Quest Diagnostics has confirmed that patients’ personal and health data were compromised in a cyberattack that hit one of its lab testing systems, marking another major health care breach this year and raising fresh concerns about the security of sensitive medical records stored by third-party platforms.
Quest Diagnostics discloses breach in SEC filing
The lab testing giant said in a legally required filing with the U.S. Securities and Exchange Commission that it learned of a cyberattack on Wednesday targeting Quanum, a system used by doctors’ offices, hospitals and other health care practices to request lab tests and manage billing. The platform stores patient health and medical records along with associated diagnostic and billing information.
In its filing, Quest said unauthorized access included “certain patient records.” The company said it notified law enforcement and is investigating the incident, but it has not yet disclosed how many patients or health care customers were affected.
The company also has not said when the intrusion began or whether any hacking group has contacted it with demands such as payment in exchange for not publishing stolen data. Quest spokesperson Amanda Rivera did not answer TechCrunch’s questions and instead referred to the company’s security notice.
What Quest says was taken
Quest’s notice says some patients’ protected health information was taken, including “personal information and patient records,” though the company is still working to identify exactly what categories of data were compromised. That matters because medical breaches can expose a mix of highly sensitive information, from contact details and insurance data to test results and other clinical records.
The notice also appears to be harder to surface through normal search engines. The website post currently contains “noindex” code, which tells search engines not to list the page in search results, making it more difficult for people to find the disclosure online.
Quest has not publicly identified the total number of records involved, and the scale of the incident remains unclear. The company’s materials say Quanum is used by about half a million clinicians in thousands of locations across North America. While it is not known how many health records the system holds overall, a 2026 case study on Quest’s website describes how a single health system with more than 6 million patients can generate hundreds of millions of related medical documents and charts.
Why Quanum matters
Quanum is not just a scheduling or communication tool. Quest describes it as a platform that helps health care providers order lab work and manage billing, which means it sits close to core operational and patient data flows. Systems like this can be especially valuable to attackers because they often contain a broad mix of personal, clinical and administrative information in one place.
That concentration of data makes a compromise potentially more serious than a narrow breach of a single database. Even if only a subset of patient records was accessed, the stolen data could still include enough information to create privacy and identity risks for affected individuals.
A broader wave of health care cyberattacks
The Quest incident is the latest major cyberattack to hit the health care industry this year. The sector has faced repeated attacks and data breaches that have caused weeks of disruption and, in some cases, the theft of millions of patient electronic health records and other medical information.
Health technology and health services companies have become frequent targets for financially motivated cybercriminals. Attackers often aim to steal as much sensitive data as possible and then threaten to publish it unless a ransom is paid, a tactic that puts pressure on organizations that handle urgent patient services.
Recent examples show how disruptive those attacks can be. In March, a cyberattack resulted in the mass-wiping of employee devices at medical tech maker Stryker. In August, a hack on medical implant manufacturer Boston Scientific forced the company’s network offline for weeks and sparked what was described as “global disruption” to its operations.
Other breaches have also affected major health-related companies this year, including medical recordkeeping company CareCloud, Scotland-based health tech provider Craneware and U.S. pharmaceutical distribution giant McKesson. Together, those incidents underscore how widely the sector has been targeted across different parts of the supply chain.
Quest’s history with patient data breaches
This is not the first time Quest has faced a major data incident. The company previously lost 11.9 million patient records in a 2019 cyberattack tied to a third-party billing company, making the newly disclosed breach its second known major data breach in a decade.
That history will likely draw scrutiny from patients, providers and regulators, especially because the new incident involves a system that handles both lab ordering and billing. For health care organizations, the question is not only whether attackers can access data, but also how quickly they can be detected and how much patient information is already exposed before containment begins.
What patients and providers may want to watch next
Quest has not yet released a complete breakdown of what was taken or how many people are affected, so the next disclosures will matter. Regulators and affected providers will likely look for answers on the following points:
- Which types of protected health information were accessed or removed
- How many patients and health care organizations were affected
- Whether the attack involved encryption, exfiltration or both
- Whether any threat actor has made contact or issued demands
- What steps Quest is taking to secure Quanum and related systems
For patients, the immediate concern is that exposed medical data can be difficult to change or replace. Unlike a credit card number, a lab test result or health record cannot simply be reissued, which is why breaches involving protected health information tend to have long tails.
For Quest and its customers, the incident is a reminder that widely used health platforms can become high-value targets precisely because they aggregate so much sensitive information. Even one compromised system can create risk far beyond a single organization.
Source: Original report
Was this helpful?
Explore more: Application Audit & Review More Cybersecurity Tech News
Last Modified: October 23, 2026 at 10:32 pm
0 views
