Quest Diagnostics Data Breach Exposes Patient Health Info in Healthcare Hack Wave

TL;DR

• Quest Diagnostics has confirmed that hackers accessed patient personal and health information during a recent third-party vendor breach.
• Exposed data includes names, contact details, dates of birth, lab-related health information and limited Social Security numbers.
• The incident is part of a growing wave of healthcare cyberattacks targeting diagnostics labs, hospitals and their tech suppliers.

What Happened

Quest Diagnostics, one of the largest medical laboratory operators in the United States, has confirmed that patient data was compromised in a recent data breach linked to its systems and vendors.

The company said unauthorized access was detected after suspicious activity was flagged on a third-party platform used for patient services and revenue cycle operations. An investigation with outside cybersecurity experts found that an attacker had exfiltrated files containing patient information.

Quest has not disclosed the exact number of individuals affected, but said it is notifying impacted patients directly and has reported the incident to federal regulators as required under HIPAA.

What Was Exposed

According to Quest, the compromised information varies by individual but may include names, addresses, phone numbers, email addresses, dates of birth, and medical and lab information such as test orders, results, diagnoses and health insurance details.

In a subset of cases, Social Security numbers and financial information were also involved. Quest stressed that its core laboratory information systems and test operations were not shut down, and patient care was not interrupted.

The company is offering free credit monitoring and identity theft protection to those affected, and is urging patients to review explanation of benefits statements and monitor accounts for suspicious activity.

How Quest Responded

Quest said it contained the intrusion, cut off unauthorized access, reset credentials and hardened its network after discovering the breach. Law enforcement was notified, and the company says it is cooperating fully with the FBI and regulators.

The company also said it is reviewing its vendor security practices and moving affected services to more secure systems. A dedicated call center and informational website have been set up for patients seeking answers.

Quest has faced vendor-related breaches before, including the 2019 AMCA billing vendor incident that exposed data for nearly 12 million Quest patients, making this latest disclosure especially sensitive for regulators and customers.

Why Healthcare Tech Is Under Attack

Cybersecurity experts say healthcare and diagnostics companies like Quest, LabCorp, Change Healthcare and hospital networks are increasingly targeted because they hold massive stores of high-value personal health information.

That data can be used for identity theft, insurance fraud, blackmail and ransomware extortion, selling for far more on the dark web than credit card numbers alone.

Attackers are also shifting from hospitals themselves to their weaker third-party vendors - billing providers, file-transfer tools, call centers and IT contractors - to gain access to multiple health systems at once.

Ransomware groups and state-linked hackers have intensified campaigns in 2025 and 2026, exploiting unpatched software, phishing, and stolen credentials to break into healthcare supply chains.

What Patients Should Do Next

Security professionals recommend that Quest patients take the breach notification seriously, enroll in the offered credit monitoring, freeze credit with the three major bureaus, and use multifactor authentication on patient portals and email.

Patients should be wary of phishing calls, texts or emails claiming to be from Quest about test results, payments or refunds, as stolen contact details are often reused in follow-on scams.

Experts also urge lawmakers and healthcare tech vendors to adopt stronger encryption, zero-trust access, faster breach disclosure, and mandatory minimum security standards for all business associates handling protected health information.

AndroGuider Team

Articles written by the AndroGuider team. We try to make them thorough and informational while being easy to read.