Quest Diagnostics admits patient data theft from Quanum lab ordering tool

Quest Diagnostics has confirmed that hackers stole patient data from Quanum, the digital platform it uses to process lab orders and billing. The company told regulators it discovered the breach on Wednesday and determined that unauthorized actors accessed specific patient records. It has not released a precise count of affected individuals or the exact volume of data taken.

Quanum serves as a central hub for healthcare providers. Roughly half a million clinicians across thousands of North American locations use the system to request lab tests and manage insurance claims. The platform stores sensitive health information, diagnostic results, and billing details. A case study on the company’s website notes that a single health system using the tool can hold hundreds of millions of medical documents.

In an 8-K filing with the Securities and Exchange Commission, Quest stated that the unauthorized access included "certain patient records." The company said it notified law enforcement and is investigating the incident. A separate security notice on its website confirmed that protected health information was taken. The notice lists personal information and patient records among the stolen items but leaves out specific data types. The company is still determining the full scope of the theft.

Quest has not said when the breach began or if a hacking group contacted it with ransom demands. Amanda Rivera, a spokesperson for the company, did not answer direct questions about the incident. She pointed to the security notice on the website. That page currently contains "noindex" code, which prevents search engines from listing it and makes it harder for the public to find.

This incident follows a year of major cyberattacks on healthcare firms. In March, Stryker experienced an attack that wiped employee devices. In August, Boston Scientific suffered a hack that forced its network offline for weeks. Other large breaches hit CareCloud, Craneware, and McKesson earlier this year. Criminal groups often target health tech companies to steal data for ransom payments or sale on the dark web.

It is the second known major data breach for Quest in ten years. In 2019, the company lost 11.9 million patient records when a third-party billing vendor was attacked. The new incident adds to the pressure on medical firms to secure the digital infrastructure that now holds the bulk of patient histories.