Quest Diagnostics Data Breach: What Patients Should Do and Why Old Health Data Is a Risk

By RedKey USB. Last updated and reviewed: October 27, 2026. Facts about the incident come from Quest Diagnostics' own notice and SEC filing and from Malwarebytes' report; HIPAA points are from HHS, and patient steps are from the FTC. All are linked in the sources.

The Quest Diagnostics data breach hit one of the largest lab testing companies in the US, and it landed in a system that sits close to the heart of patient care: the platform doctors' offices use to order tests and look up results.^[1] Quest's investigation is still running, so nobody outside the company yet knows exactly whose records or which fields were reached. This guide sets out what is confirmed, what patients can do right now, and the lesson every healthcare organization should take from it about the health data it keeps long after it needs it.

What happened in the Quest Diagnostics data breach?

Quest says it learned on October 21, 2026 of unauthorized access to its Quanum Lab Services Manager, or LSM.^[1] The company describes LSM as the system "certain clients use to place test orders and receive and look up results".^[2] Malwarebytes adds that the platform also lets healthcare professionals review historical trends and order supplies.^[1]

Quest paused access to the system and began investigating. In a Form 8-K filed with the SEC on October 22, the company said it believed an unauthorized party had accessed certain patient records.^[7] Its public notice says it terminated the unauthorized access, contained the incident, and is communicating with law enforcement.^[2]

As of 8:00 am ET on October 26, Quest says it has remediated the incident and securely restored LSM. Two other systems, Essential Insights and LabHQ, were paused as a precaution; Quest says no data was accessed in them and they are back online. Its core business operations, it says, "were not impacted by this incident".^[2]

What patient data was exposed?

This is the part that is still open. Quest's notice says "personal information and patient records were affected", and it answers yes when asked whether protected health information (PHI) or personally identifiable information was part of the access.^[2] But it adds that it is "still investigating to determine the specific data affected".^[2]

Malwarebytes notes that Quest has not published a count of affected patients, and has not said whether the data included Social Security numbers, insurance identifiers, payment information, particular test results or account passwords.^[1] Until Quest's letters arrive, treat any claim about the size or contents of the breach that does not come from Quest itself with caution.

What should Quest patients do now?

A breach does not automatically mean your information will be misused, but these steps are worth taking while you wait.^[1]

1. Watch for Quest's letter. Quest says it will notify affected patients and providers, and that its letters will describe the resources available, including credit and identity monitoring.^[2] Read the letter carefully and follow its instructions.
2. Verify every message yourself. Quest warns that phishing and voice phishing often follow an incident, including fake breach notification, credit monitoring and settlement messages.^[2] Do not click links or call numbers in an unexpected message. Go to Quest's website yourself or use contact details you already trust.^[1]
3. Check medical bills and Explanation of Benefits statements. The FTC lists bills for care you did not receive and services you never had on an Explanation of Benefits as warning signs of medical identity theft.^[3] Report anything unfamiliar to your provider and your insurer.
4. Review your credit reports for unfamiliar accounts, debts or medical collections. Free reports are available at AnnualCreditReport.com.^[8][3]
5. Act quickly if you find misuse. IdentityTheft.gov gives you a personal recovery plan.^[4] If someone received care in your name, ask the providers involved for copies of your records and request corrections in writing.^[1]

Medical identity theft is not only a money problem. Someone else's treatment recorded under your name can put the wrong information into your health records, which is why checking statements matters.^[1]

When does HIPAA require breach notification?

Quest says that as the covered entity it will make notifications as required by applicable law.^[2] Under the HIPAA Breach Notification Rule, covered entities must notify affected individuals without unreasonable delay and no later than 60 days after discovering a breach of unsecured PHI. Breaches affecting 500 or more people must also be reported to the HHS Secretary, and to prominent media outlets where more than 500 residents of a state or jurisdiction are affected.^[9] State breach laws can add their own requirements.

Why is old health data a risk?

A lab ordering system holds results by design, so this breach is not a simple case of data kept too long. But it is a reminder of a rule that applies to every healthcare organization: any health data you hold is data that can be reached. The less you keep, and the fewer places it sits, the less there is to lose.

HIPAA already points that way. The minimum necessary standard requires covered entities to make reasonable efforts to limit uses and disclosures of PHI to the minimum necessary for the purpose.^[5] Old exports of lab results, spreadsheets of patient lists made for a one-off project, and copies left on retired laptops and file servers all widen the target without adding any value.

