Quest Diagnostics Confirms Massive Data Breach Affecting Half-Million Clinicians

Approximately 500,000 clinicians utilize the Quanum platform, the central system now at the heart of a confirmed cybersecurity incident at Quest Diagnostics. The medical laboratory services provider disclosed the breach in a mandatory 8-K filing submitted to the U.S. Securities and Exchange Commission. The filing confirms that unauthorized actors gained access to the Quanum system, which facilitates lab test requests, billing, and the storage of extensive patient health records.

Quest Diagnostics identified the cyberattack on Wednesday. The Quanum system is designed for doctors' offices, hospitals, and other healthcare practices to manage patient diagnostics and associated financial data. In its regulatory disclosure, the company stated that the intrusion involved the access of "certain patient records." Quest has notified law enforcement and is currently conducting an internal investigation to determine the full scope of the compromise.

This incident marks the latest significant security failure in the healthcare sector this year. A wave of cyberattacks has previously resulted in the theft of millions of electronic health records and caused prolonged operational disruptions. Cybercriminals with financial motives have increasingly targeted health technology firms, often stealing sensitive data and threatening its public release if ransom demands are not met.

The healthcare industry has faced a series of high-profile attacks in the past several months. In March, medical technology manufacturer Stryker experienced a cyberattack that led to the mass wiping of employee devices. In August, a hack against medical implant maker Boston Scientific forced its network offline for several weeks, causing what the company described as global operational disruption. Additionally, major data breaches were reported at medical recordkeeping firm CareCloud, Scotland-based provider Craneware, and pharmaceutical distributor McKesson throughout the year.

Quest Diagnostics has not yet quantified the number of healthcare customers or patients affected by the breach of its Quanum systems. The company’s materials indicate that the platform is used in thousands of locations across North America. While the total volume of stored records is not public, a 2026 case study on Quest’s website illustrates the scale of data held by the system, noting that a single health system with over six million patients can accumulate hundreds of millions of related medical documents and charts.

The company has not disclosed when the breach began or whether any hacking group has contacted Quest with specific demands, such as payment to prevent the release of stolen data. Amanda Rivera, a spokesperson for Quest, directed inquiries to the company’s security notice rather than answering direct questions about the incident.

In the security notice, Quest acknowledged that protected health information, including personal information and patient records, was taken. However, the company stated it is still investigating the specific types of data compromised. Notably, the website page containing this notice currently includes "noindex" code, which instructs search engines to exclude the page from results, making it more difficult for the public to locate the announcement.

This is Quest Diagnostics' second known major data breach in the last decade. The previous incident occurred in 2019, when a cyberattack on a third-party billing company resulted in the compromise of 11.9 million patient records.