PRIVILEGED & CONFIDENTIAL — ATTORNEY WORK PRODUCT
INTERNAL MATTER CLOSING MEMORANDUM
CALDERWOOD & HARKNESS LLP 1700 K Street NW, Suite 900 Washington, D.C. 20006
December 1, 2023
Matter No.: 1025-00006
Matter Name: Quorum Insurance Holdings Corp. — Palomar Data Solutions Security Incident
Prepared By: Alan Burke, Lead Associate, Privacy & Data Security
Reviewed By: Kevin Ostrowski, Responsible Partner, Privacy & Data Security
Distribution: Internal file only. This memorandum is not to be distributed to the client or any third party without the express prior approval of the responsible partner.
Right-click to update Table of Contents
I. Purpose and Summary of Closure
This memorandum documents the formal closure of Calderwood & Harkness LLP ("C&H") Matter No. 1025-00006 (the "Matter"), effective December 1, 2023. The purpose of this memorandum is to provide a comprehensive record of the engagement, its principal workstreams, key milestones, outcomes, financial summary, open items requiring post-closure monitoring, and lessons learned, for the benefit of the firm's internal file and any future reference that may be required.
The Matter concerned the firm's representation of Quorum Insurance Holdings Corp. ("Quorum" or "QIH") in connection with the response to a significant data security incident originating from Quorum's third-party claims-processing vendor, Palomar Data Solutions, Inc. ("Palomar" or "PDS"). The incident involved the unauthorized access to and exfiltration of personally identifiable information ("PII"), protected health information ("PHI"), and financial data belonging to approximately 318,247 Quorum policyholders and claimants across 29 states and the District of Columbia. The breach was caused by Palomar's failure to timely patch a known critical vulnerability (CVE-2023-0669) in its GoAnywhere MFT file transfer appliance, which was exploited by a threat actor to gain access to Palomar's claims-processing environment.
Calderwood & Harkness was engaged on May 4, 2023, to serve as incident response counsel and to coordinate all aspects of the legal response to the incident, including the privileged forensic investigation, consumer and regulatory notifications, regulatory defense, vendor indemnification, insurance coordination, board and executive advisory services, and crisis communications oversight. The engagement spanned 212 days, from May 4, 2023 through December 1, 2023, a period of approximately seven months.
The Matter has concluded with uniformly favorable outcomes across all workstreams. All regulatory tracks have been closed without enforcement action, fine, penalty, or consent order. A vendor indemnification settlement with Palomar was negotiated and executed, yielding a total effective recovery to Quorum of approximately $6,156,000. An insurance claim was submitted to Quorum's primary cyber-liability carrier, Atlas Mutual Insurance Company, for reimbursement of $5,730,250 in incident response costs exceeding the $2,500,000 self-insured retention, and reimbursement processing is underway. No litigation has been filed against Quorum arising from the data breach as of the date of this memorandum. All consumer notifications were timely completed, and credit monitoring services continue to be administered by Clearfield Notification Services LLC.
With all engagement objectives achieved and no outstanding deliverables or open workstreams requiring C&H's continued involvement, the Matter is hereby formally closed. Any future matters arising from this incident—including, without limitation, litigation defense, follow-up regulatory inquiries, or additional vendor-related proceedings—would require a new engagement.
II. Client and Key Parties
A. Client
Quorum Insurance Holdings Corp. ("Quorum" or "QIH") is a Delaware corporation, publicly traded on the Nasdaq Stock Market under the ticker symbol QIHC. Quorum is headquartered at 400 Constitution Plaza, Suite 2200, Hartford, Connecticut 06103. Its Employer Identification Number is 06-4832197.
Quorum operates in the insurance and financial technology sectors. Its core business lines include property and casualty insurance, specialty lines, and life and annuity products. Quorum also operates QuorumEdge, a proprietary digital underwriting platform, and maintains insurtech analytics capabilities that support both its own operations and third-party partners. For fiscal year 2022, Quorum reported annual revenue of approximately $4.82 billion. As of May 2023, the company's market capitalization was approximately $6.1 billion, and it employed approximately 11,400 individuals.
The following individuals served as the firm's principal client contacts during the engagement:
• Thomas R. Whitfield — General Counsel
• Jennifer Liang — Chief Privacy Officer
• David Naranjo — Chief Information Security Officer
• Priya Deshmukh — Vice President, Vendor Risk Management
• Margaret D. Calloway — Chief Executive Officer
• Franklin Reeves — Board Chair, Audit Committee
• Robert Wentworth — Senior Vice President, Claims Operations
Thomas Whitfield served as the primary point of contact throughout the engagement, with Jennifer Liang and David Naranjo serving as secondary contacts for matters within their respective areas of responsibility. Margaret Calloway and Franklin Reeves were briefed at key junctures through the board and management advisory workstream. Priya Deshmukh was the lead contact for vendor accountability and indemnification matters, and Robert Wentworth provided operational support and subject matter expertise regarding the claims-processing data flows implicated in the breach.
B. Breached Vendor
Palomar Data Solutions, Inc. ("Palomar" or "PDS") is a Texas corporation headquartered at 7100 Greenville Avenue, Suite 450, Dallas, Texas 75231. Its Employer Identification Number is 75-3291048. Palomar is a claims data processing and business process outsourcing ("BPO") vendor serving the insurance industry. At the time of the incident, Quorum was Palomar's second-largest client by revenue, with an original annual contract value ("ACV") of approximately $14.2 million, which had been increased to approximately $16.3 million following Amendment 1 to the Master Services Agreement in March 2021.
