On October 21, 2026, Quest Diagnostics learned of unauthorized access to Quanum Lab Services Manager (LSM), the system some clients use to place test orders and look up results. A Form 8-K filed the next day under Item 8.01 says the company believes an unauthorized party accessed certain patient records. Business operations and the ability to serve patients were not materially disrupted.
Quest’s notice, updated 8:00 a.m. ET on October 26, says the incident is remediated. Quanum LSM is restored. Systems paused as a precaution, including Essential Insights and LabHQ, are back, and Quest says no data was accessed in those other systems. The investigation is still open. Quest has not published a patient count or a field list.
Snapshot
| Field | Detail |
|---|---|
| Event | Oct 21, 2026 · unauthorized access to Quanum LSM |
| Filing | Form 8-K · Item 8.01 · signed Oct 22, 2026 |
| Company | Quest Diagnostics Incorporated · DGX · Secaucus, NJ |
| What Quest believes | Certain patient records; personal information and patient records |
| PHI and PII | Yes, specific fields still under investigation |
| Oct 26, 8:00 a.m. ET | Portal restored · letters still to come · no count yet |
The 8-K is signed by Sean D. Mersten, vice president and corporate secretary. Quest Diagnostics Incorporated is a Delaware corporation at 500 Plaza Drive, Secaucus, NJ 07094, phone (973) 520-2700. Common stock trades as DGX on the New York Stock Exchange. This is Item 8.01, not Item 1.05. The filing does not name a patient count, a data-field list, or how the access started.
Malwarebytes on October 26 and AP on October 22 reported the same filing. The notice and the 8-K are the company’s account.
What the notice adds
| Topic | What Quest says |
|---|---|
| Quanum LSM | Restored and available to clients |
| Essential Insights and LabHQ | Paused as a precaution · no data accessed · restored |
| LIS and EMR order interfaces | Not affected |
| Law enforcement | Yes, the company is communicating with authorities |
| PHP language issue | Not this incident, based on Quest’s investigation |
| Patient notice | Letters after the investigation, including credit and identity monitoring |
Providers who cannot sign in are told to call the IT Connectivity Help Desk at 1-800-697-9302. That number is printed on the notice. Patients who call 1-866-MYQUEST may wait longer than usual. Quest also says results for orders placed through Quanum eLabs will be available through Quanum LSM, and it does not expect delays in appointment scheduling or turnaround reporting.
The notice warns that incidents are followed by phishing and voice-phishing, including fake breach letters, credit-monitoring offers, and settlement calls. A message that already links a “Quest restore” page is not the notice.
What a reader can do with this
| Do | Why |
|---|---|
| Type questdiagnostics.com/links/quanum-notice | The letter has not gone out, and the count is still open |
| Providers call 1-800-697-9302 only from the notice | That is the help desk Quest printed for a Quanum password reset |
| Read medical bills and insurance statements | Unfamiliar tests are the mismatch to raise with the provider and the plan |
| Type IdentityTheft.gov and AnnualCreditReport.com | Use those sites yourself if a bill or a credit file looks wrong |
A hardware key on a personal mailbox does not restore a lab portal, and it does not tell a patient whether a record was in the set Quest is still reviewing.
MFA on the lab portals
| Grade | Meaning |
|---|---|
| Fail | No public YubiKey or Google Authenticator path, or SMS / email codes remain the documented sign-in |
| Strong | FIDO2 / YubiKey-class security key for sign-in |
| Platform | Grade | YubiKey | Authenticator |
|---|---|---|---|
| Quanum LSM | Fail | No | No |
| MyQuest | Fail | No | No |
The eLabs FAQ says offices sign in to Quanum LSM with the same username and password. The sign-in page asks for those two fields. It does not name YubiKey or Google Authenticator. Quanum LSM is Fail.
MyQuest’s MFA guide (copyright 2026) offers a code by text message, email, or both. SMS and email remain, so MyQuest is Fail. That patient login is not the Quanum system in the 8-K. A code on MyQuest does not show whether a record in Quanum was accessed.
Directory: MFA support directory · Healthcare.
Recommended MFA tools
| Product | Best for | Get it |
|---|---|---|
| YubiKey 5C NFC | USB-C laptops + NFC phones | Amazon |
| YubiKey 5 NFC | USB-A desktops + NFC phones | Amazon |
| Proton Pass | Passkeys + authenticator-style TOTP | Proton Pass |
We may earn a commission if you buy a YubiKey or sign up for Proton Pass through the links above.
Domain audits
Ideal score is 100%. Audits ran October 26, 2026. None of these domains is at 100%. The corporate site is 85%. The Quanum hostname is 43%, and its Identity score is 0%. That hostname score is not the corporate mail score. questdiagnostics.com Identity is 90%.
