Quest Diagnostics has disclosed a Quest Diagnostics data breach affecting its Quanum lab testing system, confirming that unauthorized access included certain patient records. The company learned of the cyberattack on Wednesday and filed an 8-K with the U.S. Securities and Exchange Commission.
What Quanum Does and Who Relies on It
Quanum is a platform used by doctors, hospitals, and healthcare practices to order lab tests and manage billing. It also stores patient health records along with diagnostic and billing data. According to Quest, roughly 500,000 clinicians across thousands of locations in North America use the system, making it a central piece of the company’s provider-facing operations.
The scale of Quanum means the potential exposure extends well beyond Quest itself. A 2026 Quest case study cited a health system with more than 6 million patients holding hundreds of millions of medical documents and charts, illustrating the volume of data such platforms can hold. Quest has not said how many records Quanum contains.
Data Accessed and Official Responses
Quest said the unauthorized access included certain patient records. A security notice published by the company states that personal information and patient records were taken. The notice adds that the specific data types involved are still under investigation. The webpage hosting the notice contains noindex code, which prevents search engines from listing it. Quest did not explain whether that was intentional.
Spokesperson Amanda Rivera did not answer questions about the incident and referred to the security notice. Quest has not disclosed the number of affected patients or customers. It also has not stated when the breach began or whether any hacking group contacted the company with demands.
Quest said it notified law enforcement and is investigating the incident. The 8-K filing with the SEC formally placed the breach on the public record.
Second Major Breach in a Decade
This is Quest’s second known major breach in ten years. In 2019, the company lost 11.9 million patient records through an attack on a third-party billing company. The current incident differs in that it directly involves Quanum, a Quest-operated system rather than an outside vendor.
A Wider Pattern of Healthcare Cyberattacks
The Quest breach arrives amid a series of major cyber incidents across the healthcare industry. In March, Stryker suffered a mass-wiping of employee devices. In August, a hack at Boston Scientific forced its network offline for weeks. CareCloud, Craneware, and McKesson have also reported patient data breaches this year.
Cybercriminals continue to target health technology because it concentrates sensitive patient data and creates leverage for ransom demands. Quest has not confirmed whether any ransom demand was made in this case.
What Remains Unknown
Several key questions remain unanswered. Quest has not specified how many patients or healthcare customers were affected, when the breach began, or whether a hacking group contacted it with demands. The company also has not said whether a ransom was paid. The specific types of data taken are still under investigation.
