Quest Diagnostics has acknowledged a cyberattack that exposed patient information held in its systems, disclosing the incident to U.S. regulators as required by law. In an 8-K filing with the U.S. Securities and Exchange Commission, the medical lab testing giant said it discovered the attack on Wednesday. The intrusion targeted Quanum, one of the company's lab testing systems.
Quanum is the platform through which doctors offices, hospitals and healthcare practices order lab tests for patients, and it also processes billing. The system holds substantial amounts of patient health and medical records along with related diagnostic and billing data. Quest said the unauthorized access included certain patient records, and that it has alerted law enforcement and is investigating.
A security notice posted by Quest states that some patients' protected health information was taken, including personal information and patient records. The company said it is still working to determine exactly what categories of data were removed. The notice currently carries "noindex" code, which directs search engines not to include the page in results and makes it harder for the public to locate.
Quest has not disclosed how many healthcare customers or patients were affected, nor when the breach began or whether any hacking group has contacted it with demands such as payment in exchange for not releasing the data. Amanda Rivera, a spokesperson for Quest, referred questions about the incident to the security notice.
According to Quest's website and materials, roughly half a million clinicians at thousands of locations across North America use Quanum. The company has not said how many health records the platform holds, though a 2026 case study on its site describes how one health system with more than 6 million patients can hold hundreds of millions of related medical documents and charts.
The incident adds to a string of major cyber incidents in the healthcare industry this year. A cyberattack caused mass-wiping of employee devices at medical tech maker Stryker in March, and a hack on medical implant manufacturer Boston Scientific in August took its network offline for weeks and disrupted operations worldwide. Separate hacks during the year produced large patient data breaches at medical recordkeeping company CareCloud, Scotland-based health tech provider Craneware, and U.S. pharmaceutical distribution giant McKesson.
For Quest, the attack is its second known major data breach in a decade, following the loss of 11.9 million patient records in a 2019 cyberattack on a third-party billing company.
More cybersecurity news from TechManNews.
