Contract analysis

I. COVER LETTER August 14, 2023 Richard Nakamura, Examiner Financial Analysis Division, Cybersecurity Unit Connecticut Insurance Department 153 Market Street Hartford, CT 06103 Re: Notification of Cybersecurity Event Pursuant to Conn. Gen. Stat. § 38a-999b — Quorum Insurance Holdings Corp. Calderwood & Harkness Matter No.: 1025-00006 Dear Mr. Nakamura: 1.1 Purpose of Filing Calderwood & Harkness LLP respectfully subm

II. IDENTIFICATION OF REPORTING ENTITY 2.1 Licensee Information The reporting entity filing this notification is Quorum Insurance Holdings Corp. ("Quorum" or the "Company"). The following information is provided to identify the reporting entity: Quorum is a Top-25 U.S. insurance holding company, as measured by annual direct premiums written. Quorum conducts its insurance operations through a network of operating subs

III. DESCRIPTION OF THE CYBERSECURITY EVENT 3.1 Summary of the Event The cybersecurity event that is the subject of this notification originated at Quorum's third-party claims-processing vendor, Palomar Data Solutions, Inc. ("Palomar"), a Texas corporation with its principal place of business at 7100 Greenville Avenue, Suite 450, Dallas, TX 75231. Palomar provides claims data processing, document management, and anal

IV. DESCRIPTION OF INFORMATION INVOLVED 4.1 Types of Personal Information Compromised The forensic investigation has confirmed that the following categories of personal information were compromised in this cybersecurity event: Personally Identifiable Information (PII). The compromised data includes the following PII elements: full names (first and last), dates of birth, Social Security numbers, and driver's license n

V. ACTIONS TAKEN IN RESPONSE TO THE CYBERSECURITY EVENT 5.1 Forensic Investigation Upon being notified of the security incident by Palomar on April 21, 2023, Quorum took immediate steps to assess the nature and scope of the incident and to engage appropriate external resources. Following an internal preliminary assessment, Quorum engaged Calderwood & Harkness LLP as outside counsel on May 4, 2023, and Calderwood & Ha

VI. VENDOR ACCOUNTABILITY MEASURES 6.1 Contractual Framework and Vendor Obligations The relationship between Quorum and Palomar Data Solutions, Inc. is governed by a Master Services Agreement dated November 12, 2019 (the "MSA"), as amended by Amendment 1, dated March 3, 2021, and Amendment 2, dated September 15, 2022. The MSA establishes the terms and conditions under which Palomar provides claims data processing, do

VII. QUORUM'S INFORMATION SECURITY PROGRAM 7.1 Governance Structure Quorum maintains a comprehensive information security program designed to protect the confidentiality, integrity, and availability of the Company's information assets and the personal information of its policyholders, claimants, employees, and other stakeholders. The information security program is structured with executive-level oversight and is int

VIII. CONCLUSION AND COOPERATION COMMITMENT Quorum Insurance Holdings Corp. respectfully submits this notification to the Connecticut Insurance Department in compliance with Section 38a-999b of the Connecticut General Statutes. Quorum takes the protection of its policyholders' and claimants' personal information with the utmost seriousness and deeply regrets the impact of this cybersecurity event on the individuals w

IX. SIGNATURE Respectfully submitted, CALDERWOOD & HARKNESS LLP By: ________ Kevin Ostrowski, Partner Privacy & Data Security Practice Group Calderwood & Harkness LLP 1700 K Street NW, Suite 900 Washington, D.C. 20006 Telephone: (202) 555-8100 Facsimile: (202) 555-8101 Email: kostrowski@calderwoodharkness.com On behalf of Quorum Insurance Holdings Corp. Date: August 14, 2023

X. ENCLOSURES / EXHIBITS LIST The following enclosures are submitted with this notification filing: Enclosure 1: Sample Consumer Notification Letter — General PII Version This enclosure contains the template notification letter to be sent to all 318,247 affected individuals, notifying them of the cybersecurity event and describing the types of personally identifiable information involved (names, dates of birth, Socia