PRIVILEGED AND CONFIDENTIAL — ATTORNEY-CLIENT COMMUNICATION AND ATTORNEY WORK PRODUCT. This memorandum is protected by the attorney-client privilege and the work product doctrine. It is intended solely for the use of the addressees and should not be disclosed to any third party without the prior written consent of Calderwood & Harkness LLP.
CALDERWOOD & HARKNESS LLP 1700 K Street NW, Suite 900 Washington, D.C. 20006
MEMORANDUM
July 19, 2023
TO: Thomas R. Whitfield, General Counsel, Quorum Insurance Holdings Corp. Margaret D. Calloway, Chief Executive Officer, Quorum Insurance Holdings Corp.
FROM: Rachel Bernstein, Partner, Privacy & Data Security (New York, NY) Alan Burke, Associate, Privacy & Data Security (Washington, D.C.)
RE: SEC Disclosure Obligations — Palomar Data Solutions Security Incident; 8-K Cybersecurity Incident Disclosure and 10-Q Considerations
MATTER NO.: 1025-00006
I. Executive Summary
You have asked us to analyze the disclosure obligations of Quorum Insurance Holdings Corp. ("Quorum" or the "Company") (Nasdaq: QIHC) under the federal securities laws in connection with the data security incident (the "Incident") originating from Quorum's third-party claims data processing vendor, Palomar Data Solutions, Inc. ("Palomar"). This memorandum sets forth our analysis and recommendations regarding potential disclosure under Form 8-K and the Company's upcoming Form 10-Q filing.
Based on our quantitative and qualitative materiality analysis, as detailed in Section IV below, the Incident does not presently appear to meet the threshold for a mandatory Form 8-K filing under the SEC's anticipated new Item 1.05, nor does it appear to warrant voluntary disclosure under Item 8.01 at this time. The total estimated incident response costs of approximately $8.23 million represent roughly 0.17% of Quorum's fiscal year 2022 annual revenue and approximately 0.13% of the Company's market capitalization. After application of the Company's $2.5 million self-insured retention under its cyber-insurance program, the estimated insurance recovery of $5.73 million falls well within the $15 million primary policy limit, and the Company holds additional vendor indemnification rights under its Master Services Agreement with Palomar with a contractual liability cap of $32.6 million.
However, we strongly caution that materiality is inherently a dynamic assessment, and the current conclusion must be revisited as the matter develops. Specifically, the materiality analysis should be reassessed as direct and indirect costs are finalized, regulatory proceedings unfold following the planned notifications to twenty-nine state attorneys general, the Connecticut Insurance Department, and the U.S. Department of Health and Human Services Office for Civil Rights ("HHS-OCR"), and as litigation risk crystallizes—particularly following the commencement of consumer notification mailings in mid-August 2023.
We recommend that the Company update its risk factor and Management's Discussion and Analysis of Financial Condition and Results of Operations ("MD&A") disclosures in the upcoming Form 10-Q filing for the quarter ended June 30, 2023, to reflect the Incident and its potential impacts. Additionally, the Company should implement precautionary insider trading restrictions for individuals with knowledge of the Incident, establish a disclosure coordination working group, and formally reassess materiality at regular intervals and upon any material development.
This analysis rests on the factual foundation established by the final forensic report issued by Graystone Forensics, LLC ("Graystone") on July 14, 2023, which confirmed that the Incident affected 318,247 individuals across twenty-nine states and the District of Columbia. We have also relied on the financial estimates and insurance coverage information provided by the Company's internal legal and risk management teams, as well as our review of the applicable Master Services Agreement, insurance policies, and relevant SEC guidance and rulemaking.
II. Background — Summary of the Incident
A. Incident Overview
On or about March 14, 2023, a threat actor exploited a known remote code execution vulnerability in the GoAnywhere Managed File Transfer ("MFT") platform—specifically, CVE-2023-0669—to gain unauthorized access to Palomar Data Solutions' network environment. Palomar serves as a third-party claims data processing vendor for Quorum's personal lines division, handling the intake, processing, and storage of claims-related data for certain of the Company's personal lines insurance products.
The threat actor maintained persistent access to Palomar's network for an exfiltration window of approximately thirty-five days, from March 14, 2023, through April 18, 2023. During this period, the threat actor exfiltrated data files containing personal information of Quorum policyholders and claimants that had been provided to Palomar in the course of its claims processing services. The Graystone forensic investigation confirmed that the unauthorized access was limited to Palomar's systems and that there is no evidence that the threat actor accessed Quorum's own internal systems, the QuorumEdge platform, or any other Quorum-controlled infrastructure.
On April 18, 2023, Palomar's Security Operations Center ("SOC") identified anomalous outbound data transfers and initiated its internal incident response procedures. Palomar notified Quorum of the suspected data security incident on April 21, 2023. We note that this notification was delivered approximately seventy-two hours after Palomar's discovery, which exceeds the forty-eight-hour contractual notification requirement set forth in Section 9.4 of the Master Services Agreement between the parties, dated November 12, 2019, as amended (the "MSA"). The delayed notification and its implications for Quorum's contractual rights and vendor indemnification posture are addressed separately in our memorandum to the General Counsel dated May 22, 2023.
Upon receipt of Palomar's notification, Quorum's Chief Information Security Officer, David Naranjo, immediately activated the Company's incident response plan and convened the Cybersecurity Incident Response Team ("CIRT"). Calderwood & Harkness LLP was engaged as outside counsel on May 4, 2023, and Graystone Forensics, LLC was retained under the direction and privilege of this firm on May 5, 2023, to conduct a comprehensive forensic investigation of the scope, nature, and extent of the compromise.
B. Scope of Compromised Data (per Graystone Final Forensic Report, July 14, 2023)
Graystone's final forensic report, issued on July 14, 2023, confirmed the following regarding the scope of compromised data:
• Total affected individuals: 318,247 across twenty-nine states and the District of Columbia. These individuals are Quorum policyholders and claimants whose claims data was processed by Palomar during the relevant period.