The following individuals at Palomar were the firm's principal contacts during the engagement:
• Marcus J. Trevino — Chief Executive Officer
• Anita Raghavan — Chief Technology Officer
• Derek Copeland — General Counsel
Palomar was represented by outside counsel throughout the indemnification negotiation and settlement process:
• Mercer, Haight & Dunlop LLP, 2100 Ross Avenue, Suite 3600, Dallas, Texas 75201
• Catherine Langford — Partner (lead attorney)
• Brian Soto — Associate
C. Calderwood & Harkness Engagement Team
The following C&H attorneys comprised the engagement team for this Matter:
Kevin Ostrowski served as the responsible partner for all substantive aspects of the engagement, maintaining regular direct communication with Thomas Whitfield and the Quorum leadership team. Rachel Bernstein served as the billing partner and provided strategic input on regulatory defense and SEC disclosure considerations. Alan Burke served as the lead associate and day-to-day coordinator across all workstreams. Sara Hendricks provided research, drafting, and analytical support across all workstreams, with primary responsibility for the notification obligation analysis and consumer notification drafting.
D. Third-Party Service Providers
The following third-party service providers were retained during the engagement, either directly by Quorum or under the C&H privilege umbrella, as indicated:
Graystone Forensics LLC — Forensic investigation firm retained under the C&H privilege umbrella on May 5, 2023, to conduct the forensic investigation of the security incident. Graystone's work product was directed by and prepared at the request of C&H as outside counsel to Quorum. Graystone is headquartered at 1950 Old Gallows Road, Suite 600, Tysons Corner, Virginia 22182. Key contacts:
• Dr. Nolan Briggs — Managing Director, Incident Response
• Kendra Faulkner — Senior Forensic Analyst
Clearfield Notification Services LLC — Breach notification services firm retained by Quorum to manage consumer notification mailings, the dedicated call center, and the credit monitoring and identity theft protection program. Clearfield is located at 4500 Rockside Road, Suite 210, Independence, Ohio 44131. Key contact:
• Jerome Tillman — Account Manager
BrightPath Consulting Group Inc. — Crisis communications and public relations firm retained by Quorum to manage external communications related to the incident, including media inquiries, stakeholder communications, and reputational risk mitigation. BrightPath is located at 450 Lexington Avenue, 4th Floor, New York, New York 10017. Key contact:
• Meredith Ashford — Managing Director
Whitmore Risk Advisors Inc. — Cyber insurance brokerage firm serving as Quorum's broker for the cyber-liability insurance program. Whitmore Risk coordinated the insurance claim process and served as an intermediary between Quorum and the insurance carriers. Whitmore Risk is located at 390 Park Avenue, 18th Floor, New York, New York 10022. Key contact:
• Sandra Whitmore-Kim — Lead Broker
E. Insurance Carriers
Quorum's cyber-liability insurance program is structured as a two-layer tower with a total available limit of $40 million. The following carriers are implicated:
Atlas Mutual Insurance Company (Primary Cyber-Liability Insurer)
• Policy No.: CYB-2023-041587
• Claim No.: CYB-CLM-2023-05892
• Per-Occurrence Limit: $15,000,000
• Self-Insured Retention ("SIR"): $2,500,000
• Claims Adjuster: Paul Enriquez
• Address: 120 South LaSalle Street, Suite 3200, Chicago, Illinois 60603
Pinnacle Surplus Lines Insurance Corp. (Excess Cyber-Liability Insurer)
• Policy No.: XS-CYB-2023-7812
• Excess Limit: $25,000,000 (follow-form)
• Claims Contact: Lisa Garner
• Address: One Beacon Street, Suite 1100, Boston, Massachusetts 02108
Atlas served as the primary carrier and was the only carrier against which a claim was made. Pinnacle received a precautionary notice on May 8, 2023, but no formal claim was submitted as the total incident costs did not exceed the $15 million primary policy limit.
F. Regulators
The following regulatory bodies were involved in the incident through formal notifications, inquiries, or both:
Connecticut Attorney General's Office, Consumer Protection Division — Served as the lead state for the multistate attorney general coalition. The primary contact was Assistant Attorney General Diane Marchetti.
New York Attorney General's Office, Bureau of Internet and Technology — Served on the multistate executive committee. The primary contact was Assistant Attorney General Mark Petrosian.
Connecticut Insurance Department — Conducted a separate industry-specific inquiry regarding Quorum's compliance with Connecticut's Insurance Data Security Law. The primary contact was Richard Nakamura, Financial Analysis Division, Cybersecurity Unit.
U.S. Department of Health and Human Services, Office for Civil Rights, Region I (Boston) — Received the HIPAA breach notification for the subset of affected individuals whose PHI was compromised (41,203 individuals).
29-State Multistate Attorney General Coalition — The following states participated in the multistate inquiry: Connecticut, New York, Massachusetts, California, Illinois, Pennsylvania, New Jersey, Ohio, Texas, Florida, Georgia, Virginia, Maryland, North Carolina, South Carolina, Michigan, Minnesota, Indiana, Wisconsin, Colorado, Arizona, Oregon, Washington, Tennessee, Missouri, Louisiana, Nevada, Iowa, and New Hampshire.
