Quest Diagnostics confirms patient data stolen in recent cyberattack

Quest Diagnostics has officially confirmed that a cyberattack compromised sensitive patient information stored on its systems. The medical testing company submitted a legally required disclosure to U.S. regulators, detailing the incident and acknowledging that unauthorized parties accessed specific patient records. This announcement marks a significant development in the ongoing security concerns surrounding major healthcare providers.

The attack targeted Quanum, a lab testing system used by doctors' offices, hospitals, and other healthcare practices. This platform allows clinicians to request lab tests for patients and handles associated billing processes. Because the system stores vast amounts of medical records, diagnostic results, and billing data, it represents a critical point of vulnerability. Quest stated in its 8-K filing with the Securities and Exchange Commission that the breach was discovered on Wednesday of this week. The company is currently investigating the scope of the intrusion and has notified law enforcement authorities.

Company spokesperson Amanda Rivera directed inquiries regarding the incident to Quest's security notice. The notice confirms that protected health information was taken, including personal information and patient records. However, the company has not yet specified the exact types of data stolen or the number of patients affected. The security page on the company's website currently contains code that tells search engines not to index the page, which makes it more difficult for the public to find the details online.

Quanum is a widely used platform, with Quest stating that approximately half a million clinicians in thousands of locations across North America rely on it. While the total number of health records held by the system is not publicly known, a 2026 case study on the company's website illustrates the scale of data involved. It notes that a single health system with over six million patients can generate hundreds of millions of related medical documents and charts. Quest has not disclosed when the breach began or if any hacking group has made contact with demands for payment.

This incident is the second major data breach for Quest in the past decade. In 2019, the company lost 11.9 million patient records due to a cyberattack on a third-party billing provider. The healthcare industry has faced a surge in cyber incidents this year, with health tech companies becoming primary targets for financially motivated criminals. These attackers often steal data and threaten to publish it if a ransom is not paid. Recent disruptions have affected other major players, including Stryker, Boston Scientific, CareCloud, Craneware, and McKesson, causing weeks of operational delays and widespread data theft.

The stakes remain high as Quest continues its investigation. The company has not yet released a timeline for notifying affected patients or providing further details on the specific nature of the compromised data. For now, patients and healthcare providers are waiting for more clarity on how much information was exposed and what steps are being taken to secure the Quanum platform against future threats.