Quest Diagnostics says hackers stole patient data from its Quanum lab system

Quest Diagnostics admitted on Thursday that hackers stole patient records from its Quanum lab ordering platform. The company disclosed the breach in a mandatory filing with the Securities and Exchange Commission, confirming that unauthorized actors accessed sensitive medical and billing data.

Quest stated it became aware of the attack on Wednesday. Quanum serves as the digital interface for thousands of healthcare providers in North America, allowing them to order tests and process payments for their patients. The system stores a substantial volume of protected health information, diagnostic results, and financial records.

In a separate security notice posted to its website, Quest confirmed that some patients' protected health information was taken. The company described the stolen data as including personal information and patient records. Quest is currently determining the specific types of data that were compromised.

The company has not released the total number of affected clinicians or patients. It also has not stated when the unauthorized access began or if a hacking group has contacted Quest with ransom demands. A spokesperson for Quest, Amanda Rivera, directed inquiries to the online security notice rather than answering specific questions about the scope of the incident.

The scale of the potential exposure is large. Quest materials indicate that approximately 500,000 clinicians use Quanum across thousands of locations. A case study published on the company's website in 2026 describes a single health system on the platform that manages more than 6 million patients and hundreds of millions of medical documents.

This incident marks the second major data breach for Quest in the past ten years. In 2019, the company lost 11.9 million patient records following a cyberattack on a third-party billing vendor. The Quanum breach follows a string of major cyber incidents in the healthcare sector this year, including attacks on Stryker, Boston Scientific, CareCloud, Craneware, and McKesson.