Quest found the intruder on Wednesday. Five days on, it still cannot say how many patients were in there.

Quest Diagnostics discovered the break-in on Wednesday 21 October and disclosed it in a filing the next day. The system involved is Quanum Lab Services Manager, the platform clinics use to order tests and look up results, which means it sits very close to patient data by design. Quest called in federal law enforcement, hired outside investigators, paused the affected systems and has since restored them.

The official wording is that "certain patient records" were accessed. That is as specific as it gets so far. Quest has not said how many people are involved, nor which fields the intruder actually read, and it did take the trouble to say the incident has nothing to do with the PHP2Shell flaws that have been filling security news all week. For scale, the last big Quest number was 11.9 million people, and that came from a billing contractor in 2019 rather than Quest's own systems. Nobody should assume this one is the same size. The scope is genuinely still open.

Letters will follow, with the usual credit and identity monitoring attached. Between now and then the useful posture is watching rather than worrying. Medical identity theft tends to surface as a treatment you never had on an insurance statement, so read the explanation-of-benefits paperwork that normally goes straight in the recycling. Your free credit reports are at AnnualCreditReport.com, and IdentityTheft.gov is the place to go if something has already happened.

The other predictable consequence is phishing. A lab breach hands scammers a believable opening line, and "we are contacting you about the Quest incident" will be in inboxes shortly. Treat every one of those as untrusted and reach Quest through an address you typed yourself. Tendvane's Privacy and accounts check tells you which of your email addresses have already shown up in known leaks, which is a reasonable thing to know before the letters start arriving.