Quest Diagnostics confirms patient data breach in Quanum cyberattack

Quest Diagnostics has confirmed that hackers accessed patients' personal and health data in a cyberattack on its Quanum lab-testing platform, according to a legally required disclosure filed with the U.S. Securities and Exchange Commission.

The company disclosed the incident in an 8-K filing, saying it learned of the attack on Wednesday. The target was Quanum, a system that lets doctors' offices, hospitals and healthcare practices request lab tests for patients and handles the billing that follows. The platform stores a large volume of patient health records, diagnostic data and associated billing information.

Quest said the unauthorized access included "certain patient records." The company has notified law enforcement and is investigating.

How big is the exposure?

Quest has not said how many patients or healthcare customers had information stolen. That gap matters, because the footprint is enormous. Quest's own website and materials say Quanum is used by about half a million clinicians across thousands of locations in North America.

It's unclear how many health records Quanum holds in total. One 2026 case study on Quest's website offers a scale hint: a single health system with more than 6 million patients can hold hundreds of millions of related medical documents and charts on the platform.

In a note on its website, Quest said some patients' protected health information was taken, including "personal information and patient records." The company said it is still investigating what specific kinds of data were compromised. Notably, the website post currently contains "noindex" code — an instruction that tells search engines not to list the page, making it far harder for people to find.

What's still unknown?

Quest has not disclosed when the breach began. It also hasn't said whether any hacking group has contacted the company with demands, such as payment in exchange for not publishing the stolen data. A Quest spokesperson did not respond to TechCrunch's request for comment on Friday.

Is this Quest's first major breach?

No. This is Quest's second known major data breach in a decade. In 2019, a cyberattack on a third-party billing company cost the lab giant 11.9 million patient records.

The current incident fits a broader pattern. Healthcare has absorbed a series of damaging cyberattacks this year, with financially motivated criminals stealing millions of patient electronic health records and threatening to publish them unless paid a ransom.

The 2025 toll so far includes:

• Stryker: a March cyberattack mass-wiped employee devices at the medical tech maker.
• Boston Scientific: an August hack forced the medical implant manufacturer's network offline for weeks, causing what the company called "global disruption" to operations.
• CareCloud: the medical recordkeeping company suffered a massive breach of patient data.
• Craneware: the Scotland-based healthtech provider was hit in a separate hack this year.
• McKesson: the U.S. pharmaceutical distribution giant also suffered a major patient data breach.

Healthtech companies have become prime targets because they concentrate exactly what criminals monetize: sensitive medical and personal data that victims will pay to keep private.

What happens next?

The investigation is ongoing, and Quest faces mounting pressure to answer the two questions that matter most: how many patients were affected and exactly what data was taken. Until those answers arrive, roughly half a million clinicians and their patients are left to weigh the risk on a platform that sits at the center of American lab testing.