Quest Diagnostics Confirms Compromise of Patient Data

A major breach of patient data at Quest Diagnostics has been officially confirmed by the company.

The laboratory services provider disclosed in a regulatory filing that a cyberattack targeted one of its core systems. The incident exposed a significant volume of sensitive information belonging to patients and healthcare providers.

The attack specifically targeted the Quanum platform, which serves as a critical link between medical practices and laboratory testing services. This system allows doctors' offices and hospitals to request diagnostic tests while simultaneously managing the associated billing processes. Because of this dual function, the platform stores extensive medical records alongside financial data, creating a concentrated repository of sensitive information.

Quest stated that unauthorized actors accessed certain patient records during the intrusion. The company reported that it learned of the attack on Wednesday and immediately notified law enforcement. An internal investigation is currently underway to determine the full scope of the compromise and the specific types of data that were removed from the system.

The incident adds to a series of disruptive cyberattacks that have plagued the healthcare sector throughout 2026. Health technology firms have become prime targets for financially motivated criminals who seek to extract ransom payments by threatening to release stolen data. Recent months have seen significant operational disruptions and data thefts at several major industry players.

Earlier this year, medical technology maker Stryker experienced a mass wiping of employee devices in March. In August, a hack on medical implant manufacturer Boston Scientific forced its network offline for weeks, causing global operational delays. Additionally, separate breaches compromised patient data at medical recordkeeping firm CareCloud, Scottish health tech provider Craneware, and pharmaceutical distributor McKesson.

Quest has not yet disclosed the exact number of clinicians or patients affected by the breach. However, the company notes that Quanum is utilized by approximately half a million clinicians across thousands of locations in North America. A recent case study on the company's website illustrates the scale of potential data exposure, noting that a single health system with more than six million patients can generate hundreds of millions of related medical documents.

The company has not provided a start date for the breach or indicated whether a hacking group has made contact with ransom demands. A spokesperson for Quest directed inquiries to a security notice posted on the company's website. That notice confirms that protected health information, including personal details and patient records, was taken, though the investigation continues to identify the specific categories of data involved.

This marks the second major known data breach for Quest Diagnostics in the past decade. The company previously lost nearly 12 million patient records in 2019 following an attack on a third-party billing vendor. The current incident underscores the ongoing vulnerability of large-scale healthcare data infrastructure to sophisticated cyber threats.