G. Other Third Parties Referenced
Halstead & Monroe LLP — Quorum's external auditor, located at 1600 Market Street, Suite 2800, Philadelphia, Pennsylvania 19103. The engagement partner was Gregory Chin. Halstead & Monroe was consulted regarding the SEC disclosure implications of the incident for Quorum's periodic filings.
Kessler, Park & Associates CPA, PLLC — Palomar's SOC 2 auditor, located at 3000 Oak Lawn Avenue, Suite 700, Dallas, Texas 75219. The engagement partner was Vivian Park. Palomar's most recent SOC 2 Type II report, issued by Kessler, Park & Associates, was reviewed as part of the forensic investigation and the vendor indemnification analysis.
III. Matter Background and Incident Summary
A. The Palomar Data Solutions Relationship
Quorum outsources claims data processing for its personal lines division to Palomar under a Master Services Agreement ("MSA") originally executed on November 12, 2019. The MSA has a five-year term expiring November 11, 2024. The original annual contract value was approximately $14.2 million, yielding a five-year total contract value of approximately $71.0 million.
The MSA has been amended three times during its term. The first two amendments preceded the security incident; the third was executed contemporaneously with the indemnification settlement:
Amendment 1 (executed March 3, 2021): Added processing of data from Quorum's QuorumEdge digital underwriting platform to the scope of Palomar's services. The ACV was increased by $2.1 million to approximately $16.3 million, effective April 1, 2021. This amendment significantly expanded the volume and sensitivity of the data processed by Palomar, as QuorumEdge data includes detailed applicant information collected during the digital underwriting process.
Amendment 2 (executed September 15, 2022): Updated the Data Security Exhibit (Exhibit D) to the MSA, incorporating more specific security requirements. Notably, Amendment 2 added a requirement that Palomar maintain and provide to Quorum a SOC 2 Type II audit report on an annual basis, and updated the minimum cyber-liability insurance requirements for Palomar. These enhancements were implemented as part of Quorum's broader vendor risk management program improvements, led by Priya Deshmukh.
Amendment 3 (executed October 27, 2023): Executed contemporaneously with the indemnification settlement agreement. Amendment 3 further strengthened the data security and audit provisions of the MSA, as described in Section V.B below.
The following contractual provisions of the MSA were of particular relevance to the incident and the firm's work on this Matter:
Exhibit D (Data Security Exhibit): Required Palomar to implement and maintain "commercially reasonable" administrative, technical, and physical safeguards to protect Quorum data. Among other specific requirements, Exhibit D mandated that Palomar patch critical vulnerabilities within 30 days of the availability of a vendor-supplied patch. This provision was central to the firm's analysis of Palomar's breach of its contractual obligations, as CVE-2023-0669 had a vendor-supplied patch available on February 7, 2023—more than 35 days before the initial compromise on March 14, 2023.
Section 9.4 (Breach Notification): Required Palomar to notify Quorum of any confirmed or suspected security incident within 48 hours of discovery. As discussed below, Palomar's notification on April 21, 2023—three days after detection on April 18, 2023—exceeded this contractual deadline by approximately 24 hours.
Section 12.2 (Indemnification): Provided for Palomar's indemnification of Quorum for losses arising from Palomar's breach of its data security obligations, subject to a liability cap of two times the trailing twelve-month fees paid or payable under the MSA. Based on the applicable period, the indemnification cap was approximately $32.6 million (2 × $16.3M).
Exhibit E (Insurance Requirements): Required Palomar to maintain a minimum of $10 million in cyber-liability insurance coverage.
Section 14.2 (Termination for Cause): Permitted either party to terminate the MSA for material breach upon 30 days' written notice if the breaching party failed to cure the breach within the 30-day notice period.
These contractual provisions formed the foundation of the firm's vendor accountability strategy and were instrumental in achieving the indemnification settlement described in Section V.B below.
B. The Security Incident
On or about March 14, 2023, a threat actor exploited CVE-2023-0669, a known remote code execution vulnerability in Severin Corporation's GoAnywhere MFT file transfer appliance, to gain unauthorized access to Palomar's network environment. CVE-2023-0669 had been publicly disclosed on February 1, 2023, and a vendor-supplied patch was made available by Severin Corporation on February 7, 2023. Palomar had not applied the patch as of March 14, 2023—a period of 35 days following patch availability—in violation of the 30-day patching requirement under Exhibit D of the MSA.
Following the initial compromise, the threat actor conducted lateral movement within Palomar's network over a period of approximately 35 days, from March 14 through April 18, 2023. During this period, the threat actor accessed Palomar's claims-processing environment, which contained structured data files with Quorum policyholder and claimant information. The threat actor exfiltrated these data files from Palomar's environment through encrypted channels, a finding confirmed by the Graystone forensic investigation.
Palomar's Security Operations Center ("SOC") detected anomalous outbound data transfers on April 18, 2023. Upon investigation, Palomar determined that the anomalous activity was indicative of a data security incident involving potential unauthorized access to and exfiltration of client data. Palomar engaged its own incident response resources and began its internal investigation on April 18, 2023.
