post-incident-remediation-recommendations.docx

1025-00006 · Graystone Forensics LLC · Closing & Post-Incident

post-incident-remediation-recommendations.docx DOCUMENT Data Privacy

8 / 88 ← → ✕

CALDERWOOD & HARKNESS LLP Privacy & Data Security Practice Group 1700 K Street NW, Suite 900 Washington, D.C. 20006

November 30, 2023

MEMORANDUM

TO:

Thomas R. Whitfield, General Counsel Jennifer Liang, Chief Privacy Officer David Naranjo, Chief Information Security Officer Priya Deshmukh, Vice President, Vendor Risk Management

Quorum Insurance Holdings Corp. 400 Constitution Plaza, Suite 2200 Hartford, CT 06103

FROM:

Kevin Ostrowski, Partner, Privacy & Data Security Alan Burke, Lead Associate, Privacy & Data Security

Calderwood & Harkness LLP 1700 K Street NW, Suite 900 Washington, D.C. 20006

RE: Post-Incident Lessons Learned and Remediation Recommendations — Palomar Data Solutions, Inc. Data Security Incident

MATTER NO.: 1025-00006

This memorandum constitutes a privileged and confidential attorney-client communication and attorney work product prepared at the direction of counsel in connection with pending and anticipated legal matters. It is intended solely for the use of the addressees and should not be distributed, disclosed, or reproduced without the prior written approval of Calderwood & Harkness LLP. Distribution of this memorandum to any third party, including other Quorum Insurance Holdings Corp. employees, business units, or external advisors, may result in waiver of applicable privileges.

Right-click to update Table of Contents

I. Executive Summary

The purpose of this memorandum is to document the lessons learned from the data security incident originating from Quorum Insurance Holdings Corp.'s ("Quorum" or the "Company") third-party claims-processing vendor, Palomar Data Solutions, Inc. ("Palomar"), and to provide Calderwood & Harkness LLP's ("Calderwood & Harkness" or "outside counsel") actionable recommendations for strengthening Quorum's information security program, vendor risk management program, and incident response capabilities. This memorandum is prepared at the direction of counsel and represents Calderwood & Harkness's final advisory deliverable under Matter No. 1025-00006.

The Incident. Between approximately March 14 and April 18, 2023 — a period of approximately 35 days — a threat actor exploited CVE-2023-0669, a known remote code execution vulnerability in Palomar's GoAnywhere MFT file transfer appliance, to achieve unauthorized access to Palomar's network environment. During this window, the threat actor conducted lateral movement through Palomar's systems and exfiltrated structured data files containing personally identifiable information ("PII"), financial data, and protected health information ("PHI") of 318,247 Quorum policyholders and claimants across 29 states and the District of Columbia. The root cause of the breach was Palomar's failure to apply a vendor-issued patch for CVE-2023-0669 within the contractually mandated 30-day patching window, as confirmed by the privileged forensic investigation conducted by Graystone Forensics LLC under Calderwood & Harkness's direction.

Outcomes. The incident response engagement has been resolved with uniformly favorable regulatory outcomes. All consumer and regulatory notifications were completed in a timely manner consistent with applicable statutory requirements. The multistate attorney general coalition — comprising 29 states and led by the Connecticut Attorney General and the New York Attorney General — closed its inquiry on November 22, 2023, without enforcement action. The Connecticut Insurance Department concluded its inquiry on November 28, 2023, without adverse findings. The U.S. Department of Health and Human Services, Office for Civil Rights ("HHS-OCR") issued a no further action letter on November 30, 2023. Additionally, a vendor indemnification settlement with Palomar was executed on October 27, 2023, yielding an effective total recovery of $6,156,000 against total incident response costs of $8,230,250.

The Need for Systematic Remediation. While the favorable resolution of all regulatory inquiries and the successful cost recovery from Palomar are commendable outcomes, this favorable resolution should not obscure the systemic vulnerabilities that this incident revealed. The breach exposed concrete and actionable gaps in Quorum's vendor oversight architecture, contractual enforcement mechanisms, incident response mobilization timelines, regulatory compliance infrastructure, and data minimization practices. These gaps are addressable through the systematic remediation program recommended in this memorandum.

Engagement Closure. This engagement is closing effective December 1, 2023. This memorandum and the accompanying Document Retention & Privilege Log Protocol Memo (dated December 1, 2023) constitute the final deliverables under Matter No. 1025-00006. The recommendations contained herein represent Calderwood & Harkness's comprehensive advisory assessment, informed by the firm's experience managing the entirety of the incident response, regulatory engagement, and vendor indemnification processes.

Structure. This memorandum is organized into five categories of lessons learned, each paired with specific, prioritized remediation recommendations:

1. Vendor Risk Management Program

2. Contractual Protections and Enforcement

3. Incident Response Plan and Preparedness

4. Regulatory Notification and Compliance

5. Data Minimization and Security Architecture

These categories are followed by a financial summary and cost recovery context, an implementation roadmap with prioritized timelines, and concluding observations.

II. Incident Recap and Root Cause Analysis

A. Incident Overview

Palomar Data Solutions, Inc. is a data services firm that provides claims data processing, document management, and analytics services to Quorum's personal lines division. The relationship is governed by a Master Services Agreement originally executed on November 12, 2019, as subsequently amended by Amendment 1 (dated March 3, 2021) and Amendment 2 (dated September 15, 2022) (collectively, the "MSA"). Following the execution of Amendment 1, which added QuorumEdge platform data processing to Palomar's scope of services, the annual contract value ("ACV") increased from $14.2 million to $16.3 million. Quorum is understood to be Palomar's second-largest client by revenue, a fact that underscores both the significance of the commercial relationship and the volume of Quorum data entrusted to Palomar's environment.

In the ordinary course of its engagement, Palomar processes PII — including names, dates of birth, Social Security numbers, and driver's license numbers — financial data — including bank account numbers and payment card numbers — and PHI — including health conditions, diagnosis codes, and treatment information derived from workers' compensation and health-related insurance claims — on behalf of Quorum policyholders and claimants. The scope, sensitivity, and volume of data processed by Palomar placed this vendor at the apex of Quorum's third-party risk profile.

