Quest Diagnostics admits hackers stole patient records from its Quanum system
The company filed a regulatory notice confirming unauthorized access to a system used by roughly 500,000 clinicians, though it has not revealed how many records were taken.
By Kevin Sanders ·
Quest Diagnostics confirmed on Wednesday that hackers accessed its Quanum lab ordering platform, an event that exposed sensitive patient health information. The company submitted an 8-K filing to the Securities and Exchange Commission to disclose the cyberattack. This system serves doctors' offices, hospitals, and other healthcare practices across North America for ordering tests and processing billing.
In the filing, Quest stated that it discovered the unauthorized access on Wednesday. The company described the breach as affecting "certain patient records" and said it has notified law enforcement. A separate security notice on Quest's website indicated that protected health information was taken, including personal data and patient records. The company is still determining exactly which data types were stolen.
Quest has not yet disclosed the total number of affected patients or healthcare customers. It also did not specify when the breach began or if a hacking group contacted the company with ransom demands. Amanda Rivera, a Quest spokesperson, directed inquiries to the security notice without answering specific questions about the scope of the theft.
The scale of the potential exposure is large because Quanum is a central tool for medical professionals. Quest's materials state that about half a million clinicians use the platform across thousands of locations. While the total number of stored records is not public, a 2026 case study on Quest's website describes a single health system using the platform to manage over 6 million patients and hundreds of millions of medical documents.
The security notice page on Quest's website currently includes code that tells search engines not to index the page, making it harder for the public to find. Quest has not explained why it used this setting. The company remains silent on whether the stolen data includes diagnostic results or financial billing details beyond general patient records.
This incident marks the second major data breach for Quest in ten years. In 2019, a cyberattack on a third-party billing company resulted in the loss of 11.9 million patient records. The current attack adds to a series of major disruptions in the healthcare sector this year, including incidents at Stryker, Boston Scientific, CareCloud, Craneware, and McKesson.
Quest said it is investigating the incident and working with law enforcement. The company has not announced a timeline for notifying individual patients. The 8-K filing remains the primary public record of the company's acknowledgment of the data theft.
Source: TechCrunch