• Personally identifiable information ("PII"): All 318,247 affected individuals had PII compromised, including full names, dates of birth, Social Security numbers, and driver's license numbers. The breadth of PII exposure across the entire affected population is significant, as this combination of data elements creates a heightened risk of identity theft and fraud.
• Financial information: A subset of 84,619 affected individuals had financial information compromised, including bank account numbers and payment card numbers. This subset represents individuals who had direct-deposit or electronic payment information on file for claims disbursements.
• Protected health information ("PHI"): A subset of 41,203 affected individuals had PHI compromised, including health conditions, diagnosis codes, and treatment information derived from workers' compensation and health-related insurance claims. The presence of PHI triggers reporting obligations under the Health Insurance Portability and Accountability Act of 1996 ("HIPAA") and the Health Information Technology for Economic and Clinical Health Act ("HITECH"), which are addressed in our separate HIPAA breach notification analysis memorandum dated July 12, 2023.
The Graystone forensic investigation did not identify any evidence that the compromised data has been misused, published on the dark web, or offered for sale as of the date of their final report. However, as we have previously advised, the absence of confirmed misuse does not eliminate the risk of future misuse, and the nature and sensitivity of the compromised data categories—particularly Social Security numbers, financial account information, and PHI—create significant ongoing risk for the affected individuals.
C. Response Status as of Memo Date
As of the date of this memorandum, the following key response milestones have been completed or are in progress:
• Data mining and affected individual identification: The data mining process to identify the specific individuals affected and the categories of data compromised for each individual is being conducted by Clearfield Notification Services, Inc. ("Clearfield") under the direction of Calderwood & Harkness. This process is projected to be completed by approximately August 4, 2023.
• Consumer notification: Consumer notification letters are planned to begin mailing on or about August 18, 2023, following completion of data mining and internal review of the notification packages. The notifications will offer affected individuals twenty-four months of complimentary credit monitoring and identity theft protection services, consistent with regulatory expectations and industry best practices.
• Regulatory notifications: Notifications to the attorneys general of the twenty-nine affected states, the Connecticut Insurance Department (as Quorum's domestic state insurance regulator), and HHS-OCR (in connection with the PHI component) are planned for the period of August 14 through August 25, 2023, in accordance with applicable state breach notification statutes and federal requirements.
• Cyber-insurance claim: A claim was filed with Atlas Mutual Insurance Company ("Atlas") under Quorum's cyber-insurance policy (Policy No. CYB-2023-041587) on May 8, 2023 (Claim No. CYB-CLM-2023-05892). Atlas has acknowledged the claim and has assigned adjuster Monica Ellison. Coverage discussions are ongoing; no coverage denial or reservation of rights has been communicated as of this date.
• Vendor indemnification: Quorum's right to indemnification from Palomar under Section 12.2 of the MSA is under consideration. As discussed in our May 22, 2023 memorandum, the contractual indemnification provision includes a liability cap of two times the trailing twelve-month fees paid under the agreement, which currently totals approximately $32.6 million (based on $16.3 million in fees during the trailing twelve-month period). A formal indemnification demand has not yet been submitted, pending finalization of the cost estimates and further assessment of the litigation and regulatory landscape.
III. Applicable SEC Disclosure Framework
A. New SEC Cybersecurity Disclosure Rules (Final Rule, July 2023)
On March 9, 2022, the SEC proposed comprehensive new rules governing cybersecurity risk management, strategy, governance, and incident disclosure by public companies. Based on public statements by SEC Chair Gary Stonefield Advisory Group and the progression of the rulemaking process, these rules are expected to be adopted in final form imminently—indeed, adoption is anticipated within approximately one week of the date of this memorandum. While the final text of the rules is not yet available, the proposed rules and publicly available indications from the Commission provide a sufficient basis for this analysis, and we will update our advice promptly upon adoption of the final rules.
The centerpiece of the new disclosure framework for purposes of this analysis is new Item 1.05 of Form 8-K, which will require registrants to disclose material cybersecurity incidents within four business days of determining that the incident is material. This represents a significant departure from the prior regime, which did not include an explicit 8-K line item for cybersecurity incidents and relied instead on general materiality principles and Commission guidance.
Under the anticipated final rules, a "cybersecurity incident" is defined broadly to encompass any unauthorized occurrence, or a series of related unauthorized occurrences, on or conducted through a registrant's information systems that jeopardizes the confidentiality, integrity, or availability of a registrant's information systems or any information residing therein. Importantly, the definition is expected to cover incidents involving a registrant's third-party service providers where the registrant's data or systems are affected, which is directly relevant to the Palomar-originated Incident at issue here.
The materiality standard applicable to the new Item 1.05 disclosure obligation is consistent with the longstanding materiality standard articulated by the United States Supreme Court. Under TSC Industries, Inc. v. Northway, Inc., 426 U.S. 438 (1976), and Basic Inc. v. Levinson, 485 U.S. 224 (1988), information is material if there is a "substantial likelihood that a reasonable investor would consider it important" in making an investment decision, or if the information would "significantly alter the total mix of information" available to the reasonable investor. The SEC has consistently emphasized that materiality is not limited to quantitative financial impact but requires an evaluation of all relevant qualitative factors as well.
A critical aspect of the new framework is that the four-business-day filing obligation is triggered not by the discovery of the incident itself, but by the registrant's determination that the incident is material. However, the SEC has made clear that registrants may not unreasonably delay their materiality assessment. The Commission has stated that once an incident is discovered, the registrant must conduct a materiality determination "without unreasonable delay," and that an ongoing investigation does not permit indefinite deferral of the materiality assessment or filing obligation.
