Quest Diagnostics Confirms Patient Data Theft From Quanum

Quest Diagnostics confirmed on Wednesday that a cyberattack resulted in the theft of patient data from its Quanum platform.

The company disclosed the incident in an 8-K filing with the Securities and Exchange Commission. Quest stated that unauthorized actors accessed Quanum, a system used by doctor's offices, hospitals, and other healthcare practices to order lab tests and process billing. The platform stores large volumes of patient health records, diagnostic information, and billing data. The filing noted that the unauthorized access included certain patient records, though the company did not specify the total volume of data compromised.

A security notice issued by Quest indicated that protected health information was taken, specifically listing personal information and patient records. The company is currently determining the specific types of data involved. Quest has notified law enforcement and is investigating the breach. A spokesperson, Amanda Rivera, directed questions to the security notice rather than providing additional details. The notice page on Quest's website currently includes noindex code, a technical instruction that prevents search engines from listing the page, making it less visible to the public.

Quest has not provided specific numbers for the count of affected healthcare customers or patients. The company also has not disclosed when the breach began or whether a hacking group has contacted it with ransom demands. Quest's marketing materials state that approximately 500,000 clinicians use Quanum across thousands of locations in North America. While the total number of records stored is unclear, a 2026 case study on the company's website describes a single health system client with more than 6 million patients and hundreds of millions of associated medical documents.

This incident follows a series of major cyberattacks on the healthcare sector in 2026. In March, an attack on medical technology maker Stryker led to the mass wiping of employee devices. In August, a breach at medical implant manufacturer Boston Scientific forced its network offline for weeks, causing global disruption. Other breaches this year affected medical recordkeeping company CareCloud, health tech provider Craneware, and pharmaceutical distributor McKesson.

This marks the second known major data breach for Quest in a decade. In 2019, the company lost 11.9 million patient records following a cyberattack on a third-party billing company.