Health Data Security: Quest Diagnostics Confirms Patient Records Compromised in Cyberattack

Patients who have had lab tests ordered through their doctors or hospitals may find their personal and medical information exposed to greater risk following a confirmed cyberattack on Quest Diagnostics. The lab-testing giant disclosed to U.S. regulators that sensitive data, including personal details and patient records, was accessed without authorization. While the company has not yet specified the total number of individuals affected, the breach impacts the Quanum platform, a system widely used by healthcare providers to request tests and manage billing.

In an 8-K filing with the U.S. Securities and Exchange Commission, Quest stated that it became aware of the attack on Wednesday. The incident targeted one of its core lab testing systems, Quanum, which serves as a critical hub for healthcare practices, hospitals, and physicians' offices. This platform is designed to handle the logistical and financial aspects of patient care, storing extensive diagnostic data, medical records, and associated billing information. Quest confirmed that the unauthorized access involved certain patient records and that law enforcement has been notified as the investigation continues.

This incident marks the latest significant disruption in a year marked by widespread cyber threats within the healthcare industry. Health technology firms have become prime targets for financially motivated cybercriminals who seek to steal large volumes of sensitive data. These attackers often threaten to publish the stolen information if a ransom is not paid, causing weeks of operational chaos and forcing companies to take networks offline.

The pattern of attacks has been persistent throughout 2026. In March, medical tech manufacturer Stryker experienced a cyberattack that resulted in the mass wiping of employee devices. Later in August, a hack on implant maker Boston Scientific forced its network offline for several weeks, creating global disruptions to its operations. Additionally, separate breaches have compromised patient data at medical recordkeeping firm CareCloud, Scotland-based provider Craneware, and pharmaceutical distribution major McKesson.

Quest has not yet determined the precise number of healthcare customers or patients whose information was taken during the Quanum attack. According to the company's website, Quanum is utilized by approximately 500,000 clinicians across thousands of locations in North America. While the total volume of health records held by the platform is unclear, a 2026 case study on Quest’s site illustrates the scale of data involved, noting that a single health system with over six million patients can generate hundreds of millions of related medical documents and charts.

The company has not disclosed when the breach initially began or whether any hacking group has made contact with demands for payment. Amanda Rivera, a spokesperson for Quest, deferred to the company's security notice rather than answering specific questions about the incident. The notice indicates that some patients' protected health information was taken, but the company is still determining the specific categories of data that were accessed.

Notably, Quest's website post regarding the security notice currently contains 'noindex' code. This technical instruction tells search engines not to list the page in search results, which can make it more difficult for patients and the public to locate the information through standard online searches. The company is continuing its investigation to identify the specific types of data taken from its systems.

This is the second known major data breach for Quest in the last decade. The previous incident occurred in 2019, when a cyberattack on a third-party billing company led to the loss of 11.9 million patient records. As the investigation progresses, the company is working to understand the full scope of the compromise and the specific impact on its network of healthcare providers and patients.

The next steps for Quest involve completing its investigation into the unauthorized access and determining the specific data elements involved. The company has not indicated when it will provide further details to the public or its customers regarding the number of affected individuals or the timeline of the breach.