Quest Diagnostics confirms patient data breach in Quanum lab testing platform

Quest Diagnostics, one of the largest medical laboratory operators in the United States, has confirmed that a cyberattack against one of its systems compromised sensitive patient health data. The disclosure was reported by TechCrunch, which reviewed the company's regulatory filing.

What Quest has disclosed

According to TechCrunch, Quest disclosed the incident in an 8-K filing with the U.S. Securities and Exchange Commission. The company said it learned of the attack on Wednesday, and that it targeted Quanum, a platform used by doctor's offices, hospitals and healthcare practices to order lab tests and handle billing. The system holds large amounts of patient medical records alongside diagnostic and billing data.

Quest told regulators that the intruder accessed "certain patient records." The company says it has notified law enforcement and is investigating. It has not said when the intrusion began, how many patients or healthcare customers are affected, or whether any group has contacted it with ransom demands. TechCrunch reported that a Quest spokesperson did not respond to a request for comment on Friday.

How large the exposure could be

Quest has not put a number on the breach, but the platform's reach suggests the potential scope is significant. Materials on Quest's own website, cited by TechCrunch, say Quanum is used by roughly half a million clinicians in thousands of locations across North America. It is unclear how many health records the platform holds overall, though a 2026 case study published by Quest describes a single health system with more than six million patients holding hundreds of millions of related medical documents and charts.

In a notice on its website, Quest said some patients' protected health information was taken, including personal information and patient records, but that it is still investigating exactly which kinds of data were involved. TechCrunch also observed that the notice page carries "noindex" code, which stops search engines from listing it and makes the disclosure harder for affected people to find.

A year of attacks on healthcare

The incident fits a broader pattern. TechCrunch notes that this is only the latest major cyber incident to hit the healthcare industry this year, with earlier attacks causing weeks of disruption and the theft of millions of patient records.

In March, a cyberattack wiped employee devices en masse at medical tech maker Stryker. In August, a hack at implant manufacturer Boston Scientific forced its network offline for weeks, in what the company described as a "global disruption" to its operations. Separate breaches during the year exposed patient data at medical records company CareCloud, Scotland-based healthtech provider Craneware, and pharmaceutical distribution giant McKesson. Financially motivated criminal groups have made healthtech companies a prime target, stealing sensitive data and threatening to publish it unless a ransom is paid.

Quest's second major breach in a decade

This is not Quest's first large-scale incident. According to TechCrunch, the company lost 11.9 million patient records in a 2019 cyberattack on a third-party billing company, making the Quanum incident its second known major breach of the past ten years.

Why it matters

Lab test data sits at the intimate end of personal information: results can point to pregnancies, infections, cancer screenings and chronic conditions, and unlike a password, this information cannot be changed once it leaks. Because Quanum is shared infrastructure used by hundreds of thousands of clinicians, a single breach at Quest can ripple across thousands of care providers and their patients at once, showing how consolidated health platforms create large single points of failure. The episode also raises transparency questions: the breach was disclosed to regulators as legally required, but the patient-facing notice was published in a way that keeps it out of search results, leaving affected people with little concrete information about which of their records were taken. For a healthcare sector already battered by a year of ransomware and data theft, Quest's incident is a reminder that the organizations holding the most sensitive records remain among the most attractive targets.