Quest Diagnostics account hacked? Here’s what to do
Move fast and in the right order: reclaim the account through Quest Diagnostics’s official flow, kick the attacker out of every session, then close the door they came through — usually a password that leaked in a breach and was reused.
October 2026: Quest Diagnostics says patient records were accessed through its lab-ordering system
Quest Diagnostics, the largest lab-testing company in the US, told investors on 22 October 2026 that the day before it had found someone inside Quanum Lab Services Manager, the system doctors' offices and other clients use to order tests and look up results. Quest believes the intruder accessed certain patient records, and its incident page says protected health information or personally identifiable information was part of it. It has not said how many patients are affected or which fields were taken. On 26 October Quest said the system was fixed and back online. It says it will write to affected patients once the investigation is done, and it warns about fake breach-notification, credit-monitoring and settlement messages in the meantime.
Quest’s Form 8-K of 22 October 2026 and its incident update of 26 October, as reported by CNBC, the Washington Post, TechCrunch and BleepingComputer (22–23 October 2026)
If your Quest Diagnostics account was hacked: start recovery at the official page (www.questdiagnostics.com/support), change the password to a unique one, sign out all other sessions, and re-check the recovery email and phone on the account. Then find out how the attacker got in — check whether your password appears in known breach data — and turn on two-factor authentication so it can’t happen again.
Recover your Quest Diagnostics account, step by step
These steps follow Quest Diagnostics’s official process. Official links only: account recovery · password reset.
Watch your post for a letter from Quest. It says it will notify the patients it confirms were affected. Keep the letter: it should say what was taken, and if it offers credit or identity monitoring, enroll with the code printed in the letter rather than through a link in an email.
Log in to your health insurer's website and read the claims list, or the explanation of benefits statements you get by post, for lab tests, visits or prescriptions you did not have. Query anything unfamiliar with the insurer straight away.
Place a free credit freeze at Equifax, Experian and TransUnion, especially if your letter lists a Social Security number. A freeze blocks new accounts in your name and does not affect your existing cards or your credit score.
Before you act on any call, text or email about the breach, check it by calling Quest on the number published on questdiagnostics.com (1-866-MYQUEST for patients). Never use a number or link supplied in the message itself.
Sign in to MyQuest by typing the address yourself, check your results and appointments for anything you do not recognise, and if your MyQuest password is used anywhere else, give it a new one that is unique.
You do not need to sign up with a law firm to keep your rights. If the lawsuits produce a settlement, a claims administrator will publish a claim site and deadline, usually years later; that is the point to act.
What trips people up with Quest Diagnostics
- The break-in was in the portal your doctor's office uses to order tests, not in your MyQuest login. Changing your MyQuest password is good hygiene, but it does not undo anything, because the records that were accessed sit with Quest whatever your password is.
- You can be a Quest patient without ever choosing Quest. If your doctor or hospital sent your bloodwork to Quest, a notice may arrive from a company you do not remember dealing with. Read it before you throw it away.
- Quest itself warns about fake breach-notification, credit-monitoring and settlement messages. A genuine notice is normally a posted letter; a call or email asking for your Social Security number to confirm you are eligible for compensation is the scam, not the remedy.
- Lab orders commonly carry your insurance details and the reason the test was ordered. Until Quest says which fields were taken, watch the claims your health insurer processes as well as your credit, because medical identity theft shows up there first.
- If you got a letter about the 2019 AMCA breach, some of your Quest-related details may already be circulating. A new letter is not necessarily your first exposure, so do not assume a freeze or monitoring from back then still covers you.
What happened at Quest Diagnostics in October 2026
On 21 October 2026 Quest learned of unauthorized access to Quanum Lab Services Manager (LSM), the web tool that physician practices, hospitals and other clients use to place test orders and to receive and look up results. It started its incident response, called in outside security firms, notified federal law enforcement and disclosed the incident in a Form 8-K to the SEC on 22 October. As a precaution it also paused two other client systems, Essential Insights and LabHQ; it says no data was accessed in those. By 8 a.m. Eastern on 26 October Quest said the intrusion was remediated and Quanum LSM had been restored.
What is not known yet matters more than what is. Quest says it believes some patient data inside Quanum LSM was accessed, and when asked whether that includes health information or personal identifiers its answer is yes, but it has not listed the fields or given a number of people. It says it will notify affected patients and providers and report to regulators once it knows. Quest also told the press the incident has nothing to do with the PHP vulnerability federal officials were warning about that week. Within days, proposed class actions were filed in federal court in New Jersey, where Quest is based, according to court-tracking sites.
Quest patients have been through this before. In 2019 a breach at AMCA, a billing-collections vendor Quest used, exposed records for about 11.9 million Quest patients, and that case went on to years of litigation. The difference this time is that the system involved is Quest's own and sits where test orders and results are handled, not in a debt-collection file. The patient app, MyQuest, has not been named as affected: Quest says the access was within Quanum LSM and other systems were not affected.
