Quest Diagnostics breach exposes patient records, again. Quest Diagnostics confirms a cyberattack on its lab platform exposed patient records - the company's third major breach since 2016. Oct 28, 2026 - 19:14 Quest Diagnostics, one of the biggest lab-testing chains in the United States, told regulators this week that attackers broke into the system doctors and patients use to order tests and check results. It's the company's third major breach disclosure in a decade - and once again, nobody outside the company can yet say how many people are affected. What actually got hit. In a filing with the US Securities and Exchange Commission (SEC) - the regulator companies must notify when something material happens to their business, including a cyberattack - Quest said it discovered unauthorized access to its Quanum Lab Services Manager (LSM) platform in late October. That's the portal clinics and some patients use to place lab orders and pull up results, which means whoever got in was sitting on a system wired directly into people's medical history. The company says it has brought in outside investigators and notified law enforcement, and that day-to-day operations haven't been seriously disrupted. What it hasn't said yet is more telling: * How many patient records were actually accessed * What categories of data were exposed - test results, billing details, insurance information, or all three * Who was behind the intrusion, since no ransomware gang or extortion group had claimed responsibility as of this week Quest Diagnostics says it believes "certain patient records" were accessed, but that the full scope of the breach remains under investigation. A company that keeps ending up here. This isn't Quest's first rodeo with a headline like this. In 2016, contact and lab-result data belonging to roughly 34,000 people leaked through an earlier online flaw. In 2019, a hack at a third-party billing vendor exposed personal data on nearly 12 million Quest patients - one of the largest healthcare breaches on record at the time. A pattern like that tends to say less about one unlucky week and more about how much of healthcare's plumbing still runs through decades-old systems that were never built with today's threats in mind. Why this matters even if you've never used Quest. Lab and health-records data is uniquely hard to protect because so many parties touch it - hospitals, insurers, billing contractors, and software vendors all have a hand in the pipe, and a breach anywhere along that chain can expose the same record. For Indian readers, this should sound familiar territory rather than a distant American problem. India has been building out its own digital health backbone through the Ayushman Bharat Digital Mission, which issues health IDs and is meant to let hospitals and labs share records electronically. The more that infrastructure grows, the more it becomes exactly the kind of high-value, multi-party target that just got hit in the US. India's Digital Personal Data Protection (DPDP) Act, 2023 already classifies health data as sensitive personal information requiring extra safeguards, and breach-notification obligations under it are far stricter on paper than what US federal law generally requires - there's no single American law that mandates the kind of blanket, fast public disclosure the DPDP framework envisions. But a law only works if diagnostic chains, hospital networks, and the vendors they outsource IT to actually invest in security rather than treating a breach as a cost of doing business. Indian diagnostic networks have already had their own scares in recent years, and the incentive structure - low margins, outsourced IT, legacy software - isn't so different from what produced Quest's third strike. What to actually do about it. If you've ever gotten labs drawn through a US provider tied to Quest, there isn't much to do until the company publishes specifics - but a few habits are worth keeping regardless of which country you're in: * Watch for a breach notification letter or email, and don't click links inside it - go to the company's official site directly instead * Check insurance statements for lab tests or claims you don't recognize, which can be a sign of medical identity theft * Freeze or monitor your credit if billing and insurance data turns out to be part of what leaked Healthcare data breaches rarely make for satisfying endings - the affected count creeps up over weeks, the details stay vague, and the company moves on long before patients stop worrying about what's floating around with their name on it. The real question isn't whether Quest will clean this up. It's whether the next diagnostic chain, in the US or in India, learns anything from watching it happen for a third time.

