Follow Beinsure
Quest Diagnostics, one of the largest medical laboratory testing companies in the United States, has confirmed a cyberattack involving its Quanum platform, exposing sensitive patient information and medical records stored within the healthcare technology system.
In a Form 8-K filing with the US Securities and Exchange Commission (SEC), Quest said it became aware of the security incident on Wednesday after identifying unauthorized access to Quanum, a platform used by healthcare providers to order laboratory tests and manage associated billing activities.
- Quest Diagnostics confirmed unauthorized access to its Quanum laboratory testing platform, with personal information and protected patient health records taken during the attack.
- The company has not disclosed how many patients or healthcare organizations were affected, what specific information was stolen, or whether attackers issued ransom demands.
- The incident follows several major healthcare cyberattacks in 2026 and marks Quest’s second known major data breach in a decade, after a 2019 breach exposed 11.9 mn patient records.
The company confirmed that the intrusion involved access to “certain patient records” and said it had notified law enforcement while investigating the incident.
In a separate security notice, Quest acknowledged that some patients’ protected health information had been taken, including personal information and patient records. The company has not yet established the specific categories of information compromised.
The number of affected patients and healthcare customers remains unknown, as does the full extent of the unauthorized access.
Quest Diagnostics investigates breach of Quanum healthcare platform
Quanum supports laboratory testing operations for physicians’ offices, hospitals and other healthcare practices, allowing providers to request diagnostic tests and manage billing information.
The platform processes and stores substantial volumes of sensitive healthcare information, including medical records, diagnostic data and related financial information.
According to Quest’s website and corporate materials, approximately 500,000 clinicians use Quanum across thousands of locations in North America.
The company has not disclosed how many patient records the platform holds or how much of that information was accessible to the attackers.
A 2026 case study published by Quest illustrates the scale of medical information managed by large healthcare systems. It describes a health system serving more than 6 mn patients and holding hundreds of millions of associated medical documents and charts.
Those figures provide context for the volume of information handled by healthcare technology platforms but do not establish the number of records involved in the Quest incident.
Quest also has not identified when the intrusion began, how long unauthorized access continued or whether any cybercriminal organization has contacted the company with demands.
There has been no confirmation that the attackers sought a ransom or threatened to release the compromised information. That notice acknowledges the theft of patient information but says the investigation is continuing to determine precisely what was taken.
The webpage also contains a “noindex” instruction, which tells search engines not to include the page in search results. This makes the security disclosure more difficult for patients and other members of the public to discover through ordinary searches.
Healthcare cyberattacks cause widespread disruption in 2026
The Quest Diagnostics breach follows a series of major cyber incidents affecting healthcare providers, medical technology manufacturers and businesses responsible for storing patient information.
Attacks across the sector have caused prolonged operational disruptions and resulted in the exposure or theft of substantial volumes of electronic health records and other sensitive medical information.
Healthcare technology companies have become targets for financially motivated cybercriminals seeking access to personal and medical data.
Some attackers use stolen information for extortion, threatening to publish confidential records unless victims pay a ransom.
In March 2026, medical technology manufacturer Stryker experienced a cyberattack involving the mass deletion of data from employee devices. A pro-Iran hacktivist group known as Handala claimed responsibility for the incident.
In August, medical device manufacturer Boston Scientific suffered a cyberattack that forced its network offline for weeks, causing what the company described as a “global disruption” to operations.
Other incidents during the year affected healthcare recordkeeping company CareCloud, Scotland-based healthcare technology provider Craneware and US pharmaceutical distribution company McKesson.
The attacks involving CareCloud and Craneware resulted in substantial patient data breaches, while hackers also claimed to have stolen millions of patient records in the McKesson incident.
These cases demonstrate the operational and data security risks facing companies that maintain large healthcare information systems, although the circumstances and consequences of each incident differ.
Investigators have not publicly established whether the Quest intrusion is connected to any of those attacks.
Quest suffered an earlier breach affecting 11.9 mn patients
The latest incident is Quest Diagnostics’ second known major data breach in approximately a decade.
In 2019, a cyberattack involving a third-party billing provider compromised approximately 11.9 mn patient records associated with Quest.
That incident exposed risks arising from the handling of sensitive medical and financial information by external service providers.
The newly disclosed attack differs in that it involves unauthorized access to Quest’s Quanum laboratory technology platform.
The company has confirmed that patient information was taken but has not provided an estimate of the number of individuals affected or the potential financial and operational consequences.
Quest’s SEC filing and security notice establish that an investigation is underway, with law enforcement notified and the specific categories of stolen information still being assessed.
Further disclosures will be needed to determine the scale of the breach, the types of patient records compromised and whether the incident has affected healthcare organizations using Quanum.
