Contract analysis

I. Executive Summary This memorandum analyzes the notification obligations of Quorum Insurance Holdings Corp. ("Quorum" or the "Company") to the Connecticut Insurance Department under the Connecticut Insurance Data Security Law, Conn. Gen. Stat. § 38a-999b et seq., in connection with the vendor-originated data breach that occurred at the systems of Palomar Data Solutions, Inc. ("Palomar"), a third-party claims-proces

II. Background — The Security Incident A. Factual Summary On or about March 14, 2023, a threat actor exploited CVE-2023-0669, a remote code execution vulnerability in the Vireo Health IT (Managed File Transfer) file transfer appliance, to gain unauthorized access to the network environment of Palomar Data Solutions, Inc. ("Palomar"), Quorum's third-party claims-processing vendor. Palomar is headquartered at 7100 Gree

III. Statutory Framework — Connecticut Insurance Data Security Law A. Overview and Legislative Purpose The Connecticut Insurance Data Security Law, codified at Conn. Gen. Stat. § 38a-999b, was enacted as part of Connecticut's adoption of the National Association of Insurance Commissioners ("NAIC") Insurance Data Security Model Law (Model #668). The NAIC Model Law was adopted by the NAIC in October 2017 and was design

Section 38a-999b specifically addresses the obligations of licensees with respect to third-party service providers that access, handle, process, or store nonpublic information on behalf of the licensee. The statute requires licensees to exercise due diligence in selecting and retaining third-party service providers and to require such providers, by contract, to implement and maintain appropriate administrative, techn

IV. Notification Requirements Under § 38a-999b A. When Notification Is Required The statute requires a licensee to notify the Commissioner of Insurance when a "cybersecurity event" has occurred that meets certain criteria. Specifically, notification is required when a cybersecurity event either: (i) directly affects the licensee, or (ii) occurs at or is hosted by a third-party service provider where the cybersecurity

1. The 72-Hour Window The statute requires that notification to the Commissioner be made "as promptly as possible but in no event later than 72 hours" from the date on which the licensee makes a "determination" that a cybersecurity event has occurred. The 72-hour window is measured from the "determination" date, not from the date of the incident itself, the date of discovery of the incident by the third-party vendor,

2. Definition of "Determination" Date The identification of the proper "determination" date is the single most critical timing issue in this analysis. The statute does not provide an express definition of "determination," and the term is susceptible to multiple reasonable interpretations. It is not synonymous with "Discovery" — that is, the determination date is not necessarily the date on which the licensee first be

3. Application to This Matter Applying this framework to the facts of the Palomar breach, we identify the following key milestone dates: April 21, 2023 — Palomar's Notification to Quorum. On this date, Palomar's General Counsel, Derek Copeland, notified Quorum's General Counsel, Thomas R. Whitfield, and CISO, David Naranjo, by email of the incident. Copeland's notification described the incident in general terms and

4. Recommended Determination Date and Filing Timeline Based on the foregoing analysis, Calderwood & Harkness recommends treating August 4, 2023 — the date on which data mining and affected-individual identification was completed — as the operative "determination" date for purposes of the 72-hour notification window under § 38a-999b. This interpretation is supported by the following considerations: • The statute requi

1. Description of the Cybersecurity Event. A narrative description of the incident, including the attack vector (exploitation of CVE-2023-0669 in the GoAnywhere MFT platform), the identity of the affected third-party service provider (Palomar Data Solutions, Inc.), and the nature of the unauthorized access and data exfiltration.

2. Date of the Cybersecurity Event. The date on which the cybersecurity event is believed to have commenced (on or about March 14, 2023) through the date on which the unauthorized access was terminated (April 18, 2023), or the best estimate thereof.

3. Date of discovery of the Cybersecurity Event. The date on which the event was first discovered by Palomar's SOC (April 18, 2023) and the date on which Quorum was notified by Palomar (April 21, 2023).

4. Description of the Types of Nonpublic Information Involved. A description of the categories of nonpublic information compromised, including: full legal names, dates of birth, Social Security numbers, driver's license numbers, bank account numbers, payment card numbers, and protected health information (health conditions, diagnosis codes, treatment information).

