Quest Diagnostics confirms patient data breach in latest healthcare cyberattack

Approximately 500,000 clinicians across North America use the platform at the center of a new security incident. Quest Diagnostics has officially confirmed that a cyberattack compromised its systems, resulting in the unauthorized access to sensitive patient information. The company detailed the incident in a legally required filing with the U.S. Securities and Exchange Commission, marking a significant development in the ongoing struggle to secure healthcare data.

The breach targeted Quanum, a digital platform that allows medical offices, hospitals, and other practices to request lab tests and manage associated billing. This system stores extensive medical records, diagnostic data, and billing information. Quest stated that it discovered the cyberattack on Wednesday and has since notified law enforcement agencies. The company is currently conducting an internal investigation to determine the full scope of the intrusion and the specific nature of the data accessed.

This incident places Quest Diagnostics in the spotlight as part of a troubling trend in the healthcare sector. A series of major cyberattacks have disrupted operations and stolen millions of electronic health records this year. Health technology companies have become primary targets for financially motivated cybercriminals. These actors often aim to extract as much sensitive data as possible, threatening to release it publicly if ransom payments are not received. Recent examples include a mass-wiping of employee devices at Stryker in March and a network outage at Boston Scientific in August. Additional breaches affected CareCloud, Craneware, and McKesson, highlighting the vulnerability of the entire supply chain.

Quest Diagnostics has not yet disclosed the exact number of patients or healthcare customers affected by the attack on its Quanum systems. The company’s marketing materials indicate that Quanum is used by thousands of locations. While the total volume of held records is unclear, a 2026 case study on the company's website illustrates the scale of data involved. It notes that a single health system with over six million patients can accumulate hundreds of millions of medical documents and charts.

The company has not specified when the breach began or whether any hacking group has contacted Quest with demands. Amanda Rivera, a spokesperson for Quest, referred reporters to the company’s security notice rather than answering direct questions. That notice confirms that protected health information, including personal details and patient records, was taken. However, the company is still working to identify the specific types of data involved. Notably, the web page containing this notice includes code that tells search engines to exclude it from results, which may make it harder for affected individuals to find the information.

This is the second known major data breach for the lab-testing giant in the past decade. In 2019, Quest lost 11.9 million patient records due to a cyberattack on a third-party billing company. As the investigation continues, the company has not released further updates on remediation steps or the expected timeline for notifying affected patients. The situation remains fluid as the firm works to contain the impact and understand the full extent of the unauthorized access.

The incident underscores the persistent risk to healthcare data systems. As Quest continues its investigation, stakeholders in the industry are watching closely for signs of further disruption. The company will likely provide more details in future filings or public statements. For now, the focus remains on determining which specific records were accessed and how the information may be used by the attackers.