Home · Technology · Oct 23 archive
Quest Diagnostics Reports Cyberattack on Patient Data
· Confirmed
In Short: Quest Diagnostics, a major provider of diagnostic testing services, reported a cyberattack that affected patient data.
Quest Diagnostics, one of the nation's leading providers of diagnostic testing services, reported a cyberattack that affected patient data. The company disclosed that some patient data was accessed but is still investigating the specific information involved and how many people may have been affected.
In a filing with the Securities and Exchange Commission, Quest said it notified federal law enforcement authorities and enlisted outside cybersecurity experts to assist with its investigation and response. The company expects to restore full functionality as soon as Friday.
Quest Diagnostics confirmed that patient health information or personally identifiable information was involved in the cybersecurity breach, prompting the medical testing giant to temporarily suspend access to several systems. The company said it has stopped the unauthorized access and is working to restore the affected system.
The cyberattack targeted one of Quest's lab testing systems, Quanum, which allows doctors’ offices, hospitals, and healthcare practices to request lab tests for patients while also handling billing. Customers can use paper requisitions in place of the system, and Quest pledged to have Quantum back up and running by Friday.
Despite the temporary restrictions, Quest said its core business operations remain unaffected and its ability to serve patients has not been materially disrupted. The company temporarily paused access to its Essential Insights and LabHQ systems as a precaution, although it said no data was accessed on those systems.
Quest is still investigating the extent of the breach and the specific kinds of data taken. The company said it is working to identify affected patients and healthcare providers and will issue notifications as required by applicable law.
This is Quest’s second known major data breach in a decade, after losing 11.9 million patient records in a cyberattack on a third-party billing company in 2019. The company is working with law enforcement to resolve the incident and is investigating what patient data was affected by the attack.
Health tech companies have become a major target for financially motivated cybercriminals, who aim to steal as much sensitive data as possible and threaten to publish it if they aren’t paid a ransom. The cyberattack on Quest is the latest major cyber incident to affect the healthcare industry this year.
The company published a statement and an FAQ about the cyberattack, warning customers that they “believe some patient data” within the system was accessed. A Quest spokesperson declined to comment on the nature of the incident.
The cyberattack on Quest Diagnostics highlights the ongoing challenges faced by healthcare providers in protecting sensitive patient information from cyber threats.
What's confirmed
- In a Thursday filing with the Securities and Exchange Commission, Quest said it notified federal law enforcement authorities and enlisted outside cybersecurity experts to assist with its investigation and response.
What's still developing
- Other electronic ordering systems remain operational.
- It’s unclear how many health records Quanum holds, but one 2026 case study on Quest’s website shows how a single health system with more than 6 million patients can hold hundreds of millions of related medical documents and charts.
- In recent months, a cyberattack resulted in the mass-wiping of employee devices at medical tech maker Stryker in March, and a hack on medical implant manufacturer Boston Scientific in August forced the company’s network offline for weeks, sparking “global disruption” to its operations.
- A series of cyberattacks and data breaches have sparked weeks of disruption and allowed the theft of millions of patient electronic health records and other medical information.
- Quest did not say when the breach began or whether any hacking group has contacted the company with demands, such as payment in exchange to not release the stolen data.
- Quest is one of the largest clinical laboratory companies in the U.S., reporting more than $11 billion in revenue last year.