5. Number of Consumers Affected. The number of affected Connecticut residents: 52,114 individuals.

6. Description of Remedial Measures Taken or Planned. A description of the steps Quorum has taken and plans to take in response to the incident, including: engagement of forensic investigators; implementation of enhanced monitoring of data transfers with Palomar; review of vendor security requirements; planned notification to affected individuals; provision of complimentary credit monitoring and identity protection s

7. Name and Contact Information of the Licensee. Quorum Insurance Holdings Corp., 400 Constitution Plaza, Suite 2200, Hartford, CT 06103, with the designated contact person for the notification (to be confirmed — recommend designating Jennifer Liang, CPO, or Thomas R. Whitfield, General Counsel, with Calderwood & Harkness as outside counsel contact).

8. Name of any Third-Party Forensic Investigator Engaged. The statute contemplates disclosure of the identity of any forensic investigator engaged in connection with the cybersecurity event. We recommend disclosing the name of Graystone Forensics LLC as the firm that conducted the forensic investigation, without disclosing the substantive findings of the investigation, which are protected by the attorney-client privi

9. Copy of the Consumer Notification Letter. A copy of the notification letter that Quorum plans to send to affected Connecticut residents, including the content required by § 36a-701b and any ancillary information regarding credit monitoring, identity protection services, and other remedial measures being offered to affected individuals. In addition to the statutorily required content elements, the notification shou

V. Relationship to Connecticut General Breach Notification Statute (Conn. Gen. Stat. § 36a-701b) Connecticut's general breach notification statute, Conn. Gen. Stat. § 36a-701b, imposes separate notification obligations upon any person or entity that conducts business in Connecticut and that owns, licenses, or maintains computerized data that includes personal information of Connecticut residents. When a breach of sec

VI. Interaction with Other Regulatory Obligations A. HIPAA Breach Notification (PHI Subset) Of the 318,247 total affected individuals, a subset of 41,203 individuals had protected health information ("PHI") compromised — specifically, health conditions, diagnosis codes, and treatment information associated with workers' compensation claims and health-related personal lines claims data processed by Palomar on behalf o

VII. Information Security Program Requirements Under § 38a-999b A. Program Requirements Beyond the notification requirements discussed above, § 38a-999b imposes ongoing, affirmative obligations upon licensees to develop, implement, and maintain a comprehensive written information security program based on the licensee's risk assessment. The statute prescribes the components of such a program, which must include, amon

1. Vendor Due Diligence and Oversight of Palomar Data Solutions. The Department is likely to inquire about the due diligence Quorum conducted prior to engaging Palomar, the ongoing monitoring and oversight measures in place, and the risk assessment framework applied to Palomar as a third-party service provider. Quorum should be prepared to demonstrate that Palomar was classified as a Tier 1 — Critical vendor and was

2. Adequacy of Contractual Security Requirements. The Department may review the information security provisions of the MSA — specifically, Exhibit D (as amended by Amendment 2, dated September 15, 2022) — to assess whether the contractual requirements were sufficient and whether Quorum adequately enforced those requirements. Key provisions likely to be scrutinized include: the requirement for "commercially reasonable

3. Quorum's Incident Response Procedures and Timeliness. The Department may evaluate the timeliness and adequacy of Quorum's response following receipt of Palomar's April 21, 2023 notification. This inquiry may include questions about: the steps Quorum took upon receiving Palomar's notification; the decision to engage outside counsel and forensic investigators; the timeline of the forensic investigation; and the reas

4. Remediation Measures. The Department is likely to inquire about the specific remediation measures Quorum has implemented or plans to implement in response to the breach, including: enhanced security requirements for Palomar (or termination of the vendor relationship); changes to Quorum's vendor risk management program; enhanced monitoring and logging of data transfers with third-party service providers; and the sc

5. Vendor Accountability Actions. The Department may inquire about the contractual accountability measures Quorum has taken or plans to take against Palomar, including: formal notices of breach of the MSA; demands for reimbursement of breach-related costs; suspension or modification of the vendor relationship; and any other remedial or punitive actions. Quorum should be prepared to respond to inquiries in each of the

VIII. Recommended Actions and Timeline Based on the foregoing analysis, Calderwood & Harkness recommends the following actions and timeline: A. Notification Filing • Filing Date: August 14, 2023. • Recipient: Connecticut Insurance Department, Financial Analysis Division, Cybersecurity Unit (Attention: Richard Nakamura, Assigned Examiner). • Filing Method: Electronic submission via the Department's cybersecurity event

1. Compilation of Supporting Documentation. Quorum should compile and organize the follo