HIPAA also has rules for the end of data's life. HHS says covered entities must implement policies and procedures for the final disposition of electronic PHI and of the hardware or electronic media it is stored on, and must remove electronic PHI from media before the media is made available for reuse.^[6] HIPAA does not require a particular disposal method, but HHS gives clearing, purging and destroying as examples for electronic media, and says workforce members involved in disposal must be trained.^[6] The Breach Notification Rule also treats PHI that has been properly destroyed as secured, which means it falls outside breach notification.^[9]

For a deeper look, see our guides to HIPAA media sanitization requirements and HIPAA compliant laptop wiping.

How should clinics and labs dispose of retired drives?

1. Find where health data lives, including old desktops at front desks, retired file servers, external backup drives and USB sticks used to move exports.
2. Delete what you no longer need from systems you still run, in line with your retention schedule and the minimum necessary standard.^[5]
3. Keep retired devices under control until they are wiped. A drive waiting in a closet is still a drive full of PHI.
4. Wipe the whole drive before reuse, resale or recycling. Deleting files or reformatting usually leaves data recoverable. HHS expects electronic PHI to be removed before media is reused.^[6]
5. Record every erasure so you can show what was wiped, when and by whom.

RedKey USB is built for step four. You start a PC, laptop or Intel-based Mac from the RedKey stick and it overwrites the drives you choose: hard drives, SATA SSDs, NVMe SSDs, SCSI and SAS drives, USB flash drives and memory cards. It also removes hidden areas such as the HPA and DCO on ATA/SATA drives, and supported hidden areas on SCSI drives. RedKey Professional and Ultimate produce a PDF erasure report for each job, which gives you a record for step five, while RedKey Home shows results on screen only. It is a one-time purchase with unlimited use and no subscription.

Our guides on verifying a hard drive wipe before disposal and chain of custody for devices cover steps three to five in more detail.

The bottom line

If you are a Quest patient, watch for Quest's letter, treat every breach message with suspicion until you have verified it yourself, and keep an eye on your medical bills, insurance statements and credit reports.^[2][3] If you run a clinic, lab or practice, use this as a prompt to find the health data you no longer need and get rid of it properly, from the export on a shared drive to the hard drive in the PC you retired last year.

Quest Diagnostics data breach FAQs

What happened in the Quest Diagnostics data breach?

Quest Diagnostics learned on October 21, 2026 of unauthorized access to its Quanum Lab Services Manager (LSM) system, which certain clients use to place test orders and receive and look up results. Quest paused access, contained the incident and restored the system as of 8:00 am ET on October 26, 2026. It says patient records and personal information were affected and its investigation is ongoing.

What data was exposed in the Quest breach?

Quest has confirmed that protected health information and personally identifiable information were involved, but it has not yet said which specific data was affected or how many patients are involved. Malwarebytes notes Quest has not said whether Social Security numbers, insurance identifiers, payment information, test results or passwords were included.

Will Quest notify me if my data was affected?

Yes. Quest says that as the covered entity it will notify affected patients and providers as required by law, and that its notification letters will describe the resources available, including credit and identity monitoring. Under the HIPAA Breach Notification Rule, individual notices must go out without unreasonable delay and no later than 60 days after a breach is discovered.

How do I know if a Quest breach letter or email is real?

Quest warns that phishing and voice phishing often follow an incident, including fake breach notification, credit monitoring and settlement messages. Do not click links or call numbers in an unexpected message. Go to Quest's website yourself or use contact details you already trust.

What are the warning signs of medical identity theft?

The FTC lists bills for medical services you did not receive, calls from debt collectors about medical debt you do not owe, medical collection notices on your credit report you do not recognize, and an Explanation of Benefits statement showing services you never had. Report anything unfamiliar to your provider and insurer.

Does HIPAA say how old health data must be disposed of?

HIPAA does not require a particular disposal method. HHS says covered entities must have policies for the final disposition of electronic protected health information and the hardware or media it is stored on, and must remove it from media before the media is reused. HHS gives clearing, purging and destroying as examples of acceptable approaches for electronic media.

Sources

1. Malwarebytes, Patient records exposed in Quest breach: What you need to know (Pieter Arntz, October 26, 2026)
2. Quest Diagnostics, An update on an incident involving one of our systems (as of 8:00 am ET, October 26, 2026)
3. FTC Consumer Advice, What To Know About Medical Identity Theft
4. FTC, IdentityTheft.gov
5. HHS, Minimum Necessary Requirement
6. HHS, What does HIPAA require of covered entities when they dispose of protected health information?
7. Quest Diagnostics, Form 8-K filed with the US Securities and Exchange Commission (October 22, 2026)
8. AnnualCreditReport.com, free credit reports
9. HHS, Breach Notification Rule

This article is general information, accurate as of October 27, 2026, based on Quest Diagnostics' notice and SEC filing, Malwarebytes' report, and the HHS and FTC sources listed. Quest's investigation was ongoing at the time of writing, and the specific data and number of patients affected had not been published. It is not legal advice.