Contract analysis

I. Executive Summary The purpose of this memorandum is to analyze the obligations of our client, Quorum Insurance Holdings Corp. ("Quorum" or the "Company"), under the New York Stop Hacks and Improve Electronic Data Security Act (the "SHIELD Act"), codified at N.Y. Gen. Bus. Law § 899-aa, in connection with the vendor-originated data breach incident at Palomar Data Solutions, Inc. ("Palomar"). This analysis is prepar

II. Background and Factual Summary A. The Incident On or about March 14, 2023, a threat actor exploited CVE-2023-0669, a known remote code execution vulnerability in a Vireo Health IT (Managed File Transfer) file transfer appliance operated by Palomar Data Solutions, Inc. ("Palomar"), Quorum's third-party claims-processing vendor. The CVE-2023-0669 vulnerability had been publicly disclosed by Severin Corporation on F

III. SHIELD Act Statutory Framework A. Applicability — N.Y. Gen. Bus. Law § 899-aa(1) The SHIELD Act, enacted in 2019 and effective in stages through March 21, 2020, substantially expanded New York's existing data breach notification law. The statute applies broadly to "any person or business that owns or licenses computerized data which includes private information" of a resident of New York State. N.Y. Gen. Bus. La

IV. Notification Obligations A. Consumer Notification Requirements — § 899-aa(2) The SHIELD Act requires that "[a]ny person or business which owns or licenses computerized data which includes private information of a resident of New York shall disclose any breach of the security of the system following discovery or notification of the breach in the security of the system to any resident of New York state whose privat

1. Description of Information Categories Compromised. The letter should clearly state the specific categories of information that were accessed and acquired by the unauthorized actor. For each recipient, the letter should identify the data elements applicable to that individual. Because the compromised data elements vary by individual (some individuals had only PII compromised, while others had PII plus financial dat

2. Quorum Contact Information. The letter should include Quorum's contact information, including the toll-free telephone number for the dedicated call center operated by Clearfield Notification Services LLC. The call center should be identified as the point of contact for affected individuals who have questions about the incident or wish to enroll in the complimentary credit monitoring and identity theft protection s

3. Major Credit Bureau Contact Information. The letter should include the toll-free telephone numbers and mailing addresses of the three major consumer reporting agencies: • Harborview Enterprises: 1-800-685-1111; P.O. Box 740241, Atlanta, GA 30374; www.Harborview Enterprises.com • Penrose Group: 1-888-397-3742; P.O. Box 9554, Allen, TX 75013; www.Penrose Group.com • Penmark Enterprises: 1-800-916-8800; P.O. Box 2000

4. FTC Contact Information. The letter should include the toll-free telephone number, address, and website for the Federal Trade Commission: 1-877-382-4357; 600 Pennsylvania Avenue NW, Washington, D.C. 20580; www.ftc.gov/idtheft.

5. New York Attorney General Contact Information. The letter should include the contact information for the New York Attorney General's Office, Bureau of Internet and Technology: Office of the New York State Attorney General, Bureau of Internet and Technology, 28 Liberty Street, New York, NY 10005; 1-800-771-7755; www.ag.ny.gov.

6. Credit Monitoring Offer. The letter should describe the offer of 24-month complimentary credit monitoring and identity theft protection services provided through Clearfield Notification Services LLC, including instructions for enrollment and the enrollment deadline.

7. Protective Steps. The letter should include guidance on steps individuals can take to protect themselves against identity theft and fraud, including information regarding fraud alerts, credit freezes, monitoring of financial account statements, and review of explanation of benefits statements (for the PHI subset). I will prepare a draft of the New York-specific notification letter incorporating these elements and

V. Reasonable Security Safeguards — N.Y. Gen. Bus. Law § 899-bb A. Statutory Requirement In addition to the breach notification obligations under § 899-aa, the SHIELD Act enacted a separate affirmative data security requirement under N.Y. Gen. Bus. Law § 899-bb, which became effective on March 21, 2020. Section 899-bb requires that "[a]ny person or business that owns or licenses computerized data which includes priva

Section 899-bb(2)(c) provides that a "small business" is deemed to be in compliance with the reasonable safeguards requirement if its security program "contains reasonable administrative, technical, and physical safeguards that are appropriate for the size and complexity of the small business, the nature and scope of the small business's activities, and the sensitivity of the personal information the small business c

VI. Interaction with Other Applicable New York Laws A. New York Department of Financial Services Cybersecurity Regulation (23 NYCRR Part 500) To the extent that Quorum operates licensed insurance entities in the State of New York — which it does through Quorum Property and Casualty Insurance Company of New York (a New York-domiciled insurer) — Quorum and its New York-licensed subsidiaries may be subject to the New Yo

VII. Recommendations and Action Items Based on the foregoing analysis, I recommend the following action items to ensure Quorum's compliance with the SHIELD Act in connection with the Palomar breach: A. Consumer Notification

1. Finalize the New York-specific consumer notification letter. The letter must comply with all SHIELD Act content requirements set forth in § 899-aa(2)(b), including: a description of the categories of information compromised (specifying which data elements were involved); contact information for Quorum (including the toll-free call center number operated by Clearfield Notification Services LLC); the toll-free telep

2. Include the credit monitoring and identity theft protection offer. The letter should describe the offer of 24-month complimentary credit monitoring and identity theft protection services provided through Clearfield Notification Services LLC. The letter should include the enrollment instructions, the toll-free enrollment telephone number, the enrollment website URL, and the enrollment deadline. While not required b

3. Tailor the letter for each recipient. Because the specific data elements compromised vary by individual, the notification letter should be tailored to identify the specific categories of information applicable to each recipient. Four versions of the letter should be prepared: (a) PII only (name, date of birth, SSN, driver's license number); (b) PII plus financial data (bank account numbers and/or payment card numb

4. Commence mailing. Consumer notification mailings to 47,831 New York residents should commence as part of the overall mailing window of August 18 through September 15, 2023. New York mailings should be prioritized within the mailing window given the large number of affected New York residents and the likelihood of AG scrutiny. B. Regulatory Notification

5. File notifications with New York state agencies on August 16, 2023. Notifications must be filed concurrently with the New York Attorney General (Bureau of Internet and Technology, via the online submission portal and by U.S. mail), the New York Department of State, and the New York Division of State Police. Filing on August 16 — two days before consumer mailings commence — ensures compliance with the concurrent no

6. Content of regulatory notifications. Each notification should include: the approximate date of the breach (March 14 through April 18, 2023); the approximate number of affected New York residents (47,831); a description of the categories of private information compromised (names, dates of birth, Social Security numbers, driver's license numbers, and, for subsets of the affected population, bank account numbers, pay

7. Notify major consumer reporting agencies. Because the number of affected New York residents (47,831) exceeds the 5,000-resident threshold under § 899-aa(8)(b), Quorum must notify Harborview Enterprises, Penrose Group, and Penmark Enterprises of the timing, content, and distribution of the consumer notification. This notification should be transmitted no later than August 17, 2023 — one day prior to the commencemen

8. Prepare an information security program summary. A comprehens