Quest Diagnostics Files SEC Notice After Hackers Access Quanum Patient Records
The lab testing company confirmed unauthorized access to its ordering platform, which serves approximately 500,000 clinicians in North America.
By Elijah Fitzgerald ·
Major medical testing firm Quest Diagnostics confirmed a cyberattack on its Quanum platform after discovering unauthorized access on Wednesday. The company filed a mandatory 8-K disclosure with the Securities and Exchange Commission to report the incident to U.S. regulators.
Quanum serves as the primary interface for doctors' offices, hospitals, and other healthcare practices to order lab tests and process billing. The system stores extensive patient health records, diagnostic data, and related financial information. Quest stated in its filing that the breach involved the access of certain patient records.
In a separate security notice, the company acknowledged that some protected health information was taken. This data includes personal information and patient records. Quest is currently determining the specific types of data stolen. The company has notified law enforcement and is conducting an internal investigation into the incident.
Quest has not yet disclosed the total number of affected patients or healthcare customers. The company also did not specify when the breach began or if a hacking group has made ransom demands. Amanda Rivera, a spokesperson for Quest, directed questions to the security notice on the company's website. That page currently contains noindex code, which prevents search engines from listing the notice in results.
The potential scale of the exposure is large. Quest materials indicate that approximately 500,000 clinicians use Quanum across thousands of locations in North America. A 2026 case study on the company's website describes a single health system with over 6 million patients that can store hundreds of millions of medical documents and charts on the platform.
This incident follows a series of major cyberattacks in the healthcare sector this year. In March, an attack caused the mass wiping of employee devices at medical technology maker Stryker. In August, a hack at Boston Scientific forced its network offline for weeks, causing global disruption to operations. Separate breaches this year also affected CareCloud, Craneware, and McKesson.
This is Quest's second known major data breach in the last decade. In 2019, the company lost 11.9 million patient records following a cyberattack on a third-party billing company.
