Lab testing giant Quest Diagnostics confirms patient health and personal data compromised in breach

Medical laboratory testing giant Quest Diagnostics has confirmed a cyberattack and data breach affecting an as-yet-undetermined amount of sensitive patient information stored in its systems, according to a legally required disclosure by U.S. regulators.

Quest said in an 8-K filing with the U.S. Securities and Exchange Commission that it learned Wednesday of a cyberattack targeting one of its lab testing systems, Quanum, which allows doctors’ offices, hospitals and health care practices to order lab tests for patients while also handling billing. The platform stores a large amount of patient medical and health records, as well as associated diagnostic and billing data.

The company said the unauthorized access included access to “certain patient records.” Quest said it has notified law enforcement and is investigating.

The cyberattack on Quest is the latest major cyber incident to hit the healthcare industry this year. A series of cyberattacks and data breaches triggered weeks of disruption and enabled the theft of millions of patients’ electronic health records and other medical information. Health tech companies have become a major target for money-motivated cybercriminals, who seek to steal as much sensitive data as possible and threaten to publish it if they are not paid a ransom.

In recent months, a cyberattack led to the mass wiping of employee devices at medical technology maker Stryker in March, and a hack at medical implant maker Boston Scientific in August forced the company’s network offline for weeks, triggering a “global disruption” of its operations. Meanwhile, separate hacks throughout the year caused massive patient data breaches at medical record-keeping company CareCloud, Scottish healthcare technology provider Craneware and US pharmaceutical distribution giant McKesson.

The lab testing giant has not yet said how many healthcare customers or patients had information stolen in the attack on its Quanum systems.

Quest’s website and materials indicate that Quanum is used by approximately half a million clinicians in thousands of locations across North America. It’s unclear exactly how many health records Quanum holds, but a 2026 case study on Quest’s website shows how a single health system with more than 6 million patients can hold hundreds of millions of documents and related medical records.

Quest did not say when the breach began or whether a hacking group had contacted the company with demands, such as payment in exchange for not disclosing the stolen data. Amanda Rivera, a spokesperson for Quest, did not respond to TechCrunch’s questions about the incident and referred to its security advisory.

In the notice, Quest said that some patients’ protected health information was taken, including “personal information and patient records,” but the company is still investigating the specific types of data that were recovered. (The website post currently contains “noindex” code, which tells search engines not to list the page in search results, making it much harder for people to find the page.)

This is Quest’s second known major data breach in a decade, following the loss of 11.9 million patient records in a cyberattack on a third-party billing company in 2019.

Do you work at Quest Diagnostics or know more about data breach? We would love to hear from you. You can reach this reporter on Signal under the username zackwhittaker.1337 or by email (email protected).

Updated with a response from Quest.