Contract analysis

1. The full legal name of the Company, its state of incorporation, the date of incorporation, and its principal place of business.

2. A current organizational chart depicting the Company's corporate structure, including the identification of all operating subsidiaries, affiliates, and divisions. The organizational chart should specifically identify all subsidiaries, affiliates, or divisions that processed, stored, transmitted, or otherwise had access to the personal information of the individuals affected by the data security incident.

3. A description of the Company's business lines, including but not limited to property and casualty insurance, specialty insurance, life and annuity products, and any financial technology or insurtech operations.

4. The Company's total annual revenue for fiscal years 2021 and 2022.

5. The total number of employees of the Company and its subsidiaries as of the date of this letter.

6. The names, titles, and reporting relationships of the Company's Chief Information Security Officer, Chief Privacy Officer, and any other personnel with primary responsibility for data security and privacy, including but not limited to any Vice President or Director of Vendor Risk Management, Information Technology, or Compliance. [C&H Annotation — Burke]: This is a standard background request and should be respond

1. A complete description of the business relationship between Quorum and Palomar, including the nature and scope of the services provided by Palomar, the date the relationship commenced, and the current status of the relationship.

2. Copies of the Master Services Agreement ("MSA") and all amendments, addenda, exhibits, statements of work, or other contractual documents governing the processing of data by Palomar on behalf of Quorum.

3. The date the MSA was executed, the term of the MSA (including any renewal provisions), and the annual contract value.

4. A detailed description of the categories and volume of data processed by Palomar on behalf of Quorum, including the types of personal information, the approximate number of records, and the business purposes for which the data was processed.

5. Copies of any data security requirements, standards, specifications, exhibits, or addenda incorporated into or appended to the MSA or any related agreements that set forth obligations regarding Palomar's protection of the data it processed on behalf of Quorum.

6. Documentation of any vendor risk assessments, due diligence evaluations, security questionnaires, on-site audits, or other reviews of Palomar's data security practices conducted by Quorum or on Quorum's behalf prior to the incident, including the dates of such assessments and a summary of the findings.

7. Copies of any SOC 2 Type II audit reports or similar independent audit or certification reports received by Quorum from Palomar, together with the identity of the auditing firm that prepared such reports. [C&H Annotation — Ostrowski]: This is the most sensitive and strategically important demand category. The response to this demand will substantially shape the Coalition's assessment of whether Quorum exercised ad

1. The date on which unauthorized access to the systems containing the affected data first occurred.

2. A description of the method by which unauthorized access was achieved, including the specific attack vector, the vulnerability or vulnerabilities exploited, and the systems affected.

3. The duration of the period of unauthorized access.

4. The date on which the incident was first detected and the identity of the individual or entity that first detected the incident.

5. The date on which Quorum was first notified by Palomar of the incident, the method by which such notification was provided, and the identity of the individuals involved.

6. The date on which Quorum engaged outside legal counsel in connection with the incident.

7. The date on which Quorum engaged a third-party forensic investigation firm, or caused such a firm to be engaged, in connection with the incident.

8. The date on which the forensic investigation commenced and the date on which it was completed.

9. A summary of the findings of the forensic investigation, including the scope of data accessed or exfiltrated, the methods employed by the threat actor, and any indicators of compromise identified.

10. The identity of the forensic investigation firm retained, the date of its retention, and whether the firm was retained by Quorum, by Palomar, or jointly.

11. Copies of any preliminary and final forensic investigation reports prepared in connection with the incident. If the Company withholds any such reports on the basis of attorney-client privilege or work product protection, the Company should provide a detailed factual summary of the investigation findings and a privilege log entry identifying each withheld document. [C&H Annotation — Ostrowski]: This demand present

1. The total number of individuals whose personal information was compromised as a result of the incident, broken down by state of residence.

2. A detailed description of the types of personal information that were compromised, including but not limited to: full names, Social Security numbers, dates of birth, driver's license or state identification numbers, financial account information (including bank account and routing numbers), payment card numbers, and any protected health information as defined under the Health Insurance Portability and Accountabili

3. The number of individuals affected by each category of compromised data.

4. A description of the data mining and affected-individual identification process used to determine which individuals were affected and what categories of data were compromised for each affected individual, including the identity of any vendor retained to perform data mining, the date such vendor was engaged, and the date the identification process was completed. [C&H Annotation — Burke]: This demand should be respo

1. Copies of all versions of consumer notification letters sent to affected individuals, including any state-specific versions required by applicable law.

