Quest Diagnostics Confirms Cyberattack on Lab Ordering Platform, Says Patient Records Were Accessed

Quest Diagnostics, one of the largest medical lab testing companies, has confirmed that it suffered a cyberattack and data breach involving sensitive patient information. The company has not said how much data was affected, according to a mandatory disclosure it filed with U.S. regulators.

In an 8-K filing with the Securities and Exchange Commission, Quest said it became aware on Wednesday of an attack on Quanum, one of its lab testing systems. Doctors' offices, hospitals and other healthcare practices use the platform to order lab tests for their patients and to handle billing. It holds a large volume of patient health and medical records, along with related diagnostic and billing data.

Quest said the unauthorized access included "certain patient records." The company said it has notified law enforcement and is investigating the incident.

In a security notice, Quest said that some patients' protected health information was taken, including "personal information and patient records." The company is still working out which specific types of data were stolen. The notice page on its website currently carries "noindex" code, which tells search engines not to list it in results and makes the page much harder for people to find.

Quest has not disclosed how many healthcare customers or patients were affected, when the breach began, or whether any hacking group has contacted it with demands, such as a ransom payment in exchange for not publishing the stolen data. Amanda Rivera, a Quest spokesperson, did not answer TechCrunch's questions and pointed to the security notice instead.

The scale of the exposure could be considerable. Quest's website and materials say about half a million clinicians use Quanum across thousands of locations in North America. It is unclear how many records the system stores, but a 2026 case study on Quest's website describes a single health system with more than 6 million patients that can hold hundreds of millions of related medical documents and charts.

The attack is the latest in a string of major cyber incidents to hit the healthcare sector this year. Some have caused weeks of disruption and the theft of millions of patient electronic health records and other medical information. Health tech firms have become prime targets for financially motivated criminals, who try to steal as much sensitive data as possible and threaten to publish it unless a ransom is paid.

In March, an attack led to the mass wiping of employee devices at medical technology maker Stryker. In August, a hack at medical implant manufacturer Boston Scientific forced its network offline for weeks and caused what the company called "global disruption" to operations. Separate hacks this year also led to large breaches of patient data at medical recordkeeping company CareCloud, Scotland-based health tech provider Craneware, and U.S. pharmaceutical distributor McKesson.

This is Quest's second known major data breach in a decade. In 2019, the company lost 11.9 million patient records in a cyberattack on a third-party billing company.