Quest and Quanum: verifying the return of orders and results

The report needs to reflect the updated notice

The Cyber Security Brazil report prompted this analysis. In its 8-K signed on October 22, Quest reported learning of unauthorized access to Quanum LSM on October 21. In its October 23 notice, at 7pm ET, it announced system restoration. The FAQs acknowledge involvement of personal information and patient records, with the scope still under investigation. These documents do not confirm data extraction.

Define the path that needs to return

Choose an operation in the application your company administers: registering a request and making its response available to the approved recipient. Identify components receiving, processing and presenting each step. Formulate acceptance criteria another team can verify.

Record who owns each handoff and which information demonstrates that the request remained associated with the correct result. Include integrations and background tasks when they are in scope. If a supplier controls part of the path, define the evidence it needs to provide and mark points the team cannot observe directly.

Reconcile records produced during the pause

If there is an alternative channel, connect requests received there to normal operational records. Separate open, completed and repeatedly submitted requests. Preserve identifiers used at each step and record the decision on duplicates. Importing an entire queue again can leave unexplained which requests have already received handling and which still need action.

The Columbia alternative-service analysis follows request intake and reconciliation. Here, verification also needs to reach the associated response: which request it answers, where it becomes available and who received confirmation. Define the sample before testing, including pending cases.

Verify authorization alongside association

Prepare test identities with different roles and entirely fictional responses. Agree which records each identity may consult and through which path. Compare permitted viewing with a query that should be refused. The exercise needs to distinguish portal access from permission to receive a particular result, including after a credential reset takes place.

The C-Track confidentiality review complements that distinction between application access and content access. Check displayed fields and the integration’s recipient when these elements are authorized. The proposed exercise assesses the organization’s authorized environment without attributing this hypothesis to the incident.

Test a complete return in a controlled environment

Agree on an authorized laboratory with operations and data owners. Use a fictional request open before the simulated pause, another completed through the alternative channel and a third duplicate. The test response checks association and access without representing a valid clinical report or guiding decisions about care for any real patient.

Before execution, define expectations and stopping conditions. Record these results:

• Association: each response matches the request’s identifier and expected state.
• Recipient: the approved identity receives only the records defined for its role.
• Reconciliation: duplicates and pending requests have a recorded decision and an identified owner.
• Continuity: the legitimate workflow completes without recreating an already completed request.

Keep separate decisions for operations and data

Sample acceptance should identify the application, configuration, identities, time and limitations. The team can confirm the examined path’s functionality while another workstream still examines earlier access records. The post-incident recovery analysis helps document responsibilities and questions that remain open beyond completion of the operational assessment.

Ask the supplier specific questions about the period and data sets under examination. Preserve necessary information in a restricted location and record collection gaps. Closing operational verification does not determine who was affected or which communications are appropriate. Define responsible owners and evidence for those conclusions.

Frequently asked questions

Related reading

• Reconcile requests after an alternative channel
• Check who receives each piece of content
• Separate operational recovery from investigation

Sources and references

• Quest: Form 8-K signed on October 22, 2026
• Quest: October 23 notice and provider and patient FAQs
• Cyber Security Brazil: editorial news reference

Original Pentesty analysis, published October 26, 2026. The proposed scenarios are editorial guidance, with scope and validation to be defined for each environment.