The Second Time Isn’t Bad Luck

Quest Diagnostics, one of the largest clinical laboratory companies in the United States with nearly $12 billion in annual revenue, disclosed on October 22 that an unauthorized party had accessed its Quanum Lab Services Manager. That system is a portal clients use to place test orders and retrieve patient results. The company filed an SEC Form 8-K, confirming that patient health information and personal data were involved. Within 48 hours of the filing, at least two class-action lawsuits landed in federal court in New Jersey.

Here is what makes this more than another breach headline: Quest has been here before.

In 2019, a breach at its billing vendor, American Medical Collection Agency, exposed the records of nearly 12 million Quest patients. That incident triggered investigations by 41 state attorneys general and drove AMCA’s parent company into Chapter 11 bankruptcy. It remains one of the most cited case studies in third-party risk management.

Seven years later, a different system, a different attack vector, and the same company is back in the SEC’s inbox.

The Filing That Raises Questions

Quest filed its disclosure under Item 8.01 (“Other Events”), not under Item 1.05, the cybersecurity incident category the SEC introduced in its 2023 disclosure rules. Item 1.05 requires a company to describe the nature, scope, and timing of a material cybersecurity incident. By filing under 8.01, Quest signaled that it had not yet determined the incident to be material.

That judgment may prove correct. But the filing did not include how many patients were affected, what categories of data were accessed, or when the unauthorized access began. The company said it was still investigating. For board members and investors reading between the lines, an incident involving patient health records at a company that processes lab work for a significant share of American adults raises an obvious question: if not now, when does it become material?

The SEC’s cybersecurity disclosure rules were designed for exactly this moment. A company discovers unauthorized access to patient records, files a disclosure saying it is still determining scope, and investors are left to decide whether the stock price reflects the risk. This is the gap between compliance with the letter of the rule and the kind of transparency that builds trust.

The Repeat-Offender Problem

A single breach can happen to any organization. A second breach at the same company, on a different system, through a different vector, tells a different story. It suggests that the fixes applied after 2019 addressed the specific failure but not the systemic conditions that made the failure possible.

This is the pattern Cyber Risk Is Business Risk calls the “patch and pray” cycle. A company suffers a breach, hires forensics, remediates the vulnerability, strengthens controls around the affected system, and moves on. The board gets a briefing. The CISO presents new investment. The insurance policy renews. But the underlying questions never get asked: Is the security program resourced to protect the entire attack surface, or only the part that was last breached? Does the board receive regular reporting on risk across all systems, or only post-incident updates?

Quest’s 2019 breach was a third-party vendor problem. This one was first-party, in Quest’s own Quanum system. The fact that two very different attack paths both succeeded at the same company, seven years apart, is the kind of data point that should make a board pause before accepting the assurance that “we’ve fixed the problem.”

Forty-Eight Hours to a Lawsuit

The speed of the legal response deserves attention. Class-action complaints were filed in federal court within two days of the SEC disclosure. That timeline is not unusual in 2026, but it should reshape how boards think about breach response.

The plaintiffs’ bar now monitors SEC filings, breach notification portals, and leak sites in real time. For any public company handling sensitive data, the window between “incident discovered” and “lawsuit filed” has collapsed to days. The board’s question is no longer “Will we be sued?” It is “How quickly, and how well-positioned are we to defend?”

Pre-breach preparation matters more than post-breach crisis management. Companies that can demonstrate documented risk assessments, regular board-level cyber briefings, and funded remediation plans have a meaningfully different posture in litigation than companies that cannot.

What to Ask Your CISO This Week

If your organization handles patient data, health records, or any other regulated personal information, the Quest breach is a prompt for three questions:

1. Have we mapped every system that stores or processes patient data, not just the ones in our last risk assessment? The Quanum Lab Services Manager was a client-facing portal, not the core laboratory information system. Breaches increasingly hit the systems that sit outside the primary security perimeter.
2. When was the last time we tested our incident disclosure process end-to-end? Quest filed within 24 hours of discovery. Whether you file under Item 1.05 or 8.01, the decision tree should be documented and rehearsed before the incident, not debated during it.
3. Can we demonstrate that lessons from past incidents produced systemic changes, not just point fixes? If your company has had a prior breach, your board should be able to articulate what changed in governance, budget allocation, and risk oversight, not just which vendor was replaced or which firewall rule was added.

The Quest Diagnostics story is still developing. The patient count may be small, or it may be large. But the governance lesson is already clear: the second time is not bad luck. It is evidence that the organization has not yet answered the harder questions.