PRIVILEGED AND CONFIDENTIAL — ATTORNEY-CLIENT PRIVILEGE / ATTORNEY WORK PRODUCT — PREPARED AT THE DIRECTION OF COUNSEL — DO NOT DISTRIBUTE WITHOUT PRIOR AUTHORIZATION
MEMORANDUM
July 21, 2023
TO: Franklin Reeves, Chair, Audit Committee, Board of Directors, Quorum Insurance Holdings Corp.
FROM: Kevin Ostrowski, Responsible Partner, Privacy & Data Security, Calderwood & Harkness LLP
CC: Thomas R. Whitfield, General Counsel, Quorum Insurance Holdings Corp.; Margaret D. Calloway, Chief Executive Officer, Quorum Insurance Holdings Corp.
RE: Data Security Incident — Forensic Investigation Findings, Consumer and Regulatory Notification Plan, Cost Estimates, and Vendor Accountability Update
MATTER NO.: 1025-00006
PRIVILEGE STATEMENT: This memorandum is prepared by Calderwood & Harkness LLP at the direction of and for the benefit of Quorum Insurance Holdings Corp. ("Quorum" or the "Company") in connection with the provision of legal advice regarding the data security incident originating from Palomar Data Solutions, Inc. ("Palomar"). This memorandum and its contents are protected by the attorney-client privilege and constitute attorney work product prepared in anticipation of litigation and regulatory proceedings. Distribution should be limited to authorized recipients only. Any unauthorized disclosure, reproduction, or distribution of this memorandum or its contents may constitute a waiver of applicable privileges. Recipients are directed not to forward, copy, or otherwise disseminate this memorandum without prior written authorization from the General Counsel of Quorum Insurance Holdings Corp.
Right-click to update Table of Contents
I. EXECUTIVE SUMMARY
The purpose of this memorandum is to provide the Audit Committee of the Board of Directors of Quorum Insurance Holdings Corp. with a comprehensive update on the forensic investigation findings, the planned consumer and regulatory notification strategy, estimated incident response costs, the Company's insurance coverage posture, and our assessment of the Company's vendor accountability position with respect to Palomar Data Solutions, Inc. This memorandum supplements and updates the Board Audit Committee Briefing Memo dated May 11, 2023 (the "Initial Briefing Memo"), which provided the Audit Committee with an initial report regarding the data security incident first identified by Palomar on April 18, 2023.
Since the date of the Initial Briefing Memo, the following key developments have occurred:
• Forensic Investigation Completed. Graystone Forensics LLC ("Graystone"), the forensic investigation firm retained by Calderwood & Harkness under the attorney-client privilege umbrella, has completed its privileged forensic investigation. Graystone issued its final forensic report on July 14, 2023, and Calderwood & Harkness provided a summary and legal analysis of the final forensic findings to the Quorum legal and security team on July 18, 2023.
• Confirmed Scope of the Breach. The forensic investigation has confirmed that the data security incident affected a total of 318,247 individuals across 29 states and the District of Columbia. The compromised data includes personally identifiable information ("PII") for all 318,247 affected individuals, financial information (including bank account numbers and payment card numbers) for a subset of 84,619 individuals, and protected health information ("PHI") within the meaning of the Health Insurance Portability and Accountability Act ("HIPAA") for a subset of 41,203 individuals.
• Notification Analysis Completed. Calderwood & Harkness has completed its comprehensive 50-state breach notification law analysis, HIPAA breach notification analysis, and state-specific compliance assessments for all 29 affected states and the District of Columbia. Consumer and regulatory notifications are planned to begin in mid-August 2023.
• Vendor Accountability. A formal breach of contract demand letter was sent to Palomar Data Solutions via its outside counsel, Mercer, Haight & Dunlop LLP, on June 20, 2023, demanding full indemnification for all incident response costs. Palomar's response, received July 7, 2023, disputes causation and the scope of its liability and offers a $1,500,000 goodwill credit against future service fees, which Calderwood & Harkness considers inadequate. Negotiations are continuing.
• Insurance Coverage. The insurance claim filed with Atlas Mutual Insurance Company on May 8, 2023 has been acknowledged, and Atlas has confirmed coverage for qualifying incident response costs in excess of the $2,500,000 self-insured retention ("SIR"). A precautionary notice has also been provided to Pinnacle Surplus Lines Insurance Corp. under the excess policy.
• Estimated Total Costs. The total estimated incident response costs are approximately $8,230,250, inclusive of forensic investigation fees, notification and credit monitoring costs, crisis communications, legal fees, and internal remediation costs.
We wish to emphasize that the forensic investigation has confirmed that the breach originated entirely from Palomar Data Solutions' network environment. No intrusion into Quorum's own networks, systems, or infrastructure has been identified at any point during the investigation. Quorum's exposure arises solely from the fact that Palomar processes Quorum policyholder and claimant data under the Master Services Agreement and was the custodian of affected data at the time of the breach.
The sections that follow provide detailed analysis of each of these topics.
II. BACKGROUND — INCIDENT SUMMARY
This Section provides a brief recap of the incident for Audit Committee context. A more detailed background was provided in the Initial Briefing Memo dated May 11, 2023.
