Quest Diagnostics Files 8-K Admitting Hackers Stole Data From Quanum

Quest Diagnostics, a leading provider of medical testing services, has formally acknowledged a cyberattack on its Quanum platform. The company filed a mandatory disclosure with U.S. regulators confirming that unauthorized actors accessed sensitive patient information.

In the 8-K filing submitted to the Securities and Exchange Commission, Quest stated it learned of the intrusion on Wednesday. The attack targeted Quanum, a digital system used by doctors' offices, hospitals, and other healthcare practices to order tests and process billing. The platform stores extensive patient health records, diagnostic results, and financial data.

The company described the unauthorized access as involving specific patient records. Quest noted that it has alerted law enforcement and is currently investigating the incident. In a separate security notice, the firm confirmed that protected health information was taken. This includes personal details and medical records, though Quest is still determining the exact data categories involved.

The security notice page on Quest's website currently includes noindex code. This technical instruction tells search engines to exclude the page from results, making it difficult for patients and providers to locate the notice through standard web searches. Amanda Rivera, a Quest spokesperson, directed inquiries to the notice rather than answering direct questions from TechCrunch.

Quest has not disclosed the number of affected patients or healthcare customers. The company also has not revealed when the breach began or if a hacking group has contacted it regarding ransom demands. The scale of potential exposure is substantial because approximately 500,000 clinicians use Quanum across thousands of North American locations. A 2026 case study on the company's website notes that a single large health system can hold hundreds of millions of medical documents through the platform.

This incident continues a pattern of major cyberattacks in the healthcare sector this year. Criminals have targeted health technology firms to steal sensitive data for ransom. Previous incidents included the wiping of employee devices at Stryker in March and a weeks long outage at Boston Scientific in August. Breaches also occurred at CareCloud, Craneware, and McKesson.

This is the second major data breach known to Quest in the last decade. In 2019, the company lost 11.9 million patient records following a cyberattack on a third party billing company.