Quest Diagnostics Confirms Cyberattack on Core Lab Platform Quanum
The medical testing company disclosed that unauthorized access to its Quanum system compromised patient records, marking its second major breach in a decade.
By Amy Swan ·
Quest Diagnostics has officially confirmed that a cyberattack resulted in the compromise of sensitive patient data stored on its systems. In a legally mandated filing submitted to U.S. regulators on Thursday, the medical lab testing giant admitted that unauthorized actors accessed specific patient records. This disclosure marks the latest significant security incident in a year plagued by digital threats to the healthcare sector.
The breach targets the company’s Quanum platform, a critical infrastructure tool that allows doctors, hospitals, and healthcare practices to request lab tests and manage associated billing. Because Quanum integrates diagnostic results with financial data, it holds a vast repository of medical records and billing information. While Quest has not yet quantified the total volume of data stolen, the company noted that the unauthorized access included the extraction of certain patient files. Law enforcement agencies have been notified, and an internal investigation is currently underway to determine the full scope of the intrusion.
The incident places Quest in the spotlight as part of a broader trend of attacks on health tech companies. This year has seen a series of major breaches that have disrupted operations and exposed millions of electronic health records. These financially motivated attacks often involve threats to publish stolen data if ransom demands are not met. Recent high-profile incidents include the mass-wiping of employee devices at Stryker in March and a prolonged network outage at Boston Scientific in August, which caused global operational disruptions. Additionally, patient data was compromised in hacks targeting CareCloud, Craneware, and McKesson throughout the year.
The scale of potential impact is difficult to gauge immediately, as Quest has not specified how many healthcare customers or individual patients are affected. According to the company’s materials, Quanum is utilized by approximately 500,000 clinicians across thousands of locations in North America. While the exact number of records held is unclear, a 2026 case study on Quest’s website illustrates the density of data involved, noting that a single health system with over 6 million patients can generate hundreds of millions of related medical documents and charts.
Quest has not revealed when the breach began or if a specific hacking group has contacted them with ransom demands. Amanda Rivera, a company spokesperson, pointed reporters to the security notice posted on the company’s website. That notice confirms that protected health information, including personal details and patient records, was taken, though the specific types of data remain under investigation. Notably, the webpage currently includes “noindex” code, which instructs search engines to exclude the page from results, making it less visible to the public.
This is the second known major data breach for Quest Diagnostics in the last ten years. The previous incident occurred in 2019, when a cyberattack on a third-party billing company led to the loss of 11.9 million patient records. As the investigation continues, the company remains focused on determining the precise nature of the stolen data and the timeline of the unauthorized access.
Source: TechCrunch
