Quest Diagnostics says an unauthorized party accessed patient records inside Quanum Lab Services Manager, the portal certain healthcare providers use to order laboratory tests and retrieve results.
Then Quest took the platform offline.
That decision pushed affected clients onto Quanum eLabs, paper requisitions, fax, phone, and eFax while the company investigated the intrusion. The client FAQ Quest published Thursday gave the privacy impact in unusually direct terms: asked whether protected health information or personally identifiable information was involved, the company answered yes.
Patient-data access forced a live clinical workflow onto contingency channels.
The breach reached the order-and-results layer
Quest learned of the unauthorized access on October 21, according to its Form 8-K. It activated its incident-response process, brought in external cybersecurity specialists, and notified federal law enforcement.
The system at the center of the incident handles both sides of a laboratory transaction. Quest describes Quanum LSM as a place where practices can order tests, track orders, schedule specimen pickups, and review patient results. Its companion alert service delivers real-time Priority and STAT notifications.
Quest says it stopped the unauthorized access after pausing Quanum LSM. It also temporarily paused Essential Insights and LabHQ as a precaution, while stating that data in those systems was untouched. Providers connected through direct laboratory-information-system interfaces or electronic medical records could continue ordering through those routes.
On Thursday’s earnings call, CFO Sam Samad described Quanum as the ordering system used by certain clients that do not use an EMR. Those are the offices most dependent on the fallback instructions.
Friday arrived with Quanum still on fallback
Quest told customers it anticipated restoring full-service functionality “as soon as” October 23.
At 6:17 a.m. ET Friday, Quest’s public incident notice still said access to Quanum LSM was paused and that the company was working toward full restoration. The public Quanum LSM entry route continued to send users to eLabs.
The distinction matters operationally. An eLabs login keeps an alternate channel available. Full restoration means the original ordering-and-results workflow is back, its security work is complete enough for production use, and provider offices know which process to follow.
Quest’s notice directed LSM clients to use paper requisitions or eLabs for orders, and phone or eFax for results. The company said the same credentials could be used for eLabs. Every switch between channels creates a practical question for a provider office: where was the order placed, where did the specimen go, where will the result return, and who is watching for it?
Paper changes the incident inside the clinic
Quest’s product material lists test ordering, status tracking, pickup scheduling, results access, and Priority or STAT alert acknowledgement as Quanum functions.
Paper preserves continuity, but it moves coordination back onto people. A requisition must stay with the right specimen. Faxed orders need confirmation. Results arriving through eLabs, phone, or eFax need to reach the right clinician. Orders started in LSM before the shutdown may need to be reconciled against orders recreated through another route.
The immediate risk is a broken handoff between an order, a specimen, and its result.
That is where providers should concentrate. The incident response is happening at Quest, but the continuity work is distributed across every affected office.
Quest also told investors in 2025 that it was standardizing and digitizing its order-to-cash workflow, with electronic order rate tracked as a productivity measure. The fallback cut directly across that strategy. A portal shutdown can be contained at the company level while still generating manual work across many clinics.
Quest’s scale puts pressure on the next update
Quest says it serves half of U.S. physicians and hospitals and one in three American adults each year. The company has not disclosed how many of those relationships use Quanum LSM or how many patient records were reached in this incident.
That scale explains the attention without supplying a victim count. The current facts already carry weight: a national diagnostics company confirmed unauthorized access to patient data, paused the provider platform involved, and shifted some clients to contingency operations.
Quest is still identifying the affected patients and providers and says it will make notifications required by law. The next disclosure should provide the access window, affected record fields, patient and provider counts, entry path, restoration time, and whether the activity involved targeted searches or larger-scale retrieval.
Those details will determine the response. Contact information calls for one set of protections. Clinical data, insurance identifiers, credentials, or a combined record can create very different fraud, privacy, and security exposure.
Providers now own the reconciliation
Organizations that used Quanum LSM can act before individual notices arrive.
Record when each location lost access and when it changed to eLabs, paper, fax, phone, or eFax.
Reconcile orders submitted before the pause with orders recreated through another channel.
Confirm that every collected specimen has one valid requisition and a visible status.
Track where each result returned and document receipt of every Priority or STAT result.
Preserve local authentication records, browser logs, support tickets, and Quest communications under existing policy.
Warn staff that attackers may use the incident as a pretext for credential, billing, or patient-result phishing.
Security and privacy teams should also map which users and departments relied on Quanum. That inventory gives the organization a clean comparison point when Quest begins naming affected clients and patients.
Quest has confirmed enough for providers to move now. Build the local timeline, reconcile every order and result that crossed the interruption, and watch the next company disclosure for the true scope of the patient-data exposure.