Quest Diagnostics Hacked: Patient Data Stolen

Doctors and hospitals using the Quanum platform may need to verify patient records after Quest Diagnostics confirmed a cyberattack. The company stated that unauthorized users accessed the system, which is used to order lab tests and process billing. Quest did not specify the number of patients affected or the start date of the breach in its initial report.

Quest filed an 8-K form with the Securities and Exchange Commission on Wednesday to disclose the incident. The filing notes that the attack targeted Quanum, a core system for managing diagnostic and billing data. The company said it became aware of the breach on Wednesday and has alerted law enforcement. Quest is currently investigating the scope of the intrusion.

A security notice posted on Quest’s website indicates that protected health information was taken. The document lists stolen data as including personal information and patient records. The company has not yet determined the specific types of data involved. The notice page contains a noindex code, which prevents search engines from listing the page and makes it harder for the public to find.

Amanda Rivera, a spokesperson for Quest, did not answer questions from TechCrunch regarding the incident. She directed inquiries to the security notice. Quest has not stated if a hacking group made contact or demanded a ransom payment.

The potential scale of the breach is large. Quest’s materials indicate that about 500,000 clinicians use Quanum across thousands of locations in North America. A 2026 case study on the company’s website describes a single health system with over 6 million patients and hundreds of millions of medical documents. The total number of records stored on the platform remains unclear.

This incident follows several major cyberattacks in the healthcare sector this year. In March, Stryker reported an attack that wiped employee devices. In August, Boston Scientific’s network was offline for weeks due to a hack. Large data breaches also affected CareCloud, Craneware, and McKesson. Quest’s current breach is its second major data security failure in ten years. In 2019, a third-party billing company lost 11.9 million patient records in a cyberattack.