Quest Diagnostics Confirms Quanum Cyberattack Exposed Patient Data

The lab-testing giant said in an 8-K filing with the U.S. Securities and Exchange Commission that it learned on Wednesday of a cyberattack targeting Quanum, one of its lab-testing systems. Quanum allows doctor’s offices, hospitals and healthcare practices to request lab tests for patients while also handling billing. The platform stores a large amount of patient health and medical records, as well as associated diagnostic and billing data.

Quest said the unauthorized access included access to “certain patient records.” It said it notified law enforcement and is investigating.

The incident is the latest major cyber incident to affect the healthcare industry this year, according to TechCrunch. A series of cyberattacks and data breaches have sparked weeks of disruption and allowed the theft of millions of patient electronic health records and other medical information. Healthtech companies have become a major target for financially motivated cybercriminals, who aim to steal as much sensitive data as possible and threaten to publish it if they are not paid a ransom.

In recent months, a cyberattack resulted in the mass-wiping of employee devices at medical tech maker Stryker in March, and a hack on medical implant manufacturer Boston Scientific in August forced the company’s network offline for weeks, sparking “global disruption” to its operations. Separate hacks throughout the year caused massive breaches of patient data at medical recordkeeping company CareCloud, Scotland-based healthtech provider Craneware and U.S. pharmaceutical distribution giant McKesson.

Quest did not say when the breach began or whether any hacking group has contacted the company with demands, such as payment in exchange for not releasing the stolen data. A spokesperson for Quest did not respond to TechCrunch’s request for comment on Friday. The company has not yet said how many healthcare customers, or patients, had information stolen during the attack on its Quanum systems.

Quest’s website and materials say Quanum is used by about half a million clinicians in thousands of locations across North America. It is unclear how many health records Quanum holds, but one 2026 case study on Quest’s website shows how a single health system with more than 6 million patients can hold hundreds of millions of related medical documents and charts.

In a note on its website, Quest said that some patients’ protected health information was taken, including “personal information and patient records,” but the company is still investigating what specific kinds of data were taken. TechCrunch noted that the website post currently contains “noindex” code, which tells search engines not to list the page in search results, making it far more difficult for people to find the page.

This is Quest’s second known major data breach in a decade, after losing 11.9 million patient records in a cyberattack on a third-party billing company in 2019.