Quorum outsources claims data processing for its personal lines division to Palomar Data Solutions, Inc. ("Palomar"), a Texas corporation headquartered at 7100 Greenville Avenue, Suite 450, Dallas, Texas 75231. The outsourcing relationship is governed by a Master Services Agreement originally executed on November 12, 2019 (the "MSA"), as amended by Amendment 1 (effective March 3, 2021) and Amendment 2 (effective September 15, 2022). Amendment 1 expanded Palomar's scope of services to include data processing for Quorum's QuorumEdge platform and increased the annual contract value from $14.2 million to $16.3 million. Amendment 2 updated the Data Security Exhibit (Exhibit D) to the MSA, added a requirement that Palomar obtain and maintain a SOC 2 Type II audit report, and updated the minimum cyber insurance requirements applicable to Palomar. Palomar is currently Quorum's second-largest claims processing vendor by revenue.
On or about March 14, 2023, a threat actor exploited CVE-2023-0669, a known remote code execution vulnerability in a GoAnywhere MFT file transfer appliance operated by Palomar within its network environment, to gain initial unauthorized access to Palomar's systems. The threat actor subsequently conducted lateral movement within Palomar's internal network, ultimately accessing the claims processing environment containing Quorum policyholder and claimant data. The threat actor maintained persistent access and exfiltrated data over an approximately 35-day window from March 14, 2023 through April 18, 2023.
On April 18, 2023, Palomar's security operations center ("SOC") detected anomalous outbound data transfers that triggered an internal alert. Palomar initiated its internal incident response procedures and, following an initial investigation, notified Quorum of the incident on April 21, 2023. Notably, this notification occurred approximately 24 hours past the contractual 48-hour notification deadline specified in Section 9.4 of the MSA, which requires Palomar to notify Quorum within 48 hours of discovering or reasonably suspecting a data security incident affecting Quorum data.
Upon receipt of Palomar's notification, Quorum's internal incident response team, led by Thomas R. Whitfield (General Counsel), Jennifer Liang (Chief Privacy Officer), and David Naranjo (Chief Information Security Officer), immediately convened and initiated Quorum's own incident response procedures. Calderwood & Harkness's engagement was formally opened on May 4, 2023, and Graystone Forensics LLC was retained under the attorney-client privilege umbrella on May 5, 2023 to conduct a forensic investigation into the nature, scope, and impact of the incident. An insurance claim was filed with Atlas Mutual Insurance Company on May 8, 2023, under Cyber Liability Policy No. CYB-2023-041587 (Claim No. CYB-CLM-2023-05892).
III. FORENSIC INVESTIGATION — FINAL FINDINGS
A. Investigation Overview
Graystone Forensics LLC ("Graystone"), based in Tysons Corner, Virginia, conducted the forensic investigation under the direction and at the request of Calderwood & Harkness in order to preserve the attorney-client privilege and attorney work product protections applicable to the investigation and its findings. The investigation was led by Dr. Nolan Briggs, Managing Director of Graystone's Incident Response practice, and Kendra Faulkner, Senior Forensic Analyst. The Graystone team worked in coordination with Palomar's internal IT security personnel and with access to relevant logs, system images, and network traffic data from Palomar's environment.
Graystone issued its preliminary findings report on June 2, 2023. The preliminary findings confirmed the exfiltration of structured data files from Palomar's claims processing environment and provided an initial, though incomplete, assessment of the scope of affected data. Calderwood & Harkness provided the Quorum legal and security team — specifically Thomas R. Whitfield (General Counsel), Jennifer Liang (Chief Privacy Officer), and David Naranjo (Chief Information Security Officer) — with a detailed analysis of the preliminary findings on June 5, 2023.
Following additional forensic analysis, data recovery efforts, and data mining activities, Graystone issued its final forensic report on July 14, 2023 (the "Final Report"). Calderwood & Harkness provided a comprehensive summary and legal analysis of the Final Report to Quorum on July 18, 2023. The key findings of the Final Report are summarized below.
B. Attack Vector and Timeline
The Final Report confirms that the threat actor exploited CVE-2023-0669, a remote code execution vulnerability in Severin Corporation's GoAnywhere MFT file transfer appliance, which was deployed within Palomar's network to facilitate secure file transfers between Palomar and its clients, including Quorum. CVE-2023-0669 was publicly disclosed in early February 2023, and a vendor patch was made available by Severin Corporation shortly thereafter. The vendor patch was publicly available prior to the date of the threat actor's initial exploitation of the vulnerability on or about March 14, 2023.
Under Exhibit D (Data Security Exhibit) to the MSA, as amended by Amendment 2, Palomar was contractually required to apply vendor-issued patches for critical and high-severity vulnerabilities within 30 days of the date the vendor patch became publicly available. The failure to apply the patch for CVE-2023-0669 within this 30-day window constitutes a clear contractual breach. Moreover, as noted below, this failure was the proximate cause of the unauthorized access and subsequent data exfiltration.
The forensic timeline, as established by Graystone, is as follows:
• On or about March 14, 2023: The threat actor exploited CVE-2023-0669 to gain initial unauthorized access to Palomar's GoAnywhere MFT appliance. The threat actor deployed a web shell on the compromised appliance, establishing a persistent backdoor for ongoing access.
• Approximately March 14–20, 2023: The threat actor conducted reconnaissance of Palomar's internal network and performed lateral movement from the GoAnywhere MFT appliance to other systems within Palomar's environment, including the claims processing servers hosting Quorum policyholder and claimant data.
• Approximately March 21 – April 18, 2023: The threat actor staged and exfiltrated structured data files from the claims processing environment. The exfiltration was conducted in multiple batches over this period, utilizing encrypted channels to evade detection by Palomar's network monitoring tools.
• April 18, 2023: Palomar's security operations center detected anomalous outbound data transfers associated with the exfiltration activity. Palomar initiated its internal incident response procedures and began an internal investigation.
