Quest Diagnostics Confirms Data Breach Affecting Core Lab Testing Platform

Quest Diagnostics has officially confirmed that a cyberattack compromised sensitive patient data stored within its primary lab testing infrastructure. The disclosure, filed with U.S. regulators, marks the latest significant security incident to impact the medical industry this year.

According to an 8-K filing submitted to the Securities and Exchange Commission, the company identified the breach on Wednesday. The attack targeted Quanum, a critical platform used by hospitals, doctor’s offices, and other healthcare practices to request lab tests and process billing. This system houses extensive patient medical records, diagnostic information, and associated billing data. Quest stated that unauthorized actors gained access to certain patient records and that the company has notified law enforcement to assist in the ongoing investigation.

This incident adds to a string of disruptive cyber events affecting health technology firms in 2026. Cybercriminals, often motivated by financial gain, have increasingly targeted the sector to steal large volumes of sensitive data, frequently threatening to publish the information if ransom demands are not met. Earlier this year, medical technology maker Stryker experienced the mass wiping of employee devices in March, while medical implant manufacturer Boston Scientific saw its network taken offline for weeks in August, causing global operational disruptions. Additionally, major data breaches affected medical recordkeeping firm CareCloud, health tech provider Craneware, and pharmaceutical distributor McKesson over the past several months.

Quest has not yet specified the number of affected patients or healthcare customers. However, the company’s public materials indicate that Quanum is utilized by approximately 500,000 clinicians across thousands of North American locations. While the total volume of held records is not public, a 2026 case study on the company’s website illustrates that a single health system with over six million patients can contain hundreds of millions of related medical documents and charts.

The company has not revealed when the breach began or if a specific hacking group has made contact with ransom demands. In a security notice posted on its website, Quest acknowledged that protected health information, including personal details and patient records, was taken. The firm is still determining the specific types of data involved. Notably, the webpage containing this notice includes 'noindex' code, a technical setting that prevents search engines from listing the page, which may make it harder for the public to discover the announcement.

This is the second major data breach for Quest in the last decade. In 2019, the company lost approximately 11.9 million patient records following a cyberattack on a third-party billing vendor. A company spokesperson, Amanda Rivera, directed inquiries regarding the current incident to the firm’s security notice without providing further immediate details.