Quest Diagnostics, one of the largest lab testing companies in the United States, has confirmed that hackers accessed patient records through one of its systems. Quest is still investigating, so there's a lot we don't know yet, including how many people were affected. Here's what has been confirmed so far, and what you can do now to stay ahead of the scammers who follow breaches like this one.

What happened in the Quest Diagnostics data breach?

On Wednesday, October 21, 2026, Quest learned of unauthorized access to its Quanum Lab Services Manager system, according to a filing the company made with the U.S. Securities and Exchange Commission the next day, as reported by BleepingComputer. Quanum is the online platform doctors' offices, hospitals, and clinics use to order lab tests for patients, look up results, and handle billing.

Quest said it believes "certain patient records" were accessed, according to the Associated Press. In a security notice, the company said some patients' protected health information was taken, including "personal information and patient records," TechCrunch reported.

Quest said it notified federal law enforcement, brought in outside cybersecurity experts, and shut down the affected system while it investigates.

What we don't know yet

As of this writing, Quest has not said:

  • How many patients were affected
  • Exactly which types of information were taken
  • When the hackers first got in, or how
  • Who was behind the attack

Based on the company's disclosures so far, it has not been established that Social Security numbers, financial information, or specific test results were exposed, according to eSecurity Planet. That could change as the investigation continues. It's also worth knowing that having used Quest doesn't automatically mean your information was part of this breach. However, to understand the potential scale of this breach, Quest says Quanum is used by about half a million clinicians at thousands of locations across North America.

It's also worth noting that this isn't the first time Quest patients have been caught up in a breach. In 2019, a hack at a billing collections company Quest worked with affected about 11.9 million Quest patients, the AP reported.

Why this breach matters

Health information is especially useful to scammers because it's personal and it's hard to question. A message that mentions a real lab test, a real doctor's office, or a real bill feels far more believable than a generic scam email. As one security expert told eSecurity Planet, a scam that references a real test can seem more credible than ordinary phishing, and unlike a credit card number, you can't simply replace your medical history once it's been exposed.

Breaches like this one are also more common than most people realize. More than 35 million people were affected by large healthcare data breaches reported to federal regulators in 2025, according to TechTarget's analysis of the U.S. Department of Health and Human Services breach portal.

Scammers know that many people waiting on lab results may feel anxious, and they use that. Their goal is to get you to click a link, make a payment, or "confirm" information like your Medicare number or date of birth.

Red flags to watch for

  • Texts, emails, or calls about "test results," a "lab bill," or a "problem with your lab order" that you weren't expecting
  • Messages offering "breach help," free credit monitoring, or a settlement payment that ask you to click a link or share personal details first
  • A caller who knows your name, your doctor, or a recent test and uses that to sound official before asking you to "verify" something
  • Pressure to pay a lab balance right away, especially by gift card, wire transfer, payment app, or cryptocurrency
  • Bills, insurance statements, or Medicare notices listing tests or services you never received

How to protect yourself

  • Don't click links in unexpected messages about lab results or bills. If you want to check on a test or a balance, call your doctor's office or contact Quest using a phone number or website you look up yourself.
  • Don't treat a caller knowing your health details as proof they're legitimate. Scammers use breached data specifically to sound credible. You can always hang up and call back using a number you trust.
  • Never share your Medicare number, Social Security number, or payment details with someone who contacted you first. Whenever someone pressures you to act immediately, it's worth slowing down.
  • Review your insurance Explanation of Benefits statements and Medicare Summary Notices. Look for any lab work, visits, or prescriptions you don't recognize.
  • Watch for official updates from Quest about who was affected and what information was involved, rather than relying on unsolicited messages that claim to be from the company.
  • Keep an eye on your bank and card accounts for anything unusual.

If you think your information has been compromised

The Federal Trade Commission recommends these steps if you suspect medical identity theft:

  • Contact your health insurer, request your Explanation of Benefits statements, and report any errors to the insurer's fraud department.
  • Request your medical records from any provider or lab where your information may have been used, and ask them to correct mistakes.
  • Report it to the FTC at IdentityTheft.gov or by calling 1-877-438-4338.

Stay alert after a data breach

If your parent or loved one gets regular lab work, this is a good moment for a quick conversation. Something as simple as, "If anyone calls or texts about your lab results or a lab bill, just hang up and call your doctor’s office yourself," can head off a lot of trouble.

Americans age 60 and older reported $7.7 billion in losses to the FBI's Internet Crime Complaint Center in 2025, according to AARP. If your loved one has already clicked a link or shared information, remember to lead with care, not frustration. These scams are built to fool sharp people.

Breach details can often come out slowly, and the full picture here may take weeks. You don't need every answer to protect yourself. A little extra skepticism toward unexpected messages about your lab results or your bills goes a long way. Carefull monitors your accounts and cards for unusual activity and includes dark-web monitoring, so you can find out early if your information turns up somewhere it shouldn't. Get started with Carefull today.