Quest Diagnostics Data Breach Lawsuit 2026, Multiple Class Actions Over Patient Records, Social Security Numbers and Lab Results

The complaints contain unproven allegations. Quest has confirmed unauthorized access to its Quanum Lab Services Manager system and says patient information was affected, but it has not disclosed how many patients were affected or exactly what data was involved.

As of October 29, 2026, there is no Quest Diagnostics data breach settlement, no settlement website, no claims administrator and no claim form. The lawsuits are at the complaint stage and no class has been certified.

Any website, email, text or caller offering a Quest breach payout, or asking you to pay a fee or share a Social Security number, bank details or card number to “file a claim,” is not a verified claim process. Do not respond, and report it. If a real settlement is reached, the court will require an official notice explaining who is included and how to file, and this article will be updated.

Quest Diagnostics Data Breach Lawsuit: Quick Facts

Quest Diagnostics is facing multiple proposed class actions after a cybersecurity incident involving its Quanum Lab Services Manager (LSM) system, which healthcare providers use to order laboratory tests and retrieve results.

Quest told the SEC on October 22, 2026 that it discovered unauthorized access on October 21 and notified federal law enforcement and outside cybersecurity experts. By October 28, several lawsuits had been filed in federal court in New Jersey, where Quest is headquartered, alleging inadequate cybersecurity and seeking damages and court-ordered security improvements.

Detail	Information
Company	Quest Diagnostics Incorporated
Incident discovery date	October 21, 2026
Public SEC disclosure	October 22, 2026
Affected system	Quanum Lab Services Manager (LSM)
Nature of incident	Unauthorized access to a system containing patient records
Number of people affected	Not disclosed
Specific data accessed	Still under investigation
Court	U.S. District Court, District of New Jersey
Earliest identified lawsuit	Johnson et al. v. Quest Diagnostics Incorporated, No. 2:26-cv-13795
Main allegations	Negligence, inadequate cybersecurity, breach of implied contract, unjust enrichment
Class certification	None verified
Settlement	None verified
Official settlement website / claim form	None
Latest company update	Access contained; Quanum LSM restored; investigation continues

What Happened in the Quest Diagnostics Data Breach?

Quest, a major U.S. clinical laboratory company, discovered unauthorized access to Quanum LSM on October 21, 2026. In its SEC filing, Quest said the full scope was under investigation but that it believed an unauthorized party had accessed certain patient records. It said it activated its incident-response procedures, notified law enforcement and retained outside experts, and that core business operations were not materially disrupted.

The disclosure did not identify the attacker, explain how access was gained or say when the unauthorized activity began. October 21 is the discovery date, not necessarily the start date.

Has Quest Fixed the Security Problem?

Quest’s incident notice says it contained the unauthorized access, remediated the incident and securely restored Quanum LSM. As a precaution it temporarily paused two other systems, Essential Insights and LabHQ, reporting that no data was accessed in them and that they have been restored. Quest also says the incident was unrelated to the PHP programming-language security issue federal officials had urged businesses to address. During the pause, some clients reportedly used alternatives such as Quanum eLabs, paper requisitions or fax.

These are Quest’s own statements. They do not establish that every affected patient has been identified, that the full scope is known or that Quest is legally responsible.

What Is Quanum Lab Services Manager, and Who Is Affected?

Quanum LSM is a client-facing platform that certain healthcare providers use to place test orders and view results. A patient may use Quest through a doctor’s office or hospital without knowing which system handles the order.

The incident therefore does not automatically affect everyone who has ever used Quest. Quest says providers that order tests through their own direct laboratory information systems or electronic medical records were not affected through those interfaces. Quest has not published a final list of affected patients, and says it will notify affected patients, providers and health plans once its investigation identifies them.

What Information Was Exposed in the Quest Diagnostics Breach?

Quest has confirmed that personal information and patient records were affected, but has not identified every data field. Several complaints allege that the following may have been accessed:

• Names and dates of birth
• Addresses, phone numbers and other contact details
• Health insurance information
• Laboratory orders, ordering-provider details and test results
• Social Security numbers
• In some plaintiffs’ allegations, driver’s license and credit card information

This is not a confirmed list of what was taken from any given person. The complaints rely on information and belief, based partly on the type of data a lab system typically handles. Quest’s notice does not yet confirm Social Security numbers, financial details or every category listed.

