Lab testing giant Quest Diagnostics confirms patients’ personal and health data was compromised during breach

Medical lab testing giant Quest Diagnostics has confirmed a cyberattack and data breach affecting an as-yet unspecified amount of sensitive patient information stored in its systems, according to a legally required disclosure with U.S. regulators.

Quest said in an 8-K filing with the U.S. Securities and Exchange Commission that it learned of a cyberattack on Wednesday targeting one of its lab testing systems, Quanum, which allows doctor’s offices, hospitals, and healthcare practices to request lab tests for patients while also handling billing. The platform stores a large amount of patient health and medical records, as well as associated diagnostic and billing data.

The company said the unauthorized access included the accessing of “certain patient records.” Quest said it notified law enforcement and is investigating.

The cyberattack on Quest is the latest major cyber incident to affect the healthcare industry this year. A series of cyberattacks and data breaches have sparked weeks of disruption and allowed the theft of millions of patient electronic health records and other medical information. Healthtech companies have become a major target for financially motivated cybercriminals, who aim to steal as much sensitive data as possible and threaten to publish it if they aren’t paid a ransom. 

In recent months, a cyberattack resulted in the mass-wiping of employee devices at medical tech maker Stryker in March, and a hack on medical implant manufacturer Boston Scientific in August forced the company’s network offline for weeks, sparking “global disruption” to its operations. Meanwhile, separate hacks throughout the year caused massive breaches of patient data at medical recordkeeping company CareCloud, Scotland-based healthtech provider Craneware, and U.S. pharmaceutical distribution giant McKesson.

The lab-testing giant has not yet said how many healthcare customers, or patients, had information stolen during the attack on its Quanum systems.

Quest’s website and materials say Quanum is used by about half a million clinicians in thousands of locations across North America. It’s unclear how many health records Quanum holds, but one 2026 case study on Quest’s website shows how a single health system with more than 6 million patients can hold hundreds of millions of related medical documents and charts.

Quest did not say when the breach began or whether any hacking group has contacted the company with demands, such as payment in exchange to not release the stolen data. Amanda Rivera, a spokesperson for Quest, did not answer TechCrunch’s questions about the incident and referred to its security notice.

In the notice, Quest said that some patients’ protected health information was taken, including “personal information and patient records,” but the company is still investigating what specific kinds of data were taken. (The website post currently contains “noindex” code, which tells search engines not to list the page in search results, making it far more difficult for people to find the page.)

This is Quest’s second known major data breach in a decade, after losing 11.9 million patient records in a cyberattack on a third-party billing company in 2019.

Do you work at Quest Diagnostics or know more about the data breach? We’d love to hear from you. You can reach this reporter on Signal at the username zackwhittaker.1337 or by email [email protected]

Updated with a response from Quest.