Quest admits Quanum patient data theft

Quest Diagnostics filed a mandatory disclosure with the Securities and Exchange Commission on Wednesday to confirm a cyberattack on its Quanum lab ordering platform. The company stated that unauthorized users accessed certain patient records during the incident. Quest did not specify the volume of data involved in its initial filing.

Quanum serves as a central tool for hospitals, doctors' offices, and other healthcare practices in North America. Clinicians use the system to order lab tests and process billing for their patients. The platform stores a large volume of diagnostic information, medical charts, and financial data related to those tests.

A security notice on Quest's website confirmed that protected health information was taken. The notice listed personal information and patient records among the stolen data. Quest is still determining the specific types of records accessed. The company has not yet published a final inventory of the compromised files.

The notice page on Quest's website contains code that tells search engines to ignore the page. This technical setting makes the notice difficult for the public to find via standard web searches. Quest spokesperson Amanda Rivera declined to answer specific questions about the breach and directed inquirers to the online notice instead.

Quest has not disclosed the number of patients or healthcare customers affected by the attack. The company also did not state when the unauthorized access began or if any hacking group contacted it with ransom demands. No specific timeline for the breach was included in the SEC filing or the security notice.

Approximately half a million clinicians use Quanum across thousands of locations in North America. A 2026 case study on the company's website describes one health system using the platform that holds more than 6 million patients. That single system contains hundreds of millions of medical documents and charts.

This is Quest's second major data breach in a decade. In 2019, the company lost 11.9 million patient records after a cyberattack on a third-party billing company. The current incident follows a series of major cyberattacks on the healthcare sector earlier this year. These events included network outages at Stryker and Boston Scientific and data thefts at CareCloud, Craneware, and McKesson.