2. The dates on which notification mailings were initiated and completed.

3. The total number of notifications mailed, broken down by notification letter version and by state.

4. A description of any substitute notice provided in connection with the incident, including any website postings or media notices.

5. A description of the credit monitoring and identity theft protection services offered to affected individuals, including the identity of the service provider, the duration of the services offered, and the enrollment rate as of the date of the Company's response.

6. A description of the call center operations established in connection with the incident, including the identity of the call center vendor, the hours of operation, the total call volume received to date, and a summary of the most common categories of inquiries received. [C&H Annotation — Burke]: We have complete documentation to respond to this demand. Key details: Notification letter versions: Five (5) distinct ve

1. A complete list of all state and federal regulatory bodies to which the Company submitted notifications of the data security incident, including the specific date of each notification and the statutory or regulatory provision under which each notification was submitted.

2. Copies of all regulatory notification filings submitted by the Company in connection with the incident.

3. The identification of any other regulatory inquiries, investigations, examinations, or proceedings that have been initiated or are pending in connection with the incident, by any federal, state, or local governmental authority. [C&H Annotation — Burke]: All regulatory notifications were filed between August 14 and August 25, 2023, and all filings were timely under the applicable statutes and regulations. Below is

1. A comprehensive description of the Company's written information security program ("WISP" or "ISP"), including: (a) The governance structure of the program, including the role of the Board of Directors or any committee thereof in overseeing data security and privacy, the executive or officer with primary accountability for the program, and the reporting structure; (b) The Company's risk assessment methodology, inc

2. A description of any third-party assessments, penetration tests, audits, or certifications of the Company's own information security program conducted within the twenty-four (24) months prior to the date of the incident, including the identity of the firm that conducted each assessment and a summary of findings and recommendations.

3. The identity of the Company's external auditor and a description of any cybersecurity-focused or IT audit procedures performed by the external auditor in connection with the Company's most recent annual audit. [C&H Annotation — Ostrowski]: This demand is significant because it probes Quorum's own security posture, as distinguished from Palomar's. This is where we demonstrate that Quorum maintained a robust, well-r

1. A comprehensive description of the Company's vendor risk management program, including: (a) The process by which vendors with access to personal information are identified, categorized, and risk-rated; (b) The due diligence conducted before onboarding new data-processing vendors, including any security questionnaires, assessments, or reviews required prior to contract execution; (c) The contractual data security r

2. Specific information regarding all vendor risk management activities conducted with respect to Palomar Data Solutions, Inc., including the dates of any assessments, audits, reviews, questionnaires, or other oversight activities, and a summary of any findings, deficiencies noted, or remediation required. [C&H Annotation — Ostrowski]: Priya Deshmukh (VP, Vendor Risk Management) is the primary source for this respons

1. A description of the steps taken to contain and remediate the breach at Palomar, including the timeline for containment and any measures taken to verify that the threat actor's access was terminated.

2. A description of any changes made to the Company's own information security program as a result of the incident, including any enhancements to technical, administrative, or physical safeguards.

3. A description of any changes made to the Company's vendor risk management practices as a result of the incident, including any new policies, procedures, or oversight mechanisms implemented or planned.

4. A description of any enhancements to the contractual data security requirements imposed on Palomar, including any amendments to the MSA executed or in negotiation since the incident.

5. A description of any personnel changes, organizational restructuring, or disciplinary actions taken in connection with the incident.

6. A timeline for the implementation of all remedial measures described above, indicating which measures have been completed and which are in progress or planned. [C&H Annotation — Ostrowski]: This demand is an opportunity to demonstrate Quorum's proactive, comprehensive response to the incident. The remedial actions taken to date are extensive and should be presented in a structured, chronological format. Key remedi

1. A description of any contractual remedies pursued by the Company against Palomar, including any demands for indemnification, any exercise of termination rights, and any claims asserted or threatened.

2. A description of any changes to the contractual relationship between the Company and Palomar, including any amendments to the MSA or any new agreements entered into since the incident.

3. The current status of the vendor relationship between the Company and Palomar, including confirmation of whether Palomar continues to process the Company's data and, if so, a description of the safeguards in place to protect such data.

4. A description of the steps Palomar has taken to remediate the security deficiencies that led to the breach, to the extent known to the Company.

5. Confirmation of whether the Company has conducted, or plans to conduct, an independent security assessment of Palomar's data processing environment. [C&H Annotation — Ostrowski]: This demand is closely related to Demand 9 and should be coordinated to avoid redundancy while providing the specific vendor-focused information requested. Key facts for the response: (1) Contractual breaches by Palomar: Palomar breached