Health Data Security: Quest Diagnostics Confirms Patient Records Compromised

The healthcare industry has long been a primary target for cybercriminals, but a new incident involving one of the nation's largest lab testing companies underscores how persistent these threats remain. Quest Diagnostics has officially confirmed that a cyberattack led to the compromise of sensitive patient data stored within its digital systems.

The company revealed the details in an 8-K filing submitted to the U.S. Securities and Exchange Commission. The breach targeted a specific platform known as Quanum, which is used by doctors' offices, hospitals, and other healthcare practices to request lab tests and manage billing. This system holds a vast amount of information, including diagnostic results, medical records, and associated financial data.

Quest stated that unauthorized actors gained access to certain patient records during the attack. While the company has not yet specified exactly how many individuals are affected, it confirmed that both personal information and patient records were taken. Law enforcement has been notified, and the company is currently conducting an investigation to determine the full scope of the intrusion.

The incident follows a year filled with significant cyber disruptions in the medical tech space. In March, medical technology maker Stryker suffered a mass-wiping of employee devices, while Boston Scientific faced a hack in August that forced its network offline for weeks. Additionally, major data breaches occurred at medical recordkeeping firm CareCloud, health tech provider Craneware, and pharmaceutical distributor McKesson. These events highlight a growing trend where financially motivated attackers steal data and threaten to publish it if ransom demands are not met.

Quanum is a widely used tool, with Quest’s materials indicating that approximately half a million clinicians in thousands of locations across North America rely on the platform. Although the exact number of health records held by Quanum is not public, a 2026 case study on Quest’s website suggests that a single health system with over six million patients can contain hundreds of millions of medical documents. This scale implies that the potential impact of the breach could be substantial.

Quest has not disclosed when the breach began or if any hacking group has contacted them with ransom demands. Amanda Rivera, a spokesperson for the company, referred reporters to a security notice posted on their website. That notice confirms that protected health information was accessed but notes that the investigation into the specific types of data taken is still ongoing.

Notably, the web page containing the security notice currently includes "noindex" code, which instructs search engines to exclude the page from search results. This technical choice makes it significantly harder for affected patients and the public to find the information through standard online searches. This is Quest’s second major data breach in the last decade, following a 2019 incident where a cyberattack on a third-party billing company led to the loss of 11.9 million patient records.