• April 21, 2023: Palomar notified Quorum of the incident, approximately 72 hours after Palomar's SOC initially detected the anomalous activity and approximately 24 hours past the contractual 48-hour notification deadline under MSA Section 9.4.
The total period of unauthorized access was approximately 35 days, from March 14, 2023 through April 18, 2023.
C. Scope of Compromised Data
The Final Report confirms the following scope of compromised data:
Total Affected Individuals: 318,247 individuals across 29 states and the District of Columbia.
The compromised data falls into three categories, with overlapping subsets:
• Personally Identifiable Information (PII): The data compromised for all 318,247 affected individuals includes full names, dates of birth, Social Security numbers, and driver's license numbers. This information was contained in the structured claims data files maintained by Palomar in connection with its claims processing services for Quorum's personal lines division.
• Financial Information: For a subset of 84,619 individuals, the compromised data also includes bank account numbers and/or payment card numbers associated with premium payments, claims disbursements, or direct deposit information. This subset is drawn from policyholders and claimants whose financial account information was stored in the claims processing environment.
• Protected Health Information (PHI): For a subset of 41,203 individuals, the compromised data also includes protected health information within the meaning of HIPAA, including health conditions, diagnosis codes (ICD-10), and treatment information associated with workers' compensation claims and health-related insurance claims processed by Palomar on behalf of Quorum.
At the time of this memorandum, the data mining and affected individual identification process is nearing completion and is expected to be finalized by August 4, 2023. Calderwood & Harkness will confirm the final affected individual counts upon completion of the data mining process. We do not anticipate material changes to the figures reported above, but minor adjustments (on the order of a few hundred individuals) are possible as the final deduplication and validation steps are completed.
Importantly, Graystone's investigation found no evidence whatsoever that Quorum's own network, systems, databases, or infrastructure were compromised, accessed, or targeted by the threat actor. The breach was entirely within Palomar's network environment, and all compromised data was exfiltrated from systems under Palomar's custody and control.
D. State-by-State Breakdown of Affected Individuals
The following table summarizes the geographic distribution of affected individuals across all 29 affected states and the District of Columbia:
As the table reflects, ten states each have more than 10,000 affected residents. Connecticut, Quorum's headquarters state, has the largest number of affected residents at 52,114, followed by New York (47,831) and California (38,206). The concentration of affected individuals in these states, combined with the heightened regulatory posture of the attorneys general in these jurisdictions, warrants particular attention in the notification planning and regulatory engagement strategy, as discussed further below.
A complete state-by-state breakdown, including affected individual counts for each of the remaining 19 states and the District of Columbia, is maintained in Calderwood & Harkness's working files and is available upon request.
IV. NOTIFICATION OBLIGATION ANALYSIS
A. State Breach Notification Laws
Calderwood & Harkness completed a comprehensive 50-state breach notification law survey on June 8, 2023, identifying the specific statutory requirements, triggers, timelines, content requirements, and regulatory filing obligations applicable in each jurisdiction. On July 20, 2023, Calderwood & Harkness completed its notification trigger analysis, confirming that breach notifications are required in all 29 states where affected individuals reside, as well as the District of Columbia.
The notification triggers are based on the specific data elements compromised in the incident. Because the compromised PII includes Social Security numbers and driver's license numbers for all 318,247 affected individuals, the notification trigger is met in every affected jurisdiction. In addition, the compromise of financial account numbers and protected health information triggers additional or enhanced notification requirements in certain states.
Calderwood & Harkness has prepared detailed state-specific compliance assessments, which are maintained in separate memoranda in our working files. The key jurisdictional requirements are summarized below:
• Connecticut (52,114 affected residents): Conn. Gen. Stat. § 36a-701b requires notification to the Connecticut Attorney General no later than the time notification is provided to affected individuals. The statute requires notification to affected residents "without unreasonable delay" but no later than 60 days after discovery of the breach. Notification must include a description of the incident, the types of information compromised, and information about how affected individuals can protect themselves. As Quorum's headquarters state, Connecticut is a priority jurisdiction.
• New York (47,831 affected residents): N.Y. Gen. Bus. Law § 899-aa, as amended by the Stop Hacks and Improve Electronic Data Security Act ("SHIELD Act"), requires notification to the New York Attorney General, the Department of State, and the Division of State Police. The notification must be made "in the most expedient time possible and without unreasonable delay." Because the number of affected New York residents exceeds 5,000, Quorum must also submit a detailed written notification to the Attorney General describing the timing, content, and distribution of the notices and the approximate number of affected individuals.
• California (38,206 affected residents): Cal. Civ. Code § 1798.82 requires notification to the California Attorney General because more than 500 California residents are affected. Notification must be made "in the most expedient time possible and without unreasonable delay." The statute prescribes specific content requirements and a prescribed notice format. In addition, because the compromised data includes health-related information for a subset of California residents, the California Confidentiality of Medical Information Act ("CMIA") (Cal. Civ. Code § 56.06) imposes additional requirements, including an obligation to report to the California Department of Public Health in certain circumstances. Calderwood & Harkness has analyzed the CMIA requirements and will ensure compliance.
• Massachusetts (10,217 affected residents): Mass. Gen. Laws ch. 93H, § 3 requires notification to both the Massachusetts Attorney General and the Director of the Office of Consumer Affairs and Business Regulation. Massachusetts has among the most prescriptive breach notification content requirements of any state, including a requirement that the notification letter include whether Quorum maintains a written information security program as required by 201 CMR 17.00. Calderwood & Harkness will ensure that the Massachusetts-specific notification letters comply with all applicable requirements.
