Quest Diagnostics confirms patient data accessed in cyberattack

Quest Diagnostics has confirmed that attackers accessed patient information during a cyberattack on Quanum, its platform for ordering laboratory tests and handling billing. The company disclosed the incident in a filing with the US Securities and Exchange Commission after discovering the attack on Wednesday. ¹

Quest has not said how many patients or healthcare customers are affected. Its filing says the unauthorised access included “certain patient records”, while a separate company notice says protected health information, personal information and patient records were taken. Quest says it has notified law enforcement and is investigating. ²

What happened to Quanum

Quanum is used by doctors’ offices, hospitals and healthcare practices to request tests, manage billing and handle diagnostic information. Quest’s own materials say the platform is used by about half a million clinicians across thousands of locations in North America. ²

That makes the scope of the incident difficult to judge from the initial disclosure. Quest has not said when the intrusion began, which customers were affected or exactly what categories of data were accessed. It also has not said whether the attackers demanded payment or threatened to publish the information.

TechCrunch reports that the company is still investigating and has referred questions to its security notice. The notice does not yet provide a full accounting of the affected records, so the confirmed facts are narrower than the headline risk: unauthorised access occurred, some patient information was taken, and the investigation is ongoing. ³

Quest previously disclosed a breach affecting 11.9 million patient records in 2019 after an attack on a third-party billing company. The latest incident is separate and involves Quanum, but it again puts the security of medical and billing systems under scrutiny. ³

Our opinion

Healthcare breaches deserve unusually careful reporting because the data involved is intimate, difficult to replace and often shared across many organisations. The responsible conclusion here is not to guess at the final number of victims or imply that every Quanum record was stolen. Quest has confirmed access to certain patient records, but it has not yet published the technical and numerical detail needed to understand the full impact.

That uncertainty is frustrating for patients, but it is also why the next useful update matters more than speculation. Quest should explain which records were involved, when the exposure began, who is affected and what support it will provide. Until then, the confirmed breach is serious enough on its own.