Quest confirms patient data theft

Major healthcare records have just been taken in a fresh cyberattack on Quest Diagnostics.

The lab testing company confirmed in a legal filing that attackers gained unauthorized access to a specific platform called Quanum. This system is critical because it allows doctors, hospitals, and other medical practices to request tests and handle billing. It holds a massive amount of sensitive information, including patient health records, diagnostic details, and billing data. Quest stated that the breach involved the access of certain patient records and that they have notified law enforcement to begin an investigation.

This incident is the latest in a string of major cybersecurity hits to the healthcare industry in 2026. Over the past year, health tech companies have become prime targets for criminals motivated by financial gain. These attackers often steal large volumes of sensitive data and threaten to publish it unless a ransom is paid. The disruptions have been widespread, affecting millions of electronic health records. In March, medical tech maker Stryker suffered a mass-wiping of employee devices. In August, a hack on Boston Scientific forced the company’s network offline for weeks, causing global operational disruptions. Other significant breaches this year hit medical recordkeeping firm CareCloud, Scotland-based provider Craneware, and pharmaceutical distributor McKesson.

Quest has not yet specified exactly how many patients or healthcare customers were affected by the Quanum breach. However, the company notes that Quanum is used by approximately half a million clinicians across thousands of locations in North America. The scale of the data stored is immense; a recent case study on Quest’s website illustrates that a single health system with over six million patients can generate hundreds of millions of medical documents and charts. It remains unclear how many of these records were specifically compromised in this incident.

The company has not disclosed when the breach began or if any hacking group has contacted them with ransom demands. Amanda Rivera, a spokesperson for Quest, directed inquiries to the company’s security notice rather than answering specific questions about the timeline or the attackers. The notice confirms that protected health information, including personal details and patient records, was taken. However, the company is still determining the exact types of data involved. Notably, the webpage containing this notice currently has 'noindex' code, which instructs search engines not to list the page, making it harder for the public to find the information.

This is not the first time Quest has faced such a threat. It is the company’s second known major data breach in the last decade. In 2019, Quest lost 11.9 million patient records following a cyberattack on a third-party billing company. The current situation adds to the growing concern over the security of healthcare data in the digital age.

As the investigation continues, patients and healthcare providers are left waiting for more detailed information. The company is working to understand the full scope of the compromise and the specific data involved. For those in the medical field or patients seeking updates, the official security notice remains the primary source of information, despite its limited visibility online.

The healthcare industry continues to grapple with the frequency and severity of these attacks. Each incident highlights the vulnerability of centralized systems that hold vast amounts of sensitive personal data. As Quest works to secure its systems and notify affected parties, the focus remains on minimizing the impact on patients and restoring trust in the platform's security.