• All Other Affected States and the District of Columbia: Calderwood & Harkness has analyzed the breach notification statutes in all remaining 25 affected jurisdictions, and all required notifications will be filed in a timely manner consistent with the regulatory notification timeline set forth in Section V.B below.
B. HIPAA Breach Notification
The subset of 41,203 individuals whose protected health information was compromised triggers notification obligations under the HIPAA Breach Notification Rule, codified at 45 C.F.R. §§ 164.404–164.408. Under the Rule, Quorum is required to provide notification to the following parties:
• Individual Notice (45 C.F.R. § 164.404): Written notification to each of the 41,203 affected individuals must be provided without unreasonable delay and in no case later than 60 days following the date of discovery of the breach. The notification must contain all elements specified in 45 C.F.R. § 164.404(c), including a brief description of the breach, the types of information involved, the steps individuals should take to protect themselves, a brief description of what the entity is doing to investigate and mitigate the breach, and contact information for individuals to ask questions.
• HHS Office for Civil Rights (45 C.F.R. § 164.408): Because the breach affects more than 500 individuals, notification to the Secretary of Health and Human Services must be provided contemporaneously with the individual notices. The notification is filed through the HHS breach reporting portal and directed to the HHS Office for Civil Rights, Region I (Boston).
• Media Notice (45 C.F.R. § 164.406): Because the breach affects more than 500 residents of a state or jurisdiction, Quorum must provide notice to prominent media outlets serving the affected states. Calderwood & Harkness is coordinating with BrightPath Consulting Group Inc. to ensure that the media notice is issued in a manner that satisfies the regulatory requirement while minimizing reputational impact.
Calderwood & Harkness has prepared HIPAA-compliant individual notification letters for the PHI subset, incorporating all required elements under 45 C.F.R. § 164.404(c).
C. Connecticut Insurance Data Security Law
In addition to the general breach notification requirements under Conn. Gen. Stat. § 36a-701b, Quorum is separately subject to the Connecticut Insurance Data Security Law (Conn. Gen. Stat. § 38a-999b), which imposes specific cybersecurity event notification requirements on insurance licensees. Under this statute, Quorum must notify the Connecticut Insurance Department of the cybersecurity event. The notification must include, among other things, a description of the event, the date of the event, a description of the types of information involved, the number of Connecticut consumers affected, and a description of the Company's investigation and remediation efforts.
Calderwood & Harkness will file the notification with Richard Nakamura, Financial Analysis Division, Cybersecurity Unit of the Connecticut Insurance Department. This filing is separate from and in addition to the notification to the Connecticut Attorney General under Conn. Gen. Stat. § 36a-701b, and both filings are planned for August 14, 2023 as set forth in the regulatory notification timeline below.
V. CONSUMER AND REGULATORY NOTIFICATION PLAN
A. Consumer Notification Strategy
Calderwood & Harkness, in coordination with Quorum's legal, privacy, and corporate communications teams, has developed a comprehensive consumer notification strategy designed to achieve timely compliance with all applicable state, federal, and sector-specific notification requirements. The strategy encompasses tailored notification letters, credit monitoring services, a dedicated call center, substitute notice, and a public-facing website posting. The key elements are as follows:
Notification Letter Versions. Calderwood & Harkness has drafted multiple versions of consumer notification letters, tailored to the specific data elements compromised and to the requirements of key jurisdictions. The notification letter versions are as follows:
• General PII Version: For individuals whose personally identifiable information (name, date of birth, Social Security number, and/or driver's license number) was compromised but who are not in the financial information or PHI subsets. This version includes standard guidance on credit monitoring enrollment, fraud alerts, and identity theft protection.
• SSN + Financial Data Version: For the 84,619 individuals whose compromised data includes financial information (bank account numbers and/or payment card numbers) in addition to PII. This version includes enhanced guidance on monitoring financial accounts, placing fraud alerts with financial institutions, and reviewing account statements for unauthorized transactions.
• PHI Version (HIPAA-Compliant): For the 41,203 individuals whose protected health information was compromised. This version incorporates all elements required by 45 C.F.R. § 164.404(c) and includes additional guidance specific to the potential misuse of health information, including advice regarding monitoring Explanation of Benefits statements and reporting suspected medical identity theft.
• California-Specific Version: Adapted for 38,206 California residents to comply with the format and content requirements of Cal. Civ. Code § 1798.82 and, where applicable, the California Confidentiality of Medical Information Act. This version uses the prescribed California notification format.
• Massachusetts-Specific Version: Adapted for 10,217 Massachusetts residents to comply with the specific content requirements of Mass. Gen. Laws ch. 93H, § 3 and 201 CMR 17.00, including the required statement regarding Quorum's maintenance of a written information security program.
Credit Monitoring and Identity Theft Protection Services. All notification letters will offer affected individuals 24 months of complimentary credit monitoring and identity theft protection services, including credit report monitoring, fraud alerts, identity restoration assistance, and a $1,000,000 identity theft insurance policy. These services will be provided through a third-party vendor contracted by Clearfield Notification Services LLC. Based on industry benchmarks and Calderwood & Harkness's experience with comparable incidents, we estimate an approximate 40% enrollment take-rate, resulting in approximately 127,299 enrollees.
Notification Mailing Logistics. Notification mailings will be handled by Clearfield Notification Services LLC ("Clearfield"), based in Phoenix, Arizona, which has been retained under the attorney-client privilege umbrella. Jerome Tillman, Account Manager at Clearfield, is the primary point of contact. Clearfield specializes in large-scale breach notification mailings and has handled mailings for incidents of comparable and greater scale. The planned mailing window is August 18 through September 15, 2023, an approximately 28-day rolling period during which notification letters will be printed, personalized, and mailed via first-class U.S. mail to each affected individual at his or her last known address.
