Medical lab testing giant Quest Diagnostics has confirmed a cyberattack and data breach affecting an as-yet unspecified amount of sensitive patient information stored in its systems, according to a legally required disclosure with U.S. regulators.<\/p>\n
Quest said in an 8-K filing<\/a> with the U.S. Securities and Exchange Commission that it learned of a cyberattack on Wednesday targeting one of its lab testing systems, Quanum, which allows doctors\u2019 offices, hospitals, and healthcare practices to request lab tests for patients while also handling billing. The platform stores a large amount of patient health and medical records, as well as associated diagnostic and billing data.<\/p>\n The company said the unauthorized access included the accessing of \u201ccertain patient records.\u201d Quest said it notified law enforcement and is investigating.<\/p>\n The cyberattack on Quest is the latest major cyber incident to affect the healthcare industry this year. A series of cyberattacks and data breaches have sparked weeks of disruption and allowed the theft of millions of patient electronic health records and other medical information. Health tech companies have become a major target for financially motivated cybercriminals, who aim to steal as much sensitive data as possible and threaten to publish it if they aren\u2019t paid a ransom.\u00a0<\/p>\n In recent months, a cyberattack resulted in the mass-wiping of employee devices<\/a> at medical tech maker Stryker in March, and a hack on medical implant manufacturer Boston Scientific in August forced the company\u2019s network offline<\/a> for weeks, sparking \u201cglobal disruption\u201d to its operations. Meanwhile, separate hacks throughout the year caused massive breaches of patient data at medical recordkeeping company CareCloud<\/a>, Scotland-based health tech provider Craneware<\/a>, and U.S. pharmaceutical distribution giant McKesson<\/a>.<\/p>\n The lab-testing giant has not yet said how many healthcare customers, or patients, had information stolen during the attack on its Quanum systems.<\/p>\n Quest\u2019s website and materials say Quanum is used by about half a million clinicians in thousands of locations across North America. It\u2019s unclear how many health records Quanum holds, but one 2026 case study<\/a> on Quest\u2019s website shows how a single health system with more than 6 million patients can hold hundreds of millions of related medical documents and charts.<\/p>\n Quest did not say when the breach began or whether any hacking group has contacted the company with demands, such as payment in exchange to not release the stolen data. Amanda Rivera, a spokesperson for Quest, did not answer TechCrunch\u2019s questions about the incident and referred to its security notice<\/a>.<\/p>\n In the notice<\/a>, Quest said that some patients\u2019 protected health information was taken, including \u201cpersonal information and patient records,\u201d but the company is still investigating what specific kinds of data were taken. (The website post currently contains \u201cnoindex\u201d code<\/a>, which tells search engines not to list the page in search results, making it far more difficult for people to find the page.)<\/p>\n This is Quest\u2019s second known major data breach in a decade, after losing 11.9 million patient records<\/a> in a cyberattack on a third-party billing company in 2019.<\/p>\n Do you work at Quest Diagnostics or know more about the data breach? We\u2019d love to hear from you. You can reach this reporter on Signal at the username zackwhittaker.1337 or by email [email\u00a0protected]<\/a>.<\/p>\n Updated with a response from Quest.<\/p>\n