Quest Diagnostics Confirms Patient Data Stolen in Hack of Lab Platform

Quest Diagnostics, one of the country's biggest medical lab testing companies, said on Wednesday that hackers broke into one of its systems and took certain patient records from it. The company disclosed the intrusion in a filing with the U.S. Securities and Exchange Commission, saying it learned of the cyberattack that day. The system involved, called Quanum, is where doctors' offices, hospitals, and other healthcare practices go to order lab tests for patients, and it also processes billing for those services. That means the platform holds a large store of patient health records along with related diagnostic and billing information.

Quest said the unauthorized access reached certain patient records. It has told law enforcement about the incident and is looking into what happened. The company has not said how many patients or healthcare customers were affected, and it has not said when the intrusion started. It also has not said whether any hacking group has reached out with demands, such as payment to keep stolen data from being published. A Quest spokesperson, Amanda Rivera, did not answer questions about the incident and pointed to the company's security notice instead.

In that notice, Quest said some patients' protected health information was taken, including personal information and patient records, though the company is still working out which specific kinds of data were involved. The notice is posted on Quest's website, though it is set up in a way that keeps search engines from listing the page, making it harder for people to find on their own.

Quest has not said how many health records Quanum holds. Its website says the platform is used by about half a million clinicians at thousands of locations across North America. A 2026 case study on Quest's own site shows how one health system with more than 6 million patients can generate hundreds of millions of medical documents and charts, which gives a sense of the volume flowing through systems like this.

The incident is the latest in a run of cyberattacks aimed at healthcare and health tech companies this year. A series of breaches has caused weeks of disruption and let attackers take millions of patient health records and other medical data. Companies in this space have become a frequent target for financially motivated attackers, who try to gather as much sensitive data as they can and threaten to publish it when they are not paid.

Earlier this year, an attack in March led to the wiping of employee devices at medical technology maker Stryker. In August, a hack at medical implant maker Boston Scientific took its network offline for weeks, which the company said caused global disruption to its operations. Separate incidents through the year led to large breaches of patient data at medical recordkeeping company CareCloud, Scotland-based health tech provider Craneware, and U.S. pharmaceutical distributor McKesson.

This is the second major breach at Quest in a decade. In 2019, a cyberattack on a third-party billing company led to the loss of 11.9 million patient records. Quest has not said whether the current incident is connected to that earlier event or to any other known case.