Healthcare Data Security: Quest Diagnostics Confirms Patient Records Compromised
The lab testing company disclosed that its Quanum platform was targeted by cybercriminals, resulting in the unauthorized access of sensitive medical and billing information.
By Alessia Romano ·
A major cybersecurity incident has struck the nation's leading independent medical laboratory.
Quest Diagnostics officially confirmed that a cyberattack compromised patient data within its Quanum platform. The company disclosed the breach through a filing with the U.S. Securities and Exchange Commission, noting that the attack was identified on Wednesday. Quanum serves as a critical interface for doctors, hospitals, and other healthcare practices. It facilitates the ordering of lab tests and manages the associated billing processes. The system holds extensive collections of electronic health records, diagnostic results, and financial data. The filing states that unauthorized actors accessed specific patient records during the intrusion. Quest has alerted law enforcement agencies and has launched an internal investigation to determine the full scope of the incident.
This event marks the latest significant disruption in the healthcare sector, which has faced a wave of attacks throughout 2026. Cybercriminals have frequently targeted health tech firms for financial gain, often demanding ransoms in exchange for keeping stolen data private. Previous incidents this year have caused substantial operational delays. In March, a cyberattack wiped employee devices at medical technology maker Stryker. In August, a hack forced Boston Scientific, a manufacturer of medical implants, to take its network offline for several weeks, causing global operational issues. Additionally, patient data was breached at medical recordkeeping firm CareCloud, Scottish health tech provider Craneware, and pharmaceutical distributor McKesson. These incidents highlight the growing vulnerability of the healthcare supply chain to financially motivated threats.
Quest has not yet disclosed the exact number of affected patients or healthcare customers. The company notes that Quanum is utilized by approximately 500,000 clinicians across thousands of locations in North America. While the total volume of stored records is not public, a 2026 case study on the company's website illustrates the scale of the data. It describes a single health system with over 6 million patients that holds hundreds of millions of related medical documents. The lack of specific figures leaves many questions open regarding the immediate impact on patients and providers.
The company has not indicated when the breach began or if any hacker group has contacted them with demands for payment. Amanda Rivera, a spokesperson for Quest, referred inquiries to the company's security notice. That notice confirms that protected health information, including personal details and patient records, was taken. However, the company is still determining the specific categories of data involved. The website post for the notice currently includes code that prevents search engines from indexing the page, which may make it harder for the public to locate the information. This is the second major data breach for Quest in a decade, following a 2019 incident where 11.9 million patient records were lost due to a cyberattack on a third-party billing partner.