Palomar notified Quorum of the incident on April 21, 2023—three days after Palomar's own discovery of the anomalous activity. This notification was delivered via email from Derek Copeland (Palomar General Counsel) to Thomas R. Whitfield (Quorum General Counsel) and David Naranjo (Quorum CISO). The notification was approximately 24 hours past the contractual 48-hour notification deadline established by Section 9.4 of the MSA. While Palomar subsequently contended that the 48-hour period did not begin to run until it had confirmed the involvement of Quorum data (which Palomar asserted occurred on April 20, 2023), C&H's analysis concluded that the contractual trigger was discovery of a "confirmed or suspected" incident, which occurred no later than April 18, 2023.
C. Compromised Data Scope
The Graystone forensic investigation, completed on July 14, 2023, confirmed the following scope of compromised data:
Total affected individuals: 318,247 across 29 states and the District of Columbia.
Personally Identifiable Information (PII): All 318,247 affected individuals had the following categories of PII compromised: full names, dates of birth, Social Security numbers, and driver's license numbers.
Financial Information: A subset of 84,619 affected individuals also had financial information compromised, including bank account numbers and/or payment card numbers. These individuals were primarily policyholders who had established electronic payment arrangements for premiums or claimants who had received electronic claims payments.
Protected Health Information (PHI): A subset of 41,203 affected individuals also had protected health information compromised, including health conditions, diagnosis codes, and treatment information. These individuals were associated with workers' compensation claims and other health-related insurance claims processed by Palomar on behalf of Quorum's personal lines division.
The geographic distribution of affected individuals was broadly consistent with Quorum's policyholder and claimant base. The ten states with more than 10,000 affected residents were as follows:
The significant volume of affected individuals, the sensitivity of the compromised data (including Social Security numbers, financial account information, and PHI), and the geographic breadth of the incident across 29 states and the District of Columbia collectively established the severity and complexity of the notification and regulatory response obligations.
IV. Engagement Timeline and Key Milestones
A. Engagement Opening and Initial Response (May 2023)
The engagement commenced on May 4, 2023, following Quorum's outreach to C&H's Privacy & Data Security practice. The initial response phase focused on activating Quorum's incident response plan, retaining the forensic investigation firm under the C&H privilege umbrella, securing the evidentiary record, initiating the insurance claim process, and providing the Board Audit Committee with an initial incident briefing. The key milestones during this phase were as follows:
May 4, 2023: Calderwood & Harkness engagement formally opened under Matter No. 1025-00006. Kevin Ostrowski issued an incident response plan activation memo to the Quorum incident response team, including Thomas Whitfield, Jennifer Liang, David Naranjo, Priya Deshmukh, and Robert Wentworth. Ostrowski also sent an email to Thomas Whitfield outlining the immediate response steps to be taken, including preservation of evidence, engagement of forensic investigators, assessment of contractual notification obligations, and preliminary evaluation of regulatory notification requirements.
May 5, 2023: Graystone Forensics LLC was retained under the C&H privilege umbrella to conduct the forensic investigation. The retention was structured such that Graystone was engaged by C&H as outside counsel to Quorum, with the direction that all forensic investigation work product would be prepared at the request of and under the direction of counsel for the purpose of providing legal advice. A privilege protocol memo was issued internally within C&H to ensure all team members understood the privilege framework and the protocols for communicating with Graystone and the client.
May 6, 2023: A legal hold notice was drafted and issued to Quorum's IT and Claims departments, directing the preservation of all documents, communications, logs, and electronically stored information related to the Palomar incident, the Palomar MSA, and the claims-processing data environment.
May 7, 2023: Graystone's scope of work and investigation plan were finalized in coordination with C&H and Quorum's CISO, David Naranjo. The investigation plan encompassed network forensics, log analysis, malware analysis, data flow mapping, and exfiltration scope determination.
May 8, 2023: An initial incident assessment memo was delivered to Quorum General Counsel Thomas Whitfield, providing a preliminary legal assessment of the incident based on the information then available, including initial views on the likely scope of regulatory notification obligations and the contractual indemnification framework under the Palomar MSA. On the same date, the cyber-insurance claim was filed with Atlas Mutual Insurance Company under Policy No. CYB-2023-041587, resulting in the assignment of Claim No. CYB-CLM-2023-05892. A precautionary notice was also sent to Pinnacle Surplus Lines Insurance Corp. to preserve Quorum's rights under the excess layer.
May 9, 2023: A cyber-insurance coverage analysis memo was delivered to Quorum, setting forth the firm's analysis of the Atlas Mutual and Pinnacle policies, including the scope of covered costs, the applicable SIR, policy conditions and exclusions, and recommendations for compliance with policy conditions during the incident response process.
May 10, 2023: A common interest agreement was executed between Quorum and Atlas Mutual Insurance Company to facilitate the sharing of privileged and work product materials related to the incident response and insurance claim without waiver of applicable privileges.
May 11, 2023: A Board Audit Committee initial incident briefing memo was delivered to Franklin Reeves, Chair of the Audit Committee, through Thomas Whitfield. The memo provided the Audit Committee with a summary of the incident, the engagement of C&H and Graystone, the initial legal assessment, and the anticipated workstreams and timeline.
May 12, 2023: A contractual analysis memo on the Palomar MSA indemnification and data security provisions was delivered to Quorum General Counsel. This memo analyzed the key provisions of the MSA, including Exhibit D (data security requirements), Section 9.4 (breach notification), Section 12.2 (indemnification), and Section 14.2 (termination for cause), and provided a preliminary assessment of Quorum's contractual remedies against Palomar.
