Quest Quanum Incident: Protect Patient Data While Keeping Orders Moving, Bulwark Black

Quest Quanum Incident: Protect Patient Data While Keeping Orders Moving

Quest confirms patient information was affected in the Quanum LSM incident. Separate confirmed exposure from unknown scope, and use verified continuity channels.

Quest Diagnostics has confirmed unauthorized access to its Quanum Lab Services Manager (LSM), with personal information and patient records affected. The October 23, 8:00 a.m. ET update leaves specific data and affected population under investigation.

What is confirmed—and what is not

Quest paused LSM access after discovery. It says core operations remain running and direct-customer laboratory information system (LIS) and electronic medical record (EMR) ordering interfaces were unaffected. Essential Insights and LabHQ were precautionarily paused; Quest reports no data access there.

The notice does not establish a patient count, ransomware involvement or a technical attack path. Quest says its investigation indicates the incident is unrelated to PHP. Its restoration forecast is not confirmation that service has returned.

Keep work moving through verified routes

Quest directs LSM users to paper requisitions or Quanum eLabs for orders and results. Existing EMR users can continue usual ordering, Quest says.

Bulwark assessment: separate continuity from exposure

For small practices, healthcare contractors and service providers, a portal outage creates two different workstreams: keeping care-related administration moving and determining whether information was exposed. Success on one does not close the other.

Assign an incident owner. Track vendor updates, affected business processes and outstanding questions in one record. Document which portal and integration each team actually uses.
Validate alternate channels. Navigate through the vendor's known website or established contacts. Do not trust an unsolicited message offering a replacement login, urgent migration or patient-data upload.
Protect temporary workflows. Use approved handling procedures for requisitions and results. Avoid moving sensitive information into personal inboxes or unapproved shared folders to work around the interruption.
Reconcile the backlog. Keep a controlled record of pending orders and results, then check for missing or duplicate transactions when normal workflows return.
Preserve evidence and questions. Retain relevant access records and vendor communications under existing policies. Ask what data categories, dates and accounts were involved; do not equate being an LSM customer with confirmed individual exposure.

Patients should use official Quest updates and their provider's established contact route. A disruption is not a reason to submit personal information through an unexpected email or text link.

Original source

Quest Diagnostics incident notice and provider/patient FAQs, updated October 23, 2026, 8:00 a.m. ET. Operational status may change as the investigation progresses.