Were Social Security Numbers Stolen?

Quest has not confirmed that. Some plaintiffs allege Social Security numbers were involved. If they were, the risks include identity theft, fraudulent credit applications and tax-related fraud, but consumers should distinguish the plaintiffs’ allegations from Quest’s confirmed disclosure.

Were Medical Test Results Exposed?

Quest has not published a full inventory. Because Quanum LSM is used to order tests and retrieve results, plaintiffs allege lab information may have been involved, but the official disclosure does not yet establish that any particular category of results was taken.

Is the Stolen Information on the Dark Web?

Some complaints allege the data may have reached cybercriminals or the dark web. Neither Quest nor a court has confirmed that. Unauthorized access and public distribution of stolen data are different events. Stay alert for suspicious messages that mention lab tests or insurance details without assuming every unsolicited message is linked to this incident.

Which Quest Diagnostics Data Breach Class Actions Have Been Filed?

Multiple proposed class actions were filed in the District of New Jersey between October 22 and 26, 2026. They are separate cases with their own plaintiffs, allegations, state-law claims and proposed classes.

Lawsuit	Case number	Reported filing date
Johnson et al. v. Quest Diagnostics Incorporated	2:26-cv-13795	October 22, 2026
Vasey v. Quest Diagnostics Incorporated	2:26-cv-13820	October 22–23, 2026
Boyker v. Quest Diagnostics Incorporated	2:26-cv-13822	October 22–23, 2026
Luciano v. Quest Diagnostics Incorporated	2:26-cv-13827	October 22–23, 2026
Romero v. Quest Diagnostics Incorporated	2:26-cv-13837	October 23, 2026
O’Brien v. Quest Diagnostics Incorporated	2:26-cv-13847	October 23, 2026
Ayala v. Quest Diagnostics Incorporated	2:26-cv-13852	October 23, 2026
Williamson v. Quest Diagnostics Incorporated	2:26-cv-13889	October 24, 2026
Kisselbach v. Quest Diagnostics Incorporated	2:26-cv-13911	October 26, 2026
Colby v. Quest Diagnostics Incorporated	2:26-cv-13913	October 26, 2026
Worley v. Quest Diagnostics, Inc.	1:26-cv-13940	October 26, 2026

Case names, numbers and filing windows come from accessible complaints and docket listings. At least eight more suits against Quest were reported opened in New Jersey federal court on October 23, but their complaints were not publicly available, so their link to this incident could not be confirmed. The cases are not a single consolidated lawsuit, though the court may consider consolidation later.

What Do the Quest Diagnostics Lawsuits Allege?

The complaints generally argue that Quest had a duty to protect patient information and failed to use reasonable safeguards to prevent unauthorized access, detect suspicious activity and secure sensitive data. They seek damages, restitution and court orders requiring stronger security. Other allegations include inadequate encryption, weak access controls, insufficient monitoring and training, failure to delete unneeded data, and delayed notice. Some request multi-year credit monitoring and annual security audits, and some cite earlier incidents as evidence Quest should have recognized the risks. None of this has been proven.

• Johnson: Plaintiffs Maliaka Johnson, Tom Mesmer and Steven Schwarz allege Quest failed to secure personally identifiable and protected health information in Quanum LSM, asserting negligence, breach of implied contract and declaratory relief for a proposed nationwide class.
• Ayala: Eunice Garcia Ayala alleges negligence, breach of implied contract and, alternatively, unjust enrichment. She says she spends about two and a half hours a week monitoring accounts and has received more spam calls. Whether that is legally compensable is undecided.
• Romero: Giga Romero alleges negligence, negligence per se under Colorado law and breach of implied-in-fact contract, proposing a nationwide class with an alternative Colorado subclass. She says she could not log in to the separate MyQuest patient portal on October 22. Quest’s notice identifies Quanum LSM, not MyQuest, as the compromised system.

Related article: Ford F-Series Speedometer Recall 2026, 102,159 Trucks Affected by Faulty Gauges

Which Laws Could Apply?

