MediumII Cyber Warfare & Critical Infrastructure23 October 2026, Friday
Quest Diagnostics halts its lab ordering system after a data breach
US laboratory chain Quest Diagnostics told the SEC it detected unauthorised access to its Quanum LSM system on 21 October. The company believes some patient records were accessed. As of 23 October the system was shut down and access to 2 further platforms was suspended.
Quest's 8-K filing of 22 October says the company learned of unauthorised access to Quanum LSM on 21 October. Customers use the system to order tests and look up results. The filing says the scope is still under review and that an unauthorised party is believed to have accessed certain patient records. The incident was reported under Item 8.01, the heading for voluntary other events, and the text contains no assessment of financial materiality.
BleepingComputer reported on 23 October that Quanum LSM had been taken offline. Customers were directed to paper requisition forms or to Quanum eLabs for orders. As a precaution, access to 2 platforms, Essential Insights and LabHQ, was also temporarily closed. The company says customers using a direct LIS interface or electronic health record system were not affected, and the 8-K states the incident has not materially disrupted operations. As of 23 October no group had claimed the attack; the type of data exposed and the number of patients affected could not be verified.
Scale magnifies the risk. Quest runs 7,700 patient service sites in North America, employs 65,000 people and earns more than 11 billion dollars a year, and says it serves a third of American adults annually. A 2019 breach through billing vendor AMCA exposed data on about 11.9 million patients and led to at least 19 class actions. Medical Economics reports that Quest said the incident was unrelated to the PHP flaws disclosed the same week. The PHP project released fixes for those flaws on 21 October, and CISA, the NSA and the FBI urged that systems which cannot be updated be taken offline.
Talay assessment
Bottom line
The weight of the incident lies less in the number of records exposed than in the point of access. A clinical workflow, test ordering and results, stopped and providers went back to paper. The 8-K says operations were not materially disrupted, but with 3 platforms offline the impact depends on how quickly the system comes back. Until the number of affected patients is disclosed, the regulatory and legal cost cannot be measured.
Likely effects
- US healthcare deliveryNegativeWeeks
Practices tied to Quanum LSM are back on paper requisitions, so turnaround times lengthen; if the outage drags on, orders could move to rival labs.
- Cyber insuranceNegative1–6 months
A patient-data breach on a network that touches a third of US adults each year tightens cyber policy pricing and coverage terms across healthcare.
- Legal riskNegative6 months+
With the 19 class actions from the 2019 AMCA breach still unresolved, a new breach could trigger a similar wave of litigation depending on the scope of notification.
Possibilities, ranked
- 1Limited breach, phased restart55%
The system comes back in stages and official filings show a limited number of affected patients.
Watch: Quest announcing Quanum LSM is back online and an entry on the HHS breach portal
- 2Wide breach30%
Affected records run into the millions, class actions are filed and regulators open a review.
Watch: Breach notices to state attorneys general and the number of patients reported
- 3Ransom claim15%
A group claims the attack and lists Quest on a data leak site.
Watch: Quest's name appearing on ransomware leak sites
Probabilities are calibrated judgement based on the sources, not measurement, and are revised as new information arrives. Not investment advice.