Quest Diagnostics Quanum Breach Exposes Patient Health Data
Quest Diagnostics says attackers accessed Quanum patient records, but the scope, stolen data types, breach timing and any ransom demand remain unknown.
Summary
Quest Diagnostics disclosed in an October 23, 2026 SEC 8-K filing that it learned Wednesday of a cyberattack targeting Quanum. The lab testing system lets doctors’ offices, hospitals and healthcare practices request tests and manage billing, while storing health, medical, diagnostic and billing data. Unauthorized users accessed certain patient records, and Quest confirmed protected health information, personal information and patient records were taken.
Quest has not identified the affected patient or healthcare customer count, exact data types, attack start date or any hacker contact or payment demand. It notified law enforcement and is investigating. Spokesperson Amanda Rivera referred inquiries to a security notice carrying noindex code that prevents search engines from listing it. Quanum serves about 500,000 clinicians at thousands of North American locations. Its total record count is unknown, but a 2026 Quest case study says one health system with more than 6 million patients can hold hundreds of millions of documents and charts.
This is Quest’s second known major breach in a decade, following the theft of 11.9 million patient records through a third party billing company in 2019. Other 2026 healthcare attacks wiped Stryker employee devices in March, forced Boston Scientific’s network offline for weeks in August and caused global disruption, while CareCloud, Scotland based Craneware and McKesson suffered major patient data breaches.
Positives
- Quest notified law enforcement after discovering unauthorized access to its Quanum system.
- Quest disclosed the cyberattack through a legally required SEC 8-K filing dated October 23, 2026.
- Quest is investigating which records and categories of protected health information were taken.
Risks & concerns
- Protected health information, personal information and patient records were taken from Quest’s Quanum system.
- Quest has not disclosed how many patients or healthcare customers were affected.
- The attack’s start date, exact stolen data types and any ransom demand remain unknown.
- Quanum serves about 500,000 clinicians across thousands of North American locations, creating potentially broad exposure.
- Quest’s security notice contains noindex code that makes it difficult to find through search engines.
- The incident follows Quest’s 2019 breach involving 11.9 million patient records held by a third party billing company.