Quest Diagnostics Confirms Major Data Breach

Quest Diagnostics has officially confirmed that a cyberattack compromised sensitive patient data stored within its systems. The company disclosed this development in a legal filing with U.S. regulators, marking the latest significant security incident in the medical sector. The breach affects an unspecified number of individuals whose personal and health information was accessed by unauthorized parties.

The company detailed the event in an 8-K filing submitted to the Securities and Exchange Commission. Quest stated that it became aware of the attack on Wednesday. The breach targeted Quanum, a critical platform used by doctors, hospitals, and other healthcare practices to request lab tests and manage billing. This system holds a vast amount of medical records, diagnostic results, and associated financial data.

In its filing, Quest noted that the unauthorized access involved certain patient records. The company has notified law enforcement and is currently conducting an investigation. While the specific scope of the data theft remains under review, the incident highlights the persistent vulnerability of digital health infrastructure to financially motivated cybercriminals.

This breach is part of a troubling trend in the healthcare industry this year. A series of attacks have caused weeks of disruption and led to the theft of millions of electronic health records. Cybercriminals increasingly target health tech firms, stealing data and threatening to publish it if ransom demands are not met. Recent months have seen similar incidents at other major players, including Stryker, which wiped employee devices in March, and Boston Scientific, which faced network outages in August. Data breaches also affected CareCloud, Craneware, and McKesson throughout the year.

Quest has not yet disclosed how many healthcare customers or patients were affected. According to the company’s website, Quanum is used by approximately 500,000 clinicians across thousands of locations in North America. The exact number of records held is unclear, but a 2026 case study on the company’s site suggests that a single health system with over six million patients can generate hundreds of millions of related medical documents.

The company has not specified when the breach began or if a hacking group has contacted them with ransom demands. Amanda Rivera, a spokesperson for Quest, did not answer specific questions about the incident and directed inquiries to the company’s security notice. That notice confirms that protected health information, including personal details and patient records, was taken, though the specific types of data are still being identified. Notably, the security notice page currently contains code that prevents search engines from indexing it, making it harder for the public to find the information.

This is the second major data breach for Quest in the last decade. In 2019, the company lost 11.9 million patient records due to a cyberattack on a third-party billing company. As the investigation continues, Quest remains focused on determining the full extent of the compromise and notifying affected parties.