Quest Diagnostics admits hackers stole patient data from Quanum

Quest Diagnostics operates one of the largest medical lab testing networks in the United States, but the company is now grappling with a confirmed security failure on its digital infrastructure. The incident exposes a vulnerability in the systems that connect daily healthcare operations to financial records.

The company disclosed the breach in an 8-K filing with the Securities and Exchange Commission. Quest stated that it became aware of the attack on Wednesday. The breach targeted Quanum, a platform used by doctors' offices, hospitals, and other practices to order lab tests and process billing. The system stores large volumes of patient health records, diagnostic data, and billing information.

In the regulatory filing, Quest described the incident as unauthorized access to "certain patient records." A separate security notice on the company's website stated that some patients' protected health information was taken, specifically citing "personal information and patient records." Quest noted that it is still determining the specific types of data involved. The company said it has notified law enforcement and is actively investigating the incident.

The scale of the platform is substantial. Quest's materials indicate that approximately 500,000 clinicians use Quanum across thousands of locations in North America. While the company has not disclosed the total number of affected patients or the start date of the breach, a 2026 case study on its website describes a single health system using the platform that holds more than 6 million patients and hundreds of millions of related medical documents.

This is the second known major data breach for Quest in a decade. In 2019, the company lost 11.9 million patient records during a cyberattack on a third-party billing company. The Quanum incident adds to a string of major cyber incidents in the healthcare sector this year. Previous attacks included a mass wiping of employee devices at medical technology maker Stryker in March and a network outage at medical implant manufacturer Boston Scientific in August. Hacks also led to large breaches at CareCloud, Craneware, and McKesson.

Quest has not released a timeline for notifying affected patients or stated whether a hacking group has contacted the company with ransom demands. Amanda Rivera, a Quest spokesperson, pointed to the security notice for details. The notice page on the company's website currently carries "noindex" code, which instructs search engines not to list the page in results.