It is important to note that the compliance date for the new 8-K Item 1.05 requirement for non-smaller reporting companies is expected to be December 18, 2023. Quorum qualifies as a non-smaller reporting company and an accelerated filer based on its public float and filing history. Accordingly, the formal Item 1.05 obligation may not technically be in effect during the current incident response window. Nevertheless, we analyze Quorum's obligations under both the existing framework and the incoming rules, because the SEC has indicated that registrants should not delay adoption of best practices in advance of the compliance date, and because any future SEC scrutiny of the Company's disclosure posture is likely to evaluate the Company's conduct against the standard articulated in the final rules regardless of the formal effective date.
B. Existing Disclosure Obligations (Pre-New Rule Compliance Date)
Pending the compliance date for the new cybersecurity disclosure rules, Quorum's existing disclosure obligations are governed by several overlapping sources of authority.
SEC Division of Corporation Finance Guidance. The Division of Corporation Finance issued CF Disclosure Guidance: Topic No. 2 in October 2011, providing interpretive guidance on the disclosure obligations of public companies relating to cybersecurity risks and cyber incidents. This guidance, supplemented by the Commission's 2018 interpretive release on cybersecurity disclosure obligations, makes clear that cybersecurity risks and incidents may trigger disclosure obligations under multiple provisions of Regulation S-K, including:
• Item 105 (Risk Factors): Registrants should disclose cybersecurity risks to the extent that such risks are among the most significant factors that make an investment in the registrant speculative or risky. Where a cybersecurity incident has occurred, the registrant should update its risk factor disclosure to reflect the specific risks arising from the incident, including potential regulatory, litigation, and reputational consequences.
• Item 303 (Management's Discussion and Analysis of Financial Condition and Results of Operations): MD&A requires disclosure of known trends, demands, commitments, events, or uncertainties that are reasonably likely to have a material effect on the registrant's financial condition or results of operations. A cybersecurity incident that gives rise to identifiable costs, contingent liabilities, or operational disruption may trigger MD&A disclosure, even if the ultimate financial impact is uncertain.
• Item 503 (Prospectus Summary — Risk Factors): To the extent applicable to any offering-related filings, risk factor disclosures in registration statements should similarly be updated.
Form 10-Q Quarterly Reporting. Quorum's Form 10-Q filings require updated risk factor disclosures (Part II, Item 1A) and MD&A (Part I, Item 2) as of the end of each fiscal quarter. Material changes in risk factors since the most recent annual report on Form 10-K must be disclosed, and MD&A must address developments during the quarter that are reasonably likely to affect the Company's financial condition or results of operations.
Form 8-K Item 8.01 (Other Events). Under the existing rules, there is no dedicated 8-K line item for cybersecurity incidents. However, Item 8.01 permits voluntary disclosure of "other events" that the registrant considers to be of importance to security holders. Registrants have used Item 8.01 to voluntarily disclose significant cybersecurity incidents, and the SEC staff has encouraged the use of this item where an incident may be material to investors even if it does not fall within another specific 8-K triggering event.
Antifraud Provisions. Regardless of the applicability of specific line-item disclosure requirements, the federal securities laws' antifraud provisions impose overarching obligations that are always in effect. Section 17(a) of the Securities Act of 1933, Section 10(b) of the Securities Exchange Act of 1934, and Rule 10b-5 thereunder prohibit any material misstatement or omission in connection with the purchase or sale of securities. Accordingly, if Quorum's ongoing disclosures (including its existing risk factors, MD&A, or other public statements) are rendered materially misleading by the Incident, the Company has an obligation to correct or update those disclosures, even in the absence of a specific line-item trigger. The duty to update may also arise where the Company has previously made forward-looking statements or general cybersecurity risk disclosures that, in light of the Incident, are no longer accurate or are misleading.
C. Regulation FD Considerations
Regulation FD ("Fair Disclosure") prohibits the selective disclosure of material nonpublic information by issuers to securities market professionals and certain shareholders. In the context of the Incident, there is a risk that information about the breach could be communicated selectively—intentionally or inadvertently—to analysts, institutional investors, or individual board members in a manner that could constitute a Reg FD violation.
We recommend that all communications regarding the Incident with analysts, institutional investors, or any person outside of Quorum's legitimate need-to-know circle be carefully managed and approved in advance by the General Counsel's office. To the extent that the Company's investor relations team receives inquiries regarding cybersecurity matters, responses should be limited to information that has been publicly disclosed or that is not material, and any substantive discussion of the Incident should be deferred until the disclosure posture is finalized.
Additionally, coordination with BrightPath Consulting Group Inc. ("BrightPath") (Meredith Ashford, Managing Director) on external communications strategy is essential to ensure consistency between any public statements and the Company's SEC disclosure posture. All external communications materials, including press statements, investor-facing messaging, and social media content, should be reviewed by Calderwood & Harkness prior to dissemination to ensure compliance with Reg FD and the antifraud provisions.
IV. Materiality Analysis
The determination of whether the Incident is "material" for purposes of the federal securities laws requires both a quantitative and qualitative analysis, consistent with the standard set forth in TSC Industries and Basic Inc., as well as the SEC staff's interpretive guidance. We address each component below.
A. Quantitative Analysis
1. Estimated Financial Impact
Based on the information currently available, the total estimated incident response costs are approximately $8,230,250, comprising the following categories:
These figures are estimates based on current projections and vendor engagement scopes. Actual costs may vary as the response progresses, and additional cost categories may emerge depending on regulatory and litigation developments. The estimates do not include potential regulatory fines or penalties, private litigation defense costs or settlements, or reputational losses, which are addressed separately as contingent and uncertain costs below.
2. Insurance Coverage Offset
Quorum maintains a comprehensive cyber-insurance program consisting of two layers:
Primary Layer: Atlas Mutual Insurance Company, Policy No. CYB-2023-041587, with a per-occurrence limit of $15,000,000 and a self-insured retention ("SIR") of $2,500,000. The policy covers first-party costs including forensic investigation, notification, credit monitoring, crisis communications, legal fees, and regulatory defense costs, among other covered categories.
