Quest discloses patient data breach, expects service restoration from October 23
Key Facts
Quest Diagnostics disclosed unauthorized access to its Quanum Lab Services Manager system and said it believes some patient data held within it was accessed, while it works to identify the affected data. In an incident update, the company said some clients use the system to order laboratory tests and receive and retrieve results, and that it suspended access upon discovering the breach. The Associated Press cited the company as saying it discovered the incident on Wednesday and notified federal law enforcement authorities. The agency added that Quest is engaging outside cybersecurity experts to help respond to the incident as the company continues its investigation. The breach thus affects a system that combines test ordering and results management services, along with patient data the company believes was subject to unauthorized access.
Quest said in its update that "core operations have not been affected" and that it continues to operate despite suspending access to the affected client portal. It said direct interfaces with laboratory systems were unaffected by the incident. Interfaces with electronic medical records systems also remained unaffected, according to the company. Clients using these interfaces can continue submitting test orders through them, allowing this service channel to remain available during the investigation. For users of the suspended Quanum system, the company said paper requisitions or its Quanum eLabs service could be used to order tests and receive results.
The incident disclosure coincided with Quest's announcement of its third-quarter 2026 results, which showed revenue of $3.10 billion, up 10.0% from the corresponding period in 2025, according to its earnings release. Revenue in the previous year's third quarter was $2.82 billion, according to the company's release for that period. It recorded growth of 13.1% at that time compared with 2024, with revenue continuing to rise year on year in the latest quarter at a slower pace than in the previous period. Adjusted diluted earnings per share in the third quarter of 2026 were about $3.00, up 15.4% from the corresponding period in 2025. Adjusted earnings per share thus grew faster than revenue over the same period, according to the figures announced by the company. Quest shares fell in premarket trading as the results and cybersecurity disclosure were released, according to FactSet's StreetAccount service.
Quest previously disclosed a data security incident in 2016, when an unauthorized party accessed its online MyQuest by Care360 application. In its notice at the time, the company said that party obtained protected health information relating to about 34,000 people. Collections provider AMCA also experienced a separate incident involving a system containing information on Quest patients, according to a company filing with the U.S. Securities and Exchange Commission. The filing said the provider believed the affected system contained information on about 11.9 million of the company's patients. That estimate concerned information held on the collections provider's system, while the 2016 incident occurred in Quest's patient application.
In its earnings release, Quest raised its full-year 2026 revenue outlook to a range of $12.065 billion to $12.105 billion. It also raised its annual adjusted diluted earnings per share outlook to a range of $11.25 to $11.35. The financial outlook update came as the investigation into the incident continued and access to the Quanum system remained suspended, with core operations still running, according to company statements. On service restoration, Quest said in the incident update published on the day of the report that it expected full system functionality could be restored as early as October 23. The company specified "tomorrow, October 23" as the earliest expected date for restoring full functionality.