Quest Diagnostics confirms data breach on Quanum lab testing system, patient records accessed

Second major incident in a decade as company says protected health information taken

By LineZotpaper

Published23 October 2026

Read Time2 min

Medical lab testing giant Quest Diagnostics has confirmed a cyberattack and data breach affecting its Quanum platform, which handles lab test requests, billing and a wide array of patient health records. The company disclosed the incident in a filing with the U.S. Securities and Exchange Commission on Wednesday, saying unauthorized access included the accessing of certain patient records.

Quest Diagnostics said in an 8-K filing with the SEC that it learned of the cyberattack on Wednesday, targeting its Quanum system. Quanum is used by doctors, hospitals and healthcare practices to order lab tests, process billing and store patient medical records, diagnostic results and billing data.

The company said some patients' protected health information was taken, including personal information and patient records, but is still investigating what specific kinds of data were involved. Quest has not yet said how many patients or healthcare customers had information stolen. According to Quest's materials, Quanum is used by about half a million clinicians in thousands of locations across North America.

Quest said it notified law enforcement and is investigating. The company did not say when the breach began or whether any hacking group has contacted it with demands.

Amanda Rivera, a Quest spokesperson, did not answer questions about the incident and referred to a security notice published on the company's website. The notice contained code instructing search engines not to list the page in search results.

The breach is Quest's second known major data breach in a decade. In 2019, a cyberattack on a third-party billing company resulted in the loss of 11.9 million patient records.

The attack on Quest is the latest in a series of cyberattacks and data breaches affecting the healthcare industry this year. Recent incidents include a March attack that wiped employee devices at medical tech maker Stryker, a hack on medical implant manufacturer Boston Scientific that forced its network offline for weeks, and breaches at medical recordkeeping company CareCloud, healthtech provider Craneware and pharmaceutical distributor McKesson.

Analysis

Why This Matters

Patients whose records were in Quanum face potential exposure of sensitive medical and personal data, including diagnoses, billing information and identifying details.
Healthcare providers using Quanum may face disruptions in lab test ordering and billing while the investigation and remediation continue.
The breach underscores the persistent and growing threat to healthtech companies, which hold vast amounts of valuable personal and medical information and are frequently targeted by ransomware groups.

Background

Quest Diagnostics is one of the largest clinical laboratory services providers in the United States. The Quanum platform is marketed as an integrated system for laboratories, hospitals and physician offices, handling ordering, results reporting and billing. In 2019, Quest experienced a data breach involving a third-party billing vendor that exposed 11.9 million patient records, one of the larger healthcare data breaches at the time. The current incident marks the second major breach for the company within a decade.

Key Perspectives

Quest Diagnostics: The company has disclosed the breach to regulators and law enforcement, initiated an investigation and published a security notice. It has not yet determined the scope of the incident or whether any data was exfiltrated with a ransom demand. Patients and healthcare providers: Affected individuals may face identity theft risk or fraud, while providers may need to verify the security of patient accounts and records within Quanum. Critics and regulators: The SEC filing legally obligates Quest to provide details as the investigation progresses. Critics may question the adequacy of Quest's cybersecurity measures given it is the company's second major breach in seven years.

What to Watch

When Quest Diagnostics discloses the number of affected patients and the specific types of records accessed.
Whether a ransomware group claims responsibility and posts stolen data on leak sites, and whether Quest pays any demand.
Possible regulatory actions, including fines or investigations by the Department of Health and Human Services or state attorneys general.

Sources

Lab testing giant Quest Diagnostics confirms patients’ personal and health data was compromised during breach · TechCrunch

Checked

12 claims in this story checked against 1 source: 9 supported.

Show each claim

SupportedQuest confirmed a data breach affecting its Quanum system.TechCrunch: “Quest has confirmed a cyberattack and data breach affecting an as-yet unspecified amount of sensitive patient information stored in its systems”
Partly supportedPatient records were accessed in the breach.TechCrunch: “The company said the unauthorized access included the accessing of “certain patient records.””
Partly supportedThis is Quest’s second major incident in a decade.TechCrunch: “This is Quest’s second known major data breach in a decade”
SupportedQuest said protected health information was taken, including personal information and patient records.TechCrunch: “In the notice, Quest said that some patients’ protected health information was taken, including “personal information and patient records,””
Partly supportedQuest disclosed the incident in an SEC filing on Wednesday.TechCrunch: “Quest said in an 8-K filing with the U.S. Securities and Exchange Commission that it learned of a cyberattack on Wednesday”
SupportedQuest said it learned of the cyberattack on Wednesday and that it targeted Quanum.TechCrunch: “Quest said in an 8-K filing with the U.S. Securities and Exchange Commission that it learned of a cyberattack on Wednesday targeting one of its lab testing systems, Quanum”
SupportedQuanum lets healthcare practices request lab tests and handles billing.TechCrunch: “Quanum, which allows doctor’s offices, hospitals, and healthcare practices to request lab tests for patients while also handling billing.”
SupportedQuanum is used by about half a million clinicians in thousands of North American locations.TechCrunch: “Quest’s website and materials say Quanum is used by about half a million clinicians in thousands of locations across North America.”
SupportedQuest has not said how many patients or healthcare customers had information stolen.TechCrunch: “The lab-testing giant has not yet said how many healthcare customers, or patients, had information stolen during the attack on its Quanum systems.”
SupportedQuest did not say when the breach began or whether a hacking group had contacted it with demands.TechCrunch: “Quest did not say when the breach began or whether any hacking group has contacted the company with demands”
SupportedThe Quest security notice contained code telling search engines not to list the page in results.TechCrunch: “The website post currently contains “noindex” code, which tells search engines not to list the page in search results”
SupportedA 2019 cyberattack on a third-party billing company led to the loss of 11.9 million patient records.TechCrunch: “after losing 11.9 million patient records in a cyberattack on a third-party billing company in 2019.”