Quest Diagnostics admits hackers stole patient data from its main lab platform

Quest Diagnostics has officially confirmed that hackers breached its systems and accessed sensitive patient information. The medical testing company detailed the incident in a mandatory legal document filed with U.S. regulators. This disclosure marks a significant security failure for a firm that manages vast amounts of health data for providers across the country.

The company stated in its 8-K filing with the Securities and Exchange Commission that it discovered the intrusion on Wednesday. The attack specifically targeted Quanum, a critical platform used by doctor offices and hospitals. This system allows healthcare practices to request lab tests and handle associated billing. Because it processes these transactions, the platform stores extensive medical records and diagnostic data for numerous patients.

Quest acknowledged that unauthorized actors accessed specific patient records during the breach. The firm said it has already notified law enforcement and is currently conducting an internal investigation. While the company confirmed that protected health information was taken, it has not yet provided a precise count of the records involved. This lack of clarity has left many stakeholders waiting for more concrete details about the scale of the compromise.

This incident joins a long line of major cyberattacks hitting the healthcare sector this year. Health technology firms have become prime targets for financially motivated criminals. These groups often steal massive amounts of sensitive data and threaten to publish it unless a ransom is paid. Such disruptions have caused weeks of operational delays and the theft of millions of electronic health records recently.

Recent months have seen several high-profile attacks in the medical field. In March, medical technology maker Stryker suffered a mass wiping of employee devices. In August, a hack on Boston Scientific forced its network offline for weeks, causing global disruptions to its operations. Other significant data breaches have also affected CareCloud, Craneware, and McKesson. These events highlight the persistent vulnerability of the healthcare supply chain to digital threats.

Quest has not yet specified how many healthcare customers or individual patients were affected by the attack on its Quanum systems. The company’s own materials indicate that Quanum is used by approximately half a million clinicians in thousands of locations across North America. While the exact number of held records is unclear, a 2026 case study on the company’s website illustrates the potential scale. It notes that a single health system with over six million patients can hold hundreds of millions of related medical documents and charts.

The company has not disclosed when the breach initially began or if any hacking group has contacted it with demands. Spokesperson Amanda Rivera referred to the company’s security notice regarding the incident. She did not answer direct questions about the specific details of the attack. The security notice confirms that personal information and patient records were taken, but the company is still determining the specific types of data involved.

Notably, the website post currently contains code that instructs search engines not to list the page. This technical choice makes the security notice much harder for the general public to find. This is the second known major data breach for Quest in the last decade. In 2019, the company lost 11.9 million patient records following a cyberattack on a third-party billing company. The firm is still working to determine the full extent of the current compromise.