Quest Diagnostics disclosed in an 8-K filing with the U.S. Securities and Exchange Commission that it learned of a cyberattack targeting Quanum, one of its lab testing systems.

NJBIZ reports the company detected unauthorized access to the Quanum Lab Services Manager platform on October 21 and filed its disclosure on October 22, notifying federal law enforcement.

Quest said the access included 'certain patient records' but has not said how many people are affected or what specific information was taken.

Quanum is the connective tissue between Quest and the U.S. healthcare system: doctors' offices, hospitals, and healthcare practices use it to request lab tests and handle billing.

TechCrunch reports the platform stores large volumes of patient health and medical records along with diagnostic and billing data. According to Quest's own materials cited by TechCrunch, Quanum is used by about half a million clinicians in thousands of locations across North America.

Quest itself serves roughly a third of American adults annually through more than 7,770 patient access points, NJBIZ reports.

Neither Quest nor outside reporting can yet say how big this breach is.

TechCrunch notes it is unclear how many health records Quanum holds, but a 2026 case study on Quest's website showed how a single health system with more than 6 million patients can hold hundreds of millions of related medical documents and charts.

NJBIZ reports Quest paused access to the system after detecting the intrusion and is investigating with external cybersecurity experts, while saying core business operations remain up and running. Quest has not said when the breach began or whether hackers have made demands.

Two details stand out to security watchers.

TechCrunch reports Quest's security notice page currently contains 'noindex' code that tells search engines not to list it, making it harder for patients to find information about the incident — and a Quest spokesperson did not answer TechCrunch's questions, referring to the notice.

It is also Quest's second known major breach in a decade: TechCrunch notes the company lost 11.9 million patient records in a 2019 cyberattack on a third-party billing company, and NJBIZ adds a 2016 incident exposed lab results for about 34,000 people.

The Quest incident lands amid the worst stretch on record for healthcare data. The worst ever remains the 2024 Change Healthcare ransomware attack, which affected an estimated 192.7 million people.

TechCrunch reports 2026 has already brought device-wiping attacks at Stryker, a weeks-long network shutdown at Boston Scientific, and breaches at CareCloud, Craneware, and McKesson.

Quest says its investigation, aided by external cybersecurity experts, is ongoing, and the company is still determining what kinds of data were taken. TechCrunch reports the company has not ruled out — or confirmed — contact from a hacking group seeking ransom.

Watch for updated filings with the SEC and a revised, publicly findable security notice as the investigation advances.