In October 2026, Quest Diagnostics confirmed that someone broke into Quanum Lab Services Manager, the online system doctors’ offices use to order lab tests and view results, and accessed some patient records. Quest has not said how many people are affected or what information was taken. If you have had lab work through Quest, watch for an official letter, ignore unexpected calls or emails about the breach, check your insurance statements, and consider a free credit freeze.
What You Need to Know
- Quest found the break-in on October 21, 2026, shut the system down, and says the threat is no longer active.
- Quest has not yet said how many patients are affected or whether Social Security numbers, insurance details, or test results were exposed.
- If your records were involved, Quest will mail you a letter that explains free credit and identity monitoring.
- Scammers will use this news. Do not click links or give information to anyone who contacts you first about the breach.
- A credit freeze is free and is the strongest way to stop someone from opening accounts in your name.
- Check your Explanation of Benefits statements for tests, visits, or prescriptions you never received.
By Adam Adil Harchaoui | Published by Nevada IT Solutions | Updated October 2026
If you have seen the news about Quest Diagnostics, you might be wondering whether your information is out there. That is a fair worry. Quest is one of the biggest lab companies in the country, and many people in Reno, Sparks, and Carson City have had blood work or other tests processed through it.
The good news is that you do not need to be a tech expert to protect yourself. Most of the steps below take a few minutes, cost nothing, and work no matter what Quest’s investigation finds.
We are the team at Nevada IT Solutions, a Reno IT and cybersecurity company. We help local businesses and medical offices protect themselves from incidents like this one. This guide sticks to what Quest has actually confirmed, so you can act on facts instead of rumors.
What Happened in the Quest Data Breach?
On October 21, 2026, Quest Diagnostics learned that an unauthorized person had accessed its Quanum Lab Services Manager system. Doctors’ offices, clinics, and hospital staff use this system to order lab tests and look up results. In other words, it is not the patient app you might use. It is the tool your doctor’s office uses behind the scenes.
Quest reported the incident to the SEC the next day. In that filing, the company said it believes “an unauthorized party accessed certain patient records.” Quest also contacted federal law enforcement and brought in outside security experts.
According to Quest’s official notice, the company paused the affected system right away and says the threat is no longer active. Quest’s labs and patient service centers kept operating normally.
What We Know and What We Don’t
| Question | What Quest Has Said (as of October 2026) |
|---|---|
| Were patient records accessed? | Yes, “certain patient records” |
| How many people are affected? | Not announced yet |
| Were Social Security numbers taken? | Not announced yet |
| Were test results taken? | Not announced yet |
| Will affected people be notified? | Yes, by letter, with credit and identity monitoring details |
| When will letters go out? | After the investigation ends; no date given |
You may see some websites claim that 11.9 million patients were affected. That number comes from a different breach in 2019, when a billing collections company that worked for Quest was hacked. It does not describe the 2026 incident. For now, nobody outside Quest knows the real count.
Step 1: Watch for the Real Letter and Ignore the Fakes
Your first job is simple: wait for official word from Quest, and do not trust anyone who reaches out to you first.
Breach news brings out scammers. Expect emails, texts, and phone calls that claim to come from Quest. They may say you need to “verify your identity,” pay a lab bill, or click a link to “see if you were affected.” These messages are designed to steal the very information you are trying to protect.
Here is how to tell the difference:
- Real notices from Quest will arrive as mailed letters to people whose records were involved. They will explain what happened and how to sign up for free monitoring.
- Fake notices usually create urgency, ask for passwords or payment, or include a link you did not expect.
- When in doubt, type Quest’s website address into your browser yourself, or call the number on a bill or letter you already trust. Quest’s customer service line is 1-866-MYQUEST.
Never give your Social Security number, insurance ID, or bank details to someone who called you.
