The key facts

  • Quest Diagnostics confirmed a cyberattack on the Quanum platform in an 8-K filing with the SEC
  • Access was gained to 'certain patient records'; the scale of the breach has not been disclosed
  • Quanum is used by about half a million clinicians in North America

Cyberattack on the Quanum system

Quest Diagnostics has confirmed a cyberattack and data breach affecting an as-yet undetermined volume of sensitive patient information. In a mandatory 8-K filing with the U.S. Securities and Exchange Commission (SEC), the company said it learned of the attack on Wednesday; the target was the Quanum system, through which physician offices, hospitals and medical practices order laboratory tests and handle billing. The platform stores a large volume of medical records, diagnostic and billing data.

What is known about the breach

According to the company, unauthorized access affected 'certain patient records.' Quest notified law enforcement and is conducting an investigation. The company's website states that some protected health information data was stolen, including 'personal data and patient records,' but which specific types of data were affected is still being determined. According to TechCrunch, the page with this notice contains a 'noindex' code that hides it from search engines. The company has not disclosed when the breach began or whether any hacker group has contacted it with demands; a Quest representative did not respond to TechCrunch's request for comment.

Scale of the platform

Quanum, according to Quest itself, is used by about half a million clinicians at thousands of sites across North America. How many medical records are stored in the system is unknown, however a 2026 case study on Quest's website shows that a single healthcare system with more than 6 million patients can store hundreds of millions of related medical documents and charts.

Context: attacks on healthcare

The attack on Quest became another major incident in the industry over the past year: according to TechCrunch, a series of cyberattacks led to weeks of outages and the theft of millions of electronic medical records. In March, an attack led to the mass wiping of data from devices of employees of medical device maker Stryker; in August, a hack of medical implant maker Boston Scientific knocked out its network for weeks, causing 'global outages.' Separate hacks during the year caused major patient data breaches at companies CareCloud, Scottish provider Craneware and pharmaceutical distributor McKesson.

Second major breach in a decade

This is the second known major data breach at Quest Diagnostics in ten years: in 2019, as a result of an attack on a third-party billing company, the company lost 11.9 million patient records.