Quest Diagnostics confirms data theft in cyberattack on Quanum platform
A major lab services provider disclosed that sensitive patient records were stolen from its central ordering and billing system.
By Ivan Mori ·
Quest Diagnostics has officially confirmed that a cyberattack resulted in the unauthorized access and theft of sensitive patient data. The company disclosed the incident through a filing with the U.S. Securities and Exchange Commission, marking a significant security event for the healthcare sector.
The breach targeted Quanum, a critical system used by medical practices to request lab tests and process billing. The company stated that it became aware of the intrusion on Wednesday. Quanum stores extensive health records, diagnostic results, and associated billing information for a vast network of healthcare providers.
In its legal disclosure, Quest acknowledged that the attackers accessed specific patient records. The company has notified law enforcement agencies and is currently conducting a detailed investigation. It remains unclear at this stage exactly which categories of data were compromised beyond the general description of personal and medical records.
This incident is part of a broader trend of cyberattacks targeting the healthcare industry in 2026. Financially motivated cybercriminals have increasingly focused on health tech companies to steal large volumes of sensitive data. Attackers often threaten to publish this information if a ransom is not paid, leading to prolonged operational disruptions for affected organizations.
Recent months have seen several major security failures in the sector. In March, medical tech maker Stryker experienced the mass wiping of employee devices. In August, Boston Scientific was forced to take its network offline for weeks following a hack, causing global disruption. Additionally, patient data was breached at medical recordkeeping firm CareCloud, health tech provider Craneware, and pharmaceutical distributor McKesson.
Quest has not yet specified the number of healthcare customers or patients affected by the Quanum breach. The platform is used by approximately half a million clinicians across thousands of locations in North America. While the total volume of stored records is not public, a 2026 case study on the company's website illustrates that a single health system with over six million patients can hold hundreds of millions of related medical documents.
The company has not revealed when the breach initially began or if any hacking group has contacted them with ransom demands. A spokesperson for Quest, Amanda Rivera, referred to the company's security notice for details. That notice confirms that protected health information, including personal data and patient records, was taken, though the investigation into the specific types of data is ongoing.
This is the second known major data breach for Quest in the last decade. In 2019, the company lost 11.9 million patient records due to a cyberattack on a third-party billing company. The current incident highlights the continued vulnerability of central healthcare platforms to targeted digital threats.
Quest's website currently includes a noindex code on its security notice page. This technical setting prevents search engines from listing the page, which makes it more difficult for the general public to discover the disclosure through standard online searches.
More Business · Watch Your Wallet · Report a business · Got a Story?