On or about March 14, 2023, a threat actor exploited CVE-2023-0669, a publicly disclosed remote code execution vulnerability affecting Severin Corporation's GoAnywhere Managed File Transfer ("MFT") application, to gain initial unauthorized access to Palomar's network environment through its GoAnywhere MFT file transfer appliance. Following this initial compromise, the threat actor achieved lateral movement through Palomar's internal network, identified and staged structured data files containing Quorum policyholder and claimant data, and exfiltrated those files over an approximately 35-day window, spanning from March 14 through April 18, 2023. The exfiltration activity was ultimately detected by Palomar's security operations center ("SOC") on April 18, 2023, when analysts identified anomalous outbound data transfers from a staging server. This detection ended the active exfiltration window, though the damage to Quorum's data had already been done.

B. Root Cause: Unpatched Vulnerability

The root cause of this incident was Palomar's failure to patch a known, critical vulnerability within the contractually mandated timeframe. CVE-2023-0669 was a publicly known vulnerability with a Common Vulnerability Scoring System ("CVSS") score indicating critical severity. A vendor-issued patch was made available by Severin Corporation prior to the date of initial exploitation on March 14, 2023. Palomar's Data Security Exhibit — Exhibit D of the MSA, as amended by Amendment 2 (dated September 15, 2022) — expressly required Palomar to patch critical vulnerabilities within 30 days of the applicable vendor's patch release. Palomar failed to comply with this obligation.

This patching failure was confirmed as the direct and proximate cause of the breach by Graystone Forensics LLC ("Graystone"), the forensic investigation firm retained under privilege by Calderwood & Harkness on May 5, 2023. The Graystone engagement was led by Dr. Nolan Briggs (Managing Director) and Kendra Faulkner (Senior Forensic Analyst). In its final forensic report, dated July 14, 2023, Graystone confirmed that (a) the GoAnywhere MFT appliance operated by Palomar remained unpatched against CVE-2023-0669 at the time of initial exploitation; (b) the patch had been available for a period exceeding the contractual 30-day window; and (c) the unpatched vulnerability was the attack vector through which the threat actor gained initial access. No evidence was identified suggesting that any Quorum system, network, or security control contributed to or facilitated the compromise; the breach was entirely vendor-originated.

C. Notification Delay

MSA Section 9.4, as incorporated by Amendment 2, required Palomar to notify Quorum of any security incident affecting Quorum data within 48 hours of Palomar's discovery of such incident. Palomar's SOC detected the anomalous activity on April 18, 2023. However, Palomar did not notify Quorum until April 21, 2023 — approximately 72 hours after discovery — when Quorum received an email from Derek Copeland, Palomar's General Counsel, addressed to Thomas R. Whitfield (General Counsel) and David Naranjo (CISO). This notification was delivered approximately 24 hours past the contractual 48-hour deadline, constituting a breach of MSA Section 9.4.

While, in this instance, the approximately 24-hour delay did not materially alter Quorum's response posture — Calderwood & Harkness was not engaged until May 4, 2023, and the forensic investigation commenced on May 5, 2023 — the notification delay represents a meaningful contractual breach that could have been consequential in a faster-moving incident. In a scenario involving active, ongoing data destruction, ransomware deployment, or a threat actor with continued access to live systems, a 24-hour delay in vendor notification could have materially impaired Quorum's ability to contain the incident and mitigate harm. This delay reinforced the importance of both shortening contractual notification windows and establishing verification mechanisms to ensure vendor compliance with notification obligations.

D. Scope of Compromise

The forensic investigation confirmed that the breach compromised the data of 318,247 total affected individuals across 29 states and the District of Columbia. The data types compromised included:

• PII (names, dates of birth, Social Security numbers, and driver's license numbers): all 318,247 affected individuals.

• Financial information (bank account numbers and/or payment card numbers): 84,619 individuals.

• PHI (health conditions, diagnosis codes, and treatment information derived from workers' compensation and health-related insurance claims): 41,203 individuals.

The breadth of data types compromised — spanning PII, financial data, and PHI — triggered notification obligations under a complex matrix of federal and state laws, including the HIPAA Breach Notification Rule, state data breach notification statutes in 29 jurisdictions, and the Connecticut Insurance Data Security Law.

The table below sets forth the most affected jurisdictions by individual count:

The concentration of affected individuals in Connecticut and New York — Quorum's domiciliary state and largest market, respectively — was a significant factor in the regulatory dynamics that followed, as discussed in Section VI below.

III. Lessons Learned — Category 1: Vendor Risk Management Program

A. Pre-Engagement Due Diligence Gaps

Quorum's existing vendor risk management program, overseen by Priya Deshmukh (VP, Vendor Risk Management), incorporated a number of standard industry practices, including pre-engagement security questionnaires administered to prospective vendors, standard contractual data security requirements embedded in vendor agreements, and periodic review of vendor compliance with security obligations. These measures reflect a reasonable baseline vendor risk management posture and contributed to the inclusion of patching and notification requirements in the Palomar MSA that ultimately formed the basis for the vendor indemnification recovery.

However, the incident exposed several critical gaps in the program's design and execution that, had they been addressed earlier, could have enabled Quorum to detect Palomar's patching non-compliance before it was exploited. Most significantly, the program lacked continuous, risk-tiered monitoring of critical vendors' security posture between annual review cycles. The vendor risk management program applied a largely uniform monitoring cadence across its vendor population, without differentiating between vendors based on the sensitivity or volume of data processed, the criticality of the vendor's services to Quorum's operations, or the level of system access granted to the vendor. As a result, Palomar — a Tier 1 vendor by any reasonable measure, given the sensitivity and volume of data it processed and its integration into Quorum's core claims operations — received substantially the same monitoring cadence and oversight intensity as lower-risk vendors processing far less sensitive data.

