Quest Diagnostics Confirms Data Breach Compromising Patient Health Information

Lab testing giant Quest Diagnostics has confirmed a cyberattack and data breach that compromised an unspecified amount of sensitive patient information stored within its systems. The company disclosed the incident in a legally required 8-K filing with U.S. regulators, stating it learned of the cyberattack on Wednesday. The target of the breach was Quanum, one of Quest’s lab testing systems, which facilitates requests for lab tests from doctor’s offices, hospitals, and healthcare practices, and also handles associated billing.

The Quanum platform stores extensive patient health and medical records, along with diagnostic and billing data. Quest confirmed that the unauthorized access included the accessing of "certain patient records" and has notified law enforcement while an investigation is underway. This incident marks the latest in a series of major cyberattacks impacting the healthcare industry this year, which have led to weeks of disruption and the theft of millions of patient electronic health records and other medical information. Healthtech companies have become prime targets for financially motivated cybercriminals seeking to steal sensitive data and demand ransoms.

In recent months, other significant incidents include a mass-wiping of employee devices at medical tech maker Stryker in March, and a hack on medical implant manufacturer Boston Scientific in August that took its network offline for weeks, causing "global disruption." Separate breaches throughout the year have also resulted in massive patient data compromises at medical recordkeeping company CareCloud, Scotland-based healthtech provider Craneware, and U.S. pharmaceutical distribution giant McKesson.

Quest has not yet disclosed when the breach began, nor whether any hacking group has contacted the company with demands for payment in exchange for not releasing the stolen data. A spokesperson for Quest did not respond to TechCrunch’s request for comment on Friday. The company has also not specified the number of healthcare customers or patients whose information was stolen during the attack on its Quanum systems. Quest’s website materials indicate Quanum is utilized by approximately half a million clinicians across thousands of locations in North America. While the exact number of health records held by Quanum is unclear, a 2026 case study on Quest’s website noted that a single health system with over 6 million patients can manage hundreds of millions of related medical documents and charts. In a note on its website, Quest acknowledged that some patients’ protected health information, including "personal information and patient records," was taken, but the specific kinds of data are still under investigation. The company’s website post containing this information currently includes “noindex” code, making it difficult for search engines to list the page. This is Quest's second known major data breach in a decade, following a 2019 incident where 11.9 million patient records were lost due to a cyberattack on a third-party billing company.

What to watch: Further details on the scope of the breach and its implications for patient data security.

Editor's note: The draft is a comprehensive summary of the breach details and context provided in the source text.