Quest says patient records were breached

Quest Diagnostics has confirmed that a cyberattack on one of its laboratory systems exposed patient information, adding another healthcare data breach to a year in which medical records have kept proving both valuable and vulnerable.

In a filing with the U.S. Securities and Exchange Commission, Quest said it learned of a cyberattack targeting Quanum, a platform used by doctors’ offices, hospitals and other care providers to order tests and manage billing. The company said unauthorized access included “certain patient records” and that it has notified law enforcement and opened an investigation.

Quest’s public security notice goes slightly further on what was taken, saying some patients’ protected health information was accessed, including “personal information and patient records.” What remains unclear is the part people usually want to know first: how many patients were affected, which specific types of data were exposed, when the breach began, and whether the attackers have made extortion demands.

Those gaps matter because medical data is unusually hard to contain once it escapes. A stolen password can be changed. A medical history, billing profile or diagnostic record follows a person differently: through insurance disputes, fraud risks, and a loss of privacy that is not easily reversed.

Quanum is not a minor back-office tool. TechCrunch reports that Quest’s own materials say the system is used by about half a million clinicians across thousands of locations in North America. That does not establish how many patient files were accessed in this incident, but it helps explain why the breach could carry wide consequences even before the company has published a number.

Healthcare has become a steady target for cybercriminals precisely because disruption and sensitivity travel together. Systems that move test orders, billing and clinical records are difficult to replace quickly, and the data inside them can be monetized in several ways. That does not mean every stolen record will be leaked or misused; it does mean uncertainty itself has a cost for patients and providers.

Quest has had a major breach before. In 2019, it disclosed that 11.9 million patient records were exposed in a cyberattack on a third-party billing company. This time, the compromised system was inside Quest’s own operations, according to the company’s filing.

For now, Quest has confirmed the breach, confirmed patient data was involved, and left the central dimensions of the incident unanswered.