Quest Diagnostics Confirms Patient Records Exposed In System Compromise

Quest Diagnostics disclosed Wednesday that it is investigating a cyber incident that resulted in unauthorized access to sensitive patient information, confirming in a regulatory filing that certain records were compromised within its systems. The company alerted the U.S. Securities and Exchange Commission via an 8-K filing regarding the intrusion, which targeted a specific laboratory testing platform used by the firm. Law enforcement has been notified, and an investigation into the breach is underway, according to the company. The incident marks the latest in a wave of cyberattacks targeting the healthcare sector throughout 2026.

The compromised system, identified as Quanum, is a tool that facilitates the requesting of laboratory tests for patients by healthcare providers while simultaneously managing billing operations. Quest acknowledged in a public security notice that protected health information was accessed, specifically mentioning that “personal information and patient records” were involved in the unauthorized activity. However, the company is still determining the specific categories of data that were exfiltrated during the intrusion. The lab-testing giant has not yet revealed how many healthcare customers or patients had their information stolen during the attack on its Quanum systems.

The scale of the potential impact is difficult to gauge given the platform's extensive reach. Materials on Quest’s website indicate that Quanum is utilized by approximately half a million clinicians across thousands of locations throughout North America. While the total volume of records stored in Quanum is not specified, a 2026 case study posted on the company's site illustrates the potential magnitude of such data repositories, noting that a single health system serving over 6 million patients can generate hundreds of millions of related medical documents and charts.

Several critical details regarding the breach remain unanswered. Quest has not specified when the intrusion began or if any hacking group has contacted the company with demands, such as payment in exchange to not release the stolen data. Furthermore, a spokesperson for the company, Amanda Rivera, did not answer inquiries regarding the incident, instead referring to the security notice. The notice itself currently contains “noindex” code, which tells search engines not to list the page in search results, making it far more difficult for people to find the page.

This event represents the second known major data breach involving Quest Diagnostics in a decade. In 2019, the company lost 11.9 million patient records following a cyberattack on a third-party billing company. The current incident involving Quest is the latest major cyber incident to affect the healthcare industry this year. A series of cyberattacks and data breaches have sparked weeks of disruption and allowed the theft of millions of patient electronic health records and other medical information. Health tech companies have become a major target for financially motivated cybercriminals, who aim to steal as much sensitive data as possible and threaten to publish it if they aren’t paid a ransom. In recent months, a cyberattack resulted in the mass-wiping of employee devices at medical tech maker Stryker in March, and a hack on medical implant manufacturer Boston Scientific in August forced the company’s network offline for weeks, sparking “global disruption” to its operations. Meanwhile, separate hacks throughout the year caused massive breaches of patient data at medical recordkeeping company CareCloud, Scotland-based health tech provider Craneware, and U.S. pharmaceutical distribution giant McKesson.