Substitute Notice and Website Posting. In addition to individual written notice, Quorum will publish a substitute notice on its corporate website (www.quoruminsurance.com) as required by applicable state breach notification statutes for individuals whose current mailing addresses cannot be determined. Calderwood & Harkness has prepared the website notice language, which has been reviewed by BrightPath Consulting Group Inc. for consistency with the overall communications strategy.
Call Center. Clearfield will operate a dedicated toll-free call center for a 12-week window beginning on the first day of the notification mailing (August 18, 2023) through approximately November 10, 2023. The call center will be staffed by trained representatives who will respond to inquiries from affected individuals regarding the incident, the notification process, and the credit monitoring enrollment process. Calderwood & Harkness has prepared the call center script and a comprehensive frequently asked questions ("FAQ") document, both of which have been reviewed and approved by Quorum's legal and privacy teams.
B. Regulatory Notification Timeline
Regulatory notifications are planned to be filed on a rolling basis beginning August 14, 2023. The planned timeline is as follows:
All filings are planned to meet or exceed applicable statutory deadlines. In jurisdictions that require notification to the regulator before or concurrently with consumer notification, the regulatory filings will be submitted before the commencement of the consumer notification mailing window on August 18, 2023.
Calderwood & Harkness will maintain a comprehensive regulatory notification tracker and confirmation log, documenting the date, method, and content of each filing, as well as any acknowledgment or confirmation received from the applicable regulatory agency. This tracker will be made available to the Audit Committee upon request.
C. Crisis Communications
BrightPath Consulting Group Inc. ("BrightPath"), a crisis communications firm with extensive experience in data breach response, has been retained to manage the external and internal communications strategy in connection with the incident. Meredith Ashford, Managing Director at BrightPath, is the engagement lead. BrightPath is working in close coordination with Jennifer Liang (Chief Privacy Officer) and Quorum's corporate communications team.
BrightPath is currently preparing the following communications materials:
• A public press statement to be issued in connection with the regulatory filings and consumer notification mailings, designed to provide a clear, factual, and measured account of the incident and Quorum's response.
• Internal employee communications, including a company-wide email from the CEO and a set of talking points for managers and customer-facing personnel.
• Investor-facing disclosure language, coordinated with Calderwood & Harkness's SEC disclosure analysis, for potential use in earnings calls, investor inquiries, and SEC filings.
• Social media monitoring and response protocols to address public commentary and misinformation.
All communications materials are being developed in close coordination with Calderwood & Harkness to ensure legal accuracy, consistency with regulatory filings, and preservation of applicable privileges.
VI. ESTIMATED INCIDENT RESPONSE COSTS
A. Cost Breakdown
The following table summarizes the estimated and incurred costs associated with the incident response as of the date of this memorandum:
A more detailed breakdown of the Clearfield and Calderwood & Harkness cost components is provided below.
Clearfield Notification Services LLC — $3,214,500 (estimated)
• Notification printing and mailing: $636,000, based on 318,247 individual notification letters at an estimated per-unit cost of approximately $2.00 per letter (inclusive of printing, personalization, postage, and address verification).
• Call center operations (12-week window): $478,500, based on Clearfield's staffing model for a breach of this scale, including trained representatives, supervisory staff, quality assurance, and telecommunications infrastructure.
• Credit monitoring enrollment (24 months): $2,100,000, representing a negotiated flat fee for the estimated 40% take-rate (approximately 127,299 enrollees). This rate reflects a volume discount negotiated by Clearfield with its credit monitoring subcontractor and is consistent with market rates for engagements of this size.
Calderwood & Harkness LLP — $2,163,750 (estimated total)
The estimated legal fees reflect approximately 2,400 hours of attorney and professional time at a blended effective rate of approximately $901.56 per hour. The individual billing rates of the attorneys primarily staffed on this matter are as follows:
• Kevin Ostrowski, Partner: $1,250/hour
• Rachel Bernstein, Partner: $1,175/hour
• Michael Burke, Senior Associate: $825/hour
• Sarah Hendricks, Associate: $650/hour
This estimate covers all legal services rendered and anticipated to be rendered in connection with the incident, including forensic investigation management, notification analysis, notification drafting, regulatory filings, vendor accountability analysis and negotiations, insurance claim coordination, SEC disclosure analysis, and Audit Committee briefings. The estimate does not include legal fees that may be incurred in connection with regulatory defense if a multistate AG inquiry or other regulatory enforcement action materializes (discussed in Section IX below).
Quorum Internal Costs — $620,000 (estimated)
Quorum's estimated internal costs include IT remediation and security enhancement measures, employee overtime for incident response team members, internal legal and compliance team hours, and related operational expenses. This estimate was prepared by David Naranjo (CISO) in coordination with Calderwood & Harkness and is subject to refinement as the incident response progresses.
B. Insurance Coverage
Quorum maintains a two-layer cyber insurance program, consisting of a primary policy and an excess policy, as summarized below.
Primary Policy — Atlas Mutual Insurance Company
• Insurer: Atlas Mutual Insurance Company
• Policy Number: CYB-2023-041587
• Coverage Period: January 1, 2023 – January 1, 2024
• Per-Occurrence Limit: $15,000,000
• Self-Insured Retention (SIR): $2,500,000
• Coverage Scope: The policy covers first-party forensic investigation costs, notification costs, credit monitoring and identity theft protection costs, crisis communications and public relations costs, regulatory defense costs, and regulatory fines and penalties (where insurable under applicable law).
