Quest Discloses Unauthorized Access to Patient Records, Raises 2026 Forecast

Key Facts

Quest Diagnostics disclosed unauthorized access to its Quanum LSM system and said it learned of the incident on October 21, 2026. Some of the company’s customers use the system to order tests and receive or view results, according to its filing with the U.S. Securities and Exchange Commission. The company added that it believes an unauthorized party accessed certain patient records. The investigation has not yet determined the full scope of access, and the filing did not state how many patients or what types of data may have been involved. Quest said the incident has not materially disrupted its operations or its ability to serve patients.

The company notified federal law enforcement authorities and brought in outside cybersecurity experts to assist with the investigation and response. The filing did not specify when the investigation would be completed or when its findings would be announced. In a report, The Associated Press said the number of patients and records affected had not been determined when its report was published, while the scope of the incident remained under investigation. The news agency also quoted Quest as saying the breach was unrelated to the PHP issue that raised security concerns that week. The company listed the incident’s impact among the risks and uncertainties that could affect future results, without disclosing a material business impact at that point.

The disclosure coincided with Quest’s release of its third-quarter 2026 results. Revenue was $3.10 billion, up 10% from the same period in 2025. Adjusted diluted earnings per share rose to $3.00, an increase of 15.4% year over year. Reported diluted earnings per share were $2.78, up 28.7% from the third quarter of 2025. The company attributed the growth to continued strength in its physician, hospital and consumer channels, as well as productivity gains from automation and artificial intelligence. The results put the breach disclosure in the context of a quarter of revenue and earnings growth, while the company also affirmed that service and operations had not been materially disrupted.

Third-quarter activity metrics show a divergence between test volume and revenue per order: test requisition volume rose 14.5% compared with the third quarter of 2025, while revenue per requisition fell 4.2%. Quest says in its 2025 annual report that it generated annual revenue of $11.0 billion. It also estimates that it serves about one-third of U.S. adults each year, along with about half of the country’s physicians and half of its hospitals. This provides context for the breadth of the company’s services, while the current incident disclosure is limited to a system used by some customers. The filing does not specify whether the records accessed by the unauthorized party include particular categories of patient data.

The company has had separate prior data exposure incidents, according to The Associated Press: Quest said in 2016 that data, including laboratory results and contact information for about 34,000 people, had been exposed in another cyber breach. In 2019, personal information belonging to about 11.9 million of the company’s patients was affected in an incident involving an outside collection services provider. Those incidents are separate from the access Quest disclosed in October 2026, and the current filing does not establish a connection between them. In its disclosure of the current incident, Quest said its scope remains under investigation and did not disclose the number of affected records or patients.

In the market, Quest shares, listed under the ticker DGX, closed at $243.28 on October 22, 2026, according to EL7 data. Reuters had reported that the stock fell 3.7% to $230 in premarket trading on Thursday. The closing data provided do not include an intraday low or establish how the stock’s move ranked relative to the timing of that day’s filing. On its outlook, Quest raised its 2026 fiscal-year estimates, projecting revenue of $12.065 billion to $12.105 billion and adjusted diluted earnings per share of $11.25 to $11.35. The company said the incident’s impact could affect future results, but did not provide a specific financial estimate in the filing.