Quest Diagnostics admits to cyberattack on platform used by 500,000 clinicians

Quest Diagnostics has officially confirmed that a cyberattack compromised sensitive patient data within its systems. The company disclosed the incident in a filing with U.S. regulators, marking a significant security setback for the major medical testing provider. This latest breach adds to a growing list of high-profile attacks targeting the healthcare sector in 2026.

The company stated in an 8-K filing with the U.S. Securities and Exchange Commission that it became aware of the attack on Wednesday. The intrusion targeted Quanum, a specific lab testing system that serves as a central hub for medical practices. This platform allows doctors' offices, hospitals, and other healthcare providers to request lab tests for their patients while simultaneously managing the associated billing processes.

Quanum stores a vast amount of patient health and medical records, along with diagnostic and billing data. Quest acknowledged that unauthorized access included the viewing of certain patient records. The company has notified law enforcement and is currently conducting an internal investigation to determine the full scope of the incident.

This event is part of a broader trend of cyber incidents affecting the healthcare industry this year. A series of attacks and data breaches have caused weeks of operational disruption and led to the theft of millions of electronic health records. Health tech companies have become primary targets for financially motivated cybercriminals who aim to steal sensitive data and threaten to publish it if ransom demands are not met.

In recent months, the sector has faced multiple major threats. A cyberattack in March resulted in the mass-wiping of employee devices at medical tech maker Stryker. In August, a hack on medical implant manufacturer Boston Scientific forced the company's network offline for several weeks, causing what was described as global disruption to its operations.

Other significant breaches have also occurred throughout the year. Patient data was compromised at medical recordkeeping company CareCloud, Scotland-based health tech provider Craneware, and U.S. pharmaceutical distribution giant McKesson. These incidents highlight the persistent vulnerabilities within the complex web of healthcare data management.

Quest has not yet disclosed the exact number of healthcare customers or patients affected by the attack on its Quanum systems. The company's website indicates that Quanum is used by approximately 500,000 clinicians across thousands of locations in North America. While the total volume of records is unclear, a 2026 case study on the company's site notes that a single health system with over 6 million patients can hold hundreds of millions of related medical documents and charts.

The company has not specified when the breach began or if any hacking group has contacted it with demands for payment. Amanda Rivera, a spokesperson for Quest, did not answer detailed questions about the incident and referred to the company's security notice. That notice confirms that some patients' protected health information was taken, including personal information and patient records, though the specific types of data remain under investigation.

This is the second known major data breach for Quest in a decade. The previous incident occurred in 2019, when 11.9 million patient records were lost in a cyberattack on a third-party billing company. The current situation continues to raise concerns about the resilience of critical healthcare infrastructure against digital threats.