B. Forensic Investigation (May – July 2023)
The forensic investigation was conducted by Graystone Forensics LLC under the C&H privilege umbrella over a period of approximately ten weeks, from May through mid-July 2023. The investigation proceeded in two phases, with a preliminary report issued in early June and a final comprehensive report issued in mid-July. The key milestones during this phase were as follows:
June 2, 2023: Graystone issued its preliminary forensic findings report (privileged). The preliminary report confirmed the exfiltration of structured data files from Palomar's claims-processing environment and identified the attack vector as the exploitation of CVE-2023-0669 in Palomar's GoAnywhere MFT appliance. The preliminary report established with reasonable confidence that the threat actor had been present in Palomar's environment from approximately March 14 through April 18, 2023, and had exfiltrated multiple data files containing Quorum policyholder and claimant information. However, the full scope of affected individuals and data categories had not yet been determined.
June 5, 2023: C&H's analysis of the preliminary forensic findings was delivered to Quorum General Counsel. This memo assessed the legal significance of the preliminary findings, including the implications for the scope of notification obligations and the strength of the contractual indemnification claim against Palomar.
June 8, 2023: A comprehensive 50-state breach notification law survey was completed by Sara Hendricks, cataloging the notification requirements, timelines, exemptions, and regulator-specific filing requirements for each potentially affected jurisdiction.
June 20, 2023: A formal breach of contract demand letter was sent to Palomar through its outside counsel, Mercer, Haight & Dunlop LLP (Catherine Langford). The demand letter asserted Palomar's breach of the MSA's data security requirements (Exhibit D, 30-day patching requirement) and breach notification obligations (Section 9.4, 48-hour notification requirement), and demanded full indemnification under Section 12.2 in the amount of $8,230,250, representing the full anticipated cost of the incident response.
July 7, 2023: Palomar's initial response to the demand letter was received through Mercer, Haight & Dunlop. Palomar disputed causation, contending that the GoAnywhere MFT vulnerability was a zero-day exploit at the time of the initial compromise (a factual assertion contradicted by the public disclosure and patch availability timeline) and that Quorum's own data governance practices contributed to the scope of the exposure. Palomar offered a $1,500,000 "goodwill credit" against future services, expressly denying any liability. The firm assessed Palomar's defenses as lacking merit and recommended pursuing a rebuttal.
July 14, 2023: Graystone issued its final forensic report (privileged). The final report confirmed the full scope of the incident: 318,247 affected individuals, with the breakdowns of PII, financial information, and PHI as set forth in Section III.C above. The final report also provided a detailed technical analysis of the attack chain, the dwell time, the lateral movement within Palomar's network, and the volume and nature of exfiltrated data.
July 18, 2023: C&H's summary and legal analysis of the final forensic findings was delivered to Quorum General Counsel Thomas Whitfield, Chief Privacy Officer Jennifer Liang, and CISO David Naranjo. This memo provided a comprehensive assessment of the final forensic findings and their implications across all workstreams, including notification obligations, regulatory exposure, vendor indemnification, insurance coverage, and SEC disclosure considerations.
July 19, 2023: An SEC disclosure analysis memo was delivered to Quorum, addressing the 8-K and 10-Q disclosure considerations arising from the incident under the SEC's recently adopted cybersecurity disclosure rules and existing materiality standards. The memo was prepared in coordination with Quorum's external auditor, Halstead & Monroe LLP.
July 20, 2023: A notification trigger analysis memo was completed, confirming that notification obligations were triggered in all 29 states where affected individuals resided, as well as the District of Columbia. The memo analyzed the applicable statutory definitions, triggers, exemptions, and safe harbors in each jurisdiction and concluded that no exemption or safe harbor was available to eliminate the notification obligation in any affected jurisdiction.
July 21, 2023: A Board Audit Committee forensic findings and notification plan briefing memo was delivered to Franklin Reeves through Thomas Whitfield, summarizing the final forensic findings, the confirmed notification obligations, the proposed notification timeline, and the anticipated regulatory engagement.
July 22, 2023: Two additional notification analysis memos were completed: a HIPAA breach notification analysis memo, addressing the notification obligations under 45 C.F.R. Part 164, Subpart D, for the 41,203 individuals whose PHI was compromised; and a Connecticut Insurance Data Security Law analysis memo, addressing Quorum's obligations under Conn. Gen. Stat. § 38a-999b as a licensed insurer.
July 23, 2023: A New York SHIELD Act compliance memo was completed, analyzing Quorum's notification obligations under N.Y. Gen. Bus. Law § 899-aa and the additional requirements of the SHIELD Act (N.Y. Gen. Bus. Law § 899-bb) for the 47,831 affected New York residents.
July 24, 2023: A California CCPA/CMIA notification analysis memo was completed, addressing the notification obligations under Cal. Civ. Code § 1798.82 and, for affected individuals with compromised medical information, the Confidentiality of Medical Information Act (Cal. Civ. Code § 56 et seq.), for the 38,206 affected California residents.
July 25, 2023: A rebuttal letter was sent to Mercer, Haight & Dunlop LLP responding to Palomar's initial position. The rebuttal letter refuted Palomar's causation defenses with reference to the CVE-2023-0669 disclosure and patch availability timeline, cited the Graystone forensic findings (in redacted form appropriate for sharing with a counterparty), and reiterated the full indemnification demand.
