Major lab testing firm confirms patient data theft

Healthcare data is under constant pressure from cybercriminals seeking valuable medical records. Quest Diagnostics has now confirmed that one of its core systems was breached, resulting in the loss of sensitive patient information.

The company filed a formal notice with U.S. regulators on Wednesday, October 21, 2026. This disclosure revealed that attackers gained unauthorized access to Quanum, a digital platform used by doctors and hospitals. Quanum handles the ordering of lab tests, billing, and the storage of extensive medical records. Quest stated that certain patient records were accessed during the intrusion. The company has notified law enforcement and is currently investigating the scope of the attack.

This incident adds to a growing list of major cyberattacks targeting the medical industry in 2026. Health tech firms have become primary targets for financially motivated hackers. These groups often steal large volumes of data and demand ransom payments to keep the information from being published. Recent disruptions have been severe. In March, Stryker suffered a mass-wiping of employee devices. In August, Boston Scientific’s network went offline for weeks, causing global operational issues. Other significant breaches occurred at CareCloud, Craneware, and McKesson, leading to the theft of millions of electronic health records.

Quest has not yet specified how many customers or patients were affected by the Quanum breach. The platform is used by approximately 500,000 clinicians across thousands of locations in North America. While the total number of stored records is unknown, a recent case study on the company’s website illustrates the scale of data involved. One health system with over 6 million patients can hold hundreds of millions of associated medical documents and charts. This suggests the potential volume of compromised data could be substantial.

The company has not disclosed when the breach began or if any hacking group has contacted them with demands. Quest spokesperson Amanda Rivera referred questions about the incident to the company’s security notice. This notice states that protected health information, including personal details and patient records, was taken. However, the specific types of data stolen are still under investigation. Notably, the security notice page on Quest’s website contains code that prevents search engines from indexing it. This makes it harder for the public to find the update through standard web searches.

This is the second major data breach for Quest in the last decade. In 2019, the company lost 11.9 million patient records following a cyberattack on a third-party billing provider. The current incident highlights the ongoing vulnerability of critical healthcare infrastructure to digital threats.

The next steps involve a deeper investigation to determine the full extent of the data loss. Quest will likely continue to monitor the situation and provide updates as more information becomes available. Patients and healthcare providers using the Quanum platform may need to wait for further details on which specific records were compromised.

For now, the focus remains on securing the affected systems and understanding how the breach occurred. The healthcare industry continues to grapple with the challenges of protecting sensitive data while maintaining operational efficiency.