Quantum Breach: Quest Diagnostics Files SEC Notice

Quest Diagnostics filed a mandatory disclosure with the Securities and Exchange Commission on Thursday, confirming that unauthorized parties accessed its Quanum lab ordering platform. The filing states the company became aware of the incident on Wednesday. The 8-K form notes that the breach involved certain patient records, though the company did not specify the volume of data compromised.

Quanum serves as a central hub for healthcare providers, including doctors' offices and hospitals, to order tests and process billing. The system stores extensive health records and diagnostic data. Quest’s security notice indicates that protected health information was taken, encompassing personal details and medical records. The company is currently determining the specific types of data stolen. A spokesperson for Quest, Amanda Rivera, directed inquiries to the security notice rather than answering direct questions about the scope of the leak.

The scale of potential exposure is large. Quest materials state that roughly 500,000 clinicians use the platform across thousands of locations in North America. While the total number of stored records is not public, a 2026 case study on the company’s website describes a single health system with over 6 million patients. That system alone can hold hundreds of millions of medical documents and charts. Quest has not disclosed when the breach began or if a hacking group has issued ransom demands.

The company’s website currently hosts a security notice page with "noindex" code, a technical setting that instructs search engines to exclude the page from results. This makes the information harder for the general public to find. Quest has notified law enforcement and is investigating the incident. The firm did not reveal how many healthcare customers or patients are affected.

This event adds to a series of major cyber incidents targeting the healthcare sector in 2026. Financially motivated criminals frequently attack health tech firms to steal sensitive data for ransom. In March, an attack caused Stryker to wipe employee devices. In August, a hack at Boston Scientific forced its network offline for weeks, causing global disruption. Other breaches this year hit CareCloud, Craneware, and McKesson, resulting in the theft of millions of patient records.

This is the second known major data breach for Quest in ten years. In 2019, a cyberattack on a third-party billing company resulted in the loss of 11.9 million patient records. The company has not said if the current incident will affect its financial results or operations beyond the immediate investigation.