Quest Diagnostics Confirms Hackers Stole Patient Records After a Breach of Its Quanum Lab Platform

Quest Diagnostics, one of the largest medical laboratory testing companies in the United States, has confirmed that hackers stole patients' personal and health information in a cyberattack, the latest in a string of breaches to hit the healthcare industry this year.

In a legally required filing with the US Securities and Exchange Commission, Quest disclosed a cyberattack and data breach affecting "an as-yet unspecified amount of sensitive patient information," TechCrunch reported on Friday, October 23.

The attack targeted Quanum, a lab-testing platform that allows doctors' offices, hospitals and healthcare practices to order laboratory tests and handle billing. Quest said the unauthorised access included "certain patient records."

What was taken

On its website, Quest said some patients' protected health information was taken, including "personal information and patient records." The company said it is still determining the specific kinds of data that were stolen.

Quanum stores patient health and medical records, as well as diagnostic and billing data, according to TechCrunch. Quest says the platform is used by about half a million clinicians across thousands of locations in North America, though it is unclear how many health records Quanum holds.

Quest has not said how many patients or healthcare customers were affected, or when the breach began. The company learned of the attack on a Wednesday, notified law enforcement and is investigating. It has not said whether a hacking group has made contact or demanded payment.

A Quest spokesperson did not respond to TechCrunch's request for comment. TechCrunch noted that the company's website notice about the breach contained code that prevents search engines from listing it.

A second major breach

This is Quest's second known major breach in a decade. In 2019, a cyberattack on a third-party billing company, American Medical Collection Agency, exposed 11.9 million Quest patient records, along with data from other laboratory companies. That breach led to lawsuits, regulatory scrutiny and the bankruptcy of the billing company.

The repeat incident is likely to raise questions about Quest's security practices and those of the broader healthcare industry.

Healthcare under siege

The healthcare sector has become one of the most targeted industries for cybercriminals. TechCrunch listed several other healthcare companies hit by cyber incidents in 2026, including Stryker, Boston Scientific, CareCloud, Craneware and McKesson.

Healthcare data is especially valuable to criminals. Medical records contain names, addresses, dates of birth, insurance details and sensitive health information, which can be used for identity theft, insurance fraud and extortion. Unlike a credit card number, health information cannot be changed once stolen.

Ransomware gangs frequently target healthcare organisations, knowing that disruptions to patient care create pressure to pay. The 2024 attack on Change Healthcare, a unit of UnitedHealth Group, disrupted payments and prescriptions across the United States and affected the data of about 190 million people, making it the largest healthcare data breach in US history.

The wider cyber crisis

The Quest breach comes during an extraordinarily turbulent period for cybersecurity. This week, critical vulnerabilities in the PHP programming language triggered millions of hacking attempts worldwide, forcing banks, airlines and governments to take systems offline. Microsoft said Chinese state-aligned hackers used AI agents to target about 2,250 organisations after breaching IT firm ConnectWise.

Security experts warn that AI is helping attackers find and exploit vulnerabilities faster, increasing the pressure on organisations to strengthen their defences.

Regulatory consequences

In the United States, healthcare organisations must comply with the Health Insurance Portability and Accountability Act (HIPAA), which requires them to protect patient data and notify affected individuals and regulators of breaches. Publicly traded companies must also disclose material cybersecurity incidents to the SEC, as Quest has done.

Breaches can lead to fines, lawsuits and remediation costs, as well as reputational damage that affects customer relationships.

What it means for India

India's healthcare sector is rapidly digitising, with the Ayushman Bharat Digital Mission creating digital health IDs and records for millions of citizens, and diagnostic chains, hospitals and health tech startups storing growing volumes of patient data. Indian healthcare institutions have also faced cyberattacks, including a major ransomware attack on the All India Institute of Medical Sciences in New Delhi in 2022.

India's Digital Personal Data Protection Act imposes obligations on organisations to protect personal data and report breaches, with significant penalties for failures. The Quest breach underlines the importance of securing third-party platforms and vendors, which are often the weakest link in healthcare data security.

Indian IT services companies also manage technology systems for many US healthcare organisations, giving them a direct stake in the sector's cybersecurity.

Why vendors are a weak link

Many of the largest healthcare breaches in recent years have involved third-party vendors and platforms rather than hospitals' own systems. Healthcare organisations rely on numerous technology providers for billing, scheduling, lab ordering, electronic health records and claims processing, each of which may hold sensitive patient data.

A breach at a single platform used by many healthcare providers can expose data from thousands of organisations at once. Quanum, used by about half a million clinicians, is precisely the kind of platform that can magnify the impact of an attack. Security experts recommend that healthcare organisations assess their vendors' security practices, limit data sharing to what is necessary and ensure contracts require prompt breach notification.

The business of lab testing

Quest Diagnostics and its main rival, Labcorp, dominate the US clinical laboratory market, processing millions of tests every day for doctors, hospitals and employers. Their scale makes them central to the healthcare system, and the data they hold, including test results for conditions from diabetes to cancer and infectious diseases, is among the most sensitive in healthcare.

What comes next

Quest will continue its investigation and is expected to notify affected patients once it determines the scope of the breach. Patients who have used Quest's services may receive notification letters and offers of credit monitoring.

For the healthcare industry, the breach is another reminder that protecting patient data requires constant vigilance, particularly as attackers become faster and more sophisticated. Regulators may also scrutinise how the company detected the breach and how quickly it disclosed it, as investigators work to determine the full scope of the stolen data and the identity of the attackers. Patients concerned about their data are advised to watch for official notifications and be alert to phishing attempts that exploit news of breaches.