Quest Diagnostics Breach: Patient Records Exposed in Lab System Attack
A major medical lab company has acknowledged that unauthorized actors accessed a platform used for ordering and billing tests, resulting in the theft of protected health information.
By Tunde Adeyemi ·
Major healthcare providers have faced a wave of cyberattacks throughout the year, and now the nation's largest medical laboratory operator has confirmed it is the latest victim. Quest Diagnostics announced it has been compromised by a security breach involving systems that store sensitive patient data. The company confirmed the incident in a filing with the U.S. Securities and Exchange Commission, stating that unauthorized access to its systems occurred earlier this week.
The intrusion targeted Quanum, a platform utilized by physician offices, hospitals, and other medical facilities to request laboratory tests and process billing. Because this system facilitates requests for testing and manages associated financial transactions, it retains a significant volume of patient medical records along with diagnostic and billing details. Quest disclosed that the unauthorized activity involved accessing certain patient records.
In response to the incident, Quest has notified law enforcement authorities and has launched an investigation into the matter. The company's public security notice confirms that some patients' protected health information was taken, including personal information and patient records. However, the organization is still determining the specific categories of data involved. The company has not disclosed when the breach began or whether any hacking group has contacted them regarding ransom demands.
This event is part of a broader pattern of criminal activity targeting the healthcare sector. Throughout the year, a series of attacks on health tech companies have caused widespread disruption and the theft of millions of electronic health records. Cybercriminals, often motivated by financial gain, target these organizations to steal sensitive data for potential ransom. Previous incidents in 2026 included attacks on Stryker, Boston Scientific, CareCloud, Craneware, and McKesson.
The Quanum platform supports approximately 500,000 clinicians across thousands of locations throughout North America. Quest has not yet specified how many healthcare customers or patients had their information accessed during the attack on this system. The scale of potential exposure is significant; a 2026 case study on the company's website indicates that a single health system with more than 6 million patients can generate hundreds of millions of associated medical documents and charts.
A spokesperson for Quest, Amanda Rivera, declined to answer specific questions about the incident and directed inquiries to the company's security notice. That notice, which is intended to inform patients of the situation, is currently tagged with code that prevents search engines from listing the page. This technical setting makes it much harder for individuals to locate the information through standard searches.
This marks the second major data breach for Quest Diagnostics in a decade. The company previously suffered a significant compromise in 2019, when a cyberattack on a third-party billing vendor resulted in the loss of 11.9 million patient records. The current investigation is ongoing as the company works to identify the scope of the compromised data.
Source: TechCrunch
