Quest Diagnostics Acknowledges Unauthorized Access to Patient Records

Quest Diagnostics has confirmed a cybersecurity incident involving unauthorized access to its systems, revealing in a filing with the U.S. Securities and Exchange Commission that certain patient records were compromised. The company reported detecting the activity on Wednesday targeting Quanum, a platform utilized by healthcare providers to manage patient records, lab orders, and associated billing information. While the investigation is ongoing, the company acknowledged that some protected health information was taken, including personal information and patient records.

The incident places Quest at the center of a broader wave of attacks on the healthcare sector this year, following similar disruptions that resulted in the mass-wiping of employee devices at medical technology manufacturer Stryker in March and a breach at Boston Scientific in August. Other major entities, including CareCloud, Craneware, and McKesson, have also reported significant compromises of patient data throughout 2026.

The timeline of the current event began with Quest learning of the attack on Wednesday, prompting an immediate investigation and notification to law enforcement. Following these steps, the company issued an 8-K disclosure to regulators to outline the compromise of its lab testing systems. Subsequently, the company posted a security notice stating that specific types of data taken are still under review, and it declined to elaborate further on the incident's origins or potential ransom demands.

The potential scale of the breach remains unknown, though Quanum is a widely used tool across North America. Quest materials indicate the platform is utilized by approximately 500,000 clinicians in thousands of locations, and a 2026 case study on the company's website notes that a single health system with more than 6 million patients can generate hundreds of millions of medical documents and charts. Consequently, the volume of compromised records could be substantial, even as the company has not yet specified how many healthcare customers or patients were affected.

This event marks a significant recurrence for the company, which previously lost 11.9 million patient records in 2019 following an attack on a third-party billing provider. Currently, Quest is investigating the specific kinds of data taken and whether any hacking group has contacted the organization regarding ransom payments. The company has not yet stated when the breach began.