- Quest Diagnostics told U.S. regulators that attackers accessed patient records in Quanum, its system for ordering lab tests and handling billing. The scale is not yet known.
- Quanum is a shared platform. Quest says about half a million clinicians use it, so one intrusion can matter to many organizations at once.
- Organizations that send patients or staff to labs should ask which vendors hold their data, what the contract says about notice, and who watches vendor disclosures.
What Quest has said so far
The trigger was a Wednesday discovery. Quest's 8-K filing with the U.S. Securities and Exchange Commission says that is when it learned of an attack on Quanum. Clinicians use the system to order lab tests and handle billing. TechCrunch reports that it also holds the patient files, test results and bills that go with those orders.
Quest said the unauthorized access included "certain patient records." It has notified law enforcement and is investigating. Its security notice says some patients' protected health information was taken, including "personal information and patient records." The company is still working out which kinds of data.
TechCrunch reports that Quest has not said how many patients or healthcare customers are affected. It also has not said when the breach began, or whether any group has demanded payment. A Quest spokesperson did not answer TechCrunch's questions and pointed to the notice.
The real issue is where the data pools
The record count is the obvious question, but it is not yet known. A better question is why one platform holds so much in the first place.
Quest's website and materials say about half a million clinicians use Quanum. That makes it a shared platform, not one clinic's filing cabinet. This is the publication's view: a platform with that many users concentrates risk in a way that no single customer can see or control.
A clinic can lock its own filing room. If a shared archive is broken into, a clinic could still be affected through no fault of its own. Quest has not said whether any particular customer's data was taken.
What Quanum holds, as far as we know
TechCrunch cites Quest's website for the reach: thousands of locations across North America. In TechCrunch's description, Quanum keeps a large volume of patients' medical files, plus the test and payment details tied to them.
TechCrunch says it is unclear how many records Quanum holds. It points to a 2026 case study on Quest's own site for a sense of scale. The study's example is a single health system with over 6 million patients. Its stored documents and charts run to hundreds of millions. That is one customer's footprint. It is not an estimate of what was taken.
The sources do not say how the attackers got in. Until Quest explains, no one outside the company can say which weakness was used or whether other customers' systems were exposed.
A notice that is hard to find
TechCrunch reports that Quest's security notice carries a "noindex" tag. This is an instruction asking search engines to leave the page out of their results. Anyone searching for the notice is less likely to land on it. The sources do not say why the tag is there.
Whatever the cause, the effect is plain. Patients and customers looking for answers may not find them. A disclosure that is hard to find does only part of its job.
The wider picture in healthcare
TechCrunch calls this Quest's second known major breach in a decade. In 2019, attackers hit a third-party billing company, and 11.9 million Quest patient records were lost. This time the target was Quest's own Quanum system.
TechCrunch also lists other health-sector incidents this year. A cyberattack wiped employee devices at Stryker in March. A hack in August forced Boston Scientific's network offline for weeks. Separate hacks caused large patient-data breaches at CareCloud, Craneware and McKesson. These are different companies and different attacks. TechCrunch describes a pattern: financially motivated criminals target health tech firms, take as much sensitive data as they can, and threaten to release it unless they are paid.
Questions to put to your team
If your organization orders lab work through Quanum or a similar platform, start with four questions.
First, what patient or employee data of ours sits inside vendor platforms, and for how long? Second, what does each contract say about how fast the vendor must tell us of a breach? Third, who on our side reads vendor security notices, given that one may be hard to find? Fourth, if a patient asks us what happened, what can we say today?
Quest's investigation is still open, and the numbers may change. The lesson holds either way. You can secure your own systems and still lose what you stored in someone else's.
Produced by the WebPulse Newsroom with AI assistance from the original reporting credited below, and checked against that source by our editorial review. How we use AI.
Original reporting: TechCrunch.