Excess Layer: Pinnacle Surplus Lines Insurance Company, Policy No. XS-CYB-2023-7812, providing $25,000,000 in excess coverage above the Atlas primary layer. The total insurance tower available is $40,000,000.
Based on the current cost estimates, the estimated insurance recovery above the SIR is $5,730,250 (calculated as $8,230,250 in total costs less the $2,500,000 SIR), which falls well within the $15 million primary policy limit. Atlas has acknowledged the claim and has not issued a reservation of rights or coverage denial as of the date of this memorandum. Accordingly, Quorum's estimated net out-of-pocket financial exposure (before any vendor recovery) is limited to the $2,500,000 SIR.
3. Vendor Indemnification Potential
As noted above, Section 12.2 of the MSA between Quorum and Palomar provides for indemnification of Quorum by Palomar for losses arising from Palomar's breach of its data security obligations. The indemnification provision is subject to a liability cap of two times the trailing twelve-month fees paid under the agreement. Based on the trailing twelve-month fee payments of approximately $16.3 million, the contractual liability cap is approximately $32,600,000.
A formal indemnification demand for the full $8,230,250 in estimated incident response costs is under consideration. If successful, such a recovery would further reduce or entirely eliminate Quorum's net financial exposure, potentially including reimbursement of the SIR amount. However, recovery under the indemnification provision is not assured at this stage. Palomar has not yet formally responded to Quorum's preliminary indication of intent to seek indemnification, and the ultimate recovery amount may be subject to negotiation, dispute, or litigation. Accordingly, we do not factor the vendor indemnification as a definitive offset in the materiality analysis, but we note it as a significant mitigating factor that further reduces the likelihood that Quorum will sustain a material financial loss from the Incident.
4. Comparison to Key Financial Metrics
To assess the quantitative materiality of the Incident's financial impact, we compare the estimated costs and net exposure to Quorum's key financial metrics:
• Total estimated incident response costs ($8,230,250) as a percentage of Quorum FY 2022 annual revenue ($4.82 billion): approximately 0.17%.
• Net out-of-pocket exposure (SIR amount of $2,500,000) as a percentage of Quorum FY 2022 annual revenue: approximately 0.05%.
• Total estimated incident response costs as a percentage of Quorum market capitalization (approximately $6.1 billion as of May 2023): approximately 0.13%.
• Net out-of-pocket exposure (SIR amount) as a percentage of Quorum market capitalization: approximately 0.04%.
Under commonly applied quantitative guidelines—while recognizing that no bright-line quantitative test is dispositive of materiality—the SEC staff and auditing profession have historically used benchmarks such as 5% of pre-tax net income or 1% of total assets as rough indicators of quantitative materiality. The Incident's financial impact falls far below these thresholds by any measure. Even the gross estimated cost of $8,230,250 is de minimis relative to Quorum's financial scale, and the net out-of-pocket exposure of $2,500,000 is negligible.
5. Potential Additional Costs (Contingent/Uncertain)
In addition to the estimated direct incident response costs analyzed above, several categories of potential additional costs exist that are currently contingent and uncertain:
• Regulatory fines or penalties: Regulatory notifications to twenty-nine state attorneys general, the Connecticut Insurance Department, and HHS-OCR are in preparation. As of the date of this memorandum, no regulatory enforcement action has been threatened or indicated. The ultimate regulatory outcome is unknown and will depend on the responses received following notification, as well as any subsequent investigations or proceedings. Potential fines could range from nominal amounts to, in a worst-case scenario, significant sums—particularly under HIPAA, where civil monetary penalties for willful neglect can reach up to $2,076,008 per violation category per calendar year. However, based on the facts currently known—including Quorum's prompt response, engagement of qualified forensic and legal counsel, and comprehensive notification program—we do not believe a finding of willful neglect is likely.
• Private litigation: No class action complaint or individual lawsuit has been filed against Quorum in connection with the Incident as of the date of this memorandum. However, following the commencement of consumer notification mailings, there is a meaningful risk that one or more consumer class action lawsuits will be filed. The potential exposure from such litigation is difficult to quantify at this stage, but typical data breach class action settlements in cases involving similar data types and affected population sizes have ranged from nominal per-capita payments to, in exceptional cases, settlements of $100 million or more. We note, however, that class action exposure in this case may be mitigated by the vendor-originated nature of the breach, the absence of confirmed data misuse, and the Company's provision of credit monitoring services.
• Reputational impact: Reputational harm to Quorum's brand, customer relationships, and market position is inherently difficult to quantify. BrightPath has been engaged to manage communications and minimize reputational impact. At this stage, there has been no public reporting of the Incident and no indication of customer attrition or business disruption.
While these potential additional costs could, in theory, be significant, they are speculative at this stage and do not alter the current quantitative materiality assessment. However, they underscore the importance of periodic reassessment as the regulatory and litigation landscape evolves.
B. Qualitative Analysis
The SEC has consistently emphasized that materiality is not solely a quantitative determination. Qualitative factors may render an otherwise quantitatively immaterial item material to investors. We evaluate the relevant qualitative factors below.
1. Factors Suggesting Materiality May Be Present
Several qualitative factors weigh in favor of a finding that the Incident may be material to investors:
• Scale of affected individuals. The Incident affected 318,247 individuals—policyholders and claimants of Quorum's personal lines division. While this figure represents a fraction of Quorum's overall customer base, it is a significant number of affected individuals in absolute terms and places the Incident among the larger data breaches in the insurance industry in recent years.
• Sensitivity of compromised data. The categories of data compromised are among the most sensitive types of personal information: Social Security numbers, financial account numbers, and protected health information. The combination of SSNs, dates of birth, and driver's license numbers creates a particularly heightened risk of identity theft and fraud. The presence of PHI adds an additional layer of regulatory complexity and potential exposure.