Additionally, the requirement that Palomar obtain and maintain a SOC 2 Type II audit report was not included in the original MSA executed in November 2019. This requirement was only added in Amendment 2, dated September 15, 2022 — more than two years after the commencement of the vendor relationship. Palomar's SOC 2 Type II audit was performed by Kessler, Park & Associates CPA, PLLC, a Dallas, Texas-based accounting firm (engagement partner: Vivian Park). While the existence of a SOC 2 report provides a degree of assurance regarding the design and operating effectiveness of certain security controls, the scope of that audit, its recency relative to the date of the breach, and the extent to which it covered the specific controls relevant to vulnerability management and patch deployment should be critically evaluated. A SOC 2 report is not a substitute for continuous, independent verification of a vendor's actual security practices.

B. Lack of Real-Time Vendor Security Posture Visibility

Perhaps the most consequential gap revealed by this incident was Quorum's complete lack of any mechanism for real-time or near-real-time visibility into Palomar's vulnerability management status, patching cadence, or threat landscape exposure. Quorum's vendor risk management program relied on periodic, point-in-time assessments — security questionnaires, annual reviews, and the SOC 2 report — to evaluate Palomar's security posture. Between these periodic assessment points, Quorum had no independent means of verifying whether Palomar was, in fact, maintaining the security practices it had contractually committed to.

The practical consequence of this gap is stark: the breach was caused by an unpatched critical vulnerability that persisted in Palomar's environment for longer than the contractually mandated 30-day patching window. Quorum had no means to detect this non-compliance until after the breach had already occurred, the data had been exfiltrated, and Palomar itself belatedly notified Quorum. In effect, Quorum was relying entirely on Palomar's self-governance and self-reporting for assurance that critical security obligations were being met — an approach that proved insufficient.

The availability of third-party security rating and monitoring platforms that provide continuous external visibility into an organization's security posture — including vulnerability exposure, patching cadence, and network hygiene indicators — means that Quorum has viable options for closing this visibility gap without requiring invasive, real-time access to vendor systems. While no external monitoring tool provides a complete picture of a vendor's internal security environment, such tools would have provided Quorum with early indicators of Palomar's vulnerability exposure and potentially flagged the unpatched GoAnywhere MFT appliance before it was exploited.

C. Recommendations — Vendor Risk Management Enhancements

Based on the foregoing analysis, Calderwood & Harkness recommends that Quorum implement the following vendor risk management enhancements:

1. Implement a Formal Vendor Risk Tiering Framework. Quorum should establish a formal, documented framework for tiering all vendors into risk categories — Tier 1 (highest risk) through Tier 3 (lowest risk) — based on objective criteria including the sensitivity of data processed by the vendor, the volume of data processed, the level of system access granted to the vendor, and the criticality of the vendor's services to Quorum's core business operations. Palomar and any comparable data-processing vendor handling PII, financial data, or PHI on behalf of Quorum should be classified as Tier 1. The tiering framework should drive differentiated oversight requirements, including monitoring cadence, audit frequency, contractual requirements, and escalation protocols. The framework should be reviewed and updated annually to reflect changes in vendor relationships and the evolving threat landscape.

2. Deploy Continuous Security Monitoring for Tier 1 Vendors. Quorum should procure and deploy one or more third-party security rating and monitoring tools that provide continuous external visibility into Tier 1 vendors' security posture. These tools should, at a minimum, provide ongoing monitoring of vulnerability exposure, patching cadence, network hygiene, and publicly observable indicators of security risk. Alerts generated by these monitoring tools should be routed to both the CISO's office and the Vendor Risk Management function, with defined escalation procedures for material findings. While these tools provide an external perspective and are not a substitute for contractual audit rights and direct assessments, they offer an essential early-warning capability that Quorum currently lacks.

3. Enhance Pre-Engagement Security Due Diligence. Quorum should enhance its pre-engagement security due diligence requirements for all prospective Tier 1 vendors. Before contract execution, Tier 1 vendor candidates should be required to provide, at a minimum: (a) a current SOC 2 Type II audit report with a report period ending no more than 12 months prior to the date of engagement; (b) results of a recent penetration test conducted by a qualified third-party assessor; and (c) documentation of the vendor's vulnerability management program, including patching cadence targets and escalation procedures. These requirements should be incorporated into the vendor onboarding process managed by the Vendor Risk Management function.

4. Quarterly Vendor Security Reviews for Tier 1 Vendors. Quorum should move from an annual to a quarterly security review cadence for all Tier 1 vendors. Quarterly reviews should include, at a minimum, review of the vendor's patching logs covering the preceding quarter, review of vulnerability scan results, an assessment of the vendor's incident response readiness, and discussion of any material changes to the vendor's security environment, personnel, or technology stack. These quarterly reviews should be documented and retained by the Vendor Risk Management function.

5. Active Enforcement of Right-to-Audit Provisions. Quorum should actively and routinely exercise the right-to-audit provisions contained in its Tier 1 vendor agreements. Quorum should schedule annual on-site or virtual security assessments for all Tier 1 vendors, conducted by qualified internal or external assessors. Calderwood & Harkness notes that MSA Amendment 3 (executed October 27, 2023) now requires Palomar to submit to annual independent security assessments at Palomar's own expense. This requirement should serve as the baseline standard for all Tier 1 vendor agreements, and Quorum should ensure that similar provisions are incorporated into new and renewed Tier 1 contracts.

6. Establish a Cross-Functional Vendor Risk Committee. Quorum should establish a standing Vendor Risk Committee to provide governance oversight of Tier 1 vendor relationships and the vendor risk management program as a whole. The Committee should include representatives from the General Counsel's office (Thomas Whitfield or designee), the CISO (David Naranjo or designee), the CPO (Jennifer Liang or designee), the Vendor Risk Management function (Priya Deshmukh or designee), and Claims Operations (Robert Wentworth or designee). The Committee should meet at least quarterly, with standing agenda items including review of Tier 1 vendor security monitoring results, review of audit and assessment findings, discussion of vendor risk escalations, and evaluation of new or expanded vendor engagements involving sensitive data. The Committee should operate under a formal charter that defines its authority, membership, meeting cadence, and reporting lines to senior management and the Board Audit Committee.

