Quest Diagnostics Cyberattack: Investigators Probe Access to Patient Records

Quest Diagnostics, one of the largest clinical laboratory providers in the United States, is investigating unauthorised access to a system containing patient records. The incident highlights a critical challenge for healthcare digital forensics: determining precisely which records were accessed and whether sensitive medical information was copied or misused.

In a filing submitted to the US Securities and Exchange Commission on 22 October 2026, Quest disclosed that it had discovered unauthorised access to its Quanum Lab Services Manager (LSM) system on 21 October. Healthcare clients use the platform to place laboratory test orders and receive or review results.

Quest said it believed an unauthorised party had accessed certain patient records, but the full scope of the incident remained under investigation. The company notified federal law enforcement and engaged external cybersecurity specialists. It reported no material disruption to its overall operations.

Forensic investigators must establish more than whether an unauthorised person entered the system. They need to determine which accounts were involved, what records those accounts could access, which records were actually viewed or exported, and whether any information left the environment.

That reconstruction may require correlating authentication logs, application audit trails, database queries, API activity, network telemetry and cloud access records. Investigators can use timestamps, account identifiers, query histories and export events to build a timeline of activity. Preserved system snapshots and relevant logs may also help distinguish normal clinical workflows from suspicious access.

However, a successful login does not prove that patient records were viewed, and a record-access event does not necessarily prove that data was exfiltrated. Investigators need corroborating evidence, such as unusual bulk queries, download activity, outbound transfers or copies of data recovered from attacker-controlled infrastructure. Missing or short-lived logs can limit the conclusions they can draw.

The incident also illustrates why the scope of a breach must be established carefully. Quest has not publicly confirmed how many patients were affected or precisely what information was accessed. Those details should not be inferred from the size of the company or the number of users who rely on its services.

For healthcare digital forensics, the central task is to turn fragmented access records into a defensible account of what happened, whose information was involved and what the evidence can actually prove.