Quest Diagnostics Confirms Patient Records Compromised in Cyberattack on Lab Platform

Quest Diagnostics disclosed in an 8-K filing with the Securities and Exchange Commission that hackers gained unauthorized access to patient health and billing data, confirming a cyberattack it first learned of on October 21, as first reported by TechCrunch. The breach targeted Quanum, a lab-testing platform that lets doctors' offices, hospitals, and healthcare practices order lab tests and manage billing, and which stores patient health and medical records alongside diagnostic data.

Quest said the unauthorized access included “certain patient records” and that some patients' protected health information was taken, including personal information and medical records, but the company said it is still determining exactly what data was affected. Quest has notified federal law enforcement and brought in outside security experts, and says its core laboratory operations and other customer-facing ordering systems were not affected. The company has not disclosed how many patients or healthcare providers are affected, whether any hacking group has demanded a ransom, or when the intrusion actually began.

The scale of what's potentially exposed is significant even without a confirmed patient count: Quest says Quanum is used by roughly half a million clinicians across thousands of locations in North America, and the company's own case studies describe single health systems with more than 6 million patients storing hundreds of millions of medical documents on the platform. A security notice Quest posted to its website was marked to prevent search engines from indexing it, and a company spokesperson referred reporters to that notice rather than answering direct questions.

This is Quest's second major disclosed data breach in roughly a decade. In 2019, a cyberattack on a third-party billing vendor exposed records belonging to 11.9 million Quest patients. The new breach also lands amid a wave of attacks on healthcare and medical technology companies in 2026: medical device maker Boston Scientific had its network taken offline for weeks after an August attack, medical tech company Stryker had employee devices mass-wiped in March, and separate breaches this year have hit CareCloud, Craneware, and McKesson. Healthcare providers remain one of the most frequently targeted sectors for ransomware and data-theft attacks because patient records combine high resale value on criminal marketplaces with systems that are often difficult to take offline for security upgrades without disrupting patient care.