Quest Diagnostics: Patient data compromised in system breach

Quest Diagnostics, a major provider of medical lab testing, confirmed in a regulatory filing that a cyberattack targeted one of its core systems, potentially compromising sensitive patient information.

In an 8-K filing with the U.S. Securities and Exchange Commission, the company disclosed that it learned of the unauthorized access on October 21, 2026. The attack was directed at Quanum, the platform used by healthcare providers to order lab tests and manage billing. The company stated that the breach involved access to “certain patient records.” Quest has notified law enforcement and has launched an investigation into the matter.

The incident is the latest in a series of cyberattacks that have disrupted the healthcare sector. Earlier this year, similar attacks led to the mass-wiping of employee devices at Stryker in March, while a hack on Boston Scientific in August forced its network offline for weeks, causing operational disruptions. Other healthcare companies, including CareCloud, Craneware, and McKesson, have also suffered major data breaches this year.

Quest has not yet disclosed the number of patients affected or specified the exact types of data that were taken. A spokesperson for the company did not answer questions about the incident and referred to a security notice. The notice confirms that some patients’ protected health information was stolen, including “personal information and patient records,” but the investigation is ongoing to determine the full scope of the data accessed.

The company’s website states that Quanum is used by approximately 500,000 clinicians in locations throughout North America. The potential scale of the breach is significant, as a single health system can hold hundreds of millions of medical documents. Quest did not say when the breach began or whether any hacking group has contacted the company with demands for payment.

The company’s website contains a notice regarding the incident, but the page is currently marked to prevent search engines from indexing it, making it difficult for individuals to locate. The company is still investigating the specific kinds of data that were taken.

This incident marks Quest’s second major data breach in a decade. In 2019, the company lost 11.9 million patient records in a cyberattack on a third-party billing company. The current investigation into the Quanum system breach is ongoing.