Quest Diagnostics Confirms Cyberattack Exposed Patient Data on Core Platform

Quest Diagnostics has officially confirmed that a cyberattack resulted in the unauthorized access of sensitive patient data stored on its primary laboratory information system, Quanum. The company disclosed the incident through a mandatory filing with U.S. regulators, acknowledging that the breach involved the compromise of specific patient records and associated health information.

The attack was identified on Wednesday, October 21, and targeted the Quanum platform, which serves as a critical hub for doctors’ offices, hospitals, and other healthcare practices. This system not only facilitates the ordering of lab tests but also manages billing and stores extensive medical histories. Quest stated that it has notified law enforcement and is actively investigating the scope of the intrusion, though it has not yet determined the precise volume of data taken or the number of affected patients.

This incident adds to a string of major cybersecurity failures in the healthcare industry throughout 2026. Medical technology firms have increasingly become targets for financially motivated cybercriminals who aim to steal vast amounts of sensitive data to leverage in ransom negotiations. Recent disruptions include a March incident at Stryker, where employee devices were mass-wiped, and an August hack at Boston Scientific that forced the company’s network offline for weeks, causing global operational delays. Other significant breaches this year have impacted CareCloud, Craneware, and McKesson, resulting in the theft of millions of electronic health records.

While Quest has not specified when the breach began or if a hacking group has contacted them with ransom demands, the company notes that Quanum is utilized by approximately 500,000 clinicians across thousands of locations in North America. The potential scale of the data exposure is significant; a 2026 case study on Quest’s website illustrates that a single health system with over six million patients can hold hundreds of millions of related medical documents, suggesting the Quanum platform may contain a similarly massive repository of information.

Amanda Rivera, a spokesperson for Quest, directed inquiries to the company’s security notice, which confirms that protected health information, including personal details and patient records, was accessed. The company is still determining the specific types of data compromised. Notably, the webpage containing this notice currently includes code that prevents search engines from indexing it, making it less visible to the public.

This is the second major data breach for Quest Diagnostics in the last decade. The previous incident occurred in 2019, when a cyberattack on a third-party billing partner led to the loss of 11.9 million patient records. As the investigation continues, the healthcare industry remains on high alert, with stakeholders closely monitoring the situation for further developments regarding the extent of the data loss and the identity of the attackers.

The company has not yet announced a timeline for notifying affected individuals or outlining the next steps for its healthcare customers. In the meantime, Quest is working to secure its systems and assess the long-term impact of the breach on its operations and client relationships.