Quest Diagnostics Confirms Major Cyberattack on Core Patient System

Quest Diagnostics has officially confirmed that a cyberattack compromised the personal and health data of its patients. The company disclosed the incident in a regulatory filing, acknowledging that hackers gained unauthorized access to one of its primary systems. This platform handles critical operations for the medical industry, including test requests and billing for doctors and hospitals.

The breach targeted a specific system known as Quanum. This software serves as a central hub for healthcare providers to manage lab tests and financial transactions. It stores vast amounts of sensitive information, ranging from detailed medical records to diagnostic results and billing history. Quest stated in its filing that the attackers accessed certain patient records. The company has already notified law enforcement and is currently conducting a full investigation into the scope of the intrusion.

This event adds to a growing list of significant cyber incidents hitting the healthcare sector this year. Attackers have frequently targeted health tech firms because they hold valuable data that can be sold or used for leverage. Recent disruptions in the industry have caused weeks of operational chaos. For instance, a March attack on Stryker wiped employee devices, while an August hack on Boston Scientific took its network offline for an extended period, causing global supply issues. Other major breaches affected CareCloud, Craneware, and McKesson throughout the year.

Quest has not yet specified exactly how many patients or healthcare customers were affected by the breach. The company’s public materials indicate that Quanum is used by approximately half a million clinicians across thousands of locations in North America. While the total number of stored records is not public, a recent case study suggests that a single large health system using the platform could hold hundreds of millions of medical documents. This highlights the potentially massive scale of the data at risk.

A spokesperson for Quest, Amanda Rivera, referred to the company’s security notice for details. That notice confirms that protected health information, including personal data, was taken. However, the company is still determining the specific types of data involved. The security page on their website currently includes code that prevents search engines from indexing it, making it harder for the public to find. Quest has not said when the breach began or if the attackers have contacted them with ransom demands.

This is the second major data breach for Quest in the last ten years. The previous incident occurred in 2019 when a third-party billing company was hacked, resulting in the exposure of 11.9 million patient records. The company is continuing its investigation and has not provided a timeline for when it will share more information with the public.

The next steps for Quest involve completing its internal review and determining the full extent of the data loss. As the investigation continues, patients and healthcare providers who rely on the Quanum platform will likely await further announcements regarding which specific records were accessed and what measures are being taken to secure the system against future threats.