Still logged in? Lock the account down now
If you can still get in, you're racing the attacker. In this order: change the password to a long, unique one; sign out all other sessions/devices (the setting exists in Quest Diagnostics's security settings); confirm the recovery email and phone number are yours (attackers quietly add their own so they can "recover" the account later); remove unfamiliar linked apps or API access; and turn on two-factor authentication. Only then deal with anything the attacker posted, sent or bought.
Got a "new login" alert from Quest Diagnostics?
Treat it as real but verify it the safe way: never tap the link in the message itself (fake login alerts are a top phishing template for Quest Diagnostics). Open the app or type the address yourself, check the active-sessions list in security settings, and if you see a device or location you don't recognize, sign it out and change your password immediately. If the alert was genuine, that password is burned — assume it's circulating and change it everywhere else you reused it.
Locked out of Quest Diagnostics — email or phone was changed
This is the worst-case scenario and the most common complaint: the attacker changed the account email, phone number or password so the normal reset flow emails them, not you. Do NOT keep triggering password resets — they go to the hacker. Go straight to Quest Diagnostics's dedicated recovery flow (link above), which is built for exactly this case: it verifies you by your original signup details, previous passwords, linked devices or a government ID / selfie check, bypassing the stolen email. Watch for the security notice Quest Diagnostics sent to your OLD email when the address was changed — it usually contains a "revert this change" link that works for a limited time and is the fastest way back in.
Why this happened — and how to make sure it can’t again
About a third of account takeovers are credential stuffing: a password you used on Quest Diagnostics (or the email behind it) leaked in some other company’s breach, and attackers replayed it here automatically. The FBI’s IC3 logged over 5,100 account-takeover complaints with $262M in losses in 2025 alone (IC3). Even when Quest Diagnostics itself was never breached, your reused password from another site opens it.
So after recovery, check what’s already out there: our free scanner shows which known breaches and dark-web dumps include your email — and whether passwords were exposed with it.
Check my exposure — free →After you recover: three doors to close
- Unique password + 2FA. A password manager plus app-based two-factor stops both stuffing and phishing replays.
- Reset everywhere you reused that password — email first (it’s the master key), then bank, then the rest.
- Shrink your public footprint. Attackers research targets on data-broker sites (your address, phone, relatives — enough to social-engineer support lines). Our free opt-out guide covers 190 of them, step by step.
Hacked Quest Diagnostics account, answered
How did my Quest Diagnostics account get hacked?
The most common cause isn't a hack of Quest Diagnostics itself — it's credential stuffing: a password you used on Quest Diagnostics leaked from some other site's breach, and attackers tried it here automatically. Roughly a third of account takeovers happen this way, with phishing (fake Quest Diagnostics login pages and alerts) close behind. That's why the first fix is a unique password, not just a new one.
Can I get my Quest Diagnostics account back?
Usually yes. Use the official recovery flow (https://www.questdiagnostics.com/support) — it can verify you even when the attacker changed the email and password. Be patient and respond quickly to follow-ups so the case stays open.
Should I just make a new Quest Diagnostics account instead?
Not until you've tried recovery. The old account keeps your history and contacts — and while the attacker controls it, it will be used to scam people who trust you. Recover it, or at minimum report it as compromised so Quest Diagnostics can lock it, before you start over.
Was Quest Diagnostics hacked in 2026?
Yes. Quest disclosed in an SEC filing on 22 October 2026 that on 21 October it learned of unauthorized access to its Quanum Lab Services Manager system, which clients use to order tests and look up results. It believes certain patient records were accessed. On 26 October it said the incident had been remediated and the system restored.
What patient data was exposed in the Quest Diagnostics breach?
Quest has not said yet. Its incident page confirms that protected health information or personally identifiable information was part of the unauthorized access, but says it is still working out which specific data was involved and how many patients are affected. It will set this out in the letters it sends to affected patients.
How do I know if I was affected by the Quest breach?
Quest says it will notify patients it determines were affected, as the law requires, once its investigation is complete. Until then nobody, including breach checkers and law firms, can confirm whether your record was involved. The data has not appeared in known breach databases.
Was MyQuest hacked?
Quest has not said so. The system named in its filing and incident page is Quanum Lab Services Manager, the tool used by doctors' offices and other clients, and Quest says other systems were not affected. Changing your MyQuest password does no harm, especially if you reuse it, but the incident was not a breach of patient logins.
Is there a Quest Diagnostics class action lawsuit?
Proposed class actions were filed in federal court in New Jersey within days of the disclosure, according to court-tracking sites. These are early complaints, not a settlement. If one is reached, a claims administrator will run a claim website with a deadline, and that is when patients would file.
Is this the same as the 2019 Quest Diagnostics breach?
No. The 2019 incident happened at AMCA, an outside billing-collections vendor, and affected about 11.9 million Quest patients. The 2026 incident is in Quest's own Quanum system, used for test orders and results. If you were in the 2019 breach, some of your details may already be in circulation, so take the new notice seriously.
How do I stop my Quest Diagnostics account being hacked again?
Three things close most of the doors: a unique password (a manager makes this painless), app-based two-factor authentication, and shrinking your exposed footprint — checking your email against known breach databases and removing your personal data from data-broker sites that attackers use to research targets.