Quest Diagnostics Discloses Security Breach Involving Patient Records

Quest Diagnostics, a major provider of medical laboratory testing, has confirmed a cyberattack that resulted in the unauthorized access of patient data. The company disclosed the security incident in a filing with the U.S. Securities and Exchange Commission, stating that certain patient records were compromised. While the specific volume of data affected remains unspecified, the organization acknowledged that protected health information was taken during the intrusion.

The attack targeted Quanum, a platform utilized by healthcare providers to facilitate laboratory testing requests and billing operations. This system stores extensive medical records, diagnostic data, and billing information associated with patients. Quest Diagnostics reported that the unauthorized access was detected on Wednesday, October 21, 2026. Following the discovery, the company initiated an investigation into the breach and notified law enforcement authorities regarding the incident.

In a security notice issued by the company, Quest confirmed that the compromised data included personal information and patient records. However, the specific categories of data accessed are still being determined as part of the ongoing investigation. The organization has not disclosed whether any hacking group has made contact or issued demands for ransom payment to prevent the release of the stolen information. Additionally, details regarding the start date of the breach have not been provided.

Quest Diagnostics has not yet quantified how many patients or healthcare customers were impacted by the event. The Quanum platform is reported to be utilized by approximately half a million clinicians across thousands of locations throughout North America. The potential scale of the compromise is significant, as data stored within such systems can be extensive; a single health system with more than six million patients can generate hundreds of millions of medical documents.

This incident marks the second major breach of patient data involving Quest Diagnostics in the past decade. In 2019, the company experienced a cyberattack on a third-party billing vendor that resulted in the loss of 11.9 million patient records. The current event is part of a broader trend affecting the healthcare sector this year, which has seen multiple organizations, including Stryker, Boston Scientific, CareCloud, Craneware, and McKesson, targeted by cybercriminals seeking to steal sensitive data.

Quest Diagnostics is proceeding with its investigation into the security compromise. The company has declined to comment further on the specific circumstances of the incident, referring inquiries to its published security notice.