Quest Diagnostics experienced a data breach, a new class action claims.

On Oct. 23, 2026, Lana Luciano filed a class action lawsuit against Quest Diagnostics Inc. in the U.S. District Court for the District of New Jersey.

The lawsuit claims Quest failed to protect patients' personal and medical information, which an unauthorized party accessed in a data breach the lab testing company discovered two days earlier.

The breach

Quest Diagnostics claims it serves half the physicians and hospitals in the United States and one in three American adults each year. On Oct. 21, 2026, it reportedly learned of unauthorized access to its Quanum LSM system, which some clients use to order tests and look up results. In an SEC filing the next day, the company said it notified federal law enforcement and believed an unauthorized party accessed certain patient records.

That notice did not say how or when the breach began or whether Quest had stopped it, the complaint alleges. Given the lab services Quest provides, the lawsuit contends the exposed records include both personally identifiable information and health information.

The alleged security failures

The lawsuit cites Quest's privacy notice, which says the company uses physical, technical and administrative measures designed to prevent unauthorized access. However, it claims Quest did not encrypt or redact the sensitive information it stored and fell short of federal health privacy rules and widely used cybersecurity standards.

The complaint also cites two earlier Quest breaches: one in 2016 affecting about 34,000 people and another in 2019 affecting about 11,900,000, which it says should have alerted the company to its cybersecurity risks.

Luciano, a Quest patient, contends she had to hand over her personal information to receive lab services and would not have done so had she known about the company's security practices. Since the breach, she claims her personal information appeared on the dark web and she has spent significant time verifying the breach and taking steps to protect herself.

The legal claims

The proposed class action brings four claims:


  • Negligence, which claims Quest failed to use reasonable care in securing patient data

  • Negligence per se, which argues Quest's alleged violations of federal privacy and consumer protection laws count as negligence on their own

  • Breach of implied contract, which claims Quest broke an unspoken promise to protect the information patients provided

  • Unjust enrichment, which claims Quest benefited by spending too little on security

The class action seeks compensation for class members and an order requiring Quest to strengthen its security. That would include encrypting data, submitting to outside audits and testing, training employees and undergoing yearly independent security reviews for 10 years.

What the lawsuit means for Quest patients

The proposed class covers everyone in the United States whose personal information an unauthorized party accessed in the breach. As of this writing, there is no settlement, no claims process and no money available.