Quest Diagnostics breach: what lab and healthcare security leaders should do

What Quest has said so far

Reuters reported on October 22, 2026 that Quest Diagnostics said it had learned of unauthorized access to its Quanum LSM system.

Reuters describes the system as one that some Quest clients use for test orders and results.

On patient data, Reuters reports that Quest believes an unauthorized party accessed certain patient records, while the full scope is still under investigation.

On timing, Reuters says Quest disclosed in a regulatory filing that it learned of the incident on Wednesday and has notified federal law enforcement.

That is the full set of facts about the incident in the sources provided here. Quest's scope is still being worked out, so treat the picture as incomplete.

What the reporting does not say

The Reuters report does not say how the unauthorized access happened. It does not say who is responsible, and it does not use the word ransomware. It does not say how many patient records are involved or which clients were affected.

CISA's release does not mention Quest. Nothing in either document links the Quest incident to the SafePay group or to any other named actor. Anyone who writes that link into a board briefing or a client notice is going beyond what these sources support.

The question that prompted this briefing refers to guidance on ransomware targeting healthcare. The CISA document is broader than that. Its title refers to critical infrastructure sectors, and the release text does not single out healthcare. Everything below should be read as general ransomware guidance from CISA and the FBI. It is not an assessment of the Quest incident.

What CISA and the FBI released

CISA's press release is dated October 21, 2026. It says CISA, the FBI, the U.S. Secret Service and international partners issued a joint Cybersecurity Advisory titled "#StopRansomware: SafePay Ransomware."

According to the release, the advisory warns of one of the most active ransomware groups in 2026, with approximately 600 victims across sectors in the Americas, Europe and Australia.

Brett Leatherman, the FBI Cyber Division's assistant director, is quoted in the release giving a slightly different count. He said SafePay actors have already targeted more than 600 victims worldwide across multiple critical infrastructure sectors.

The release says the advisory is meant to help defenders directly. It provides observed tactics, techniques, and procedures, indicators of compromise and recommended mitigations.

How SafePay gets in, according to the advisory

CISA's release summarizes the group's method in three steps. The first is entry. CISA says SafePay actors gain access to victim networks by compromising credentials and targeting known vulnerabilities in internet-facing devices, often connecting through virtual private network (VPN) services.

The second step is movement and sabotage of recovery. The release says that once inside, the actors use legitimate IT tools to move through networks and undermine recovery by deleting or disabling backups.

The third step is extortion. CISA says the actors steal data and encrypt systems, pressure victims by threatening to publish stolen information and, in some cases, call victims directly.

Chris Butera, CISA's Acting Executive Assistant Director for Cybersecurity, framed the pattern in his quote. He said public-facing devices with known vulnerabilities continue to be frequently targeted by threat actors like the SafePay group.

None of this describes what happened at Quest. It describes what CISA and the FBI say one active ransomware group does.

Mitigations the agencies list

The release says CISA, the FBI, the Secret Service and international partners urge organizations to review the advisory and implement recommended mitigations.

The first two items on the release's list are keeping systems current and requiring multifactor authentication.

The remaining three cover patching priority, backups and network design.

Butera adds two actions in his quote. He encourages organizations to urgently patch the known exploited vulnerabilities named in the advisory and to conduct forensic triage to determine whether systems have been compromised.

Leatherman's quote states the expected benefit. He said that by following the recommendations, network defenders can significantly reduce both the likelihood and the impact of a SafePay ransomware attack.

The detail behind each item, including the specific vulnerabilities and indicators of compromise, sits in the full advisory. The press release does not reproduce it, and this briefing has not reviewed the advisory itself.

What this means for healthcare and lab security leaders

Neither source gives instructions written for Quest clients, for healthcare providers or for laboratory partners. Quest's disclosure, as Reuters reports it, contains no client guidance. CISA's release is addressed to organizations in general.

Within that limit, the sources support a few points:

• Quest says it is still determining the scope, so confirmed facts may change as the investigation continues.
• Reuters says some clients use the affected system for orders and results. Which of your own users or integrations touch that system is something only your own records can answer.
• CISA's list is the only mitigation guidance in these sources, and the agencies describe it as a way to reduce both likelihood and impact.
• Butera's call for forensic triage is the one step in these sources aimed at finding out whether systems are already compromised.

Treat the SafePay material as general guidance, not as a finding about Quest. Until Quest or law enforcement says more, the sources do not support naming a cause, a threat actor or a ransomware link. Updates from Quest and from CISA's advisory page are the places to watch for changes.