Quest Diagnostics Breach Exposes Patient Records, Scale Unknown
A cyberattack on Quest Diagnostics compromised sensitive patient health information, prompting an investigation into the scope of the stolen data.
By Tunde Adeyemi ·
Quest Diagnostics, a major medical laboratory testing provider, has confirmed that a cyberattack compromised sensitive patient health information stored within one of its systems. The company disclosed the incident in a filing with the U.S. Securities and Exchange Commission, stating that the unauthorized access targeted its Quanum platform.
The Quanum system is a critical tool for healthcare providers, enabling doctors’ offices, hospitals, and other practices to order lab tests for patients while also managing billing. The platform stores a large volume of patient health and medical records, alongside associated diagnostic and billing information. Quest confirmed that the breach involved accessing “certain patient records.”
In response to the incident, Quest has notified law enforcement and launched an investigation. The company’s security notice states that some patients’ protected health information was taken, including “personal information and patient records.” However, the specific types of data accessed remain under investigation, and the company has not yet disclosed how many patients or healthcare customers were affected.
This latest breach is part of a broader wave of cyberattacks targeting the healthcare industry throughout 2026. Earlier this year, medical device maker Stryker had its employee devices wiped in March, while a hack on Boston Scientific in August forced its network offline for weeks, causing global disruption. Other major incidents have compromised patient data at CareCloud, Craneware, and McKesson.
The potential scope of the incident is significant. Quest’s website states that Quanum is used by about half a million clinicians across thousands of locations in North America. The volume of records it can contain is also substantial; a case study on Quest’s site details how a single health system with over 6 million patients can generate hundreds of millions of related medical documents and charts.
Quest has not specified when the breach began or whether any hacking group has contacted the company with demands. A company spokesperson did not provide additional details and referred inquiries to the security notice. The notice itself is currently marked with “noindex” code, which prevents search engines from listing the page, making it difficult for individuals to find.
This event marks the second major data breach for Quest Diagnostics in a decade. In 2019, the company lost 11.9 million patient records in a cyberattack targeting a third-party billing company. The current investigation is ongoing as the company works to determine the full extent of the compromise.
Source: TechCrunch
