Quest Diagnostics confirms data theft from Quanum platform

The scale of the compromise remains unclear, but the fact that it happened at all is enough to raise eyebrows.

Quest Diagnostics has officially confirmed that a cyberattack resulted in the unauthorized access of sensitive patient information. The company revealed this in a legally required disclosure filed with U.S. regulators. In the document, Quest stated that it became aware of the incident on Wednesday. The attack specifically targeted Quanum, a system used for lab testing. This platform serves as a hub for doctors' offices, hospitals, and other healthcare practices. It allows these entities to request lab tests for patients while also managing billing processes. Consequently, the system holds a vast amount of data, including medical records, diagnostic results, and billing information.

The company noted that the unauthorized access included the viewing of specific patient records. Quest has already notified law enforcement and is currently conducting an investigation into the matter. This incident marks the latest significant cyber event to affect the healthcare sector in 2026. A string of recent attacks and breaches have caused weeks of disruption in the industry. These incidents have allowed attackers to steal millions of electronic health records and other critical medical data.

Health technology companies have emerged as primary targets for financially motivated cybercriminals. These groups aim to steal as much sensitive data as possible. They often threaten to publish the stolen information if a ransom is not paid. The pattern of attacks has been consistent throughout the year. In March, a cyberattack led to the mass wiping of employee devices at medical tech maker Stryker. In August, a hack on medical implant manufacturer Boston Scientific forced its network offline for several weeks. This outage caused what was described as global disruption to its operations.

Other major breaches have also occurred recently. Separate hacks throughout the year led to significant data leaks at medical recordkeeping company CareCloud. Similar incidents affected Scotland-based health tech provider Craneware. U.S. pharmaceutical distribution giant McKesson also suffered a massive breach of patient data. These events highlight the persistent vulnerabilities within the medical technology infrastructure.

Quest has not yet disclosed how many healthcare customers or patients had their information stolen during the attack on its Quanum systems. This lack of clarity is a significant open question. The company’s website and materials indicate that Quanum is used by approximately half a million clinicians. These users are located in thousands of places across North America. It remains unclear exactly how many health records the platform holds. However, a case study published on Quest’s website in 2026 provides some context. It shows that a single health system with more than six million patients can hold hundreds of millions of related medical documents and charts.

The company has not stated when the breach began. It is also unknown whether any hacking group has contacted Quest with demands. Such demands typically involve payment in exchange for a promise not to release the stolen data. Amanda Rivera, a spokesperson for Quest, did not answer specific questions about the incident. Instead, she referred reporters to the company’s security notice. The notice states that some patients’ protected health information was taken. This includes personal information and patient records. However, the company is still investigating what specific kinds of data were compromised.

Notably, the website post currently contains noindex code. This code instructs search engines not to list the page in search results. This technical choice makes it considerably more difficult for the public to find the notice. This is Quest’s second known major data breach in the past decade. The previous incident occurred in 2019. At that time, the company lost 11.9 million patient records following a cyberattack on a third-party billing company. The current situation leaves many questions unanswered about the scope of the data taken and the long-term impact on patient privacy.