C. Data Mining and Notification Preparation (August 2023)
With the forensic investigation completed and the notification obligations confirmed, the engagement transitioned to the data mining, notification preparation, and logistics phase. This phase involved identifying specific affected individuals, drafting notification letters tailored to the applicable jurisdictional requirements and data categories, and engaging the notification services vendor. The key milestones were as follows:
August 1, 2023: A state-by-state notification timeline and content requirements matrix was completed. This comprehensive matrix cataloged the specific content requirements, timing requirements, and regulator-specific filing procedures for all 29 states and the District of Columbia, as well as the federal HIPAA requirements. The matrix served as the master reference document for the notification workstream.
August 4, 2023: Data mining and affected individual identification were completed. Working with Quorum's Claims Operations team (Robert Wentworth) and the Graystone forensic findings, the firm confirmed the identity and contact information for all 318,247 affected individuals and categorized each individual by the types of data compromised (PII only, PII plus financial data, PII plus PHI, or PII plus both financial data and PHI) and state of residence.
August 6, 2023: The statement of work with Clearfield Notification Services LLC was executed. The total contract value was $3,214,500, encompassing notification letter printing and mailing ($636,000), a dedicated call center staffed for a 12-week window ($478,500), and 24 months of complimentary credit monitoring and identity theft protection services for all 318,247 affected individuals ($2,100,000 negotiated flat fee).
August 10, 2023: Model consumer notification letters were finalized in three versions: (1) a general PII version for individuals whose names, dates of birth, Social Security numbers, and/or driver's license numbers were compromised; (2) an SSN plus financial data version for individuals whose Social Security numbers and financial account information (bank account and/or payment card numbers) were compromised; and (3) a PHI/HIPAA-compliant version for individuals whose protected health information was compromised, incorporating the additional content elements required under 45 C.F.R. § 164.404(c).
August 12, 2023: California-specific and Massachusetts-specific notification letters were finalized, incorporating the additional content and formatting requirements of Cal. Civ. Code § 1798.82 and Mass. Gen. Laws ch. 93H, § 3, respectively. These state-specific adaptations were necessary due to the particularly detailed requirements of these jurisdictions' notification statutes.
August 14, 2023: The call center script and frequently asked questions ("FAQ") document were finalized for Clearfield's call center operations. The script and FAQ were designed to address anticipated consumer inquiries regarding the nature of the breach, the types of data compromised, the credit monitoring enrollment process, and the steps individuals could take to protect themselves from identity theft and fraud.
D. Regulatory and Consumer Notifications (August – September 2023)
The regulatory and consumer notification phase commenced on August 14, 2023, and was completed by September 15, 2023. Notifications were filed with all applicable state regulators and federal agencies, and individual notification letters were mailed to all 318,247 affected individuals. All notifications were confirmed timely under the applicable statutory deadlines. The key milestones were as follows:
August 14, 2023: The Connecticut Attorney General notification was filed pursuant to Conn. Gen. Stat. § 36a-701b. On the same date, the Connecticut Insurance Department notification was filed pursuant to Conn. Gen. Stat. § 38a-999b. Connecticut was prioritized as the first state for notification filings given Quorum's domicile in Connecticut and the state's role as lead state for the anticipated multistate inquiry.
August 15, 2023: The HHS Office for Civil Rights breach notification was filed pursuant to 45 C.F.R. § 164.408, reflecting the compromise of PHI affecting more than 500 individuals. In accordance with 45 C.F.R. § 164.406, a media notice was prepared and distributed to prominent media outlets serving the affected states, informing the public of the breach and the availability of credit monitoring services. Additionally, substitute notice and website posting language were published on Quorum's website pursuant to applicable state statutes requiring or permitting substitute notice.
August 16, 2023: The New York Attorney General notification was filed pursuant to N.Y. Gen. Bus. Law § 899-aa. The California Attorney General notification was filed pursuant to Cal. Civ. Code § 1798.82 (applicable for breaches affecting more than 500 California residents).
August 17, 2023: The Massachusetts Attorney General and Department of Consumer Rights notification was filed pursuant to Mass. Gen. Laws ch. 93H, § 3. Filing of the remaining state notifications commenced on the same date.
August 17–25, 2023: All remaining 24 state attorney general and/or regulatory notifications were filed during this period. All filings were confirmed timely per the applicable statutory deadlines in each jurisdiction.
August 18, 2023: Consumer notification mailing commenced on a rolling basis. Notification letters were mailed first-class through the United States Postal Service, printed and distributed by Clearfield Notification Services.
August 25, 2023: The regulatory notification tracker was finalized, confirming that all required state and federal regulatory filings had been completed and were compliant with all applicable requirements. The tracker documented the date of each filing, the statutory basis, the method of filing, and the confirmation or receipt number (where provided by the regulator).
August 28, 2023: A negotiation strategy memo for the Palomar indemnification was delivered to Quorum General Counsel, setting forth the firm's recommended approach for the next phase of indemnification negotiations in light of Palomar's initial response and the completed forensic findings.
August 30, 2023: An insurance coverage status update memo was delivered, confirming that Atlas Mutual had accepted coverage for incident response costs exceeding the $2,500,000 SIR. The accepted cost categories included forensic investigation, consumer notification (mailing, call center, and credit monitoring), crisis communications, and regulatory defense legal fees.
