Quest confirms Quanum platform hack
The lab testing giant filed with the SEC to report unauthorized access to patient records, leaving the scale of the breach unclear.
By Alina Carter ·
A cyberattack on a major medical lab platform has confirmed the theft of sensitive patient data, according to a new regulatory filing.
Quest Diagnostics disclosed the breach in an 8-K filed with the Securities and Exchange Commission. The company stated that it became aware of the incident on Wednesday. Attackers gained unauthorized access to Quanum, a system used by doctors, hospitals, and other healthcare practices to order lab tests and process billing. The platform stores extensive patient health records, diagnostic results, and related financial data. Quest described the compromised files as "certain patient records" in its filing.
The company has notified law enforcement and is currently investigating the scope of the intrusion. In a separate security notice on its website, Quest confirmed that protected health information, including "personal information and patient records," was taken. The firm is still determining the specific categories of data involved. That notice page currently carries "noindex" code, which prevents search engines from listing the URL and makes it harder for the public to find the details.
Quest has not provided a specific count of affected patients or healthcare customers. It also has not revealed when the breach began or whether a hacking group has contacted the company with ransom demands. Amanda Rivera, a spokesperson for the company, deferred to the security notice when asked for further comment by TechCrunch.
The potential scale of the exposure is substantial. Quest materials indicate that approximately half a million clinicians use Quanum across thousands of locations in North America. While the total number of stored records is unknown, a 2026 case study on the company's website notes that a single health system using the platform can manage hundreds of millions of medical documents for over 6 million patients.
This incident marks the second major data breach for Quest in a decade. In 2019, the company lost 11.9 million patient records following a cyberattack on a third-party billing provider. The current breach adds to a string of high-profile incidents in the healthcare sector this year. Other recent attacks included a mass wipe of employee devices at Stryker in March and a weeks-long network outage at Boston Scientific in August. Significant data breaches also occurred at CareCloud, Craneware, and McKesson earlier this year.