Cybersecurity's Black October: How to protect yourself. Magazine PublishedOct 28, 2026 Each day brings news of another AI-powered attack, or a newly discovered vulnerability. Here's what's happening and how ordinary people can protect themselves online. Cybersecurity professionals are having a brutal month. What's being dubbed Black October isn't even over, and it's already brought about several dozen major cyberattacks and AI-identified vulnerabilities across the internet. When critical vulnerabilities in PHP, the programming language used by around 70% of websites, were uncovered with the help of AI tools and disclosed by the PHP Foundation on Oct. 21, the race to patch servers around the world began. Cloud services provider Cloudflare reported millions of attempts to exploit the vulnerability after its disclosure, following thousands of attempts in the preceding hours. Some countries, including France and Finland, temporarily pulled access to certain websites while the US National Security Agency (NSA) warned organizations to patch the flaws immediately or take affected systems offline. "We are at Security Armageddon now," said NEAR founder Illia Polosukhin. Anthropic's chief security adviser Jason Clinton warned that, "as bad as things have gotten in the past 4 days, they are going to get a lot worse before they get better." Citizens of the United Kingdom are even being urged to "be ready" for an emergency, such as severe weather or cyberattacks, that could cut off access to critical infrastructure such as water, electricity or the internet. US military installation have been told to prep for 90 days of independent operation under the FORTRESS initiative. Houston, do we have a problem? Beyond rushing out to stockpile canned food and walkie-talkies, is there anything else ordinary people can do to mitigate their exposure? So how bad is Black October, really? "It's really bad. It looks like the rest of the internet is waking up to the reality we had three months ago," Rob Hamilton, a Bitcoin security researcher involved in the Bitcoin Red Team, tells Magazine. UK government is urging citizens to be ready for an emergency. Source: gov.uk In the past week or so, cloud platform Railway disclosed that an attacker has accessed and decrypted customer credentials and API keys, apparently targeting AI providers. Medical testing giant Quest Diagnostics confirmed a breach of private patient health data, while Indian security firm eMudhra was found to have eight digital certificate authorities with weak keys that could potentially have let attackers impersonate trusted websites. And code hosting platform GitHub experienced a major service disruption that highlighted how heavily the software world relies on shared infrastructure. GitHub's senior director of security, Austin Devers, says incidents like this are a "clear reminder that reliability requires constant work," because modern development is "so connected." Railway security incident. Source: Railway Jonathan Riss, an OSINT and blockchain intelligence analyst at blockchain security firm CertiK, tells Magazine: "What concerns us most is how a single weakness in shared infrastructure can expose many organizations simultaneously." Unfortunately, he adds that AI's ability to find vulnerabilities is not matched by its ability to fix them: "Finding vulnerabilities faster does not automatically give us the capacity to resolve them faster." Why things are likely to get worse. One reason the problem is getting worse is because AI has changed the economics of cybersecurity. What once required nation-state resources and sophisticated hackers to pull off can now be achieved by a teenager in a basement somewhere. AI entrepreneur and investor Matt Shumer said that AI enables non technical users to find weak spots and exploit them, leaving defenders are "racing to keep up." "Every weak spot still has to be fixed, tested and installed on millions of systems run by people who are already stretched thin." Devers says AI-assisted security tools are "dramatically" lowering the barrier to "uncovering complex, deep-seated flaws in widely used codebases." What can ordinary people actually do? There are some practical steps ordinary folk can use to stay safer online during this volatile period. The internet is under attack. Source: Matt Shumer Shumer recommends staying off sites you don't know, and definitely don't enter passwords or card numbers into unfamiliar sites "until this blows over" since smaller sites are the "least likely to have patched." Delete any apps you don't use and unplug smart gadgets you don't need. Keep some cash at home and enough groceries for a few days, "if you want to be extra careful." Devers says the best defense is "locking down personal access points and keeping overall footprints small." Turn on Multi-Factor Authentication (MFA) across all accounts, ideally using an authenticator app or hardware security key rather than text messages. "This acts as a circuit breaker and stops hackers from logging into your account even if the underlying software is compromised." Never reuse passwords either, he says. "Create strong, unique passwords for every site, and periodically disconnect old app permissions or third-party connections you no longer use." Keep your devices and web browsers updated automatically: "While platform teams work to fix cloud-level security issues on the backend, keeping your devices secure ensures hackers can't use your personal hardware as a back door into your accounts." To self-custody or not self-custody, that is the question. While the alarming rise in security incidents has caused some crypto holders to consider alternatives and some experts to advise against self-custody, others, such as Bitcoin advocate and Casa chief security officer Jameson Lopp, remind users that defeats the whole purpose. "You can only benefit from Bitcoin's unique properties when you hold your own keys. [...] Giving up your keys doesn't make the risk go away, he says. It moves the risk somewhere you can't see or control." Riss recommends separating small amounts you intend to use into a hot wallet, from longer-term holdings in a hardware wallet, and to "actually read what you're signing rather than approving blind." While these precautions can reduce your vulnerability to attack, everyday users can only lock down local issues, and have little ability to affect wider problems. You can "reduce blast radius," he says, "not prevent infrastructure compromise." So while users can improve their cyber hygiene, ultimately, "the structural burden sits with platforms and providers." Get more of Cointelegraph on Google Add Cointelegraph as a preferred source for Google Search. Cointelegraph publishes long-form journalism, analysis and narrative reporting produced by Cointelegraph's in-house editorial team with subject-matter expertise. All articles are edited and reviewed by Cointelegraph editors in line with our editorial standards. Some articles contain affiliate links, from which Cointelegraph may earn a commission. These relationships do not influence which products we review or our editorial conclusions. Content published in here does not constitute financial, legal or investment advice. Readers should conduct their own research and consult qualified professionals where appropriate. Cointelegraph maintains full editorial independence.