IV. Lessons Learned — Category 2: Contractual Protections and Enforcement

A. Notification Window

The 48-hour contractual notification window established in MSA Section 9.4 proved adequate in principle as a baseline requirement, providing Quorum with a reasonable expectation of timely notification in the event of a security incident. However, as discussed in Section II.C above, Palomar breached this obligation by approximately 24 hours, delivering notification approximately 72 hours after its discovery of the anomalous activity. While this delay did not, in this instance, materially alter the trajectory of Quorum's incident response, the breach of the notification obligation underscored the importance of both establishing shorter contractual notification windows for high-risk vendor relationships and implementing mechanisms to verify and enforce compliance with those obligations.

Given the sensitivity and volume of data processed by Palomar — encompassing PII, financial data, and PHI for over 318,000 individuals — a shorter mandatory notification window is advisable for Palomar and all similarly situated Tier 1 vendors. A 24-hour notification window, measured from the vendor's discovery of a confirmed or reasonably suspected security incident, provides Quorum with the earliest practicable notice while remaining a commercially reasonable requirement for vendors with mature security operations. MSA Amendment 3, executed on October 27, 2023 as part of the vendor indemnification settlement, reduced Palomar's notification obligation from 48 hours to 24 hours. This enhanced standard should be adopted as the baseline for all Tier 1 vendor agreements going forward.

B. Patching Requirements

The 30-day critical vulnerability patching requirement contained in Exhibit D of the MSA (as amended by Amendment 2) was a reasonable contractual provision and, in fact, provided the legal basis for Quorum's indemnification claim against Palomar, as Palomar's breach of this obligation was the direct and proximate cause of the incident. However, the patching requirement was not enforced through any verification mechanism prior to the breach. Quorum had no means of confirming whether Palomar was, in fact, patching critical vulnerabilities within the 30-day window — a gap that, as discussed in Section III.B above, contributed directly to the undetected persistence of the CVE-2023-0669 vulnerability in Palomar's environment.

MSA Amendment 3, executed October 27, 2023, shortened the critical vulnerability patching window for Palomar from 30 days to 14 days. This enhanced standard reflects the accelerated pace at which threat actors exploit newly disclosed vulnerabilities and is consistent with emerging industry best practices and regulatory expectations. The 14-day patching standard should be adopted as the baseline for all new and renewed Tier 1 vendor agreements.

Critically, the experience with Palomar demonstrates that contractual patching requirements are only as effective as the mechanisms in place to verify and enforce them. Accordingly, Calderwood & Harkness recommends that all Tier 1 vendor agreements include a provision requiring the vendor to provide evidence of patch deployment within a specified period upon Quorum's request. Such evidence may take the form of patch management reports, system scan results, or attestations from the vendor's CISO or equivalent security officer. This verification mechanism, combined with the continuous monitoring tools recommended in Section III.C.2, will provide Quorum with layered assurance of vendor patching compliance.

C. Indemnification Provisions

The indemnification provisions of the MSA, as amended, established a cap on Palomar's indemnification obligations equal to two times (2×) the trailing twelve-month fees paid by Quorum — a cap of $32,600,000 based on the $16.3 million ACV. This cap was adequate to cover the total incident response costs of $8,230,250, and the indemnification provisions provided the legal foundation for the successful recovery from Palomar.

The settlement negotiated with Palomar, memorialized in the Settlement Agreement and Mutual Release executed October 27, 2023, yielded an effective total recovery of $6,156,000, comprising a cash payment of $4,200,000 and fee reductions of $1,956,000 over an 18-month period (calculated as an 8% reduction of the $16.3 million ACV applied over 18 months). This recovery represents approximately 74.8% of total incident response costs — a favorable result in the context of vendor indemnification disputes, which frequently involve protracted litigation and uncertain outcomes.

For future Tier 1 vendor agreements, Quorum should evaluate whether the 2× trailing twelve-month fee cap remains appropriate or should be increased, particularly for vendors processing PHI or large volumes of financial data. In this instance, the cap was more than sufficient, but a larger incident — involving, for example, a broader data set, regulatory fines or penalties, or class action litigation — could readily exceed a 2× fee cap, leaving Quorum with significant unrecovered losses. Quorum should also consider the inclusion of express, uncapped indemnification for regulatory fines and penalties arising directly from vendor security failures, carved out from the general indemnification cap. While such provisions are commercially challenging to negotiate, the increasing likelihood and magnitude of regulatory penalties for data breaches — including potential HIPAA civil monetary penalties and state AG enforcement actions — warrant the effort.

D. Insurance Requirements

MSA Exhibit E required Palomar to maintain a minimum of $10 million in cyber liability insurance coverage. At the time the MSA was originally executed in November 2019, a $10 million minimum may have been consistent with prevailing market expectations. However, in light of the evolving threat landscape, the increasing costs of breach response, and the potential for regulatory fines and class action litigation, a $10 million minimum is no longer adequate for Tier 1 vendors processing the volume and sensitivity of data entrusted to Palomar.

Calderwood & Harkness recommends that Quorum increase the minimum cyber liability coverage requirement to a range of $15 million to $25 million for Tier 1 vendors processing sensitive data on behalf of Quorum. The specific minimum within this range should be calibrated to the volume and sensitivity of data processed by the particular vendor. In addition, Quorum should require that it be named as an additional insured on the vendor's cyber liability policy, ensuring that Quorum has direct access to policy proceeds in the event of a vendor-originated incident. Finally, Quorum should require annual delivery and verification of certificates of insurance demonstrating that the vendor maintains coverage meeting or exceeding the contractual minimums, with the vendor obligated to provide prompt notice of any material reduction, cancellation, or non-renewal of coverage.

E. Recommendations — Contractual Enhancements

Based on the foregoing analysis, Calderwood & Harkness recommends the following contractual enhancements:

1. Standard 24-Hour Notification Window. Quorum should adopt a 24-hour incident notification requirement as the default standard for all Tier 1 vendor agreements. The notification obligation should be triggered upon the vendor's discovery of a confirmed or reasonably suspected security incident affecting Quorum data, and the notification should be directed to both the General Counsel and the CISO via pre-designated contact methods. This standard is consistent with the enhanced notification window now applicable to Palomar under MSA Amendment 3.

