The Quest Diagnostics data breach has exposed sensitive patient information after unauthorized access to the company’s Quanum laboratory system. The medical testing giant discovered the incident on Oct. 21, 2026, but has not determined how many patients were affected.
In an SEC filing Thursday, Quest said an unauthorized party apparently accessed certain patient records. The company notified federal law enforcement and brought in cybersecurity specialists to investigate. It said the incident had not materially disrupted its operations or ability to serve patients.
Quest Diagnostics Data Breach Affects Quanum System
Quanum Lab Services Manager lets doctors, hospitals, and healthcare practices order laboratory tests and access patient results. The platform handles sensitive medical and diagnostic information, making the unauthorized access particularly concerning.
In its official security notice, Quest confirmed that protected health information and personally identifiable information were involved. However, investigators have not established which specific records were compromised or how many people were affected.
Quest temporarily suspended access to Quanum LSM and several other systems as a precaution. The company said it had not identified unauthorized access in those other systems. According to its archived incident update, healthcare providers could continue using unaffected electronic medical record connections and alternative ordering methods.
The potential scale remains uncertain. Quest says its Quanum services support approximately 500,000 clinicians across North America. A separate 2026 case study describes a health system managing records for more than 6 million patients. That study concerns a different Quanum product and does not establish the breach’s scope.
Quest has not disclosed when the intrusion began or identified the attackers. It also remains unclear whether the incident involved ransomware, stolen-data extortion or demands for payment.
Healthcare Cyberattacks Continue Across the US
The incident follows several major cyberattacks affecting healthcare companies in 2026. In March, medical technology manufacturer Stryker suffered a destructive attack that disrupted operations and wiped data from employee devices.
Boston Scientific experienced a separate cyberattack in August that disrupted its global network. Other breaches affected healthcare technology provider Craneware and pharmaceutical distributor McKesson.
Medical software companies have also exposed patient information. An earlier CareCloud data breach compromised personal and medical information belonging to more than 3.75 million people.
Healthcare systems are attractive targets because they store medical histories, personal identifiers and financial information. Criminal groups can exploit stolen records for fraud or extortion, although Quest has not established a motive for this incident.
Quest Faced Another Major Patient Data Breach in 2019
The latest attack is not Quest’s first major security incident. In 2019, a breach involving third-party billing provider American Medical Collection Agency compromised information associated with approximately 11.9 million Quest patients.
That incident exposed personal, financial and medical information through an outside billing system. The current investigation instead concerns unauthorized access to Quest’s Quanum laboratory platform.
Quest says it is working to identify affected patients and determine which information was accessed. The company plans to issue notifications as required by law, but the full extent of the breach remains unknown.
