Quest Diagnostics Quanum LSM data breach lawsuit

Quest Diagnostics, one of the largest clinical lab companies in the United States, says an unauthorized party got into Quanum Lab Services Manager (LSM), a web system that some doctors' offices and other clients use to order lab tests and look up results. Quest says patient records and personal information were affected. It has not said how many people were involved or exactly which details were taken.

Within two days of Quest's disclosure, at least 10 proposed class actions were filed against the company in the U.S. District Court for the District of New Jersey. The first was Johnson v. Quest Diagnostics Incorporated, No. 2:26-cv-13795, filed October 22, 2026. These are lawsuits, not a settlement. No court has ruled, no class has been certified and there is no claim form.

Quest Diagnostics Incorporated is headquartered in Secaucus, New Jersey. The Johnson complaint describes it as serving half of the physicians and hospitals in the United States and one in three American adults each year, with about $11.04 billion in 2025 revenue and roughly 2,000 patient service centers. Those figures come from the complaint, which cites Quest's own materials.

The Johnson case was brought by Maliaka Johnson of Summerville, South Carolina, Tom Mesmer of Largo, Florida, and Steven Schwarz of Sacramento, California, represented by Ruta Soulios & Stratis LLP, with Israel David LLC listed as counsel seeking admission. The second complaint we reviewed, Ayala v. Quest Diagnostics Incorporated, No. 2:26-cv-13852, was filed October 23, 2026, by Eunice Garcia Ayala, a Texas resident who says she is a Quest patient. Edelson Lechtzin LLP represents her.

Other cases filed on October 23 include suits by plaintiffs named Bishop, Umeda, Briggs, O'Brien, Romero, Luciano, Barcelo Boyker and Vasey. Their complaints were not available for review.

In a Form 8-K filed with the Securities and Exchange Commission on October 22, 2026, Quest said it learned on October 21 of unauthorized access to Quanum LSM. It said it notified federal law enforcement, brought in outside cybersecurity experts and believed the unauthorized party accessed certain patient records. It said the incident had not materially disrupted its operations.

Quest's public notice adds detail. In an update dated 7:00 pm ET on October 23, Quest said it had remediated the incident and restored Quanum LSM and other systems it had paused as a precaution, including Essential Insights and LabHQ, where it says no data was accessed. It said providers that order through direct lab interfaces or electronic medical records were not affected, and that the incident was not related to a PHP programming issue that federal officials had warned about. In its patient FAQs, Quest says "personal information and patient records were affected" and that it is still identifying which patients and which information.

The plaintiffs say Quest failed to protect sensitive health and personal data. The Johnson complaint alleges, on information and belief, that the records in Quanum LSM include names, dates of birth, contact details, tests ordered, ordering providers, insurance information and lab results. The Ayala complaint alleges that Social Security numbers were among the data and that Quest kept information unencrypted in an internet-accessible environment. Quest has not confirmed any of those data elements.

Both complaints point to earlier incidents. Johnson cites a December 2016 breach through the MyQuest by Care360 app affecting about 34,000 people, the 2019 breach at billing collections vendor American Medical Collection Agency that exposed data of about 11.9 million Quest patients and led to centralized litigation in New Jersey, and a 2021 incident at Quest subsidiary ReproSource Fertility Diagnostics involving about 350,000 patients. The plaintiffs say this history put Quest on notice. These are allegations.

The claims we reviewed are:

• Negligence (both complaints).
• Breach of implied contract (both complaints).
• Declaratory judgment (Johnson).
• Unjust enrichment (Ayala).

Ayala says she spends about two and a half hours a week monitoring her accounts and has received more spam calls since the incident. Quest has not responded to the lawsuits in court. Its public statements focus on remediation and notification and do not address the legal claims.

Nothing has been decided. The public dockets show complaints and summons requests, with no judge assignment listed yet on the records we reviewed. The court has not ruled on whether Quest was negligent, what data was exposed or whether any case can proceed as a class action.

The Johnson complaint proposes a class of "All individuals in the United States whose Private Information was maintained by Quest and was accessed or compromised in the Data Breach." The Ayala complaint proposes a similar class of everyone residing in the United States whose private information was compromised. Both exclude Quest, its subsidiaries, affiliates and officers, and the judges assigned to the case. Definitions often change as cases are combined.

Quanum LSM is a provider-side system, so a patient may not know whether their doctor used it. The clearest sign you are covered would be a notification letter from Quest.

1. Watch your mail for a letter from Quest. Keep it and note any enrollment code and deadline for monitoring services.
2. Review explanation-of-benefits statements from your health insurer for tests or visits you do not recognize.
3. Check your credit reports for free at AnnualCreditReport.com and consider a free credit freeze with Equifax, Experian and TransUnion.
4. Be wary of calls, texts or emails that mention your lab tests and ask for payment or login details.
5. If you see misuse, report it at IdentityTheft.gov and keep a log of the time and money you spend.

There is no payment now. Both complaints ask for actual, compensatory and punitive damages, orders to protect the data Quest still holds, and attorneys' fees. Ayala adds at least three years of credit monitoring, restitution and a detailed disclosure of what was taken. These are requests, not awards. Any recovery would depend on a settlement or court ruling, which in large data breach cases usually takes a year or more.

• October 21, 2026: Quest says it learned of the unauthorized access.
• October 22, 2026: Quest filed its Form 8-K. Johnson complaint filed.
• October 23, 2026: Ayala and at least eight other complaints filed. Quest says systems were restored.

There are no claim, opt-out or objection deadlines yet. Under the federal HIPAA breach notification rule, covered entities generally must notify affected individuals without unreasonable delay and no later than 60 days after discovering a breach.

• Quanum LSM: Quest's Lab Services Manager, a web system clients use to place test orders and receive and look up results.
• PHI and PII: Protected health information and personally identifiable information, such as test results, insurance details, names and birth dates.
• Form 8-K: A report public companies file with the SEC to disclose significant events.
• Consolidation: Combining related lawsuits before one judge, often with appointed lead lawyers.
• Credit freeze: A free block that stops new creditors from viewing your credit report.

Quest will be served and must answer or move to dismiss each complaint. With so many cases in one court, the plaintiffs' firms are likely to ask the court to consolidate them and appoint interim lead counsel. Quest's investigation should also produce a count of affected people and a list of data types, which it would report to federal regulators and state attorneys general.

This article relies on Quest's Form 8-K, Quest's incident notice as updated October 23, the Johnson complaint and docket, and the Ayala complaint and docket. Company size figures, prior-incident counts and the alleged data fields come from the complaints. Quest has not confirmed the number of people affected or the specific data involved. We did not review the other eight complaints.

Class Action Pulse is not a law firm or settlement administrator and does not guarantee eligibility or payment. This article is general information, not legal advice.