Quest Diagnostics Confirms Theft of Patient Data in Cyberattack
A major lab testing company has verified that sensitive health records were stolen in a recent breach, leaving millions of patients potentially exposed to risk.
By Layla Petrov ·
Quest Diagnostics has officially verified that a cyberattack resulted in the unauthorized removal of sensitive patient data from its systems, a development that marks a significant escalation in the ongoing wave of healthcare security failures. The company disclosed this information in a filing with U.S. regulators, confirming what had been suspected since the incident was first detected earlier this week.
The breach targeted Quanum, a critical platform that serves as the digital backbone for many healthcare providers. This system allows clinics, hospitals, and doctor’s offices to request lab tests and manage associated billing. By compromising this specific infrastructure, attackers gained access to a repository that holds not only diagnostic results but also extensive medical records and financial data for a vast number of patients. The company stated that the unauthorized access included specific patient records, though the exact scope remains under investigation.
In its 8-K filing with the Securities and Exchange Commission, Quest noted that it became aware of the attack on Wednesday. The company reported that it has already notified law enforcement and is actively investigating the incident. While the firm has confirmed that personal information and patient records were taken, it has not yet released a comprehensive list of the specific data types compromised. This lack of detail leaves many stakeholders in a state of uncertainty regarding the full extent of the exposure.
The scale of the potential impact is difficult to gauge because Quest has not yet specified how many healthcare customers or individual patients were affected. According to company materials, Quanum is utilized by approximately half a million clinicians across thousands of locations in North America. A case study published on Quest’s website in 2026 illustrates the density of this data, noting that a single health system with over six million patients can generate hundreds of millions of related medical documents. This suggests that the volume of data at risk is substantial, even if the number of affected entities is not immediately clear.
This incident is the latest in a string of major cyberattacks that have plagued the healthcare sector this year. The industry has faced weeks of disruption and the theft of millions of electronic health records. Health technology firms have become prime targets for financially motivated cybercriminals who seek to steal large volumes of sensitive data. These attackers often threaten to publish the stolen information if a ransom is not paid, creating a persistent threat to patient privacy and operational continuity.
Other major players in the medical field have suffered similar fates in recent months. In March, a cyberattack led to the mass-wiping of employee devices at medical technology maker Stryker. Later in August, a hack on Boston Scientific, a manufacturer of medical implants, forced the company’s network offline for several weeks. This outage caused global disruption to its operations. Additionally, separate breaches at medical recordkeeping company CareCloud, Scotland-based provider Craneware, and pharmaceutical distributor McKesson resulted in the loss of massive amounts of patient data throughout the year.
Quest has not provided a timeline for when the breach began or whether any hacking group has contacted the company with demands for payment. Amanda Rivera, a spokesperson for the firm, directed inquiries to the company’s security notice rather than answering specific questions about the incident. This notice confirms that protected health information, including personal details and patient records, was taken, but it acknowledges that the investigation into the specific data types is still ongoing.
Notably, the security notice on Quest’s website currently contains noindex code. This technical instruction tells search engines not to list the page in search results, which makes it significantly more difficult for the public to find the announcement. This decision raises questions about the company’s communication strategy during a crisis, as it may hinder patients from learning about the breach through standard online searches.
This is the second known major data breach for Quest Diagnostics in the last decade. In 2019, the company lost 11.9 million patient records following a cyberattack on a third-party billing company. The recurrence of such a significant security failure prompts scrutiny of the measures in place to protect sensitive health information. As the investigation continues, the healthcare industry and its patients will be watching closely for updates on the scope of the damage and the steps being taken to prevent future incidents.
