Quest Diagnostics Confirms Breach Compromised Patients’ Personal and Health Information
Quest Diagnostics, a prominent player in medical laboratory testing, has acknowledged a cyberattack that has led to a data breach, compromising a currently unspecified volume of sensitive patient information, as revealed in an official report to U.S. regulatory bodies.
In their 8-K submission to the U.S. Securities and Exchange Commission, Quest disclosed that they became aware of the cyberattack on a Wednesday, which targeted their Quanum lab testing system. This platform enables healthcare providers, including doctors’ offices and hospitals, to order lab tests and manage billing processes. The system holds a significant amount of patient health records and related diagnostic and billing information.
The company stated that unauthorized access led to the compromise of “certain patient records.” Quest has reported the incident to law enforcement and is currently conducting an investigation.
This incident marks the latest in a series of significant cyberattacks impacting the healthcare sector this year. A wave of similar attacks has resulted in extensive disruptions and the theft of millions of electronic health records, alongside sensitive medical information. Cybercriminals, driven by financial motives, are increasingly targeting health tech companies to acquire sensitive data and commonly threaten to make it public unless a ransom is paid.
Previous incidents include a cyberattack in March that led to the wiping of employee devices at medical technology firm Stryker and an August breach that incapacitated the network of medical implant manufacturer Boston Scientific for several weeks, causing major operational disruptions. Additionally, hacking incidents throughout the year have severely compromised patient data at companies like CareCloud, Craneware, and McKesson.
Quest has yet to disclose the specific number of healthcare clients or patients affected by the breach involving its Quanum systems.
According to information on Quest’s website, around half a million clinicians across numerous locations in North America utilize Quanum. While the precise number of health records within the system remains unknown, a 2026 case study on Quest’s website illustrates that a single health system with over 6 million patients can maintain hundreds of millions of associated medical documents.
Quest has not specified when the breach originally occurred or if any hacking group has reached out with demands such as ransom payments to prevent the release of the stolen information. Amanda Rivera, a representative for Quest, did not respond to inquiries regarding the incident and instead pointed to the company’s security advisory.
The advisory noted that some patients’ protected health information was compromised, which includes “personal information and patient records,” but Quest is still in the process of determining the exact nature of the data that was accessed. The security notice is currently configured to not appear in search engine results, which may hinder the public’s ability to locate the information.
This is the second significant data breach for Quest in the last decade, following a 2019 incident where 11.9 million patient records were compromised due to a breach of a third-party billing partner.
If you have insights about the Quest Diagnostics incident, we would like to hear from you. Please connect with this reporter via Signal or by email.
Note: This article has been updated with a statement from Quest.