The cases mainly rely on state-law claims. Federal healthcare privacy rules may inform Quest’s duties, but that does not mean HIPAA itself supports a damages suit.

• Negligence: duty, breach, causation and legally recognized harm, judged under each state’s law. A breach alone does not establish every element.
• Negligence per se: may apply when a defendant violates a statute meant to protect people like the plaintiff from the harm alleged. Requirements vary by state, and the Romero complaint invokes Colorado law.
• Breach of implied contract: plaintiffs argue that giving information to receive testing created an implied promise of reasonable security. Whether such a contract existed and was breached is disputed.
• Unjust enrichment: alleges Quest kept fees without providing the security plaintiffs say was part of the deal. Plaintiffs need more than the fact that they paid for services.
• Declaratory and injunctive relief: requests that the court define rights or require better security. No such order has been issued in the new cases.

What Does HIPAA Require, and Can I Sue Under It?

HIPAA’s Security Rule requires covered entities and business associates to maintain administrative, physical and technical safeguards for electronic protected health information, and its Breach Notification Rule (45 C.F.R. §§ 164.400–414) governs notice to individuals, federal authorities and, in some cases, the media. HIPAA generally does not give individuals a private right to sue for damages, so patients typically rely on state-law claims.

What Is the Deadline for Breach Notification Letters?

For a reportable breach of unsecured protected health information, HIPAA requires individual notice without unreasonable delay and no later than 60 calendar days after discovery. The 60 days is an outer limit, not a safe harbor: notice may be required sooner if there is no reason for delay, and some state laws set shorter deadlines.

Counting from Quest’s stated October 21, 2026 discovery date, the outer limit would fall on or about December 20, 2026, assuming HIPAA’s rule applies to the data involved and that date is treated as the discovery date. That is an estimate, not a confirmed Quest-specific deadline. Quest says it will make required notifications once it identifies affected people and the information involved.

Who May Be Included in the Proposed Class Actions?

The complaints propose nationwide classes of people whose personal or health information was accessed or compromised in the incident, sometimes with state subclasses. No court has certified any class, and a judge could narrow it, reject certification or let claims proceed in another form.

Does everyone who used Quest qualify? No. Having had a Quest test does not show your information was in the affected system, and Quest has not published a count or list.

Do I need to have suffered identity theft? Not necessarily to be within a proposed class, depending on its final definition. Plaintiffs allege injuries such as loss of privacy, time spent monitoring accounts and increased fraud risk, but whether those are legally sufficient is for the court to decide.

What Should Quest Patients Do Now?

1. Follow Quest’s official incident page for updates and any notification letter. Quest says letters will describe protections for affected patients, including credit and identity monitoring.
2. Watch for suspicious contact that mentions a recent lab test, diagnosis, insurance or an account problem. Do not click unverified links or give passwords, Social Security numbers or payment details to unsolicited callers.
3. Secure key accounts. Use unique passwords for email, banking and healthcare portals and turn on multifactor authentication.
4. Monitor insurance and finances. Review Explanation of Benefits statements for unfamiliar tests or services. If you receive a breach notice, follow its fraud-alert or credit-freeze instructions. A freeze makes it harder to open new credit in your name but does not stop every kind of fraud.
5. Keep records of notices, suspicious messages, expenses and time spent, in case you need to show a specific loss later.
6. Do not assume you qualify for a lawsuit. That depends on whether your data was affected, the class definition and the law.

How Is the 2026 Quest Breach Different From Earlier Incidents?

In 2019, a breach at the third-party billing collector American Medical Collection Agency (AMCA) exposed information of roughly 11.9 million Quest patients, according to reporting. Quest’s SEC filings said that incident involved AMCA’s systems rather than Quest’s own and did not include lab results. Reporting also notes a smaller 2016 incident tied to a Quest patient portal.

The new complaints cite prior incidents as context for their claim that Quest should have recognized the risks. An earlier breach involving a different vendor does not prove Quest caused the 2026 incident, and a settlement from the AMCA matter does not cover the Quanum incident.

For other recent health-data breaches, see our coverage of the Veradigm vendor hack and class actions, the Dexcom ShinyHunters data breach lawsuits and the TriZetto breach that went undetected for 11 months. Each involves a separate incident and separate claims.

What Happens Next?

