Medical testing giant Quest Diagnostics has confirmed a cyberattack and data breach incident, involving a undisclosed number of sensitive patient records stored in its systems. The company made this statement in disclosure documents submitted in accordance with U.S. regulatory requirements.
In its 8-K filing submitted to the U.S. Securities and Exchange Commission (SEC), Quest stated that on Wednesday, the company became aware that one of its laboratory testing systems, Quanum, had been subjected to a cyberattack. This system allows doctor's offices, hospitals, and medical institutions to request tests for patients, as well as process billing. The platform stores a large amount of patient health and medical records, as well as related diagnostic and billing data.
The company stated that unauthorized access included reading “certain patient records.” Quest mentioned that law enforcement has been notified, and an investigation is underway.
The cyberattack targeting Quest is the latest major cyber incident to affect the healthcare industry this year. A series of consecutive cyberattacks and data breaches have caused weeks of chaos, resulting in the theft of millions of patients' electronic health records and other medical information. Healthcare technology companies have become a primary target for cybercriminals with profit motives; these attackers attempt to steal as much sensitive data as possible and threaten to disclose it if a ransom is not paid.
In recent months, medical technology manufacturer Stryker suffered a cyberattack in March, which resulted in the mass deletion of data from employees' devices; while a hack targeting medical implant manufacturer Boston Scientific in August forced its network to be offline for several weeks and caused a "global disruption" to its operations. At the same time, other independent hacking incidents this year have also led to large-scale patient data breaches at medical record management company CareCloud, Scottish-based medical technology provider Craneware, and American pharmaceutical distribution giant McKesson.
Quest did not specify when the leak began, nor did they mention if any hacker group contacted the company with demands, such as paying a fee in exchange for not disclosing the stolen data. Quest The spokesperson did not respond to TechCrunch's request for comment on Friday.
This laboratory testing giant has not yet stated how much information of medical clients or patients was stolen in the attack targeting its Quanum system.
According to websites and related materials, Quanum is used by approximately 500,000 clinicians at thousands of locations in North America. It is not yet clear how many health records are stored in Quanum, but a case study from 2026 on the Quest website indicates that when a single healthcare system has over 6 million patients, it may store hundreds of millions of related medical documents and patient records.
Quest stated in a note on its website that some protected health information of patients has been taken away, including “personal information and patient records,” but the company is still investigating what specific types of data were removed. (The webpage currently contains “noindex” code, which instructs search engines not to include this page in search results, making it even more difficult for outsiders to find this page.)
This is the second major data breach incident known to have occurred to Quest within the past decade. Previously, in 2019, the company lost 11.9 million patient records due to a cyberattack on one of its third-party billing companies.
If you work at Quest Diagnostics or would like to learn more about this data breach, please feel free to contact this reporter. You can reach the reporter through Signal using the username zackwhittaker.1337, or by sending an email to [ email protected ].
