Quest Diagnostics Confirms Cyberattack Exposed Patient Data on Its Quanum Platform

Quest Diagnostics has officially acknowledged that a cyberattack compromised its systems, leading to the unauthorized access of sensitive patient information. The laboratory testing giant disclosed the incident in a legal filing to U.S. regulators, confirming that a breach occurred on one of its key platforms. While the company is still determining the full scope of the damage, it has verified that certain patient records were accessed by unauthorized parties during the attack.

The incident specifically targeted Quanum, a critical system used by doctors’ offices, hospitals, and healthcare practices to request lab tests and manage associated billing. This platform serves as a hub for a vast amount of data, including patient health records, diagnostic results, and financial information. Quest stated in its 8-K filing with the Securities and Exchange Commission that it became aware of the cyberattack on Wednesday, prompting immediate internal investigations and notifications to law enforcement.

The company has not yet released specific figures regarding how many patients or healthcare customers were affected by the breach. However, the scale of Quanum’s usage suggests a potentially large impact. According to Quest’s own materials, the platform is utilized by approximately half a million clinicians across thousands of locations in North America. While the exact number of stored health records is unclear, a recent case study on the company’s website illustrates the volume of data involved, noting that a single health system with over six million patients can hold hundreds of millions of related medical documents.

This breach is the latest in a series of major cyber incidents targeting the healthcare sector in 2026. Health tech companies have become prime targets for financially motivated cybercriminals who seek to steal sensitive data and demand ransom payments. Throughout the year, the industry has faced significant disruptions, including a mass-wiping of employee devices at medical tech maker Stryker in March. Additionally, a hack on medical implant manufacturer Boston Scientific in August forced its network offline for weeks, causing global operational disruptions.

Other major players in the health tech space have also been hit this year. Separate hacks resulted in massive data breaches at medical recordkeeping company CareCloud, Scotland-based provider Craneware, and U.S. pharmaceutical distribution giant McKesson. These incidents have allowed the theft of millions of electronic health records, highlighting the persistent vulnerability of the sector to sophisticated cyber threats.

In its public security notice, Quest confirmed that some patients' protected health information was taken, specifically citing “personal information and patient records.” The company is still investigating the specific types of data that were compromised. Notably, the company’s website post currently contains “noindex” code, which instructs search engines not to list the page in search results. This technical decision makes it significantly more difficult for the general public to find the notice through standard web searches.

This is Quest’s second known major data breach in the past decade. The previous incident occurred in 2019, when a cyberattack on a third-party billing company resulted in the loss of 11.9 million patient records. Quest has not disclosed when the current breach began or if any hacking group has contacted the company with demands for payment in exchange for not releasing the stolen data.

Amanda Rivera, a spokesperson for Quest, referred inquiries to the company’s security notice and did not provide additional details in response to questions about the incident. The company continues its investigation to understand the full extent of the unauthorized access and to determine the next steps for notifying affected individuals.