Quest Diagnostics: SEC filing reveals hackers stole patient records from Quanum

Approximately 500,000 clinicians rely on Quest Diagnostics' Quanum platform to order lab tests and manage billing, but a new Securities and Exchange Commission filing confirms that hackers stole patient records from the system. The company disclosed the breach in an 8-K filing, stating it became aware of the attack on Wednesday. Quest did not specify how much data was compromised or how many patients were affected in its initial disclosure to regulators.

Quanum serves as a central hub for doctors' offices, hospitals, and other healthcare practices across North America. It stores a large volume of sensitive information, including patient health records, diagnostic data, and billing details. In a separate security notice, Quest stated that unauthorized access included "certain patient records" and that some patients' protected health information was taken. The company is currently determining the specific types of data stolen.

The breach adds to a series of major cyber incidents targeting the healthcare sector in 2026. Health tech firms have become frequent targets for financially motivated criminals who seek to steal sensitive data and threaten to publish it unless a ransom is paid. This year's attacks have caused weeks of operational disruption and the theft of millions of electronic health records. In March, Stryker experienced a mass wiping of employee devices. In August, a hack at Boston Scientific forced its network offline for weeks, causing what the company described as global disruption to operations.

Other major breaches this year involved medical recordkeeping company CareCloud, Scotland-based provider Craneware, and U.S. pharmaceutical distributor McKesson. Quest's current incident marks the second known major data breach the company has suffered in a decade. In 2019, Quest lost 11.9 million patient records in a cyberattack on a third-party billing company.

Quest has notified law enforcement and is investigating the incident. The company has not disclosed when the breach began or whether a hacking group has contacted it with ransom demands. Amanda Rivera, a Quest spokesperson, pointed reporters to the company's security notice rather than answering direct questions. That notice page currently contains "noindex" code, which instructs search engines not to list the page, making it harder for the public to find details about the breach.

The scale of the potential exposure remains unclear because Quest has not released the number of healthcare customers or patients involved. However, the company's own materials describe the platform's reach. A 2026 case study on Quest's website notes that a single health system using the platform serves more than 6 million patients and holds hundreds of millions of related medical documents and charts.