Quest Diagnostics Confirms Theft of Patient Records From Quanum Platform

Quest Diagnostics disclosed on Thursday that hackers stole patient records from its Quanum platform. The company filed a Form 8-K with the Securities and Exchange Commission to report the breach. It said it first detected the unauthorized access on Wednesday.

Quanum serves as a central hub for ordering lab tests and processing billing for healthcare providers. Doctors' offices and hospitals across North America rely on the system to manage patient care. The platform stores sensitive health data, diagnostic results, and financial information. Quest stated that the attack targeted 'certain patient records' but did not specify how much data was taken.

In a security notice posted on its website, Quest confirmed that protected health information was removed. The company listed personal information and patient records as part of the theft. It is still determining the full scope of the stolen data. The notice page currently uses 'noindex' code, which hides it from search engine results.

The scale of the potential exposure is large. Quest materials indicate that approximately 500,000 clinicians use Quanum across thousands of locations. A 2026 case study on the company's site describes a single health system with over 6 million patients that can hold hundreds of millions of medical documents. Quest has not revealed how many specific records were compromised.

Amanda Rivera, a spokesperson for Quest, pointed to the security notice for details. She did not answer specific questions from TechCrunch regarding the incident. The company has notified law enforcement and is conducting an investigation. It has not stated whether a hacking group made contact or demanded a ransom payment.

This is the second major data breach for Quest in the last decade. In 2019, the company lost 11.9 million patient records after an attack on a third-party billing firm. The healthcare sector has faced a series of significant cyber incidents this year. Recent attacks have affected Stryker, Boston Scientific, CareCloud, Craneware, and McKesson, leading to operational disruptions and data theft.