Quest Diagnostics confirms breach of Quanum system after cyberattack

Quest Diagnostics has officially confirmed that a cyberattack compromised its systems, leading to the theft of sensitive patient information. The company detailed the incident in a formal disclosure submitted to U.S. regulators, marking a significant security event for the medical testing industry.

According to an 8-K filing with the U.S. Securities and Exchange Commission, Quest discovered the attack on Wednesday. The breach targeted Quanum, a specific lab testing system that serves as a hub for doctors' offices, hospitals, and other healthcare practices. This platform is used to request lab tests for patients and manage associated billing, meaning it holds a vast repository of health records, diagnostic results, and financial data.

The company stated that the unauthorized access allowed attackers to reach certain patient records. Quest has notified law enforcement authorities and is currently conducting an investigation into the scope of the intrusion. While the specifics of the data stolen are still being determined, the firm acknowledged that protected health information, including personal details and medical records, was taken.

This incident adds to a growing list of major cyber threats facing the healthcare sector this year. A string of recent attacks has caused weeks of operational disruptions and resulted in the theft of millions of electronic health records. Health technology companies have become prime targets for financially motivated cybercriminals who seek to steal data and threaten to publish it unless a ransom is paid.

The pattern of attacks has intensified over the past several months. In March, a cyberattack caused the mass wiping of employee devices at medical technology maker Stryker. Later in August, a hack on medical implant manufacturer Boston Scientific forced its network offline for weeks, causing global disruptions to its operations. Additionally, separate breaches affected medical recordkeeping company CareCloud, Scotland-based provider Craneware, and pharmaceutical distribution giant McKesson throughout the year.

Quest has not yet disclosed the exact number of healthcare customers or patients affected by the Quanum breach. The company’s materials indicate that Quanum is utilized by approximately half a million clinicians across thousands of locations in North America. Although the total number of records held by the platform is unclear, a 2026 case study on Quest’s website illustrates that a single health system with over six million patients can maintain hundreds of millions of related medical documents.

The company has not specified when the breach initially began or if any hacking group has contacted them with ransom demands. Amanda Rivera, a spokesperson for Quest, referred to the company's security notice rather than answering direct questions about the incident. Notably, the web page containing this notice includes a 'noindex' code, which instructs search engines to exclude the page from results, making it harder for the public to discover the update.

This is the second known major data breach for Quest Diagnostics in the last decade. The previous incident occurred in 2019, when 11.9 million patient records were lost due to a cyberattack on a third-party billing company. As the investigation continues, the company remains focused on determining the specific types of data compromised and the full extent of the impact on its users.