Cyberattack hits medical lab testing giant

A medical lab testing giant, Quest Diagnostics, has confirmed a cyberattack and data breach affecting an as-yet unspecified amount of sensitive patient information stored in its systems. A legally required disclosure with U.S. regulators reveals the breach, which targets one of its lab testing systems, Quanum. This platform allows doctors’ offices, hospitals, and healthcare practices to request lab tests for patients while also handling billing, and it stores a large amount of patient health and medical records, as well as associated diagnostic and billing data.

The company said in an 8-K filing with the U.S. Securities and Exchange Commission that it learned of a cyberattack on Wednesday. The unauthorized access included the accessing of “certain patient records,” and the company said it notified law enforcement and is investigating.

The cyberattack on Quest is the latest major cyber incident to affect the healthcare industry this year. A series of cyberattacks and data breaches have sparked weeks of disruption and allowed the theft of millions of patient electronic health records and other medical information. Health tech companies have become a major target for financially motivated cybercriminals, who aim to steal as much sensitive data as possible and threaten to publish it if they are not paid a ransom.

In recent months, a cyberattack resulted in the mass-wiping of employee devices at medical tech maker Stryker in March, and a hack on medical implant manufacturer Boston Scientific in August forced the company’s network offline for weeks, sparking “global disruption” to its operations. Meanwhile, separate hacks throughout the year caused massive breaches of patient data at medical recordkeeping company CareCloud, Scotland-based health tech provider Craneware, and U.S. pharmaceutical distribution giant McKesson.

The lab-testing giant has not yet said how many healthcare customers, or patients, had information stolen during the attack on its Quanum systems. Quest’s website and materials say Quanum is used by about half a million clinicians in thousands of locations across North America. It’s unclear how many health records Quanum holds, but one 2026 case study on Quest’s website shows how a single health system with more than 6 million patients can hold hundreds of millions of related medical documents and charts.

Quest did not say when the breach began or whether any hacking group has contacted the company with demands, such as payment in exchange to not release the stolen data. Amanda Rivera, a spokesperson for Quest, did not answer TechCrunch’s questions about the incident and referred to its security notice.

In the notice, Quest said that some patients’ protected health information was taken, including “personal information and patient records,” but the company is still investigating what specific kinds of data were taken.

This is Quest’s second known major data breach in a decade, after losing 11.9 million patient records in a cyberattack on a third-party billing company in 2019.

Do you work at Quest Diagnostics or know more about the data breach? We’d love to hear from you. You can reach this reporter on Signal at the username zackwhittaker.1337 or by email [email protected].