Quest Diagnostics admits hackers accessed patient records on Quanum platform

500,000 clinicians use the Quanum platform, a lab ordering system operated by Quest Diagnostics that now sits at the center of a confirmed data breach. In a mandatory 8-K filing with the Securities and Exchange Commission, the medical lab testing company stated that it became aware of an attack on the system on Wednesday. The platform serves doctors' offices, hospitals, and other healthcare practices that rely on it to order tests and process billing.

Quest confirmed that unauthorized access reached certain patient records. The company described the incident as a cyberattack involving sensitive patient information but did not specify how much data was affected in its regulatory filing. A separate security notice on the company's website states that protected health information was taken, including personal information and patient records. Quest said it notified law enforcement and is currently investigating the incident.

The company has not disclosed the start date of the breach, the number of affected healthcare customers, or whether a hacking group has contacted it with ransom demands. Amanda Rivera, a Quest spokesperson, directed inquiries to the security notice rather than answering questions about the scope of the theft. The notice page currently contains noindex code, a technical tag that prevents search engines from listing the page, which makes the details harder for the public to locate.

The potential scale of the exposure is difficult to quantify without a full record count. Quest materials indicate that Quanum operates across thousands of locations in North America. A 2026 case study on the company's website describes a single health system with more than 6 million patients that can hold hundreds of millions of related medical documents and charts.

This incident adds to a series of major cyber attacks in the healthcare sector this year. In March, Stryker experienced mass wiping of employee devices. In August, Boston Scientific was forced offline for weeks, causing global disruption to operations. Large breaches of patient data also occurred at CareCloud, Craneware, and McKesson this year.

The Quanum breach marks Quest's second known major data incident in a decade. In 2019, the company lost 11.9 million patient records following a cyberattack on a third-party billing company.