• Claim Number: CYB-CLM-2023-05892
• Claim Filed: May 8, 2023
• Status: Atlas has acknowledged the claim and confirmed coverage for qualifying incident response costs in excess of the $2,500,000 SIR. Atlas's assigned claims adjuster is Paul Enriquez.
Excess Policy — Pinnacle Surplus Lines Insurance Corp.
• Insurer: Pinnacle Surplus Lines Insurance Corp.
• Policy Number: XS-CYB-2023-7812
• Coverage: $25,000,000 in excess of $15,000,000 (total tower: $40,000,000)
• Terms: Follow-form to Atlas Mutual primary policy terms
• Precautionary Notice: Provided May 8, 2023 (Lisa Garner, Claims Contact)
• Status: At the current estimated cost level of $8,230,250, total costs remain well within the primary layer. The excess layer is unlikely to be implicated absent unforeseen cost escalation, such as might result from a significant regulatory fine, class action litigation, or material expansion of the scope of affected individuals.
Financial Exposure Summary
Based on the current estimated total incident response costs of $8,230,250, Quorum's financial exposure is summarized as follows:
A Common Interest Agreement was executed on May 10, 2023 between Quorum and Atlas Mutual Insurance Company to facilitate the sharing of privileged and work product–protected information between the parties in connection with the claim, while preserving the applicable privileges as against third parties.
Quorum's cyber-insurance broker is Whitmore Risk Advisors Inc. Sandra Whitmore-Kim, Lead Broker, is coordinating with Calderwood & Harkness and Quorum's risk management team to ensure that all claim documentation is properly submitted to Atlas and that Atlas is kept informed of developments in a timely manner.
VII. VENDOR ACCOUNTABILITY — PALOMAR DATA SOLUTIONS
A. Contractual Basis for Indemnification
As noted above, the outsourcing relationship between Quorum and Palomar is governed by the MSA dated November 12, 2019, as amended by Amendment 1 (effective March 3, 2021) and Amendment 2 (effective September 15, 2022). Calderwood & Harkness has conducted a thorough review of the MSA and its amendments to identify all contractual provisions relevant to Quorum's indemnification claim and vendor accountability position. The key provisions are summarized below:
• Data Security Exhibit (Exhibit D, as amended by Amendment 2): Exhibit D requires Palomar to implement and maintain "commercially reasonable" administrative, technical, and physical safeguards to protect the confidentiality, integrity, and availability of Quorum data in Palomar's custody and control. Among other specific requirements, Exhibit D requires Palomar to (i) apply vendor-issued patches for critical and high-severity vulnerabilities within 30 days of the date the vendor patch becomes publicly available; (ii) conduct annual penetration testing of its systems and provide Quorum with a summary of findings and remediation actions; and (iii) obtain and maintain a SOC 2 Type II audit report covering the controls relevant to the services provided to Quorum, with the first report due no later than March 31, 2023.
• Breach Notification Clause (Section 9.4): Section 9.4 requires Palomar to notify Quorum within 48 hours of discovering or reasonably suspecting a data security incident that involves or may involve Quorum data. The notification must include, at a minimum, a description of the incident, the date of discovery, the types of data believed to be affected, and the steps Palomar is taking to investigate and contain the incident. As noted herein, Palomar's notification on April 21, 2023 was approximately 24 hours late.
• Indemnification (Section 12.2): Under Section 12.2, Palomar agrees to indemnify, defend, and hold harmless Quorum and its affiliates, directors, officers, employees, and agents from and against any and all losses, damages, liabilities, costs, and expenses (including reasonable attorneys' fees) arising from or related to Palomar's breach of its data security obligations under the MSA, including Exhibit D. The indemnification obligation is subject to a liability cap equal to two times (2×) the trailing twelve-month fees paid by Quorum to Palomar under the MSA. Based on the current annual contract value of $16.3 million, the liability cap is $32,600,000.
• Insurance Requirements (Exhibit E): Exhibit E requires Palomar to maintain, at its own expense, a cyber liability insurance policy with a minimum per-occurrence limit of $10,000,000, naming Quorum as an additional insured. Calderwood & Harkness has requested confirmation from Palomar's counsel that Palomar's policy remains in force and that coverage has been confirmed; a response is pending.
• Termination for Cause (Section 14.2): Section 14.2 provides that either party may terminate the MSA upon material breach by the other party, subject to a 30-day cure period following written notice of the breach. Calderwood & Harkness's assessment is that Palomar's failure to timely patch the known vulnerability and its late breach notification constitute material breaches of the MSA that would support a termination for cause.
B. Palomar's Identified Contractual Breaches
Based on the findings of the forensic investigation and Calderwood & Harkness's analysis, Palomar committed the following contractual breaches:
1. Failure to Timely Patch. Palomar failed to apply the vendor-issued patch for CVE-2023-0669 within the 30-day window required by Exhibit D of the MSA. The patch was publicly available prior to the date of initial exploitation (on or about March 14, 2023). This failure was the direct and proximate cause of the threat actor's initial access to Palomar's network and the subsequent data exfiltration. This constitutes a breach of Palomar's data security obligations under Exhibit D.
2. Late Breach Notification. Palomar's notification to Quorum on April 21, 2023, approximately 72 hours after its SOC detected the anomalous activity on April 18, 2023, was approximately 24 hours past the contractual 48-hour notification deadline under Section 9.4 of the MSA. While the late notification did not itself cause the breach, it delayed Quorum's ability to initiate its own incident response procedures and engage outside counsel and forensic investigators.
