Quest Diagnostics Confirms Patient Data Stolen in Attack on Quanum Platform
The lab-testing giant revealed that sensitive health and billing records were accessed during a cyberattack, marking its second major breach in a decade.
By Anna Nowak ·
Quest Diagnostics has officially confirmed that a cyberattack compromised sensitive patient information stored within its systems, according to a mandatory disclosure filed with U.S. regulators this week. The company revealed that unauthorized access occurred on Wednesday, targeting a critical infrastructure component of its business. This development marks the latest significant security incident affecting the healthcare sector and raises fresh concerns for patients across the country whose data is held by major medical service providers.
The breach specifically targeted Quanum, a platform that serves as a central hub for healthcare operations. This system allows doctors’ offices, hospitals, and various healthcare practices to request lab tests for their patients while simultaneously managing the associated billing processes. Because Quanum handles these dual functions, it stores a vast array of information, including detailed patient health records, medical charts, diagnostic results, and financial billing data. Quest stated that the unauthorized access involved the retrieval of certain patient records, prompting the company to notify law enforcement and launch an internal investigation.
This incident places Quest Diagnostics in the line of fire for health tech companies, which have become prime targets for financially motivated cybercriminals. These attackers often aim to steal large volumes of sensitive data, threatening to publish it if a ransom is not paid. The current event is part of a broader pattern of disruption in the industry this year, where a series of attacks have allowed the theft of millions of electronic health records. In March, a cyberattack led to the mass-wiping of employee devices at medical tech maker Stryker. In August, a hack on medical implant manufacturer Boston Scientific forced its network offline for weeks, causing global operational disruptions. Additionally, separate breaches throughout the year have exposed patient data at medical recordkeeping firm CareCloud, Scotland-based provider Craneware, and pharmaceutical distribution giant McKesson.
Despite the severity of the incident, Quest Diagnostics has not yet disclosed the specific number of healthcare customers or patients affected by the attack on its Quanum systems. According to the company’s own materials, Quanum is utilized by approximately half a million clinicians in thousands of locations across North America. While the total volume of health records held by the platform is not publicly listed, a 2026 case study on Quest’s website illustrates the scale of data involved, noting that a single health system with more than six million patients can possess hundreds of millions of related medical documents and charts.
The company has also remained silent on the timeline of the breach, leaving it unclear when the unauthorized access began. Furthermore, Quest has not confirmed whether any hacking group has contacted the company with specific demands, such as a payment in exchange for withholding the stolen data. Amanda Rivera, a spokesperson for the firm, did not respond to specific questions about the details of the incident, instead referring media outlets to the company’s official security notice.
In that notice, Quest acknowledged that protected health information was taken, including personal information and patient records. However, the company stated that it is still in the process of determining the exact types of data that were accessed. Notably, the webpage containing this notice currently includes 'noindex' code, a technical directive that tells search engines not to list the page in search results. This makes it significantly more difficult for the general public and patients to discover the announcement through standard online searches.
This is the second known major data breach for Quest Diagnostics in the last decade. The previous incident occurred in 2019, when a cyberattack on a third-party billing company resulted in the loss of 11.9 million patient records. The recurrence of such a significant event underscores the persistent challenges facing the healthcare industry in securing its digital infrastructure against increasingly sophisticated threats.
As the investigation continues, the healthcare community and patients await further clarity on the scope of the compromise. The lack of immediate details regarding the number of affected individuals and the nature of the data stolen has led to ongoing speculation. Quest Diagnostics remains under scrutiny as it works to secure its systems and determine the full extent of the damage caused by the Wednesday attack.
Source: TechCrunch
