Healthcare Data: Quest Confirms Patient Breach
Quest Diagnostics disclosed that a cyberattack on its Quanum platform exposed sensitive patient and billing records, marking its second major security incident in ten years.
By Ken Adams ·
The healthcare sector continues to face persistent digital threats, with recent incidents disrupting major medical providers across the region. Quest Diagnostics, a leading medical laboratory testing company, has officially confirmed that a cyberattack compromised patient data within its systems. This confirmation was made through a legally required disclosure filed with U.S. regulators on Thursday.
The company reported that the breach targeted its Quanum platform, a system used by doctors' offices, hospitals, and other practices to order lab tests and manage billing. Quest stated that unauthorized access occurred on Wednesday, allowing attackers to reach certain patient records. The platform holds extensive health and medical records, as well as associated diagnostic and billing information. The firm has notified law enforcement and is currently conducting an investigation into the scope of the intrusion.
This incident adds to a growing list of significant cyberattacks affecting the healthcare industry this year. Financially motivated cybercriminals have increasingly targeted health technology firms, often stealing large volumes of sensitive data and threatening to publish it if ransoms are not paid. Recent examples include a March attack on Stryker that wiped employee devices and an August hack on Boston Scientific that took its network offline for weeks, causing global operational disruptions. Additionally, major data breaches occurred at CareCloud, Craneware, and McKesson earlier in the year.
Quest has not yet specified exactly how many healthcare customers or patients were affected by the attack on its Quanum systems. The company's materials indicate that Quanum is utilized by approximately half a million clinicians in thousands of locations across North America. While the total number of records held is unclear, a 2026 case study on the company's website suggests that a single health system with over six million patients can hold hundreds of millions of medical documents and charts.
Several questions remain unanswered regarding the specific details of the breach. Quest did not disclose when the intrusion began or if any hacking group has contacted the company with ransom demands. Amanda Rivera, a spokesperson for the firm, directed inquiries to the company's security notice rather than answering specific questions directly. That notice confirms that protected health information, including personal data and patient records, was taken, but it is still under investigation.
Notably, the company's website post containing the security notice includes noindex code, which instructs search engines to exclude the page from results. This technical choice makes the page more difficult for the public to find. This is the second known major data breach for Quest in the last decade, following a 2019 incident where 11.9 million patient records were lost due to a cyberattack on a third-party billing company.
Source: TechCrunch