C. Indemnification Demand and Palomar's Response
On June 20, 2023, Calderwood & Harkness sent a formal breach of contract demand letter to Catherine Langford at Mercer, Haight & Dunlop LLP, Palomar's outside counsel, demanding full indemnification under MSA Section 12.2 in the amount of $8,230,250, representing the total estimated incident response costs arising from Palomar's breach of its data security obligations.
Palomar's response was received on July 7, 2023. In its response, Palomar, through Mercer, Haight & Dunlop, disputes causation and the scope of its liability on the following grounds:
• Palomar contends that the threat actor's exploitation of CVE-2023-0669 constituted a "sophisticated cyberattack" that would have succeeded regardless of whether the patch had been timely applied, citing the threat actor's use of advanced lateral movement techniques and encrypted exfiltration channels.
• Palomar asserts that the 30-day patching requirement in Exhibit D is a "best efforts" obligation rather than an absolute deadline and that its patching practices were consistent with industry norms.
• Palomar offers a $1,500,000 "goodwill credit" against future service fees in lieu of full indemnification, characterizing the offer as a "reasonable compromise" reflecting Palomar's commitment to the ongoing business relationship.
Calderwood & Harkness's Assessment. We consider Palomar's causation defenses to be weak. The forensic evidence clearly establishes that the threat actor gained initial access through the unpatched CVE-2023-0669 vulnerability. Had Palomar applied the available patch within the contractually required 30-day window, the initial attack vector would not have been available. Palomar's characterization of the attack as "sophisticated" does not negate the fact that the initial exploitation relied on a known, patched vulnerability. Moreover, the 30-day patching requirement in Exhibit D is stated in mandatory terms ("shall") and is not qualified by "best efforts" or similar language.
The $1,500,000 goodwill credit offered by Palomar is inadequate, representing less than 20% of the total estimated incident response costs and falling well below the contractual indemnification cap of $32,600,000.
Calderwood & Harkness is preparing a rebuttal letter, anticipated to be sent on or about July 25, 2023, rejecting Palomar's causation defenses and the inadequate goodwill offer and reiterating Quorum's demand for full indemnification. Negotiations are expected to continue, and Calderwood & Harkness will provide the Audit Committee with updated negotiation strategy recommendations as the discussions progress.
We note that the indemnification cap of $32,600,000 provides substantial headroom above the current $8,230,250 claim, leaving room for potential cost increases (including regulatory defense costs, if any) while remaining within the contractual cap.
D. Vendor Relationship Considerations
The Audit Committee should be aware of the broader vendor relationship considerations that inform the Company's approach to the indemnification negotiations and the question of whether to terminate the MSA for cause:
• Palomar is Quorum's second-largest claims processing vendor by revenue, with an annual contract value of $16.3 million (post-Amendment 1). Palomar processes claims data for Quorum's personal lines division across multiple product lines and geographies, and the services provided by Palomar are operationally significant.
• The MSA has a remaining term through November 11, 2024. Termination of the MSA prior to the expiration of the term would require Quorum to transition the claims processing services to an alternative vendor or bring the services in-house, either of which would entail significant operational risk, cost, and disruption during the transition period.
• Calderwood & Harkness recommends that, regardless of the outcome of the indemnification negotiations, Quorum should impose enhanced security provisions and audit requirements on Palomar as a condition of the ongoing relationship. These may include, among other things, more frequent vulnerability scanning and patching verification, real-time security event monitoring with direct feed to Quorum's SOC, and additional contractual protections and remedies in the event of a future incident.
• Palomar's current SOC 2 Type II auditor is Kessler, Park & Associates CPA, PLLC (Vivian Park, Engagement Partner). Calderwood & Harkness recommends that Quorum request a copy of Palomar's most recent SOC 2 Type II report (if completed) and evaluate whether additional audit requirements or a change in auditor should be required.
• Quorum may wish to consider termination for cause under Section 14.2 as a negotiating lever, while maintaining operational readiness to execute such termination if negotiations fail to produce an acceptable indemnification outcome.
VIII. SEC DISCLOSURE CONSIDERATIONS
Calderwood & Harkness has prepared a separate SEC Disclosure Analysis Memorandum dated July 19, 2023 (the "SEC Memo"), which provides a detailed analysis of Quorum's disclosure obligations under Item 1.05 of Form 8-K (cybersecurity incident disclosure, effective December 2023) and the potential need to update risk factor disclosures in Quorum's upcoming 10-Q filing. The SEC Memo has been provided separately to Thomas R. Whitfield (General Counsel) and Margaret D. Calloway (CEO) and is available to the Audit Committee upon request.
Without restating the full analysis contained in the SEC Memo, we note the following key considerations relevant to the materiality assessment:
• The total estimated incident response costs of $8,230,250, while significant in absolute terms, represent a small fraction of Quorum's $4.82 billion in fiscal year 2022 annual revenue and its approximately $6.1 billion market capitalization as of May 2023.
• The availability of insurance coverage (with $5,730,250 of the estimated costs covered by the Atlas Mutual primary policy above the SIR) and the potential for recovery of all or a substantial portion of the costs through the Palomar indemnification claim further reduce the likely net financial impact on the Company.
• The breach originated entirely from a third-party vendor's environment, and no compromise of Quorum's own systems has been identified. This factor may reduce the market impact and reputational harm associated with the disclosure.
• The detailed analysis and specific disclosure recommendations are set forth in the SEC Memo and are not repeated here. Calderwood & Harkness recommends that the Audit Committee review the SEC Memo in connection with its oversight responsibilities.