2. 14-Day Critical Patching Standard. Quorum should adopt a 14-day critical vulnerability patching requirement as the default standard for all Tier 1 vendor agreements. The patching obligation should apply to all vulnerabilities rated "critical" or "high" under the Common Vulnerability Scoring System (CVSS) or equivalent industry-standard rating system. Vendors should be contractually obligated to provide evidence of patch deployment within five business days of Quorum's written request. Failure to patch within the 14-day window should be treated as a material breach of the agreement.

3. Enhanced Indemnification Terms. Quorum should review and, where commercially practicable, increase indemnification caps for Tier 1 data-processing vendors beyond the current 2× trailing twelve-month fee standard. Quorum should also negotiate carve-outs from general liability caps for data security breaches, ensuring that the costs of breach response, regulatory fines, class action settlements, and related expenses are not subject to the same cap that governs ordinary commercial indemnification obligations. Express, uncapped indemnification for regulatory fines and penalties arising from vendor security failures should be pursued as a negotiating priority.

4. Heightened Insurance Minimums. Quorum should increase minimum cyber liability coverage requirements to a range of $15 million to $25 million for Tier 1 vendors processing sensitive data on behalf of Quorum. Quorum should require additional insured status on all Tier 1 vendor cyber liability policies and require annual certificate of insurance delivery with prompt notice of any material change in coverage.

5. Mandatory Endpoint Detection and Response (EDR). Quorum should require all Tier 1 vendors to deploy and maintain endpoint detection and response ("EDR") solutions on all systems that process, store, or have access to Quorum data. This requirement is now applicable to Palomar under MSA Amendment 3 and should be extended to all Tier 1 vendor agreements. The EDR requirement should include a contractual obligation for the vendor to maintain current EDR signatures and to monitor EDR alerts on a 24/7 basis, either through an internal SOC or a qualified managed detection and response ("MDR") provider.

6. Periodic Contract Review Cadence. Quorum should establish a 12-month review cycle for all Tier 1 vendor agreements to ensure that data security exhibits, insurance requirements, indemnification provisions, and other risk-relevant contractual terms remain current with the evolving threat landscape, regulatory requirements, and Quorum's own security standards. Contract reviews should be coordinated between the General Counsel's office, the CISO, the CPO, and the Vendor Risk Management function, and should be tracked as a standing agenda item for the Vendor Risk Committee recommended in Section III.C.6 above.

V. Lessons Learned — Category 3: Incident Response Plan and Preparedness

A. Incident Response Plan Activation

Quorum's incident response plan was activated on May 4, 2023, when Calderwood & Harkness was engaged as outside counsel to lead the legal response to the incident. This engagement occurred approximately 13 days after Palomar's initial notification on April 21, 2023. The intervening period — April 21 through May 4 — was occupied by internal assessment and escalation activities within Quorum, including preliminary evaluation of the Palomar notification by the General Counsel and CISO, internal consultations regarding the scope and significance of the reported incident, and the decision to engage outside counsel.

While these internal activities were reasonable and necessary, the 13-day gap between vendor notification and outside counsel engagement represents an area for improvement. In a vendor-originated data breach, the first days and weeks after notification are critical for establishing the privilege framework, initiating forensic investigation, preserving evidence, and assessing notification obligations. A more compressed timeline from vendor notification to outside counsel engagement and forensic investigation launch would strengthen Quorum's response posture and reduce the risk that critical evidence is lost or degraded during the intervening period.

It is notable that once Calderwood & Harkness was engaged on May 4, 2023, the Graystone Forensics engagement was initiated the following day, May 5, 2023 — an efficient one-day mobilization that reflected the urgency of the investigation. The efficiency of this downstream mobilization underscores the importance of reducing the upstream gap between initial vendor notification and outside counsel engagement.

B. Internal Coordination

The incident response team — comprising Thomas R. Whitfield (General Counsel), David Naranjo (CISO), Jennifer Liang (CPO), Priya Deshmukh (VP, Vendor Risk Management), and Robert Wentworth (SVP, Claims Operations) — functioned effectively once assembled. Communication among team members was consistent, decision-making was well-coordinated, and each member brought essential subject matter expertise to the response effort. The team's collaborative approach contributed significantly to the favorable outcomes achieved.

The initial internal communications between the General Counsel and CISO upon receipt of Palomar's April 21, 2023 notification were appropriately handled, with both officers recognizing the potential severity of the reported incident and beginning preliminary assessment activities. However, the escalation from initial notification to full incident response team activation and outside counsel engagement followed an informal path rather than a documented, predefined escalation protocol. Formalizing escalation triggers — defining the specific criteria that mandate immediate escalation to the full incident response team and engagement of outside counsel — and pre-designating roles and responsibilities for each team member would strengthen future response and reduce the risk of delay in mobilization.

Board reporting during the incident response was timely and appropriately detailed. Franklin Reeves, Chair of the Board Audit Committee, received an initial briefing on May 11, 2023 — seven days after outside counsel engagement — followed by subsequent briefings on July 21, 2023 (forensic findings update), October 16, 2023 (regulatory engagement and vendor settlement update), and November 29, 2023 (matter resolution and closure). The cadence and content of these briefings were well-calibrated to the Board's need for oversight without creating undue interference with the response team's operational activities. This cadence should be formalized as the standard model for future incident response Board reporting.

C. Forensic Investigation Privilege Structure

The privilege protocol established for this engagement — retaining Graystone Forensics LLC under the direction and control of Calderwood & Harkness, with all forensic reports, findings, and work product flowing to counsel and marked as attorney-client privileged and attorney work product — functioned as designed throughout the engagement. The protocol was documented in the Privilege Protocol Memo dated May 5, 2023, distributed to all members of the incident response team and to Graystone.

All forensic work product generated during the engagement was properly marked with the applicable privilege legends, channeled through Calderwood & Harkness, and stored in accordance with the retention and access protocols specified in the Privilege Protocol Memo. No inadvertent disclosures or privilege breaches occurred during the engagement. The Graystone final forensic report (dated July 14, 2023) was delivered to Calderwood & Harkness and shared with the Quorum incident response team under the umbrella of the attorney-client privilege, preserving the confidentiality of the forensic findings.

