Quest Diagnostics files 8-K admitting theft of patient data from Quanum

Quest Diagnostics confirmed on Thursday that a cyberattack compromised its Quanum lab ordering platform. The company disclosed the incident in a mandatory 8-K filing with the Securities and Exchange Commission. The filing states that Quest became aware of the unauthorized access on Wednesday. The platform is used by doctors, hospitals, and other healthcare practices to order tests and process billing. It stores patient health records, diagnostic data, and financial information.

The 8-K filing uses the phrase "certain patient records" to describe the scope of the theft. Quest has not released a specific count of affected patients or healthcare customers. The company stated that it notified law enforcement and is currently investigating the event. In a separate security notice, Quest acknowledged that protected health information was taken. That notice lists "personal information and patient records" among the stolen data. The company is still determining which specific data types were removed.

The security notice is hosted on Quest’s website with "noindex" code applied. This technical setting instructs search engines to exclude the page from results. This makes the page difficult for the public to find through standard search tools. Amanda Rivera, a Quest spokesperson, did not answer specific questions from TechCrunch. She directed the outlet to the security notice page.

Quest has not stated when the breach began or if any hacking group contacted the company. The filing does not mention a ransom demand. The potential scale of the exposure is large because Quanum serves about half a million clinicians in North America. A 2026 case study on Quest’s website describes one health system using the platform. That single system holds more than 6 million patients and hundreds of millions of medical documents.

This breach follows a series of major cyber incidents in the healthcare sector this year. In March, Stryker reported an attack that wiped employee devices. In August, Boston Scientific’s network was offline for weeks due to a hack. Other breaches this year affected CareCloud, Craneware, and McKesson. These incidents often involve financially motivated criminals who steal data and threaten publication unless paid.

Quest has suffered a second major data breach in ten years. In 2019, a cyberattack on a third-party billing company resulted in the loss of 11.9 million patient records. The company has not scheduled a press conference to discuss the new incident further. The 8-K filing serves as the official record of the breach for investors and regulators.

Quest’s website currently displays the security notice on its main portal. The notice does not provide a timeline for when patients will receive individual notifications. The company continues to investigate the root cause of the intrusion. No further details have been released as of the filing date.