Patients whose records were held in Quest Diagnostics’ Quanum Lab Services Manager system may be covered by proposed class actions alleging Quest Diagnostics failed to protect personal and health information accessed in an October 2026 breach. No class has been certified and there is nothing to file yet.
Allegations Only · No Settlement Yet
This article describes class action lawsuits. The claims in them are unproven allegations. Quest Diagnostics has not been found liable, there is no certified class, and nothing to claim at this time. This page is informational and is not legal advice.
What Happened at Quest Diagnostics?
Quest Diagnostics, the Secaucus, New Jersey–based clinical laboratory company, told the Securities and Exchange Commission on October 22, 2026 that it had learned of unauthorized access to its Quanum Lab Services Manager (LSM) system on October 21. In that filing, Quest said the full scope of the access was still under investigation, but that it believed an unauthorized party had accessed certain patient records. It said it had notified federal law enforcement and brought in outside cybersecurity experts.Quanum LSM is the system that, according to Quest, certain clients use to place test orders and to receive and look up results; Quest markets it to healthcare professionals for ordering lab tests for their patients. In a notice posted on its website, Quest says it paused access to the system when it discovered the incident, that patient health and identifying information was involved, and that it is still working to determine exactly which data was affected. Quest says its core business operations were not affected.
The first proposed class action was filed in New Jersey federal court the same day as the SEC filing, and a second followed on October 23. No court has ruled on any of the allegations.
Free settlement alerts
Get notified when new class actions open to claims
Join thousands of readers who get the latest class action settlements you may qualify for — delivered straight to your inbox.
The Lawsuits Filed So Far
The earliest suit located is Johnson v. Quest Diagnostics Incorporated, No. 2:26-cv-13795, filed October 22, 2026 in the U.S. District Court for the District of New Jersey by three Quest customers from South Carolina, Florida and California. It is brought by Ruta Soulios & Stratis LLP and pleads negligence, breach of implied contract and a claim for a declaratory judgment.The second is Ayala v. Quest Diagnostics Incorporated, No. 2:26-cv-13852, filed October 23, 2026 in the same court by a Texas resident who describes herself as a Quest patient. Edelson Lechtzin LLP filed the complaint, which pleads negligence, breach of implied contract and, in the alternative, unjust enrichment.
Court records also show at least eight other suits against Quest Diagnostics opened in the District of New Jersey on October 23, 2026. Their complaints were not publicly available for review, so whether they concern the Quanum incident could not be confirmed.
What the Complaints Allege
Both complaints accuse Quest of failing to adequately secure the personal and health information it held. The Ayala complaint alleges that Quest stored patients’ information unencrypted in an internet-accessible environment, failed to monitor its network closely enough to catch the intrusion sooner, and did not tell patients precisely which information was taken. It alleges that the stolen information includes names and Social Security numbers.The Johnson complaint alleges, on information and belief, that because Quanum LSM is used to order tests and retrieve results, the records accessed include patients’ names, dates of birth, contact information, the tests ordered, the ordering provider, health insurance information and laboratory results. Quest has not confirmed any of these data elements.
The named plaintiff in Ayala says she has spent about two and a half hours a week monitoring her accounts since the breach and has received more spam calls. The complaint asks for damages, including punitive damages, for orders requiring Quest to improve its data security and submit to annual audits, and for at least three years of credit monitoring paid for by Quest.
What Quest Says Was Involved
Quest’s notice answers “yes” to whether patient health information or patient identifying information was part of the unauthorized access, and says that, based on its investigation so far, “personal information and patient records were affected.” It does not list specific data types, and it has not given a count of affected patients.The notice says Quest also temporarily paused two other systems, Essential Insights and LabHQ, as a precaution, but that no data was accessed in them. Providers that order through their own lab interfaces or electronic medical records were not affected, according to Quest, and the company says the incident is not related to the PHP programming-language security issue that federal officials have urged companies to patch.
Who the Proposed Classes Would Cover
The Ayala complaint proposes a nationwide class of all individuals residing in the United States whose private information was compromised in the breach. The Johnson complaint’s class is similar: all individuals in the United States whose private information was maintained by Quest and accessed or compromised in the breach. Quest itself, its officers and directors, and the judges assigned to the case are excluded.Neither class has been certified. Quest says that once its investigation is complete it will notify patients determined to be affected, as required by law, and that the letters will describe the resources available, including credit and identity monitoring. It says it will also notify affected providers and health plans.
What Happens Next
More suits may be filed, and cases over the same incident in the District of New Jersey may be consolidated before one judge. Quest would then respond, often with a motion to dismiss. Other health-data breaches this fall drew suits within days of disclosure, including the Blueberry Pediatrics data breach lawsuits and the Veradigm data breach lawsuit.There is nothing to file in the Quest lawsuits now. If a settlement is reached, people whose information was involved would normally receive a notice explaining how to file a claim.
Questions
Is there a Quest Diagnostics data breach class action?
Yes. Court records show at least two proposed class actions over the Quanum breach in the U.S. District Court for the District of New Jersey: Johnson v. Quest Diagnostics Incorporated, No. 2:26-cv-13795, filed October 22, 2026, and Ayala v. Quest Diagnostics Incorporated, No. 2:26-cv-13852, filed October 23, 2026. Both are at the complaint stage. No class has been certified, there is no settlement, and there is nothing to claim yet.
What is the Quanum Lab Services Manager?
Quanum Lab Services Manager (LSM) is a Quest Diagnostics system that, according to Quest, certain clients use to place test orders and to receive and look up results. Quest markets it to healthcare professionals for ordering lab tests for their patients. Quest says it paused access to the system when it discovered the intrusion.
Were Social Security numbers exposed in the Quest Diagnostics breach?
Quest Diagnostics has not said. Its notice says personal information and patient records were affected and that it is still working to determine the specific data involved. The Ayala complaint alleges that names and Social Security numbers were among the information taken, but that is an unproven allegation.
How many people were affected by the Quest Diagnostics breach?
Quest Diagnostics has not released a number. Its October 22, 2026 SEC filing says the full scope of the unauthorized access remains under investigation.
Will Quest Diagnostics notify affected patients?
Quest says it will notify patients determined to be affected as required by applicable law, once its investigation is complete. It says the notification letters will describe the resources available, including credit and identity monitoring. Quest also says it will notify affected providers and health plans.
Sources
• Quest Diagnostics: An Update on an Incident Involving One of Our Systems (company notice and FAQs, as of October 23, 2026).• Quest Diagnostics Incorporated: Form 8-K, Item 8.01 (filed October 22, 2026).
• Complaint, Ayala v. Quest Diagnostics Incorporated, No. 2:26-cv-13852 (D.N.J., filed October 23, 2026): complaint (PDF) and CourtListener docket.
• Complaint, Johnson v. Quest Diagnostics Incorporated, No. 2:26-cv-13795 (D.N.J., filed October 22, 2026): complaint (PDF) and CourtListener docket.
