Quest Discloses Breach Impacting 500,000 Clinicians' Systems
The lab giant confirmed unauthorized access to its Quanum platform, affecting patient records and medical data.
By Jacob Leary ·
Quest Diagnostics disclosed a cyberattack on Wednesday that compromised personal and medical information for an unspecified number of patients. The company filed an 8-K document with the Securities and Exchange Commission to announce that a laboratory testing system was targeted by unauthorized access.
The incident centers on Quanum, a platform used by approximately 500,000 clinicians across thousands of locations in North America. This software facilitates the ordering of lab tests by medical offices and hospitals while also managing billing operations. The company stated that the intrusion allowed access to specific patient records within the system.
Quest stated that it has notified law enforcement regarding the incident and is conducting an investigation. While the company confirmed that protected health information was taken, including personal details and patient records, the specific categories of data involved remain under review. The organization has not clarified when the breach started.
The attack also raises questions regarding potential extortion attempts. Quest has not stated whether any hacking group has contacted the organization to demand payment to prevent the release of stolen data. A spokesperson for the company declined to comment on specific inquiries and pointed instead to a security notice posted online.
This notice acknowledges that some patients' protected health information was accessed. However, the web page hosting this notice includes code that prevents search engines from listing it, complicating efforts for individuals to locate the information independently.
The incident marks a significant cybersecurity event for the healthcare sector this year, which has experienced a series of attacks causing widespread disruption. These breaches have enabled the theft of millions of electronic health records and medical information. Cybercriminals frequently target health technology firms to extract sensitive data for ransom.
Other organizations in the sector have also faced similar threats recently. In March, medical technology manufacturer Stryker experienced a mass wipe of employee devices. In August, an incident forced medical implant manufacturer Boston Scientific offline for weeks, causing global disruption. Throughout the year, separate breaches occurred at CareCloud, Craneware, and McKesson.
For Quest, this represents the second major data breach in the last decade. In 2019, the company lost 11.9 million patient records following a cyberattack involving a third-party billing provider. The current investigation into the Quanum breach continues to determine the full scope of the data compromised.
The company has not yet specified how many healthcare customers or patients were affected by the incident. It remains unclear how many health records the platform holds, though a 2026 case study on Quest's website indicates that one health system with more than 6 million patients can generate hundreds of millions of related medical documents.
Source: TechCrunch
