Contract analysis

I. Executive Summary The purpose of this memorandum is to provide a definitive analysis of which state breach notification statutes are triggered as a result of the security incident involving Palomar Data Solutions, Inc. ("Palomar"), based on the specific data elements confirmed compromised in the final forensic report prepared by Graystone Forensics LLC ("Graystone") and delivered to Calderwood & Harkness LLP ("Cal

II. Background A. The Incident On or about March 14, 2023, a threat actor exploited CVE-2023-0669, a known remote code execution vulnerability in Palomar Data Solutions, Inc.'s GoAnywhere MFT file transfer appliance, to gain unauthorized access to Palomar's network environment. CVE-2023-0669 was publicly disclosed in early February 2023 and was widely exploited by threat actors during the first quarter of 2023. Palom

III. Analytical Framework — State Breach Notification Trigger Elements A. Common Statutory Elements All fifty states, the District of Columbia, and U.S. territories have enacted breach notification statutes requiring entities that own, license, or maintain computerized personal information to provide notification to affected individuals when a "breach of security" or "unauthorized acquisition" of such information occ

1. Breach of Security / Unauthorized Acquisition. The first element requires that a "breach of security," "security breach," or "unauthorized acquisition of" or "unauthorized access to" computerized data has occurred. States define this event variously — some focus on "unauthorized acquisition" (requiring actual acquisition of data by an unauthorized person), while others use broader formulations such as "unauthorize

2. Compromise of "Personal Information." The second element requires that the breach involved "personal information" as defined by the applicable state statute. The definition of "personal information" varies by jurisdiction, but virtually all states define it to include an individual's name in combination with one or more specified data elements (SSN, driver's license number, financial account number, and, in a grow

3. Absence of an Applicable Safe Harbor. The third element requires that no applicable safe harbor exempts the entity from the notification obligation. The most common safe harbor is the encryption safe harbor, under which notification is not required if the compromised data was encrypted and the encryption key was not also compromised. Other safe harbors include risk-of-harm exemptions and good-faith acquisition exc

IV. State-by-State Affected Individual Breakdown The following table presents the state-by-state breakdown of affected individuals based on Graystone's Final Forensic Report. The counts for the ten states with the largest affected populations are derived from Graystone's analysis of structured data fields within the exfiltrated files. The counts for the remaining nineteen states and the District of Columbia are based

V. Notification Trigger Analysis — Top 10 States by Affected Population This Section provides a detailed analysis of the notification trigger, timing requirements, regulatory notification obligations, and content requirements for each of the ten states with the largest affected populations. These ten states collectively account for 262,031 of the 318,247 affected individuals (approximately 82.3% of the total affected

I. Ohio (11,743 Affected Individuals) Statute: Ohio Rev. Code § 1349.19. Triggering Data Elements: The Ohio statute defines "personal information" to include an individual's name (consisting of the individual's first name or first initial and last name) in combination with and linked to any one or more of the following: (i) Social Security number; (ii) driver's license number or state identification card number; and

VI. Notification Trigger Analysis — Remaining 19 States and the District of Columbia A. Summary Table The following table provides a summary of the notification trigger analysis for the remaining nineteen states and the District of Columbia, which collectively account for 56,216 affected individuals. Because SSNs were compromised for all affected individuals, the notification trigger is satisfied in every jurisdictio

VII. Timing Requirements — Consolidated Analysis and Recommended Notification Schedule A. Summary of Timing Deadlines The following is a consolidated summary of the notification timing deadlines across all thirty affected jurisdictions (twenty-nine states and the District of Columbia), organized by the stringency of the deadline: 30-Day Jurisdictions (Most Aggressive): • Florida (Fla. Stat. § 501.171): No later than