• HIPAA and federal regulatory scrutiny. The PHI component of the Incident triggers reporting obligations to HHS-OCR under the HIPAA Breach Notification Rule and subjects Quorum to potential investigation and enforcement action by HHS-OCR. Federal regulatory proceedings, if initiated, could generate significant costs, management distraction, and reputational harm.
• Multistate regulatory exposure. The Incident spans twenty-nine states and the District of Columbia, creating a significant regulatory footprint and the potential for coordinated multistate attorney general investigations. Multistate enforcement actions in data breach matters have resulted in substantial settlements in recent years, including several in the hundreds of millions of dollars for large-scale incidents.
• Consumer class action risk. The commencement of consumer notification mailings in August 2023 is likely to trigger one or more class action lawsuits. Consumer data breach class actions have become increasingly common and, in some cases, have resulted in significant settlements and judgments.
• Media and public interest. Data breaches at insurance companies and financial services firms receive significant media attention, and the size and scope of this Incident could generate meaningful press coverage once the notification process begins.
• SEC enforcement focus. The SEC has made cybersecurity disclosures an enforcement priority and has brought actions against registrants for alleged failures to timely or adequately disclose cybersecurity incidents. The current regulatory environment creates heightened scrutiny of disclosure decisions in connection with data security events.
2. Factors Suggesting Materiality May Not Be Present
Countervailing qualitative factors weigh against a finding of materiality:
• Vendor-originated breach. The Incident originated in Palomar's network, not in Quorum's own systems. Quorum's information security program, network infrastructure, and the QuorumEdge platform were not compromised. The threat actor exploited a vulnerability in a third-party vendor's software, and the unauthorized access was confined to Palomar's environment. This significantly distinguishes the Incident from a breach of Quorum's own systems, which would raise more fundamental questions about the Company's cybersecurity posture and operational integrity.
• Insurance coverage substantially mitigates financial impact. As detailed in Section IV.A.2, the Company's cyber-insurance program provides $40 million in total coverage, and the estimated insurance recovery of $5,730,250 falls well within the $15 million primary policy limit. The Company's net out-of-pocket exposure is limited to the $2.5 million SIR.
• Vendor indemnification rights. The Company holds contractual indemnification rights under the MSA with a $32.6 million cap, which significantly exceeds the total estimated incident response costs. While recovery is not yet assured, the existence of these contractual rights provides a meaningful additional layer of financial protection.
• No evidence of data misuse. As of the date of this memorandum, there is no evidence that any of the compromised data has been misused, sold, or published. The Graystone forensic investigation did not identify any such activity, and no reports of identity theft or fraud linked to the Incident have been received from affected individuals.
• No regulatory enforcement action. No regulatory enforcement action has been threatened or indicated as of the date of this memorandum. While regulatory notifications have not yet been submitted, there is no basis to anticipate an adverse regulatory outcome at this stage.
• No litigation filed. No class action or individual lawsuit has been filed as of the date of this memorandum. While litigation risk exists, it has not yet materialized.
• De minimis quantitative impact. As analyzed in Section IV.A.4, the financial impact of the Incident is de minimis relative to Quorum's financial scale—representing approximately 0.17% of annual revenue and 0.13% of market capitalization at the gross cost level, and approximately 0.05% of annual revenue and 0.04% of market capitalization at the net out-of-pocket level.
• Limited scope relative to Company operations. Quorum has approximately 11,400 employees and operates in all fifty states. The Incident affected data processed by one vendor for personal lines claims—a subset of the Company's overall business—and did not result in any operational disruption to Quorum's insurance operations, claims processing capabilities, or technology platforms.
C. Materiality Conclusion (as of July 19, 2023)
On balance, taking into account both the quantitative and qualitative factors analyzed above, we conclude that the Incident does not presently appear to constitute a "material" cybersecurity incident requiring immediate disclosure on Form 8-K under either the existing disclosure framework or the anticipated new Item 1.05. The quantitative financial impact is modest relative to Quorum's size and is substantially offset by available insurance coverage and potential vendor indemnification. The qualitative factors, while presenting some indicia of significance—particularly the number of affected individuals, the sensitivity of the compromised data, and the multistate regulatory exposure—are counterbalanced by the vendor-originated nature of the breach, the absence of evidence of data misuse, the absence of regulatory enforcement action or litigation, and the limited scope of the Incident relative to the Company's overall operations.
However, we emphasize that this conclusion is based on the facts and circumstances as of the date of this memorandum, and that materiality is a dynamic assessment that must be revisited as the situation evolves. The current non-materiality conclusion must be reassessed if any of the following developments occur:
1. Any regulatory enforcement action is initiated by a state attorney general, the Connecticut Insurance Department, HHS-OCR, or any other regulatory authority;
2. A consumer class action lawsuit or other significant litigation is filed with the potential for substantial exposure;
3. Insurance coverage is disputed, denied, or the carrier issues a reservation of rights that materially reduces expected recovery;
4. Vendor indemnification negotiations fail, or Palomar contests its indemnification obligations in a manner that significantly reduces expected recovery;
5. Additional compromised data is identified, or the number of affected individuals increases materially beyond the current 318,247;
6. Evidence of misuse of the compromised data emerges;
7. Media coverage or investor reaction to the Incident, once publicly disclosed, indicates a market-moving impact; or
8. Total costs significantly exceed current estimates.
We recommend that the General Counsel, Chief Privacy Officer (Jennifer Liang), and Chief Information Security Officer (David Naranjo) establish a periodic review cadence of at minimum every thirty days, or immediately upon any of the developments identified above, to formally reassess materiality. Each reassessment should be documented in writing to create a contemporaneous record of the Company's good-faith, ongoing evaluation of its disclosure obligations.
