Quest Diagnostics Investigates Breach of Quanum Patient Records
Quest Diagnostics has confirmed a cyberattack involving its Quanum lab-testing system, with unauthorized access to certain patient records. In an 8-K filing with the U.S. Securities and Exchange Commission, the company said it learned on Wednesday that the system had been targeted. Quest has not disclosed how many patients or healthcare customers may be affected.
Quanum is used by doctors’ offices, hospitals and healthcare practices to request laboratory tests and handle billing. The platform contains health and medical records alongside diagnostic and billing information, making the incident significant even though Quest is still determining the precise scope of the data involved.
Protected health information was taken
Quest said on its website that some patients’ protected health information was taken, including personal information and patient records. The company has not yet identified the specific categories of information obtained by the unauthorized party.
The company notified law enforcement and said it is investigating the incident. It did not state when the intrusion began, whether a hacking group has contacted it, or whether any demand for payment was made in exchange for not releasing data.
Scale of the Quanum environment remains unclear
Quest materials describe Quanum as being used by about half a million clinicians at thousands of locations across North America. The number of health records held in the environment is unknown. A 2026 Quest case study, however, describes a single health system serving more than 6 million patients and holding hundreds of millions of related documents and charts.
The breach comes amid repeated attacks on healthcare and health-technology organizations. The source article cites incidents affecting Stryker, Boston Scientific, CareCloud, Craneware and McKesson, illustrating the value attackers place on sensitive medical and administrative information.
A second known major Quest breach in a decade
This is Quest’s second known major data breach in ten years. In 2019, a cyberattack on a third-party billing company led to the loss of 11.9 million patient records. The newly disclosed event instead concerns a Quest-operated system used in clinical ordering and billing workflows.
For healthcare providers and laboratory customers, the practical implication is to identify which vendors process both clinical and billing data, confirm contractual incident-notification obligations, and review access controls around connected patient-record systems.