Step 2: Read Your Letter and Figure Out Your Risk
If you get a letter, read it closely. It should tell you which types of information were involved. Your next steps depend on what is listed.
| If the Letter Says This Was Exposed | Focus On This First |
|---|---|
| Name, address, or date of birth only | Watch for scam calls and phishing emails |
| Insurance ID or medical information | Check Explanation of Benefits statements closely |
| Social Security number | Place a credit freeze at all three bureaus right away |
| Bank or card information | Call your bank or card issuer today |
Also, think about who in your family might be at higher risk. Older relatives and people with complex medical billing are common targets for medical identity theft. If you help a parent manage their health care, check their mail and statements too.
Keep a simple list of what you know was exposed and when you found out. That record helps if you ever need to dispute a charge or file a report.
Step 3: Lock Down Your Accounts
Even though this breach involved a doctors’ office system, it is a good moment to tighten up your own accounts. Many identity theft cases start with a reused password.
Use a Different Password for Every Account
If you use the same password for your email, your bank, and your patient portals, one leak can open all of them. Instead, use a password manager to create and store a unique password for each account. Most password managers are free or cost a few dollars a month.
Turn On Two-Step Login
Next, turn on multifactor authentication, often called two-step login. With it turned on, a stolen password is not enough. The thief would also need a code from your phone. Start with your email account, since that is the key to resetting everything else. Then add your bank, your health insurance portal, and any patient portals.
Clean Up Old Apps and Accounts
Finally, check which apps can access your email or social media accounts. Remove anything you no longer use or do not recognize. Fewer connected apps means fewer ways in.
Step 4: Credit Freeze vs. Fraud Alert
These two tools protect your credit in different ways. According to the FTC’s guide to credit freezes and fraud alerts, both are free.
| Credit Freeze | Fraud Alert | |
|---|---|---|
| What it does | Blocks lenders from seeing your credit report, so new accounts cannot be opened | Tells lenders to verify your identity before opening new credit |
| Cost | Free | Free |
| How to set it up | Contact Equifax, Experian, and TransUnion separately | Contact any one bureau, and it tells the other two |
| How long it lasts | Until you lift it | One year (seven years with an identity theft report) |
| Best for | Anyone whose Social Security number may be exposed | People who want some protection without freezing |
For most people affected by a major breach, a credit freeze is the safer choice. You can lift it for a few minutes when you apply for a loan or credit card, then turn it back on. You can also freeze a child’s credit, which is smart because kids’ identities often get stolen without anyone noticing for years.
Step 5: Watch for Medical Identity Theft
Medical identity theft happens when someone uses your name or insurance to get care, prescriptions, or equipment. It does more than cost money. It can also put false information into your health records, such as the wrong blood type or a diagnosis you never had.
The FTC lists these warning signs:
- Bills or Explanation of Benefits statements for care you did not receive
- Calls from debt collectors about medical bills you do not owe
- Medical collection notices on your credit report that you do not recognize
- A notice from your insurer that you hit a benefit limit you should not have reached
If you see any of these, call your insurer and the provider listed on the statement. Ask for copies of your medical records, and request corrections in writing. Then visit IdentityTheft.gov to report it and get a step-by-step recovery plan.
Step 6: Sign Up for Free Monitoring and Set Reminders
If Quest’s letter offers free credit or identity monitoring, sign up. Monitoring will not stop a thief. However, it gives you an early warning if your information shows up somewhere it should not.
You can also check your own credit reports for free at AnnualCreditReport.com. Look for accounts or debts you do not recognize.
To keep this from slipping your mind, set three calendar reminders:
- In 30 days: Check your credit reports and your latest insurance statements.
- In 90 days: Check again, and confirm your credit freeze is still in place.
- Every six months: Review your passwords and two-step login settings.
Run a Medical Office or Small Business?
If you own a medical or dental practice, or you manage one, this breach affects you differently. Your staff may have logged in to Quest’s system, and your patients will call with questions. We wrote a separate guide for practices: Quest Diagnostics Data Breach: What Medical Practices Should Do Now. It covers staff passwords, phishing warnings, lab order tracking during the outage, and patient call scripts.
