Quest Diagnostics admits hackers stole data from Quanum platform used by half a million clinicians
The lab testing giant filed an SEC notice confirming unauthorized access to patient records, though it has not specified how much data was taken or when the breach began.
By Fatima Laurent ·
Approximately 500,000 clinicians in North America use the Quanum platform, according to company materials. Quest Diagnostics confirmed on Thursday that hackers accessed this system, which allows doctors' offices and hospitals to order lab tests and process billing. The company stated that the attack involved the theft of certain patient records, including personal information and medical documents.
Quest became aware of the intrusion on Wednesday and subsequently filed a Form 8-K with the Securities and Exchange Commission. The filing noted that the unauthorized access included protected health information. The company said it has notified law enforcement and is currently investigating the incident. It has not yet determined which specific types of data were stolen or how many records were impacted.
The scale of the potential exposure is difficult to gauge. Quest has not disclosed the start date of the breach or whether a hacking group has contacted it with ransom demands. A spokesperson for the company, Amanda Rivera, directed media inquiries to a security notice on the company's website. That page currently contains code that prevents search engines from indexing it, making the document harder for the public to find.
The Quanum system holds a large volume of diagnostic and billing data. While the total number of records stored is unclear, a 2026 case study on Quest's website describes one health system with more than 6 million patients that can hold hundreds of millions of related medical documents. This suggests the database size could be substantial across all customers.
This incident marks the second known major data breach for Quest in a decade. In 2019, the company lost 11.9 million patient records following a cyberattack on a third-party billing provider. The current attack is part of a pattern of major cyber incidents in the healthcare sector this year. In March, Stryker experienced mass wiping of employee devices. In August, Boston Scientific's network was offline for weeks due to a hack. Other recent breaches affected CareCloud, Craneware, and McKesson.
Health tech firms remain prime targets for financially motivated criminals. These groups often steal sensitive data and threaten to publish it unless a ransom is paid. Some of these attacks have caused weeks of operational disruption and the theft of millions of electronic health records.
Source: TechCrunch