V. Form 8-K Analysis
A. Item 1.05 (Cybersecurity Incident Disclosure)
Under the SEC's anticipated final rules, new Item 1.05 of Form 8-K will require a registrant to file a Current Report on Form 8-K within four business days of determining that a cybersecurity incident is material. The four-business-day clock begins to run from the date on which the registrant makes the materiality determination—not from the date of discovery of the incident. However, as noted above, the SEC has emphasized that registrants must make their materiality determinations "without unreasonable delay" after discovery and may not use the pendency of an investigation as a basis for indefinitely deferring the assessment.
As analyzed in Section IV, our current assessment is that the Incident is not material. Accordingly, an Item 1.05 Form 8-K filing is not presently required. The Company has not made a materiality determination in the affirmative, and the analysis set forth in this memorandum supports the conclusion that no such affirmative determination is warranted at this time.
We note, however, that the compliance date for the new Item 1.05 requirement for non-smaller reporting companies is expected to be December 18, 2023. Because the Incident was discovered in April 2023 and the current response activities are occurring before the formal compliance date, the Item 1.05 obligation may not technically be in effect during the current response window. Nevertheless, we strongly recommend that the Company conduct its disclosure analysis and maintain its documentation as if the Item 1.05 obligation were currently in effect. The SEC has indicated that it expects registrants to adopt best practices in advance of the compliance date, and any future enforcement inquiry is likely to evaluate the Company's conduct against the new standard, regardless of formal applicability.
Furthermore, the SEC's requirement that materiality determinations be made "without unreasonable delay" creates a need for ongoing diligence. The Company should not treat the current non-materiality conclusion as a final determination but rather as a point-in-time assessment subject to revision. If facts change such that materiality is indicated, the four-business-day filing clock will begin to run from the date of that revised determination.
B. Item 8.01 (Other Events — Voluntary Disclosure)
Even if the materiality threshold is not met, the Company has the option of voluntarily disclosing the Incident under Item 8.01 of Form 8-K, which permits registrants to disclose information that they deem to be of importance to security holders but that does not fall within any other specific 8-K triggering event.
We have considered the arguments in favor of and against voluntary disclosure:
Arguments in Favor of Voluntary Disclosure:
• Voluntary disclosure demonstrates transparency and a commitment to proactive investor communication, which can enhance investor confidence and credibility with the SEC staff.
• Once consumer notification mailings commence on or about August 18, 2023, the Incident will enter the public domain. Proactive disclosure before or concurrent with the notification process may preempt negative media coverage and investor criticism.
• The SEC staff has expressed a general preference for proactive cybersecurity disclosure, and voluntary disclosure may reduce the risk of subsequent enforcement criticism regarding the Company's disclosure posture.
• Several peer companies in the insurance and financial services sectors have voluntarily filed 8-K disclosures in connection with data security incidents of similar or smaller scale, creating an industry expectations benchmark.
Arguments Against Voluntary Disclosure:
• The Incident is vendor-originated and quantitatively immaterial. Filing a voluntary 8-K could be perceived by the market as elevating the significance of the Incident beyond its actual impact and could be interpreted as an implicit acknowledgment of materiality.
• Consumer notification has not yet commenced and regulatory notifications have not yet been submitted. Premature disclosure before these processes are completed could cause unnecessary market disruption and may interfere with the orderly execution of the notification and regulatory response plan.
• A voluntary 8-K filing could trigger premature litigation. Plaintiffs' firms actively monitor 8-K filings for cybersecurity incidents as a basis for initiating class action lawsuits. Filing a voluntary 8-K before the Company has completed its notification process and assessed the regulatory response could accelerate litigation and increase the Company's exposure.
• The filing could be construed as an admission of materiality in any subsequent enforcement proceeding or litigation, potentially undermining the Company's position that the Incident is not material.
Recommendation: We recommend that the Company defer voluntary 8-K disclosure at this time. The arguments against premature voluntary disclosure outweigh the arguments in favor, particularly given the pending consumer notification and regulatory processes. This recommendation should be revisited after consumer notification mailings commence (projected for August 18, 2023) and the initial regulatory response posture becomes clearer. If the Incident receives significant media attention following consumer notifications, or if any other development alters the materiality calculus, a voluntary 8-K filing should be reconsidered promptly.
C. Insider Trading Considerations
The new SEC cybersecurity disclosure rules are expected to include provisions addressing insider trading in connection with cybersecurity incidents. Specifically, the rules are expected to provide that trading restrictions may apply once a registrant has initiated the process of determining whether a cybersecurity incident is material, even if a materiality determination has not yet been made in the affirmative.
Even in the absence of a formal determination that the Incident is material, information about the Incident—including its scope, the categories of compromised data, and the potential financial and legal exposure—constitutes material nonpublic information ("MNPI") in the hands of individuals who possess it. Trading in Quorum securities by such individuals while in possession of this MNPI would expose both the individuals and the Company to significant liability under Section 10(b) of the Exchange Act, Rule 10b-5, and Section 16 of the Exchange Act.
We recommend that Quorum implement precautionary trading restrictions for all individuals with knowledge of the Incident, effective immediately if not already in place. The restricted individuals should include, at a minimum:
• Margaret D. Calloway, Chief Executive Officer
• Thomas R. Whitfield, General Counsel
• David Naranjo, Chief Information Security Officer
• Jennifer Liang, Chief Privacy Officer
• Robert Wentworth, Senior Vice President, Claims Operations
• Priya Deshmukh, Vice President, Vendor Risk Management
• Franklin Reeves, Chair, Board Audit Committee
• Any other directors, officers, or employees who have been briefed on the Incident or who have access to nonpublic information regarding the Incident
The trading restrictions should remain in place until the Incident has been publicly disclosed through the consumer notification process, SEC filing, or other public communication, and a reasonable period has elapsed for the market to absorb the disclosed information. We recommend that the Company's corporate secretary and compliance team implement these restrictions through the Company's existing insider trading policy and pre-clearance procedures, and that the General Counsel confirm implementation in writing to all affected individuals.
