Quest's Quanum breach exposes half a million clinicians
The lab testing giant filed an SEC disclosure stating hackers accessed records on its Quanum platform.
By Thiago Kovalenko ·
Quest Diagnostics filed a mandatory Securities and Exchange Commission disclosure on Thursday confirming that unauthorized actors accessed patient information on its Quanum lab ordering system. The company stated it learned of the intrusion on Wednesday but did not specify the volume of data compromised or the duration of the breach.
Quanum serves as the primary interface for doctors' offices, hospitals, and other practices to order lab tests and process billing in North America. The platform stores diagnostic results, medical records, and associated financial data. Quest described the unauthorized access as including certain patient records, though it is still determining the specific categories of information taken.
In a security notice posted to its website, the company acknowledged that protected health information was stolen. This included personal details and clinical files. The notice page currently contains noindex code, a technical setting that instructs search engines to exclude the page from results. This makes the information difficult for affected individuals to locate without a direct link.
The scale of the potential exposure is substantial. Quest materials indicate that approximately half a million clinicians use Quanum across thousands of locations. A case study on the company's website from 2026 describes a single health system using the platform that manages more than 6 million patients and holds hundreds of millions of medical documents.
Amanda Rivera, a Quest spokesperson, declined to answer specific questions from TechCrunch regarding the incident. She directed reporters to the security notice instead. Quest has not stated whether a hacking group has made contact with demands for a ransom payment or a deadline for the return of data.
This incident follows a series of major cyberattacks in the healthcare sector this year. In March, Stryker suffered an attack that wiped employee devices. In August, Boston Scientific took its network offline for weeks due to a hack. Breaches also affected CareCloud, Craneware, and McKesson earlier in the year. Quest's last major known data breach occurred in 2019, when 11.9 million patient records were lost through a third-party billing company.
The company said it has notified law enforcement and is continuing its investigation. It has not yet announced a timeline for notifying affected patients or healthcare customers directly.
