Contract analysis

I. Executive Summary The cybersecurity event that is the subject of this inquiry originated not within Quorum's own information systems, network infrastructure, or digital platforms, but within the network of a third-party claims-processing vendor, Palomar Data Solutions, Inc. ("Palomar"), a Texas corporation headquartered at 7100 Greenville Avenue, Suite 450, Dallas, TX 75231. Palomar provides claims data processing

II. Background on the Vendor Relationship A. Palomar Data Solutions — Overview Palomar Data Solutions, Inc. ("Palomar") is a Texas corporation, Employer Identification Number 75-3291048, with its principal offices located at 7100 Greenville Avenue, Suite 450, Dallas, TX 75231. Palomar provides claims data processing, document management, and analytics services to mid-to-large insurance carriers across the United Stat

III. Detailed Incident Timeline The following provides a detailed chronological account of the cybersecurity event, from the initial unauthorized access through the completion of consumer notifications. A. Unauthorized Access and Exfiltration (March 14 – April 18, 2023) On or about March 14, 2023, a threat actor exploited CVE-2023-0669, a known but unpatched remote code execution vulnerability affecting Palomar's GoA

IV. Scope of Compromised Data A. Total Affected Population The forensic investigation and data mining process confirmed that the personal information of a total of 318,247 individuals across twenty-nine (29) states and the District of Columbia was compromised in the cybersecurity event. B. Data Types Compromised The compromised data falls into three categories, affecting overlapping subsets of the total affected popu

V. Compliance with Connecticut Insurance Data Security Law (Conn. Gen. Stat. § 38a-999b) A. Overview of Statutory Requirements The Connecticut Insurance Data Security Law, Conn. Gen. Stat. § 38a-999b, requires each licensee domiciled in Connecticut to develop, implement, and maintain a comprehensive written information security program that contains administrative, technical, and physical safeguards for the protectio

VI. Consumer Notification and Remedial Services A. Consumer Notification Process Quorum undertook a comprehensive consumer notification program to ensure that all affected individuals received timely and informative notice of the cybersecurity event. A total of 318,247 notification letters were mailed on a rolling basis via first-class U.S. Mail from August 18, 2023, through September 15, 2023, a rolling twenty-eight

VII. Forensic Investigation and Root Cause A. Forensic Investigation Graystone Forensics LLC was retained on May 5, 2023, under the direction and privilege umbrella of Calderwood & Harkness LLP, to conduct a comprehensive forensic investigation of the cybersecurity event. The engagement was structured to preserve the attorney-client privilege and work product protections applicable to the investigation and its findin

VIII. Vendor Accountability Measures A. Indemnification Demand On June 20, 2023, Calderwood & Harkness LLP, on behalf of Quorum, issued a formal breach of contract demand letter to Palomar through Palomar's outside counsel, Mercer, Haight & Dunlop LLP (Catherine Langford, Partner). The demand letter asserted that Palomar's failure to timely patch CVE-2023-0669, in violation of the patching requirements under Exhibit

IX. Quorum's Information Security Program Enhancements A. Post-Incident Internal Improvements In addition to the vendor-facing accountability measures described above, Quorum has undertaken and continues to pursue a number of internal enhancements to its information security program in response to the cybersecurity event. These enhancements are designed to strengthen the Company's ability to detect, prevent, and resp

X. Insurance Coverage Quorum maintains a comprehensive cyber-liability insurance program designed to mitigate the financial impact of cybersecurity events. The program is placed through Whitmore Risk Advisors Inc. (Sandra Whitmore-Kim, Lead Broker) and consists of the following policies: Primary Cyber-Liability Policy: Atlas Mutual Insurance Company, Policy No. CYB-2023-041587. The policy provides a per-occurrence li

XI. Summary of Total Incident Costs The following table summarizes the total incident response costs incurred by Quorum in connection with the cybersecurity event through the date of this submission: The allocation of these costs across Quorum's insurance program and vendor indemnification recovery is as follows: • Self-insured retention (Quorum's responsibility): $2,500,000 • Amount covered by Atlas Mutual primary c

XII. Quorum's Commitment to Continued Cooperation Quorum remains fully committed to cooperating with the Connecticut Insurance Department throughout the duration of this inquiry. The Company recognizes the critical importance of maintaining public trust in the insurance industry and in the security of the personal information entrusted to insurance carriers and their service providers. Quorum will promptly provide an

XIII. Conclusion In summary, the cybersecurity event that is the subject of this inquiry was vendor-originated and resulted from the failure of Quorum's third-party claims-processing vendor, Palomar Data Solutions, Inc., to timely patch a known critical vulnerability in its file transfer infrastructure. The event did not reflect a failure of Quorum's own information security program, which was designed and maintained