You went for bloodwork, not a data breach: Quest Diagnostics confirms patient records were exposed. The medical testing giant confirms hackers accessed sensitive patient information, raising urgent privacy concerns as investigators work to determine whose records were compromised. Reading Time: 4 mins read Quest Diagnostics has confirmed a major cybersecurity breach involving sensitive patient information, but the company still cannot say how many people were affected or exactly what medical records were exposed. The Quest Diagnostics breach became public after the company disclosed unauthorized access to its Quanum Lab Services Manager system, a platform healthcare providers use to order laboratory tests and retrieve patient results. According to a filing with the U.S. Securities and Exchange Commission, Quest discovered the unauthorized access on Wednesday, October 21, 2026. The company reported the incident to federal regulators the following day and acknowledged that an unauthorized party had accessed "certain patient records." By Friday, October 23, the situation had become more concerning. In an official security notice, Quest confirmed that protected health information and personally identifiable information were involved. The company also acknowledged that "personal information and patient records" were affected, although investigators have not determined the specific information compromised. That leaves patients facing serious unanswered questions about their privacy. Quest has not disclosed the number of affected individuals, which healthcare organizations were impacted, or how long the unauthorized access may have continued before discovery. The company has also not publicly established whether the accessed records were downloaded, distributed, or used for fraudulent activity. For anyone who has undergone bloodwork, medical screenings, or other diagnostic testing through Quest, the uncertainty creates an immediate concern. However, receiving services from Quest does not automatically mean a patient's information was involved in this incident. The affected Quanum system plays an important role in everyday medical care. According to Quest's description of its laboratory services platform, physicians, hospitals, and medical office employees use the technology to submit testing requests, monitor orders and review laboratory results. That connection to patient care makes the breach particularly sensitive. Depending on which records were accessed, medical information can potentially reveal private details about someone's health, testing history, or treatment. Quest has not confirmed that any particular diagnosis, laboratory result or category of sensitive medical information was taken. The possible consequences extend beyond personal embarrassment or unwanted disclosure. According to the Federal Trade Commission, stolen medical information can be used in identity theft schemes, including attempts to obtain healthcare services or submit fraudulent insurance claims under another person's identity. The agency warns that victims may discover suspicious medical bills, unfamiliar insurance claims, or incorrect information appearing in their health records. Such problems can become especially complicated when inaccurate records affect future medical treatment. Patients should also remain alert to suspicious messages claiming to come from Quest, their doctor's office, or an insurance company. The FTC advises consumers not to provide medical information to unexpected callers or through unfamiliar email and text links. Instead, patients should contact healthcare organizations using verified contact information. Meanwhile, Quest says it has taken steps to contain the intrusion. Its regulatory filing confirms that federal law enforcement authorities were notified and outside cybersecurity specialists were brought in to investigate. The company also activated its incident response procedures to determine the scope of the unauthorized activity. Quest temporarily suspended access to Quanum Lab Services Manager. Its official notice states that other systems, including Essential Insights and LabHQ, were also temporarily paused as a precaution, although the company reported no unauthorized data access in those systems. Healthcare providers who normally rely on the affected platform were directed to use paper requisitions or Quanum eLabs while restoration efforts continued. Quest said other electronic systems used by healthcare providers to order testing were unaffected. The company maintains that its core business operations remain functional and that its ability to serve patients has not been materially disrupted. However, keeping laboratory services operational does not resolve the questions surrounding patient privacy. Quest's online security notice contained a "noindex" directive, which instructs search engines not to display the page in search results. That could make the company's explanation harder for concerned patients to discover through ordinary searches. The incident comes during another difficult year for healthcare cybersecurity. In August, medical device manufacturer Boston Scientific disclosed a cyberattack that caused "global disruption" to its operations, according to the company's SEC filing. The incident interfered with business applications and the processing and shipment of medical products. Earlier in March, medical technology company Stryker also experienced a major cybersecurity incident that interrupted portions of its operations. These separate incidents illustrate how attacks against healthcare companies can create both operational problems and concerns about sensitive information. Quest also has a troubling history involving patient data. In June 2019, the company disclosed a security incident involving American Medical Collection Agency, a third-party billing collections provider. Information associated with approximately 11.9 million Quest patients was potentially exposed. At the time, the company said the affected information could include Social Security numbers, financial records, and other personal medical information, although laboratory test results were not involved in that incident. The latest Quest Diagnostics breach involves a different system, and investigators have not announced a comparable number of affected patients. For people concerned about the current incident, monitoring medical billing statements and insurance explanations of benefits can help identify unfamiliar activity. The FTC also recommends reviewing credit reports and considering additional identity protections when sensitive personal or financial information has been compromised. Quest says it will notify individuals determined to have been affected in accordance with applicable law. The company also plans to send notification letters explaining available resources, including credit and identity monitoring.