The integrity of the privilege structure was a significant asset during the regulatory engagement phase. Calderwood & Harkness was able to provide regulators with sufficient information to demonstrate the thoroughness and rigor of Quorum's investigation and response without disclosing privileged forensic work product. This approach was instrumental in achieving the favorable regulatory outcomes described in Section VI below.

D. Recommendations — Incident Response Enhancements

Based on the foregoing analysis, Calderwood & Harkness recommends the following incident response enhancements:

1. Semi-Annual Tabletop Exercise Program. Quorum should implement a semi-annual tabletop exercise program that simulates vendor-originated data breach scenarios of varying scope and complexity. Each exercise should be designed to test specific elements of the incident response plan, including internal escalation procedures, outside counsel and forensic vendor mobilization, regulatory notification decision-making, consumer notification logistics, crisis communications, and Board reporting. Participants should include the General Counsel, CISO, CPO, VP Vendor Risk Management, SVP Claims Operations, and Board Audit Committee representatives. Calderwood & Harkness is available to assist with scenario design, facilitation, and post-exercise assessment if requested by Quorum.

2. Pre-Negotiated Vendor Panels. Quorum should establish and maintain pre-negotiated retainer agreements with a panel of forensic investigation firms (such as Graystone Forensics LLC), notification vendors (such as Clearfield Notification Services LLC), and crisis communications firms (such as BrightPath Consulting Group, Inc.) to enable immediate engagement upon incident detection. Pre-negotiated retainers eliminate the need for scope negotiation, rate negotiation, and contracting during the critical early hours of an incident response, reducing mobilization time and ensuring that qualified resources are available without delay. These retainer agreements should be reviewed and updated annually to ensure that pricing, scope, and vendor capabilities remain current.

3. Compressed Engagement Timeline Target. Quorum should establish an organizational target of engaging outside counsel within 72 hours of receiving a vendor breach notification for incidents involving Tier 1 vendors or incidents that, based on the vendor's initial notification, appear to involve a significant volume of records, PHI, or financial data. The current experience — 13 days between Palomar's April 21, 2023 notification and Calderwood & Harkness's May 4, 2023 engagement — represents a timeline that, while understandable in context, should be substantially compressed. Achieving a 72-hour engagement target will require pre-defined escalation triggers, pre-designated decision-making authority for the General Counsel or CISO to engage outside counsel without additional internal approvals, and pre-negotiated engagement terms with one or more outside counsel firms.

4. Formalized Escalation Protocol. Quorum should develop and document a formal internal escalation protocol that defines the specific criteria triggering mandatory escalation to the full incident response team and engagement of outside counsel. Recommended escalation triggers include: (a) any vendor security incident involving more than 1,000 individual records; (b) any incident involving PHI; (c) any incident involving financial data (bank account numbers, payment card numbers, or similar sensitive financial information); (d) any incident involving a Tier 1 vendor; and (e) any incident involving potential ransomware or destructive malware. The escalation protocol should specify designated escalation chains (identifying the specific individuals responsible at each step), response time targets for each escalation step, and pre-assigned roles and responsibilities for all incident response team members. The escalation protocol should be distributed to all relevant personnel and tested during tabletop exercises.

5. Board Reporting Playbook. Quorum should formalize the cadence and content framework for Board Audit Committee briefings during active incident response, based on the model employed during this engagement. The playbook should specify: (a) an initial report to the Audit Committee Chair within 10 business days of outside counsel engagement, providing a factual summary of the incident, preliminary scope assessment, and planned investigative steps; (b) a forensic findings update upon completion of the forensic investigation; (c) a regulatory engagement update summarizing the status of all regulatory notifications and inquiries; and (d) a closure report summarizing the final resolution of all regulatory, litigation, and vendor accountability matters. The playbook should be maintained as an appendix to the incident response plan.

6. Privilege Protocol Template. Quorum should maintain a standing privilege protocol template, based on the May 5, 2023 Privilege Protocol Memo developed for this engagement, for immediate deployment in future incidents. The template should be pre-approved by the General Counsel and should include standard privilege legends, instructions for marking and channeling privileged communications and work product, protocols for retaining forensic investigators, notification vendors, and crisis communications firms under counsel's direction, and guidelines for interactions with regulators and other third parties. Having a pre-approved template will enable the privilege framework to be established within hours of outside counsel engagement, rather than requiring development from scratch during the early stages of each new incident.

VI. Lessons Learned — Category 4: Regulatory Notification and Compliance

A. Multistate Notification Complexity

The scope of this incident — 318,247 affected individuals spanning 29 states and the District of Columbia, with data types triggering obligations under multiple state breach notification statutes, the HIPAA Breach Notification Rule, and the Connecticut Insurance Data Security Law — generated a regulatory notification challenge of significant complexity. Each of the 29 affected states (and the District of Columbia) maintains its own breach notification statute with distinct requirements regarding notification timing (ranging from 30 to 60 days, with some states imposing "without unreasonable delay" standards), notification content (with varying requirements for the specific information that must be included in consumer notification letters), notification format (some states requiring specific formatting or prescribed language), and regulatory filing requirements (some states requiring advance or concurrent notification to the state attorney general, consumer protection agency, or other regulator).

Calderwood & Harkness's 50-state breach notification law survey, prepared on June 8, 2023, and the state-by-state notification timeline and content requirements matrix, prepared on August 1, 2023, were essential tools for navigating this regulatory landscape. These resources enabled the incident response team to develop a comprehensive notification strategy that satisfied the most stringent applicable requirements in each jurisdiction while maintaining a consistent, accurate, and legally defensible approach across all 29 states and the District of Columbia.

All regulatory notifications were filed in a timely manner, between August 14 and August 25, 2023. All consumer notification letters were mailed between August 18 and September 15, 2023, with the staggered mailing schedule reflecting the logistical requirements of producing, personalizing, and mailing over 318,000 individual notification packages through Clearfield Notification Services LLC. Each notification package included the required consumer notification letter, information regarding the 24-month credit monitoring and identity theft protection services offered by Quorum, and supplemental identity theft prevention resources as required by certain state statutes.