| Organization | Domain | Overall | vs 100% |
|---|---|---|---|
| SEC | sec.gov | 88% | −12 |
| IdentityTheft.gov | identitytheft.gov | 85% | −15 |
| Quest Diagnostics | questdiagnostics.com | 85% | −15 |
| Malwarebytes | malwarebytes.com | 71% | −29 |
| AP News | apnews.com | 69% | −31 |
| Annual Credit Report | annualcreditreport.com | 56% | −44 |
| Domain | Identity | Transport | Website |
|---|---|---|---|
| sec.gov | 90% | 45% | 98% |
| identitytheft.gov | 90% | 45% | 90% |
| questdiagnostics.com | 90% | 15% | 95% |
| malwarebytes.com | 90% | 45% | 43% |
| apnews.com | 65% | 45% | 70% |
| annualcreditreport.com | 65% | 45% | 37% |
| Host | Domain | Overall | vs 100% |
|---|---|---|---|
| Quanum LSM | physician.quanum.questdiagnostics.com | 43% | −57 |
| MyQuest | myquest.questdiagnostics.com | 38% | −62 |
| Quest sign-in | auth2.questdiagnostics.com | 28% | −72 |
| Domain | Identity | Transport | Website |
|---|---|---|---|
| physician.quanum.questdiagnostics.com | 0% | 15% | 87% |
| myquest.questdiagnostics.com | 0% | 15% | 70% |
| auth2.questdiagnostics.com | 0% | 15% | 37% |
Fresh reports: sec.gov · identitytheft.gov · questdiagnostics.com · malwarebytes.com · apnews.com · annualcreditreport.com · physician.quanum.questdiagnostics.com · myquest.questdiagnostics.com · auth2.questdiagnostics.com.
Website stack
| Host | What the probe returned |
|---|---|
| questdiagnostics.com | Undetected · DigiCert to 2027-03-27 |
| auth2.questdiagnostics.com | Undetected · DigiCert to 2027-04-09 |
| physician.quanum.questdiagnostics.com | Undetected · DigiCert to 2027-01-26 |
| myquest.questdiagnostics.com | Undetected · DigiCert to 2027-03-17 |
| sec.gov | Drupal, version hidden · DigiCert to 2027-04-29 |
| malwarebytes.com | WordPress, version hidden · Amazon to 2027-04-30 |
| apnews.com | Undetected · Amazon to 2027-01-14 |
| identitytheft.gov | Undetected · Amazon to 2027-03-09 |
| annualcreditreport.com | Undetected · DigiCert to 2027-05-01 |
Blacklist
questdiagnostics.com shows UCEPROTECT Level 2 and Level 3 hits on shared MessageLabs MX hosts. Those are provider-netblock listings, not a reason to call Quest’s mail blacklisted. auth2, physician.quanum, sec.gov, malwarebytes.com, identitytheft.gov, and annualcreditreport.com were clear on the lists that answered. myquest.questdiagnostics.com and apnews.com have SPFBL notes on web or CDN addresses. Those are not led as the organization being blacklisted. Some Spamhaus and URIBL lists did not answer through public resolvers.
Lookalikes
The Quest brand scan checked 40 lookalikes. BEC staging: 0. Three names have mail. .net and .org redirect to the real site.
| Lookalike | Technique | Signal |
|---|---|---|
| queestdiagnostics.com | Extra e | Mail (NS, A, MX) |
| questdiagnostics.ai | Other TLD | Mail (NS, A, MX) |
| questdiagnostics.co | Other TLD | Mail (NS, A, MX) |
| questdiagnostics.net | Other TLD | Redirects to www.questdiagnostics.com |
| questdiagnostics.org | Other TLD | Redirects to www.questdiagnostics.com |
Credit-report and identity-theft names also have mail. Those are lookalikes of the sites a reader is told to type, not proof of a Quest impostor.
| Lookalike | Technique | Signal |
|---|---|---|
| ananualcreditreport.com | Extra n | |
| eannualcreditreport.com | Extra e | |
| annualcreditreport.xyz | Other TLD | |
| identitytheft.ai | Other TLD | |
| identitytheft.info | Other TLD | |
| identitytheft.site | Other TLD |
malwarebytes.app and malwarebytes.io have mail. Several other Malwarebytes names redirect to the real site. The sec.gov scan is the three-letter name sec. sec.cloud is flagged as BEC staging. That is not an impostor of this 8-K. The apnews.com scan is mostly short insertions on that name.
CourtListener
CourtListener shows several District of New Jersey cases filed October 22–26, 2026 that name Quest Diagnostics Incorporated. The complaints were not read here, so these rows are filing dates and docket codes, not a finding that each suit is about Quanum.
| Case | Filed | What the docket shows |
|---|---|---|
| Johnson · 2:26-cv-13795 | Oct 22 | Cause and nature empty |
| Kisselbach · 2:26-cv-13911 | Oct 26 | Diversity property damage · nature 380 |
| Colby · 2:26-cv-13913 | Oct 26 | Diversity property damage · nature 380 |
Ayala (2:26-cv-13852), Vasey (2:26-cv-13820), and Williamson (2:26-cv-13889) are coded personal injury. Rafi v. Quest Diagnostics Inc., D. Massachusetts 1:26-cv-14589, was filed October 9 as an employment case. That filing predates the Quanum access Quest reported.
A search for the product name Quanum did not return a docket titled Quanum. It returned these Quest Diagnostics cases.
Related coverage
- PHP2Shell is the language issue Quest’s notice says this incident is not
- MFA support directory
Sources: Quest Quanum notice (as of 8:00 a.m. ET, October 26, 2026) · Form 8-K, October 22, 2026 · eLabs FAQ · MyQuest MFA PDF · Malwarebytes, October 26, 2026 · AP, October 22, 2026. Independent EmailMeNow audits, website-tech, blacklist, cybersquat, and CourtListener searches October 26, 2026.