Every small business should take one lesson from this. Your customers’ data probably lives in outside systems you do not control, such as payment processors, booking tools, and cloud storage. Knowing which ones you use, and who on your team can log in, is the first step to protecting it. Nevada IT Solutions helps Reno businesses with exactly this through our managed IT services and cybersecurity services. For medical offices, our HIPAA compliance support covers vendor reviews and staff training.
Nevada IT Solutions is locally owned in Reno, not owned by a private equity firm.
Get a 20-Point Cybersecurity Assessment
Wondering how protected your business is? Our 20-point assessment covers:
- Endpoint protection
- Patch compliance
- Backup integrity and recovery testing
- Email security (SPF, DKIM, DMARC)
- MFA coverage
- Password policy
- Network segmentation
- Remote access (VPN and Zero Trust)
- User access controls
- Firewall configuration
- Wi-Fi security
- Mobile device management
- Software licensing
- Data classification
- Vendor and third-party access
- Incident response
- Security awareness baseline
- Dark web credential check
- Disaster recovery plan review
- Compliance posture (HIPAA, PCI-DSS, FTC Safeguards)
Request your 20-point cybersecurity assessment →
Frequently Asked Questions
How do I know if I was affected by the Quest data breach?
Quest says it will mail letters to patients whose records were involved once its investigation is finished. It has not given a date yet. Until then, do not trust emails, texts, or calls claiming to tell you whether you were affected. You can check Quest’s official notice page for updates by typing the address into your browser yourself.
What information was stolen in the Quest breach?
Quest has confirmed that “certain patient records” and personal information were accessed. It has not said whether Social Security numbers, insurance details, or test results were included. Your letter, if you receive one, should list exactly what was involved for you. Be cautious of websites that claim to know more than Quest has announced.
Should I freeze my credit after the Quest breach?
A credit freeze is free, takes a few minutes per bureau, and does not affect your credit score. If you are worried, freezing your credit now is a reasonable step even before Quest’s letters arrive. You need to contact Equifax, Experian, and TransUnion separately. You can lift the freeze anytime you need to apply for credit.
Is it safe to keep using Quest for lab work?
Quest says the threat is no longer active and its labs kept running normally. The breach involved a system used by doctors’ offices, not the lab testing itself. If you have concerns, talk with your doctor about your options. Either way, the steps in this guide protect you no matter which lab you use.
How much does it cost to protect my small business from a breach like this?
Nevada IT Solutions managed IT plans run $75 to $150 per user per month. That covers monitoring, security updates, endpoint protection, backups, and a local helpdesk you can actually call. Our 20-point cybersecurity assessment shows you where your biggest gaps are. Most small businesses spend far less on prevention than a single breach would cost them.
Why work with Nevada IT Solutions instead of a national IT company?
Nevada IT Solutions is based in Reno, so you work with people who know Northern Nevada businesses. Real people answer the phone, and you work with the same team over time. We explain things in plain English and give honest recommendations sized for small businesses. That local focus is hard to get from a national call center.
Related Reading
- Quest Diagnostics Data Breach: What Medical Practices Should Do Now
- IT for Healthcare Practices
- Cybersecurity Risk Assessments
- IT Support in Reno
About the author: Adam Adil Harchaoui, a University of Nevada, Reno alumnus and veteran of Microsoft and IGT, founded Nevada IT Solutions with a clear vision: to bring elite technical strategy to the local Reno business landscape. As a seasoned Cybersecurity professional, Adam recognized a growing gap between enterprise-level protection and the practical needs of regional organizations. Under his leadership, Nevada IT Solutions has become a premier partner for Managed IT, Cybersecurity, and AI-driven solutions, ensuring that local businesses are not just staying connected, they are staying secure and ahead of the technological curve. Connect on LinkedIn →