The complexity of managing 29-plus simultaneous state filings, each with its own requirements and deadlines, underscores the need for Quorum to invest in pre-built compliance templates, automated tracking systems, and standing relationships with outside counsel experienced in multistate breach notification compliance. While the notification process was executed successfully in this instance, the reliance on manual tracking and ad hoc template development introduced unnecessary risk and resource burden.

B. HIPAA Notification

The presence of PHI among the compromised data elements — specifically, health conditions, diagnosis codes, and treatment information derived from workers' compensation and health-related insurance claims for 41,203 individuals — triggered notification obligations under the HIPAA Breach Notification Rule, codified at 45 C.F.R. Part 164, Subpart D. As a covered entity under HIPAA, Quorum was required to provide individual notice to affected individuals, notification to HHS-OCR, and, because the breach affected more than 500 individuals in multiple states, prominent media notice in accordance with 45 C.F.R. § 164.406.

The HHS-OCR notification was filed on August 15, 2023, within the 60-day window prescribed by 45 C.F.R. § 164.408. The required media notice was issued concurrently. Individual notices to the 41,203 affected individuals whose PHI was compromised were included within the broader consumer notification mailing and complied with the content requirements of 45 C.F.R. § 164.404(c).

HHS-OCR issued its no further action letter on November 30, 2023, concluding its review of the breach notification and finding no basis for further investigation or enforcement action. This favorable outcome reflects the timeliness and completeness of Quorum's HIPAA notifications, the thoroughness of the investigation documented in the breach notification submission, and the remedial measures implemented by Quorum in response to the incident.

Looking forward, Quorum should evaluate whether the volume of PHI processed by third-party vendors — 41,203 individuals in this instance — can be reduced through data minimization measures. The processing of PHI by a third-party vendor introduces HIPAA compliance obligations and regulatory exposure that could be mitigated by limiting the PHI data elements shared with vendors to the minimum necessary for the performance of their contractual obligations, consistent with the HIPAA minimum necessary standard and the data minimization recommendations set forth in Section VII below.

C. Connecticut Insurance Data Security Law

As a Connecticut-domiciled insurance holding company, Quorum is subject to the Connecticut Insurance Data Security Law, Conn. Gen. Stat. § 38a-999b, which imposes specific requirements on insurers regarding the establishment and maintenance of information security programs, oversight of third-party service providers, investigation of cybersecurity events, and notification of cybersecurity events to the Connecticut Insurance Commissioner. This statute, modeled on the National Association of Insurance Commissioners ("NAIC") Insurance Data Security Model Law, reflects the heightened regulatory expectations applicable to insurance industry participants.

The Connecticut Insurance Department opened an inquiry following Quorum's August 14, 2023 regulatory notification. The inquiry was managed by Richard Nakamura of the Department's Financial Analysis Division, Cybersecurity Unit. Calderwood & Harkness coordinated Quorum's response to the Department's information requests, demonstrating the vendor-originated nature of the breach, Quorum's own robust information security program, the timeliness of Quorum's response and notifications, and the vendor accountability measures pursued by Quorum, including the indemnification demand, settlement, and MSA Amendment 3. The inquiry was closed on November 28, 2023, without adverse findings.

Quorum should ensure ongoing compliance with the Connecticut Insurance Data Security Law's requirements, including the maintenance of a comprehensive written information security program, risk-based oversight of third-party service providers (including the vendor risk management enhancements recommended in this memorandum), investigation and notification procedures for cybersecurity events, and annual certification of compliance to the Connecticut Insurance Commissioner. The remediation measures recommended in this memorandum are designed, in part, to strengthen Quorum's compliance with these requirements.

D. Multistate AG Engagement

The multistate attorney general coalition opened its inquiry on September 8, 2023, following receipt of the regulatory notifications filed between August 14 and August 25, 2023. The coalition comprised 29 state attorneys general and was led by Assistant Attorney General Diane Marchetti of the Connecticut Attorney General's office and Assistant Attorney General Mark Petrosian of the New York Attorney General's office. The involvement of the Connecticut and New York AGs in leadership positions reflected the concentration of affected individuals in those two states (52,114 and 47,831, respectively).

Calderwood & Harkness developed and executed a response strategy grounded in cooperative, transparent engagement with the multistate coalition. The strategy emphasized the vendor-originated nature of the breach, the fact that Palomar's patching failure — not any deficiency in Quorum's own security program — was the root cause, the timeliness and completeness of Quorum's consumer and regulatory notifications, the robust remedial measures undertaken by Quorum (including vendor indemnification demand, settlement, MSA Amendment 3, and the programmatic enhancements under development), and Quorum's demonstrated commitment to vendor accountability.

Quorum's initial written response to the multistate coalition's inquiry was submitted on October 13, 2023. Supplemental information, responding to follow-up questions from the coalition, was provided on November 3, 2023. The coalition issued its closure letter on November 22, 2023, concluding the inquiry without enforcement action and without requiring Quorum to enter into an assurance of voluntary compliance, consent decree, or other regulatory agreement.

Several key factors contributed to this favorable resolution: (a) the timeliness of all consumer and regulatory notifications, filed well within applicable statutory deadlines; (b) the offer of 24-month credit monitoring and identity theft protection services to all affected individuals, exceeding the standard typically expected by regulators; (c) the vendor accountability measures pursued by Quorum, including the indemnification demand, negotiated settlement, and comprehensive MSA Amendment 3 imposing enhanced security requirements on Palomar; and (d) Quorum's demonstration of its own robust information security program, including existing policies, procedures, and technical controls, which underscored that the breach was attributable to vendor failure rather than any deficiency in Quorum's own security posture.

E. Recommendations — Regulatory Compliance Enhancements

Based on the foregoing analysis, Calderwood & Harkness recommends the following regulatory compliance enhancements:

1. Maintain an Updated Notification Law Database. Quorum should invest in a continuously updated breach notification law database or subscription service to supplement the notification law survey work performed by outside counsel during active incident response. State data breach notification laws evolve frequently — multiple states amend their statutes each legislative session, and new requirements regarding notification timing, content, and regulatory filing are regularly enacted. Maintaining an up-to-date database will enable Quorum to perform rapid preliminary assessments of notification obligations upon learning of a potential incident, reducing the time required to develop a comprehensive notification strategy.

