Contract analysis

I. PURPOSE AND SCOPE This letter is issued on behalf of a coalition of twenty-nine (29) state Attorneys General — specifically, the Attorneys General of Connecticut, New York, Massachusetts, California, Illinois, Pennsylvania, New Jersey, Ohio, Texas, Florida, Georgia, Virginia, Maryland, North Carolina, South Carolina, Michigan, Minnesota, Indiana, Wisconsin, Colorado, Arizona, Oregon, Washington, Tennessee, Missour

II. BACKGROUND AND SUMMARY OF THE INCIDENT The Coalition's inquiry concerned a data security incident originating from Quorum's third-party claims-processing vendor, Palomar Data Solutions, Inc., a corporation headquartered in Dallas, Texas, that provides claims intake, data processing, and managed file transfer services to Quorum and other insurance industry clients pursuant to a Master Services Agreement dated Janu

III. QUORUM'S RESPONSE AND REMEDIAL ACTIONS The Coalition acknowledges the following response and remedial actions taken by Quorum in connection with the data security incident: Investigation and Forensic Review. Quorum promptly engaged outside counsel, Calderwood & Harkness LLP, and, under the direction of counsel, retained a forensic investigation firm, Graystone Forensics LLC, to investigate the nature, scope, and

IV. FINDINGS AND DETERMINATION Based on the Coalition's review of Quorum's submissions, the remedial actions taken by Quorum in response to the data security incident, Quorum's cooperation with the multistate inquiry, and Quorum's demonstrated commitment to compliance with applicable data breach notification laws and consumer protection statutes, the Coalition has determined that no enforcement action against Quorum

V. RESERVATIONS AND CAVEATS The closure of this investigation does not constitute an approval, endorsement, or certification of Quorum's data security practices, policies, or procedures, and should not be construed or represented as such by Quorum or any person acting on its behalf. The Coalition reserves all rights to investigate and take enforcement action in the event of future data security incidents involving Qu

VI. ACKNOWLEDGMENTS AND COMMENDATIONS The Coalition wishes to acknowledge Quorum's prompt and thorough response to the data security incident, including its timely engagement of experienced outside counsel and forensic investigators; its timely and comprehensive consumer and regulatory notifications, which met or exceeded the requirements of all applicable state breach notification statutes; its proactive vendor acco

VII. CONTACT INFORMATION Any questions regarding this letter or the closure of this investigation should be directed to: Diane Marchetti, Assistant Attorney General Consumer Protection Division Office of the Attorney General, State of Connecticut 165 Capitol Avenue Hartford, CT 06106 Telephone: (860) 808-5400 Mark Petrosian, Assistant Attorney General Bureau of Internet and Technology Office of the Attorney General,

1. Notification Compliance Confirmed. All regulatory notifications and consumer notifications have been confirmed timely and compliant by the 29-state Coalition. The AGs affirmatively found that notifications met all applicable statutory requirements — this is an affirmative compliance determination, not merely the absence of an adverse finding.

2. Vendor-Originated Breach Characterization Accepted. The Coalition accepted the characterization of the incident as vendor-originated, attributed the root cause to Palomar's failure to patch CVE-2023-0669, and did not attribute any independent security failure to Quorum. No findings of deficiency were made regarding Quorum's own information security program, vendor risk management practices, or monitoring capabilit

3. Vendor Accountability Measures Viewed Favorably. The Coalition specifically referenced and described in detail the vendor accountability measures taken by Quorum, including the $4.2 million financial settlement, MSA Amendment 3, and the enhanced contractual security and audit obligations imposed on Palomar. The specificity of these references strongly suggests that these measures weighed materially and favorably i

4. Strongest Standard Closure Language Achieved. The determination that "no enforcement action … is warranted at this time" represents the strongest form of closure language available from a multistate AG coalition. Full no-action closure without monetary penalties, consent orders, or mandatory compliance commitments is a relatively uncommon outcome in multistate data breach investigations of this scale.

5. No Individual State Separate Action Indicated. The Coalition's affirmative statement that no individual state Attorney General has indicated an intent to pursue a separate investigation or enforcement action provides an additional and unusual layer of assurance beyond standard closure language. This signals alignment across all 29 participating states.

6. Commendatory Language Provides Defensive Value. The explicit commendations regarding Quorum's "prompt and thorough response," "timely and comprehensive" notifications, "proactive vendor accountability measures," and "cooperative engagement" provide significant defensive value for future proceedings, including any private class action litigation, regulatory inquiries, or cyberinsurance renewal negotiations. Remaini