↓Skip to main content
  1. News/

Quest Diagnostics Breach: What to Ask About the Vendors You Rely On

·5 mins
Quest Diagnostics Data Breach Vendor Risk Healthcare Small Business
Table of Contents
Quest Diagnostics, a large medical lab company, told the public on October 22, 2026 that someone got into one of its systems without permission. Quest says it believes certain patient records were accessed. This post is about the outside companies your own office depends on, and four questions to ask about them this week.

What Quest has said so far #

Quest says it learned of the problem on Wednesday, October 21, 2026. On Thursday, October 22, it reported it in a required public filing with the U.S. Securities and Exchange Commission.

The system is called Quanum Lab Services Manager. Certain Quest clients use it to place test orders and to look up results. In the filing, Quest says it believes an unauthorized party accessed certain patient records in it, and that the full scope is still under investigation. Quest says it told federal law enforcement and brought in outside cybersecurity experts.

Quest’s website update, current as of 7 pm Eastern on Friday, October 23, says it ended the unauthorized access and contained the incident. It says the system “has been securely restored and is available to clients.” Other systems it paused as a precaution are back too, and Quest says no data was accessed in them. Providers who need help getting back into the system were told to call a help desk, and Quest warns of longer waits than usual.

Here is what is not known. Quest’s update says the access did involve patient health and personal information, but Quest is still working out which patients and exactly which data. It has not given a number. It has not said who did this or how. Quest says it will notify affected patients and providers and report to regulators.

Quest also says that, based on its investigation, the incident is not related to the PHP software flaws that have been in the news.

Why this matters if you are not Quest #

You may never have heard of this system. But your office likely has a similar arrangement with some outside company. Maybe a website where you order tests. Maybe the one that sends your bills or runs your payroll.

When that company has a problem, your patients or customers still look to you. They do not call the vendor first.

A vendor’s problem can reach far. In 2019, a billing collections company that worked for Quest, American Medical Collection Agency, told Quest that an unauthorized user had gained access to information on about 11.9 million Quest patients. Quest said it had not been able to verify that figure.

If your office uses Quanum Lab Services Manager, look to Quest’s own notices and your Quest contact for details.

Four questions to ask this week #

These are not legal advice, and they will not stop a problem from happening. They are good questions to have answers to. Take them to your IT person, your managed service provider (the outside company that runs your IT) or your office manager.

1. Who holds our information? Which outside companies and websites hold our customers’ or patients’ information? Think labs, billing, payroll, scheduling, email and file sharing. Who in our office has a login to each? A simple written list is the goal.

2. What if the vendor goes offline? Quest paused some systems as a precaution, and told providers who could not log in to call a help desk. If one of our vendors went quiet for a few days, how would we keep working? Who do we call? What is the paper or phone fallback?

3. What did we agree about bad news? What does our written agreement with each important vendor say about how fast they must tell us, and who tells our customers or patients? For health offices, federal rules say an outside company that handles patient information must tell the provider without unreasonable delay, and no later than 60 days after discovery. The provider has the duty to tell patients, on the same timeline. Whether those rules apply to a particular vendor depends on the facts, so ask what your agreement says. The Federal Trade Commission’s guide for businesses adds one more point: if a vendor says it fixed a problem, verify that it really did.

4. Who does what when a notice arrives? Who in our office reads a vendor’s notice? Who tells the owner? Who decides what we tell our own customers? Add one caution for staff. The Cybersecurity and Infrastructure Security Agency (CISA) says attackers take advantage of current events. It advises checking directly with the company and not following links in email. Use the website or phone number from your own records.

Take this to your next IT meeting #

Print the four questions. Ask for written answers, even short ones. A one-page vendor list is a good start.

At SOC-Lite, a named analyst reviews your alerts, calls you when one is real, works with your IT person or MSP on the fix, and keeps the evidence. A visibility check is free, it takes 20 minutes, and you talk to us by phone or at your office. Book a visibility check

Updates #

2026-10-25: First published, based on the sources below as of this date. We update this post as the details develop.

Sources #