Quest Diagnostics Data Breach
In October 2026, Quest Diagnostics disclosed that an unauthorized party accessed patient records through its Quanum Lab Services Manager system, a portal physicians and hospitals use to order lab tests and look up results. Hausfeld has filed a class action on behalf of affected patients.
On October 21, 2026, Quest Diagnostics, one of the largest clinical laboratories in the United States, learned of unauthorized access to its Quanum Lab Services Manager (Quanum LSM) system. Quanum LSM is a web-based platform that physicians, hospitals and medical-office staff use to place lab test orders and to receive and look up patient results. In a filing with the U.S. Securities and Exchange Commission the next day, Quest stated that it believes an unauthorized party accessed certain patient records. Quest has since confirmed that protected health information and personally identifiable information were involved.
On October 30, 2026, Hausfeld LLP and Seeger Weiss LLP filed a putative class action lawsuit in the U.S. District Court for the District of New Jersey on behalf of individuals whose information was compromised. The complaint alleges that Quest made identifiable patient records available through an internet-facing portal without the authentication, access controls and monitoring needed to keep them secure, and that Quest was on notice of these risks from its own prior security incidents in 2016, 2019 and 2021.
According to the complaint, the patient records accessible through Quanum LSM may include names, dates of birth, addresses and other contact information, health insurance information, the identity of the ordering provider, the tests ordered, diagnosis codes and laboratory results. They may also include Social Security numbers and other identifiers kept in patient records. The complaint alleges that these records can reveal highly sensitive information, such as the results of HIV, hepatitis and cancer screening, pregnancy tests and drug tests.
Quest has not publicly disclosed when the unauthorized access began, how it occurred, whether data was taken, or how many patients were affected. As of the filing of the complaint, Quest had not yet sent notice letters to affected individuals. Under federal law, it must notify affected individuals without unreasonable delay and no later than 60 days after discovering a breach.
Unlike a password or credit card number, medical information cannot be changed once it is exposed. Individuals whose information was compromised may face an increased risk of medical identity theft, in which someone uses their insurance information to obtain care or submit claims, as well as financial fraud and phishing or extortion attempts that reference their real medical care.
The lawsuit asserts claims for negligence, breach of implied contract, unjust enrichment, and declaratory and injunctive relief. It seeks damages on behalf of affected individuals, long-term credit, identity-theft and medical-identity monitoring at Quest's expense, and an order requiring Quest to strengthen its data security.
You may have been impacted if you had laboratory testing performed by Quest Diagnostics, particularly testing ordered by a physician, hospital or medical office that uses Quest's online ordering and results systems. Many patients never interact with Quanum LSM directly, because their provider's office uses it on their behalf. If you receive a notice letter from Quest about this incident, or believe your information may have been affected, and would like to learn more about your rights, please contact our team.
The case is: Cooke v. Quest Diagnostics Incorporated, No. 2:26-cv-14163 (D.N.J.)