Quest Diagnostics: Hackers Accessed Patient Records on Quanum

Quest Diagnostics confirmed on Thursday that unauthorized actors accessed patient records on its Quanum lab ordering platform. The company disclosed the breach in a mandatory 8-K filing with the Securities and Exchange Commission. It became aware of the intrusion on Wednesday. The platform serves doctors' offices, hospitals, and other healthcare practices. These users rely on Quanum to order lab tests and process billing. The system stores extensive patient health data, diagnostic results, and financial records.

The company stated that the unauthorized access included certain patient records. A separate security notice on its website indicated that protected health information was taken. This data includes personal information and patient records. Quest is still determining the specific types of data stolen. The company has notified law enforcement and is conducting an internal investigation. Spokesperson Amanda Rivera directed media inquiries to the security notice. She did not answer specific questions about the scope of the breach.

Quest has not revealed how many patients or healthcare customers were affected. The company has also not specified when the breach began. It has not confirmed whether a hacking group made ransom demands. The security notice page currently uses noindex code, which prevents search engines from listing the page. This technical setting makes the information harder for the general public to locate.

The potential scale of the exposure is large. Quest's materials state that about 500,000 clinicians use Quanum across thousands of locations in North America. A 2026 case study on the company's website describes a single health system with more than 6 million patients. That system holds hundreds of millions of related medical documents and charts. It is unclear how many records the Quanum system stores in total.

This incident follows a series of major cyberattacks on the healthcare sector this year. Several of these attacks caused weeks of operational disruption and the theft of millions of electronic health records. Financially motivated criminals frequently target health tech firms to steal sensitive data for ransom. In March, an attack caused the mass wiping of employee devices at Stryker. In August, a hack at Boston Scientific forced its network offline for weeks. Other breaches this year affected CareCloud, Craneware, and McKesson.

This is the second known major data breach for Quest Diagnostics in a decade. In 2019, the company lost 11.9 million patient records following a cyberattack on a third-party billing company. Quest has not announced a timeline for notifying individual patients of the current incident.