Quest Diagnostics Admits Patient Data Stolen in New Cyberattack

Quest Diagnostics has officially acknowledged that sensitive patient data was stolen during a recent cyberattack, though the company has yet to specify how many individuals are affected. This admission, made in a regulatory filing, adds to the growing list of major healthcare breaches that have plagued the industry in 2026. The uncertainty surrounding the scope of the data theft creates immediate tension for the millions of clinicians and patients who rely on Quest’s services daily.

In an 8-K filing submitted to the U.S. Securities and Exchange Commission on Wednesday, Quest stated that it discovered the breach targeting its Quanum system. Quanum is a critical platform used by doctors’ offices, hospitals, and other healthcare practices to request lab tests and process billing. The system holds extensive medical records, diagnostic results, and associated financial data, making it a high-value target for cybercriminals.

The company confirmed that unauthorized access allowed attackers to view certain patient records. Quest has notified law enforcement and is currently investigating the incident. However, the firm has not disclosed when the breach began or if a specific hacking group has contacted them with ransom demands, a common tactic in these types of attacks.

This incident is the latest in a string of significant cyber disruptions hitting the healthcare sector this year. Previous attacks have caused weeks of operational downtime and the theft of millions of electronic health records. Health technology firms have become primary targets for financially motivated actors who steal data and threaten to publish it if a ransom is not paid.

Recent months have seen several high-profile incidents in the medical tech space. In March, Stryker suffered a cyberattack that resulted in the mass wiping of employee devices. In August, Boston Scientific was forced to take its network offline for weeks following a hack, causing global disruption to its operations. Additionally, major data breaches occurred at medical recordkeeping firm CareCloud, Scotland-based provider Craneware, and pharmaceutical distributor McKesson.

Quest has not yet clarified how many healthcare customers or patients had their information compromised. According to the company’s website, Quanum is used by approximately 500,000 clinicians across thousands of locations in North America. While the total volume of records held by Quanum is unclear, a 2026 case study on Quest’s site illustrates the scale of data involved, noting that a single health system with over 6 million patients can hold hundreds of millions of medical documents.

Amanda Rivera, a spokesperson for Quest, directed inquiries to the company’s security notice rather than answering specific questions about the incident. The notice states that protected health information, including personal data and patient records, was taken. The company is still determining the specific types of data involved. Notably, the webpage containing this notice includes code that instructs search engines not to index the page, making it harder for the public to find the information through standard searches.

This marks the second known major data breach for Quest in the last decade. In 2019, the company lost 11.9 million patient records due to a cyberattack on a third-party billing company. The current incident raises questions about the company’s security posture and the resilience of its critical infrastructure.

As the investigation continues, Quest has not provided a timeline for a full resolution or a detailed report on the nature of the attack. The lack of specific numbers and the obscurity of the public notice leave patients and healthcare partners in a state of wait-and-see, hoping for clearer communication as the company works to contain the damage.