Healthcare Security: Quest Diagnostics Confirms Patient Data Theft

The healthcare sector continues to face relentless digital threats as another major provider falls victim to a significant security incident. On Wednesday, medical lab testing giant Quest Diagnostics confirmed that a cyberattack compromised sensitive patient information stored within its systems.

In a legally required disclosure filed with the U.S. Securities and Exchange Commission, Quest detailed the breach. The attack targeted Quanum, a critical platform used by doctors’ offices, hospitals, and healthcare practices to request lab tests and manage billing. Because this system houses extensive patient health records, diagnostic data, and billing information, the scope of the compromise is substantial. The company stated that unauthorized actors accessed certain patient records, prompting immediate notification to law enforcement and the launch of an internal investigation.

This incident marks the latest in a string of major cyberattacks affecting the healthcare industry this year. Financially motivated cybercriminals have increasingly targeted health tech companies, seeking to steal vast amounts of sensitive data to demand ransom or threaten publication if payment is not made. The frequency and severity of these attacks have caused weeks of disruption across the sector, leading to the theft of millions of electronic health records.

Recent months have seen several high-profile breaches that underscore the vulnerability of the industry. In March, a cyberattack resulted in the mass wiping of employee devices at medical technology maker Stryker. In August, a hack on medical implant manufacturer Boston Scientific forced the company’s network offline for weeks, causing global operational disruptions. Additionally, patient data was breached at medical recordkeeping firm CareCloud, Scotland-based provider Craneware, and pharmaceutical distribution giant McKesson throughout the year.

Quest has not yet disclosed the specific number of healthcare customers or patients affected by the attack on its Quanum systems. The platform is widely used, with Quest materials indicating that approximately half a million clinicians across thousands of locations in North America rely on it. While the exact volume of held records is unclear, a 2026 case study on the company’s website illustrates the potential scale, noting that a single health system with over 6 million patients can generate hundreds of millions of related medical documents and charts.

The company has not specified when the breach began or whether a hacking group has contacted Quest with demands for payment in exchange for keeping the stolen data private. Amanda Rivera, a spokesperson for Quest, directed inquiries to the company’s security notice rather than answering specific questions about the incident details directly.

According to the security notice, some patients’ protected health information was taken, specifically including personal information and patient records. Quest is still investigating the specific types of data involved. Notably, the webpage containing this notice currently includes 'noindex' code, which instructs search engines not to list the page in search results, making it significantly more difficult for the public to discover the alert.

This is the second known major data breach for Quest in the last decade. The previous incident occurred in 2019, when a cyberattack on a third-party billing company led to the loss of 11.9 million patient records. As the investigation continues, patients and healthcare providers are left waiting for further clarity on the extent of the compromise and the potential implications for their data security.

The situation remains fluid as Quest continues its forensic analysis. Until the company provides more details on the timeline and the specific data categories involved, stakeholders in the New York and New Jersey regions, along with the broader North American market, will be monitoring the situation for updates on mitigation efforts and potential notifications to affected individuals.