VI. Form 10-Q Disclosure Considerations
A. Timing
Quorum's next quarterly report on Form 10-Q is for the fiscal quarter ended June 30, 2023, and is expected to be filed on or about mid-August 2023 (within 40 days of the quarter-end for accelerated filers). The Incident and its potential impacts should be addressed in this filing. The timing of the 10-Q filing relative to the planned consumer notification mailings (beginning approximately August 18, 2023) and regulatory notifications (August 14–25, 2023) creates a natural coordination point, and the disclosure working group should ensure that the 10-Q disclosure is consistent with the communications being made to regulators, affected individuals, and the public.
B. Risk Factor Updates (Item 1A)
Part II, Item 1A of Form 10-Q requires disclosure of any material changes from risk factors previously disclosed in the registrant's most recent Form 10-K. Quorum's most recent Form 10-K, filed for the fiscal year ended December 31, 2022, likely includes general cybersecurity risk factor language addressing the Company's exposure to data security threats, unauthorized access to customer information, regulatory requirements, and the potential financial and reputational consequences of cybersecurity incidents. However, such general disclosure may not specifically address the risks associated with third-party vendor incidents or the specific developments arising from the Palomar Incident.
We recommend updating the risk factor disclosure in the upcoming 10-Q to accomplish the following:
• Acknowledge third-party vendor risk. The updated risk factor should note that Quorum relies on third-party vendors, including for data processing services related to insurance claims, and that the Company's data may be subject to security risks arising from vulnerabilities in vendor systems and networks, over which the Company has limited direct control.
• Address vendor-originated incidents. The disclosure should note that cybersecurity incidents, including those originating at third-party vendors, may expose the Company to notification obligations under state and federal law, regulatory scrutiny and potential enforcement actions, remediation and response costs, and potential private litigation, including class action lawsuits.
• Reference the Palomar Incident. We recommend that the updated risk factor specifically reference the fact that the Company has experienced a cybersecurity incident involving a third-party vendor in which personal information of certain policyholders and claimants was compromised. The disclosure should note that the Company has incurred and expects to continue to incur costs in connection with the response to the incident, including forensic investigation, notification, credit monitoring, legal, and related expenses. The disclosure should further note that the Company maintains cyber-insurance coverage and holds contractual indemnification rights against the vendor, and that, based on current estimates, the Company does not expect the financial impact of the incident to be material. Appropriate cautionary language should be included noting that actual costs may differ from current estimates and that the Company's assessment is subject to change depending on developments in the regulatory and litigation environment.
We will prepare draft risk factor language for review and approval by the General Counsel and CEO, and will coordinate with the Company's disclosure counsel to ensure consistency with the overall 10-Q filing.
C. MD&A Disclosure (Item 2)
Under Regulation S-K Item 303, MD&A requires disclosure of known trends, demands, commitments, events, or uncertainties that are reasonably likely to have a material effect on the registrant's financial condition or results of operations. The MD&A analysis is forward-looking and focuses on whether a known event or uncertainty could reasonably be expected to affect future financial performance.
We analyze the MD&A disclosure obligation as follows:
• Total estimated incident response costs of $8,230,250, compared to Quorum's FY 2022 annual revenue of $4.82 billion, represent approximately 0.17% of revenue—a de minimis amount.
• Net out-of-pocket costs after insurance coverage (the $2.5 million SIR) represent approximately 0.05% of annual revenue.
• Potential vendor recovery of up to $8,230,250 under the MSA indemnification provision (with a $32.6 million cap) would further offset costs, although recovery amounts have not yet been negotiated and remain uncertain.
• Contingent liabilities, including potential regulatory fines and private litigation exposure, are speculative at this stage. No enforcement action has been threatened, and no litigation has been filed.
While the direct financial impact is not, in isolation, reasonably likely to be material, the combination of potential regulatory and litigation developments creates an "uncertainty" within the meaning of Item 303 that should be disclosed. Consistent with SEC staff guidance and best practices, we recommend that the Company include a brief MD&A disclosure noting the Incident, the estimated costs incurred and expected to be incurred, the availability of insurance coverage and vendor indemnification rights, and the Company's current assessment that the financial impact is not expected to be material to the Company's financial condition or results of operations. The disclosure should include appropriate cautionary language noting that the assessment is subject to change if regulatory enforcement actions or litigation develop, costs exceed current estimates, or insurance coverage or vendor indemnification is unavailable or insufficient.
D. Financial Statement Notes
The treatment of the Incident in Quorum's interim financial statements for the quarter ended June 30, 2023, should be coordinated with the Company's external auditor, Halstead & Monroe LLP (Engagement Partner: Gregory Chin, 1600 Market Street, Suite 2800, Philadelphia, PA 19103).
The following Accounting Standards Codification ("ASC") provisions are relevant:
ASC 450 — Contingencies. ASC 450-20 (Loss Contingencies) requires that an estimated loss from a loss contingency be accrued by a charge to income if two conditions are met: (1) information available prior to the issuance of the financial statements indicates that it is probable that an asset has been impaired or a liability has been incurred at the balance sheet date, and (2) the amount of the loss can be reasonably estimated. If a loss contingency does not meet both conditions, but there is at least a reasonable possibility that a loss has been incurred, disclosure of the contingency is required in the notes to the financial statements.
Applying this framework to the Incident:
• Direct incident response costs ($8,230,250): These costs are known and reasonably estimable. The Company has incurred or committed to incur these costs in connection with the forensic investigation, notification, credit monitoring, crisis communications, and legal response. An accrual of these costs (net of any probable insurance recovery) is appropriate to the extent they have not already been recognized.