1. Quest responds to the complaints by answering or moving to dismiss, and cases may proceed on separate schedules.
2. Quest’s investigation identifies affected patients and data, followed by notification letters.
3. The court examines legal sufficiency and standing, including whether plaintiffs have alleged a concrete injury.
4. The court may consolidate related cases. No consolidation order has been verified.
5. Class certification under Federal Rule of Civil Procedure 23 may be considered later.
6. Settlement or continued litigation cannot be predicted from the current record.

Quest’s report that the incident is contained and Quanum LSM restored does not end the lawsuits or decide liability.

Quest Diagnostics Data Breach Lawsuit FAQ

Is Quest Diagnostics facing a class action lawsuit in 2026?

Yes. Multiple proposed class actions were filed in New Jersey federal court after Quest disclosed unauthorized access to Quanum LSM. They allege failures to protect patient information, and no class has been certified.

When did Quest discover the data breach?

Quest says it learned of the unauthorized access on October 21, 2026 and disclosed it on October 22. That is the discovery date, not necessarily when the access began.

What information did Quest confirm was stolen?

Quest confirmed that personal information and patient records were affected but has not published a complete list of data fields. Claims about Social Security numbers, insurance details and lab results come from complaints and are unconfirmed.

How many people were affected?

Quest has not disclosed a number. Proposed class estimates in the complaints are not an official count.

What is the case number for the Quest lawsuit?

The earliest identified case is Johnson et al. v. Quest Diagnostics Incorporated, No. 2:26-cv-13795, in the District of New Jersey. Related complaints have their own numbers, listed above.

Is there a Quest Diagnostics data breach settlement or claim form?

No. No settlement, administrator, claim deadline or claim form has been verified as of October 29, 2026. Treat any offer of a payout as a possible scam.

Can I get money from the Quest lawsuit?

There is no current verified payout. Any future compensation depends on the litigation outcome, an approved class or settlement and its eligibility rules.

Does HIPAA let me sue Quest directly?

HIPAA generally gives patients no private right of action. State-law claims such as negligence and breach of implied contract may be available depending on the facts and law, and none has been adjudicated here.

Has Quest fixed the breach?

Quest says the access was contained and Quanum LSM restored, but its investigation into the full scope continues.

What should I do if I used Quest for blood tests?

Check Quest’s official incident page, watch for suspicious messages, secure your accounts and follow any breach notice you receive. Having used Quest does not by itself mean your data was involved.

Sources and Primary-Record Verification

1. Quest Diagnostics, Form 8-K, October 22, 2026, unauthorized access to Quanum Lab Services Manager: https://www.sec.gov/Archives/edgar/data/1022079/000094787126000941/ss6979200_8k.htm
2. Quest Diagnostics, official Quanum incident update and patient FAQs: https://www.questdiagnostics.com/links/quanum-notice
3. Johnson et al. v. Quest Diagnostics Incorporated, No. 2:26-cv-13795, complaint: https://storage.courtlistener.com/recap/gov.uscourts.njd.611272/gov.uscourts.njd.611272.1.0.pdf
4. Ayala v. Quest Diagnostics Incorporated, No. 2:26-cv-13852, complaint: https://storage.courtlistener.com/recap/gov.uscourts.njd.611385/gov.uscourts.njd.611385.1.0.pdf
5. Romero v. Quest Diagnostics Incorporated, No. 2:26-cv-13837, complaint materials from plaintiff’s counsel: https://www.hallattorneys.com/quest
6. U.S. Department of Health and Human Services, HIPAA Breach Notification Rule (45 C.F.R. §§ 164.400–414): https://www.hhs.gov/hipaa/for-professionals/breach-notification/index.html
7. Quest Diagnostics, second-quarter 2026 Form 10-Q (earlier AMCA incident and related litigation): https://www.sec.gov/Archives/edgar/data/1022079/000102207926000070/dgx-20260630.htm
8. Associated Press, October 2026, Quest Diagnostics reports cybersecurity breach affecting patient records: https://apnews.com/article/82dbe1fa6ba06cf6514bc16f73e64fe1

This article is for informational purposes only and does not constitute legal advice or create an attorney-client relationship. AllAboutLawyer.com is a legal information website, not a law firm.