Lab Ordering System Used by 500,000 Clinicians Hit by Attack, Quest Says

Quest Diagnostics, one of the largest medical laboratory testing companies, disclosed this week that intruders reached a platform holding patient health records and billing data.

The company said it learned of the attack on Wednesday, October 21, on Quanum, the system that doctors' offices, hospitals, and other practices use to order tests and process billing. Quest filed an 8-K with the Securities and Exchange Commission describing the incident. The filing states that unauthorized access included "certain patient records." Quest said it has notified law enforcement and is investigating.

A security notice posted by the company says some patients' protected health information was taken, including "personal information and patient records." The company has not determined which categories of data were taken. That notice page carries a "noindex" code, which keeps search engines from listing it in results. Amanda Rivera, a Quest spokesperson, referred questions to the notice rather than answering them directly.

Quest has not said how many patients or healthcare customers are affected, when the incident began, or whether an attacker has made demands such as a ransom. The company's materials say about 500,000 clinicians use Quanum across thousands of locations in North America. A 2026 case study on Quest's website describes one health system with more than 6 million patients whose records can include hundreds of millions of documents and charts.

Other healthcare and health technology companies have reported breaches this year. In March, an attack on Stryker led to the mass wiping of employee devices. In August, a hack at Boston Scientific took its network offline for weeks, which the company called "global disruption" to operations. Hacks this year also produced patient data breaches at CareCloud, Craneware, and McKesson.

Quest has reported one other major breach in the past decade. In 2019, a cyberattack on a third-party billing company exposed 11.9 million patient records.