Hackers accessed patient records in attack on lab ordering platform used by 500,000 clinicians

Quest Diagnostics says hackers reached patient records in an attack on Quanum, the lab ordering and billing system used by doctors' offices and hospitals to request tests for patients. The company filed an 8-K with the Securities and Exchange Commission on Wednesday saying it became aware of the attack that day and that unauthorized access included "certain patient records."

The company has not said how many patients or healthcare customers were affected, when the breach began, or whether any hacking group has made demands. A security notice on its website says some patients' protected health information was taken, including "personal information and patient records," and Quest is still determining which data types were stolen. That notice page carries "noindex" code, which keeps search engines from listing it in results.

Quest said it notified law enforcement and is investigating. Spokesperson Amanda Rivera did not answer questions about the incident and pointed to the security notice. About 500,000 clinicians use Quanum across thousands of locations in North America, according to Quest's website and materials. The system stores patient health and medical records along with diagnostic and billing data. A 2026 case study on Quest's website describes one health system with more than 6 million patients that can hold hundreds of millions of related medical documents and charts.

Healthcare has drawn repeated attacks this year. In March, an attack led to mass wiping of employee devices at medical technology maker Stryker. In August, a hack at Boston Scientific forced its network offline for weeks, causing what the company called "global disruption" to operations. Hacks this year also led to large breaches of patient data at CareCloud, Craneware and McKesson.

This is Quest's second known major data breach in a decade. In 2019, the company lost 11.9 million patient records in a cyberattack on a third-party billing company.