Quest Diagnostics Confirms Data Breach Affecting Patient Records

Patients and healthcare providers relying on the Quanum platform should now expect potential scrutiny of their personal and medical data, as Quest Diagnostics has officially confirmed a cybersecurity incident. The lab testing company disclosed in a regulatory filing that it experienced an unauthorized cyberattack affecting one of its core systems. While the exact number of individuals impacted has not yet been released, the breach involves the exposure of sensitive patient records, including personal identifiers and diagnostic information, stored within the company’s digital infrastructure.

Quest Diagnostics detailed the incident in an 8-K filing submitted to the U.S. Securities and Exchange Commission. The company stated that it became aware of the cyberattack on Wednesday, October 21, 2026. The target was the Quanum system, a critical platform used by hospitals, doctors’ offices, and other healthcare practices to request laboratory tests and process associated billing. Because this platform manages a significant volume of electronic health records, diagnostic results, and financial data, the compromise represents a significant disruption to the integrity of medical information handling.

The firm indicated that the unauthorized access involved the retrieval of specific patient records. In response to the intrusion, Quest has notified law enforcement agencies and has launched an internal investigation to determine the full scope of the data accessed. The company has not yet specified whether the breach began before the date of discovery, nor has it confirmed if a hacking group has contacted Quest with ransom demands or other conditions for the release of the stolen data.

This incident marks the latest in a series of major cyberattacks targeting the healthcare sector throughout 2026. The industry has faced persistent threats from financially motivated cybercriminals who aim to steal large datasets of sensitive medical information. These groups often threaten to publish the data if a ransom is not paid. Earlier in the year, medical technology maker Stryker suffered a mass-wiping of employee devices in March. In August, medical implant manufacturer Boston Scientific was forced to take its network offline for weeks due to a hack, causing global operational disruptions. Additionally, significant data breaches affected medical recordkeeping company CareCloud, the Scottish health tech provider Craneware, and pharmaceutical distribution giant McKesson.

Quest Diagnostics has not yet determined how many healthcare customers or patients were affected by the attack on its Quanum systems. The company’s public materials state that Quanum is utilized by approximately 500,000 clinicians across thousands of locations in North America. While the total volume of health records held by the platform is not public, a 2026 case study on the company’s website illustrates the scale of data involved, noting that a single health system with over 6 million patients can generate hundreds of millions of related medical documents and charts.

In a security notice posted to its website, Quest stated that some patients’ protected health information was taken, specifically citing "personal information and patient records." The company noted that it is still investigating the specific types of data compromised. The webpage currently contains "noindex" code, a technical instruction that prevents search engines from listing the page in results, which may make it more difficult for the public to locate the notification. Amanda Rivera, a spokesperson for Quest, referred media inquiries to this security notice rather than answering specific questions about the incident.

This is the second known major data breach for Quest Diagnostics in the last decade. The previous significant incident occurred in 2019, when 11.9 million patient records were lost following a cyberattack on a third-party billing company. As the investigation continues, Quest has not provided a timeline for when it will release further details regarding the scope of the breach or the specific data elements involved.

The company’s disclosure comes as healthcare organizations continue to grapple with the rising threat of cyberattacks. The breach highlights the vulnerability of centralized medical data platforms that serve as hubs for diagnostic and billing operations across the nation. Quest Diagnostics remains focused on investigating the incident and will provide updates as more information becomes available regarding the extent of the data compromise.