Quest Diagnostics reveals Quanum hack exposing data used by half a million clinicians

Doctors and hospitals using Quest Diagnostics' Quanum platform now know their lab ordering system was hacked. The company confirmed on Wednesday that unauthorized users accessed the platform, which handles test orders, billing, and medical records for healthcare providers across North America.

Quest filed a Form 8-K with the Securities and Exchange Commission to disclose the breach. The filing states that the company became aware of the attack on Wednesday. Quest described the incident as involving 'certain patient records' but did not specify exactly how many files were taken or when the intrusion began.

A security notice on Quest's website adds that protected health information was removed from the system. The company says it has alerted law enforcement and is conducting an internal investigation. Quest is still determining which specific data categories were compromised. The notice page currently uses 'noindex' code, which prevents search engines from displaying the link in results.

The exposure affects a large network of users. Quest materials state that about 500,000 clinicians use Quanum across thousands of locations. A 2026 case study on the company's website describes one health system that uses the platform to manage data for more than 6 million patients. That single system holds hundreds of millions of medical documents and charts.

Quest has not disclosed whether a hacking group made contact with the company. The company also has not said if it received a ransom demand. Amanda Rivera, a Quest spokesperson, referred questions to the security notice rather than providing further details. The company has not announced a timeline for restoring full service or notifying individual patients.

This incident follows several major cyberattacks on healthcare companies in 2026. In March, Stryker reported an attack that wiped employee devices. In August, Boston Scientific's network went offline for weeks due to a hack. Other breaches this year hit CareCloud, Craneware, and McKesson, all of which involved the theft of patient data or operational disruption.

This is the second major data breach Quest has reported in ten years. In 2019, a cyberattack on a third-party billing vendor resulted in the loss of 11.9 million patient records. Quest continues to assess the scope of the current incident and its impact on healthcare customers.