IX. ANTICIPATED REGULATORY ENGAGEMENT
Based on Calderwood & Harkness's experience with incidents of comparable scope and scale, we anticipate that the regulatory notification filings will likely prompt follow-up inquiries from one or more regulatory agencies. The regulators most likely to engage are:
• Connecticut Attorney General's Office: AAG Diane Marchetti, Consumer Protection Division, is the likely point of contact. Given that Quorum is headquartered in Connecticut and that Connecticut has the largest number of affected residents (52,114), we expect the Connecticut AG to be actively engaged.
• New York Attorney General's Office: AAG Mark Petrosian, Bureau of Internet and Technology, handles cybersecurity investigations for the NY AG. New York has the second-largest number of affected residents (47,831), and the NY AG has been highly active in pursuing data breach investigations and enforcement actions.
• Connecticut Insurance Department: Richard Nakamura, Financial Analysis Division, Cybersecurity Unit, will receive the notification under the Connecticut Insurance Data Security Law and may initiate a review of Quorum's cybersecurity program and vendor risk management practices.
• HHS Office for Civil Rights (Region I, Boston): OCR may initiate a compliance review in connection with the HIPAA breach notification, particularly given the scale of the PHI compromise (41,203 individuals).
In addition, given the scale of the breach (29 states and the District of Columbia, 318,247 affected individuals), there is a meaningful possibility that affected states may coordinate a multistate attorney general inquiry. Multistate AG inquiries have become increasingly common in response to large-scale data breaches, and the number of affected jurisdictions and individuals in this incident is within the range that has historically prompted such coordinated investigations.
Calderwood & Harkness recommends a proactive, cooperative engagement strategy with all regulators. Quorum should position itself as a responsible data custodian that was the victim of a vendor-originated breach, that took swift and comprehensive action upon learning of the incident, and that is providing timely and complete notifications in full compliance with all applicable laws and regulations. Quorum's strong information security program, its robust vendor risk management practices (overseen by Priya Deshmukh, Vice President of Vendor Risk Management), and its prompt and thorough remediation posture should support a favorable regulatory outcome.
We note that if a multistate AG inquiry or other formal regulatory enforcement action materializes, Calderwood & Harkness's engagement scope may need to be expanded to include regulatory defense services, which would increase the legal fees component of the estimated incident response costs. We will advise the Audit Committee promptly if such an expansion becomes necessary.
X. RECOMMENDED NEXT STEPS AND TIMELINE
Based on the foregoing analysis, Calderwood & Harkness recommends the following next steps and timeline:
1. By August 4, 2023: Finalize the data mining and affected individual identification process, which is currently in its final stages. Calderwood & Harkness will confirm the final affected individual counts and any necessary adjustments to the notification letters upon completion.
2. By August 6, 2023: Execute the statement of work with Clearfield Notification Services LLC for notification mailing, call center operations, and credit monitoring enrollment services. The statement of work is in final draft and has been reviewed by Calderwood & Harkness.
3. By August 14, 2023: File regulatory notifications with the Connecticut Attorney General and the Connecticut Insurance Department, initiating the regulatory notification sequence.
4. By August 15, 2023: File the HHS-OCR HIPAA breach notification through the HHS breach reporting portal and issue the required media notice under 45 C.F.R. § 164.406.
5. August 16–25, 2023: File remaining state attorney general and regulator notifications on a rolling basis, in accordance with the regulatory notification timeline set forth in Section V.B above.
6. August 18 – September 15, 2023: Mail consumer notification letters through Clearfield on a rolling basis over the approximately 28-day mailing window.
7. Ongoing: Continue Palomar indemnification negotiations. Send rebuttal letter (anticipated July 25, 2023) rejecting Palomar's causation defenses and the inadequate goodwill offer. Develop and implement negotiation strategy to achieve full or near-full indemnification recovery.
8. Ongoing: Coordinate with Atlas Mutual Insurance Company on claim documentation and reimbursement for qualifying costs above the SIR. No excess layer (Pinnacle Surplus Lines) involvement is anticipated at current cost levels.
9. Ongoing: Monitor for and respond to any regulatory follow-up inquiries or information requests from state attorneys general, the Connecticut Insurance Department, HHS-OCR, or other regulatory agencies.
10. Ongoing: BrightPath Consulting Group Inc. to manage external and internal communications in accordance with the coordinated communications strategy, including the press statement, employee communications, and investor-facing disclosure language.
11. As Needed: Provide further updates to the Audit Committee as material developments occur. Calderwood & Harkness anticipates that the next full briefing will be appropriate after the completion of the regulatory filings and the substantial completion of the consumer notification mailings, which is expected by late September or early October 2023.
XI. CONCLUSION
The forensic investigation conducted by Graystone Forensics LLC, under the direction of Calderwood & Harkness, has confirmed a significant but manageable data security incident affecting 318,247 individuals across 29 states and the District of Columbia. The incident originated entirely from Palomar Data Solutions' failure to maintain the security controls required by the Master Services Agreement — specifically, Palomar's failure to timely patch a known critical vulnerability in its GoAnywhere MFT file transfer appliance. No compromise of Quorum's own networks, systems, or infrastructure has been identified.
Quorum has a strong legal position for recovery of its incident response costs through the indemnification provisions of the MSA, supported by clear evidence of Palomar's contractual breaches. The indemnification claim of $8,230,250 is well within the $32,600,000 contractual liability cap. In addition, Quorum's cyber insurance coverage provides robust financial protection, with $5,730,250 of the estimated costs covered by the Atlas Mutual primary policy above the $2,500,000 SIR.