September 15, 2023: Consumer notification mailing was completed. All 318,247 individual notification letters were mailed during the approximately 28-day mailing window from August 18 through September 15, 2023.
E. Multistate AG Inquiry and Regulatory Defense (September – November 2023)
As anticipated, the incident attracted the attention of state regulators, culminating in a formal multistate attorney general inquiry. This phase also encompassed the vendor indemnification settlement negotiations, which proceeded in parallel with the regulatory defense workstream. The key milestones were as follows:
September 8, 2023: A multistate attorney general joint demand letter was received from the Connecticut Attorney General's Office (AAG Diane Marchetti) and the New York Attorney General's Office (AAG Mark Petrosian) on behalf of a 29-state coalition. The demand letter requested detailed information regarding the incident, Quorum's data security practices, its vendor oversight program, the forensic investigation findings, the notification process, and the remedial measures taken and planned.
September 10, 2023: An engagement scope expansion letter was issued to Quorum, formalizing the addition of two workstreams to the engagement: (1) regulatory defense in connection with the multistate AG inquiry, the CT Insurance Department inquiry, and the HHS-OCR inquiry; and (2) vendor indemnification negotiation and settlement with Palomar.
September 11, 2023: C&H's strategy memo for the multistate AG response was delivered to Quorum. The memo outlined the recommended approach for engaging with the coalition, emphasizing a cooperative and transparent posture while carefully protecting privileged materials. The strategy centered on demonstrating Quorum's status as a victim of a vendor-originated breach, its robust pre-existing information security program, its prompt and comprehensive response to the incident, and its proactive vendor accountability measures.
September 18, 2023: A draft indemnification settlement term sheet was circulated to Mercer, Haight & Dunlop LLP, proposing settlement terms that included a substantial cash payment, prospective fee reductions, enhanced security commitments by Palomar, and a mutual release.
September 22, 2023: The Connecticut Insurance Department inquiry response was submitted, providing detailed information regarding Quorum's compliance with the Connecticut Insurance Data Security Law (Conn. Gen. Stat. § 38a-999b) and its information security program as it relates to third-party vendor oversight.
October 5, 2023: The HHS-OCR inquiry response was submitted, addressing the Office for Civil Rights' questions regarding the scope of the PHI breach, the HIPAA-compliant notification process, and Quorum's compliance with the HIPAA Security Rule and Business Associate Agreement requirements.
October 13, 2023: The multistate AG response brief and supporting Exhibits A through D were submitted to the 29-state coalition. The response brief was a comprehensive submission addressing each of the coalition's requests and demonstrating Quorum's diligent response to the incident. The exhibits included: (A) a summary of Quorum's information security program; (B) a timeline of the incident and response; (C) a summary of the notification process and consumer remediation measures; and (D) a summary of the vendor accountability measures taken, including the pending indemnification claim and proposed security enhancements.
October 15, 2023: A revised indemnification settlement term sheet was exchanged with Mercer, Haight & Dunlop following several rounds of negotiation. The revised term sheet reflected the parties' progress toward agreement on the principal terms, including the cash payment amount, the fee reduction structure, and the scope of the enhanced security commitments.
October 16, 2023: A Board Audit Committee regulatory engagement update briefing memo was delivered to Franklin Reeves, providing an update on the status of the multistate AG inquiry, the CT Insurance Department inquiry, the HHS-OCR inquiry, and the Palomar indemnification negotiations.
October 20, 2023: A supplemental information submission was provided to the Connecticut Insurance Department in response to follow-up questions regarding specific aspects of Quorum's vendor risk management program and the contractual security requirements applicable to Palomar.
October 27, 2023: The Palomar indemnification settlement agreement and mutual release were executed by authorized representatives of Quorum and Palomar. The settlement terms are summarized in Section V.B below. Concurrently, MSA Amendment 3 was executed, incorporating the enhanced data security, patching, endpoint detection, and audit provisions agreed upon as part of the settlement.
October 28, 2023: C&H delivered a memo summarizing the settlement terms and providing recommendations to Quorum regarding implementation and monitoring of the settlement provisions and the new MSA Amendment 3 requirements.
F. Closure of All Regulatory Tracks (November 2023)
The final phase of the engagement focused on securing the closure of all outstanding regulatory inquiries and completing the remaining administrative steps necessary to close the Matter. The key milestones were as follows:
November 3, 2023: Supplemental information was provided to the multistate AG coalition at the coalition's request, including updated credit monitoring enrollment statistics and a summary of the Palomar settlement agreement.
November 15, 2023: A proof of loss and final cost summary was submitted to Atlas Mutual Insurance Company in support of the reimbursement claim for $5,730,250 in covered costs exceeding the SIR.
November 22, 2023: The multistate AG closure letter was received from AAG Diane Marchetti on behalf of the 29-state coalition. The letter confirmed that the coalition had concluded its review and would not be taking enforcement action against Quorum. The closure letter noted the coalition's acknowledgment of Quorum's cooperative engagement with the inquiry, its prompt and comprehensive notification and consumer remediation measures, and its vendor accountability actions.
November 24, 2023: C&H's analysis memo on the AG closure letter and its implications was delivered to Quorum, including a discussion of the potential precedential value of the closure for any future incidents and the importance of maintaining the remediation measures as ongoing protections.
November 28, 2023: The Connecticut Insurance Department inquiry was formally closed. Richard Nakamura confirmed by letter that the Department had concluded its review and would not be taking further action.
