Quest Discloses Unauthorized Patient Data Access

A major medical laboratory network has confirmed a security breach affecting patient information.

Quest Diagnostics disclosed in a filing with the U.S. Securities and Exchange Commission that it detected a cyberattack on Wednesday. The intrusion specifically targeted Quanum, a platform utilized by hospitals and physicians to facilitate the ordering and billing of diagnostic tests. The company reported that unauthorized parties gained access to certain patient records, prompting an immediate notification to law enforcement and the launch of an internal investigation.

Quanum serves as a central hub for processing medical records, diagnostic results, and associated billing data. Public materials indicate the system supports approximately 500,000 clinicians across thousands of North American locations. The scale of potential exposure is significant; a 2026 case study available on Quest's site notes that a single health system containing over 6 million patients can generate hundreds of millions of related documents, though Quest has not yet specified how many records were actually compromised in this instance.

The company's public security notice confirms that protected health information was taken, including personal details and patient records. However, the specific categories of data accessed remain under review. Questions regarding the start date of the breach or potential ransom demands were not addressed by a Quest spokesperson, who referred inquiries to the posted security notice.

The notice itself is currently tagged with 'noindex' code, a setting that instructs search engines not to list the page in search results. This technical detail could significantly hinder patients attempting to locate information regarding their own data through standard online searches.

This incident adds to a series of high-profile cybersecurity failures within the healthcare sector throughout 2026. Earlier this year, a mass-wiping event affected employee devices at Stryker, while an August intrusion forced Boston Scientific to take its network offline for weeks, disrupting operations globally. Additional breaches have occurred at CareCloud, Craneware, and McKesson, indicating a persistent targeting of health tech and medical records infrastructure.

Financially motivated actors frequently target these entities to harvest sensitive data and threaten its publication in exchange for payment. Quest, however, has not confirmed if any group has made contact regarding ransom or if they intend to pay.

This event marks the second significant breach for Quest Diagnostics in the last decade. In 2019, a cyberattack on a third-party billing vendor resulted in the loss of 11.9 million patient records. The current investigation into the Quanum intrusion is ongoing.