Quest Diagnostics discloses breach of certain patient records

Quest Diagnostics learned Oct. 21, 2026 that an unauthorized party accessed certain patient records through its Quanum Lab Services Manager system. It disclosed the breach in an Oct. 22, 2026 SEC filing. An SEC 8-K filing is mandated by law when a cyber attack occurs.

The company said it believes an unauthorized party accessed certain patient records, but the full scope remains under investigation. The number of affected patients and the specific records involved are unknown. Quest notified federal law enforcement and is working with external cybersecurity experts on its response. Quest initiated cybersecurity incident response procedures after learning of the incident Oct. 21.

Quanum Lab Services Manager lets certain clients place test orders and receive or look up results. The incident has not materially disrupted Quest’s business operations or its ability to serve patients. Quest Diagnostics, based in New Jersey, serves one-third of adults in America annually, half of U.S. physicians and hospitals each year, and about 2,000 patient locations.

Quest told the Associated Press that the breach is not related to PHP programming language vulnerabilities disclosed earlier in the week. After publication, Quest told Gizmodo, “Based on our investigation, the incident is not related to a PHP programming language issue.” The cause of the Quest Diagnostics breach was not immediately known. Quest did not respond to a request for comment.

As much as 70% of websites use PHP, and its vulnerabilities were first warned about on Tuesday. Patches arrived Wednesday, and administrators worldwide rushed to apply them, sometimes pulling critical websites offline while patching. Hackers can use the critical flaws to fully take control of affected servers.

Since discovery of the flaws, Cloudflare has observed millions of hacking attempts exploiting them across its network, according to CEO Matthew Prince. Exploit attempts rose to thousands before the public announcement. They reached tens of thousands within 45 minutes after announcement. They reached hundreds of thousands within two hours.

Word of the flaws spread widely on social media before patches existed. This gave hackers a head start. One severe vulnerability disclosed earlier in the week was called php2shell. Cybersecurity officials advised websites unable to fix the vulnerability immediately to shut down temporarily.

In 2016, an unauthorized user accessed a Quest patient portal affecting about 34,000 people. Exposed information included names, birthdates, laboratory results and sometimes telephone numbers. Social Security numbers and financial information were not exposed.

In 2019, personal information of about 11.9 million Quest patients was affected after a hack at American Medical Collection Agency, a billing collections service provider. An unauthorized user accessed financial information, Social Security numbers and medical information. Laboratory test results were not accessed.

Recent healthcare cyber attack victims include medical device makers Abbott, Stryker, Medtronic and Boston Scientific, plus Novo Nordisk and West Pharmaceutical Services. Stryker experienced a global outage in March after the Iran-linked hacking group Handala claimed responsibility. Handala said its March outage against Stryker was retaliation for the brutal attack on the Minab school. That attack was part of a U.S.-led bombing of Iran that killed 168 people.

Most of them were children. The school was an all-girls elementary school. Cyberattacks are rising across industries, with recent breaches disrupting supermarket chains and core education applications.