 8-K filing with the Securities and Exchange Commission on Thursday morning, saying it learned of the unauthorised access on Wednesday 21 October.

“While the full scope of unauthorized access remains under investigation, at this time the Company believes that an unauthorized party accessed certain patient records,” Quest said. It did not say how many patients are affected, what information the records contained, or who was responsible. It says the incident “has not materially disrupted” its operations or its ability to serve patients.

Quest has called in law enforcement and outside experts

According to the filing, Quest “promptly initiated its cybersecurity incident response procedures to contain the activity, assess and investigate the nature and scope of the incident and implement appropriate remedial measures”. It has notified federal law enforcement and engaged external cybersecurity experts to help with the investigation.

The filing describes Quanum LSM only as a system “which certain clients use to place test orders, receive and look up results”. Quest has not said which clients were affected or when the unauthorised access began.

The disclosure arrived alongside Quest’s quarterly results. Its third-quarter release, filed four minutes earlier at 11:49 BST, reported revenue of $3.10bn, up 10%, and raised full-year revenue guidance to between $12.065bn and $12.105bn. Jim Davis, Quest’s chairman, chief executive and president, said growth came from “continued strength across our physician, hospital and consumer channels”. The release mentions the breach only once, in its list of risks: “the impact of the incident described in the Current Report on Form 8-K filed on October 22, 2026”.

Quest’s revenue beat analysts’ estimates of $3.05bn, according to LSEG data cited by Reuters, which reported that Quest shares fell 3.7% to $230 in premarket trading.

Quest filed under Item 8.01, not the material-incident item

The form Quest chose says something about where its assessment stands. Under rules the SEC adopted in July 2023, public companies must report material cybersecurity incidents under Item 1.05 of Form 8-K. In a May 2024 statement, Erik Gerding, director of the SEC’s Division of Corporation Finance at the time of the statement, said staff encourage companies disclosing an incident they have not yet judged material, or have judged immaterial, to use a different item, “for example, Item 8.01”.

Quest’s filing sits under Item 8.01, “Other Events”. It does not say whether Quest has decided the incident is material. Under the same SEC guidance, if a company later decides an incident is material, it should file an Item 1.05 report “within four business days of such subsequent materiality determination”. The statement itself notes it is staff guidance with “no legal force or effect”.

What Quest has not said is the story so far

For patients and the clinicians who use Quanum LSM, the filing answers almost none of the questions that matter. Quest has given no patient count, no description of the data and no timeline beyond the day it found the intrusion. Its own risk language points to what may follow, naming “adverse results from pending or future government investigations, lawsuits or private actions” among the uncertainties.

The timing also shapes how the news landed. Quest put out its results and raised its guidance minutes before the breach filing, so the same morning carried both a stronger outlook and an open-ended security investigation. The results release treats the incident as a risk factor, not a cost, and Quest has not put a figure on it.

The next filing is the one to watch. A move from Item 8.01 to Item 1.05, or a notice to patients, would be the first sign of how large the breach is.

TSN tracks incidents like this on its ransomware and cyber attacks hub. Recent healthcare cases include Fisher & Paykel Healthcare, which said two staff email accounts and some files were accessed, and the Louisiana clinic in our 9 October breach round-up.