November 29, 2023: A Board Audit Committee matter resolution and closure briefing memo was delivered to Franklin Reeves, summarizing the resolution of all regulatory inquiries, the vendor indemnification settlement, the insurance claim status, the absence of litigation, and the firm's recommendation that the Matter be closed.
November 30, 2023: The HHS Office for Civil Rights issued a no further action letter, concluding its review of the HIPAA breach notification and the underlying PHI breach without enforcement action. On the same date, C&H delivered a post-incident lessons learned and remediation recommendations memo to Quorum, setting forth the firm's observations and recommendations for strengthening Quorum's data security, vendor risk management, and incident response programs based on the experience of this incident.
December 1, 2023: The engagement was formally closed. This matter closing memorandum, along with the document retention and privilege log protocol memo, was delivered as the final C&H work product under the engagement.
V. Outcomes Summary
A. Regulatory Outcomes
The Matter achieved uniformly favorable regulatory outcomes across all tracks. No fines, penalties, consent orders, or other enforcement actions were imposed by any regulator:
• Multistate AG Coalition (29 states): All 29 state attorneys general participating in the coalition closed their inquiry without enforcement action. The closure letter, dated November 22, 2023, was issued by AAG Diane Marchetti of the Connecticut Attorney General's Office on behalf of the full coalition.
• Connecticut Insurance Department: The Department's inquiry was closed on November 28, 2023, without enforcement action.
• HHS Office for Civil Rights, Region I: OCR issued a no further action letter on November 30, 2023, concluding its review without enforcement action.
The favorable regulatory outcome is attributable to several factors that the firm emphasized throughout its regulatory engagement strategy. First, the breach was vendor-originated, arising from Palomar's failure to patch a known vulnerability in its own systems, rather than from any deficiency in Quorum's information security program. Second, Quorum maintained a robust information security program with appropriate policies, procedures, and controls, including a vendor risk management program that incorporated contractual data security requirements, SOC 2 audit requirements, and cyber insurance minimums. Third, Quorum provided timely and comprehensive consumer and regulatory notifications in compliance with all applicable state and federal statutes. Fourth, Quorum implemented proactive remedial measures, including the offer of 24 months of complimentary credit monitoring and identity theft protection to all affected individuals. Fifth, Quorum took affirmative vendor accountability actions, including the indemnification demand, the settlement, and the strengthening of the MSA's security provisions through Amendment 3. Sixth, Quorum engaged cooperatively and transparently with all regulators throughout the inquiry process.
B. Vendor Indemnification Outcome
The vendor indemnification workstream resulted in a negotiated settlement that yielded a total effective recovery to Quorum of approximately $6,156,000 against total incident response costs of $8,230,250. The negotiation history and final settlement terms are summarized as follows:
Initial Demand: C&H's demand letter of June 20, 2023, sought full indemnification of $8,230,250, representing the total anticipated incident response costs. The demand was grounded in Palomar's breach of the MSA's data security requirements (Exhibit D, 30-day critical patching requirement), Palomar's breach of the notification obligation (Section 9.4, 48-hour notification requirement), and the indemnification provision of Section 12.2.
Palomar's Initial Offer: Palomar's response of July 7, 2023, disputed causation and offered a $1,500,000 "goodwill credit" against future services, expressly denying liability.
Negotiated Settlement (executed October 27, 2023): After multiple rounds of negotiation conducted through Mercer, Haight & Dunlop, the parties reached a settlement on the following principal terms:
(a) Cash Payment: Palomar agreed to pay $4,200,000 in cash to Quorum within 30 days of execution of the settlement agreement (i.e., by November 26, 2023).
(b) Fee Reduction: Palomar agreed to an 18-month reduction of 8% in fees under the MSA, effective November 1, 2023, through April 30, 2025. Based on the current ACV of $16.3 million, this fee reduction yields approximately $1,956,000 in savings to Quorum over the 18-month period ($16,300,000 × 8% × 1.5 years = $1,956,000).
(c) Independent Security Assessor: Palomar agreed, at its own expense, to engage an independent third-party security assessor to conduct enhanced annual security audits of Palomar's environment, with results shared with Quorum.
(d) Security Enhancements: Palomar agreed to implement enhanced patch management protocols and endpoint detection and response ("EDR") capabilities across its environment within 90 days of the settlement execution date (i.e., by approximately January 25, 2024).
(e) Mutual Release: The parties exchanged mutual releases of all claims related to the security incident.
Total effective recovery by Quorum from Palomar: $6,156,000 ($4,200,000 cash + $1,956,000 fee reduction).
The indemnification liability cap under Section 12.2 of the MSA was $32.6 million (2 × trailing twelve-month fees of $16.3M). The settlement was well within this cap. The firm's assessment is that the settlement represented a favorable outcome for Quorum, reflecting a substantial recovery while avoiding the cost, distraction, and risk of protracted litigation with a critical business vendor whose services Quorum continues to utilize.
Concurrently with the settlement agreement, MSA Amendment 3 was executed, incorporating the following enhanced provisions:
• Critical vulnerability patching requirement reduced from 30 days to 14 days
• Mandatory deployment of endpoint detection and response ("EDR") solutions across all systems processing Quorum data
• Quarterly vulnerability scanning with results reported to Quorum's vendor risk management team