• Insurance receivable ($5,730,250): To the extent that recovery from Atlas under the primary policy is probable—and we note that Atlas has acknowledged the claim and has not issued a reservation of rights or coverage denial—the insurance receivable should be recognized as a separate asset. Under ASC 450, insurance recoveries are not netted against the loss contingency accrual but are recognized as a separate asset when recovery is probable.
• Vendor indemnification recovery: Recovery from Palomar under the MSA indemnification provision is not yet probable, as a formal demand has not been submitted and Palomar has not acknowledged its obligation. Accordingly, no receivable for vendor indemnification should be recognized at this time, though the indemnification right should be disclosed.
• Regulatory fines and penalties: Potential regulatory fines are possible but not yet probable, as no enforcement action has been threatened or indicated. No accrual is appropriate at this stage, but disclosure as a reasonably possible loss contingency is warranted.
• Private litigation exposure: No litigation has been filed as of the date of this memorandum. While consumer class action litigation is a reasonably foreseeable possibility following notification, it is not yet probable. No accrual is appropriate at this stage, but disclosure as a reasonably possible loss contingency is warranted.
We recommend that the Company include a note disclosure in its Q2 2023 interim financial statements describing the Incident as a contingency, summarizing the nature and estimated costs of the response, the availability of insurance coverage and indemnification rights, and the current assessment of the Company's exposure, while noting the possibility of additional costs from regulatory proceedings or litigation. No accrual for regulatory fines or litigation is recommended at this stage.
We further recommend that Calderwood & Harkness coordinate directly with Gregory Chin and the Halstead & Monroe engagement team to review the proposed note disclosure language, discuss the ASC 450 analysis, and ensure alignment between the legal assessment and the financial statement treatment.
E. Disclosure Controls and Procedures / Internal Controls
Form 10-Q requires management to evaluate the effectiveness of the Company's disclosure controls and procedures ("DC&P") as of the end of the fiscal quarter (Exchange Act Rule 13a-15(b)) and to disclose any changes in internal control over financial reporting ("ICFRR") that have materially affected, or are reasonably likely to materially affect, the Company's ICFRR (Exchange Act Rule 13a-15(d)).
The Incident raises the question of whether it reveals any material weakness or significant deficiency in the Company's DC&P or ICFRR. We analyze this as follows:
• The Incident originated at Palomar, a third-party vendor, and did not involve any compromise of Quorum's own systems, networks, or internal controls. There is no indication that Quorum's DC&P or ICFRR failed to operate as designed.
• However, the Company's vendor risk management program—overseen by Priya Deshmukh, Vice President, Vendor Risk Management—is an element of the Company's overall risk management framework and may be considered a component of the Company's DC&P to the extent that it is relevant to the Company's ability to identify and respond to risks affecting its disclosures. Palomar's failure to timely patch the GoAnywhere MFT vulnerability (CVE-2023-0669) and the resulting breach may raise questions about the effectiveness of Quorum's vendor oversight processes, including the frequency and rigor of security assessments, the monitoring of vendor compliance with contractual security requirements, and the timeliness of vendor incident notifications.
• We recommend that the General Counsel and CISO review the vendor risk management program in light of the Incident to determine whether any gaps exist that should be addressed and whether any such gaps rise to the level of a significant deficiency or material weakness in DC&P or ICFRR. Absent evidence of a systemic failure in the vendor risk management program, we do not believe the Incident, standing alone, would support a finding of a material weakness or significant deficiency in the Company's DC&P or ICFRR.
We recommend that this matter be discussed with Franklin Reeves, Chair of the Board Audit Committee, and with Halstead & Monroe, in the context of the Q2 2023 DC&P and ICFRR assessment. The outcome of that assessment should be documented and, if warranted, reflected in the 10-Q disclosure.
VII. Coordination with Public Communications
The timing of the Company's SEC disclosure activities must be carefully coordinated with the broader public communications strategy for the Incident. Several concurrent workstreams will bring the Incident into the public domain in August 2023:
• Consumer notification letters are planned to begin mailing on or about August 18, 2023. Once the notification mailings commence, affected individuals will become aware of the Incident, and information about the breach will inevitably enter the public domain through media coverage, social media, and inquiries from customers, regulators, analysts, and investors.
• Regulatory notifications to the attorneys general of twenty-nine states, the Connecticut Insurance Department, and HHS-OCR are planned for August 14 through August 25, 2023. Several state attorneys general have track records of issuing public statements or initiating investigations promptly upon receipt of breach notifications, which could accelerate public awareness.
• External communications strategy. BrightPath Consulting Group Inc. (Meredith Ashford, Managing Director) is developing the Company's external communications strategy, including reactive press statements, investor-facing messaging, and social media response protocols. All such materials should be reviewed by Calderwood & Harkness prior to finalization to ensure consistency with the Company's SEC disclosure posture and compliance with Regulation FD and the antifraud provisions.
• Investor relations communications. Any communications to investors, analysts, or the financial media regarding the Incident should be developed in coordination with the General Counsel's office and outside counsel, and should be limited to information that is consistent with the Company's public disclosures and does not constitute selective disclosure of MNPI.
We recommend that the Company establish a disclosure coordination working group consisting of the following individuals:
• Thomas R. Whitfield, General Counsel
• Margaret D. Calloway, Chief Executive Officer
• Jennifer Liang, Chief Privacy Officer
• David Naranjo, Chief Information Security Officer
• Rachel Bernstein and/or Alan Burke, Calderwood & Harkness LLP
• Meredith Ashford, BrightPath Consulting Group Inc.
The working group should meet regularly during the August 2023 notification and disclosure window to synchronize the timing and content of SEC disclosure, consumer notifications, regulatory notifications, public statements, and investor communications. The goal is to ensure that no single communication channel reveals information that is inconsistent with, or premature relative to, the other channels, and that the Company maintains a coherent, defensible disclosure posture throughout the process.
VIII. SEC Enforcement Risk Considerations