2. Pre-Built Notification Templates. Quorum should develop and maintain a library of pre-drafted notification letter templates for the most common data element combinations (PII only, PII plus financial data, PII plus PHI, PII plus financial data plus PHI) in the jurisdictions where Quorum has the highest concentrations of policyholders: Connecticut, New York, California, Texas, Florida, Pennsylvania, Illinois, New Jersey, Ohio, and Massachusetts. These templates should be designed to comply with the most stringent content and formatting requirements in each jurisdiction and should be reviewed and updated at least annually by outside counsel. Having pre-built templates available will significantly reduce the time and cost associated with developing notification materials during an active incident response.

3. Regulatory Relationship Management. Quorum should consider proactive engagement with the Connecticut Insurance Department and other key state regulators regarding Quorum's cybersecurity program enhancements, outside of any incident context. Proactive engagement — such as participating in industry working groups, attending regulator-sponsored cybersecurity events, or scheduling informational briefings with key regulatory contacts — can build goodwill, establish Quorum as a responsible industry participant committed to data security, and create constructive relationships that may prove valuable in the event of a future incident. This approach is consistent with the cooperative engagement strategy that proved effective during the multistate AG inquiry.

4. HIPAA Compliance Program Review. Quorum should conduct a comprehensive review of its HIPAA compliance program, including a review of all business associate agreements ("BAAs") with vendors that process, store, or have access to PHI on behalf of Quorum. The review should ensure that all BAAs are current, contain the required provisions under 45 C.F.R. § 164.314(a), and are consistent with current HHS-OCR enforcement priorities. The review should also evaluate whether Quorum's HIPAA policies and procedures regarding breach investigation, risk assessment, and notification are current and aligned with OCR's published guidance and enforcement trends.

VII. Lessons Learned — Category 5: Data Minimization and Security Architecture

A. Volume and Sensitivity of Data Shared with Vendors

One of the most fundamental lessons of this incident is that the scope and severity of a vendor-originated breach are directly proportional to the volume and sensitivity of data accessible within the vendor's environment. Palomar processed data for 318,247 individuals, encompassing Social Security numbers, financial account numbers, and protected health information — a substantial volume and breadth of sensitive data entrusted to a single third-party vendor. Every one of these data elements was within the threat actor's reach once initial access to Palomar's network was achieved.

Quorum should critically evaluate whether the full complement of data elements currently shared with Palomar (and similarly situated vendors) is necessary for the performance of claims processing operations, or whether data minimization techniques — including truncation, masking, tokenization, or pseudonymization — could reduce the volume and sensitivity of data exposure in the event of a future compromise. For example, claims processing operations may not require full Social Security numbers in all instances; truncated SSNs (last four digits) or alternative identifiers may be sufficient for many processing functions. Similarly, full bank account numbers or payment card numbers may be replaceable with tokenized values for certain processing activities. Each data element shared with a vendor represents incremental risk; reducing the data shared reduces the potential impact of any future breach.

B. QuorumEdge Platform Data

The risk implications of data sharing expansions are further illustrated by the history of the Palomar engagement. MSA Amendment 1, executed on March 3, 2021, added QuorumEdge platform data processing to Palomar's scope of services. This expansion increased the ACV from $14.2 million to $16.3 million and, more significantly for present purposes, expanded the categories and volume of data processed by Palomar to include data from the QuorumEdge platform. At the time Amendment 1 was executed, no formal data protection impact assessment was conducted to evaluate the security implications of expanding the data-sharing arrangement with Palomar.

The QuorumEdge expansion illustrates a broader principle: any expansion of data sharing with a vendor — whether through the addition of new data categories, new data sources, new processing activities, or new system integrations — should be accompanied by a formal data protection impact assessment and a re-evaluation of the vendor's security posture. The security assurances that were adequate for the original scope of the vendor relationship may not be adequate for an expanded scope, particularly when the expansion introduces new data types, larger data volumes, or new attack surfaces.

C. Recommendations — Data Minimization and Architecture

Based on the foregoing analysis, Calderwood & Harkness recommends the following data minimization and security architecture measures:

1. Comprehensive Data Minimization Review. Quorum should conduct a comprehensive review of all data elements shared with Tier 1 vendors, beginning with Palomar and extending to all other Tier 1 data-processing vendors. The review should identify specific opportunities to reduce the volume and sensitivity of data transferred to each vendor, evaluating whether Social Security numbers, full financial account numbers, granular PHI data elements, and other sensitive information are operationally necessary in the vendor's environment or whether truncated, masked, tokenized, or otherwise de-identified alternatives would suffice for the vendor's contracted processing activities. The review should be led by the CISO in coordination with the CPO, VP Vendor Risk Management, and SVP Claims Operations, with legal support from the General Counsel's office to address contractual, regulatory, and privacy law implications.

PRIVILEGED AND CONFIDENTIAL — ATTORNEY-CLIENT COMMUNICATION AND ATTORNEY WORK PRODUCT — PREPARED AT THE DIRECTION OF COUNSEL — DO NOT DISTRIBUTE WITHOUT PRIOR APPROVAL OF CALDERWOOD & HARKNESS LLP
CALDERWOOD & HARKNESS LLP Privacy & Data Security Practice Group 1700 K Street NW, Suite 900 Washington, D.C. 20006
November 30, 2023
MEMORANDUM
TO:
Thomas R. Whitfield, General Counsel Jennifer Liang, Chief Privacy Officer David Naranjo, Chief Information Security Officer Priya Deshmukh, Vice President, Vendor Risk Management
Quorum Insurance Holdings Corp. 400 Constitution Plaza, Suite 2200 Hartford, CT 06103
FROM:
Kevin Ostrowski, Partner, Privacy & Data Security Alan Burke, Lead Associate, Privacy & Data Security
Calderwood & Harkness LLP 1700 K Street NW, Suite 900 Washington, D.C. 20006
RE: Post-Incident Lessons Learned and Remediation Recommendations — Palomar Data Solutions, Inc. Data Security Incident
MATTER NO.: 1025-00006
This memorandum constitutes a privileged and confidential attorney-client communication and attorney work product prepared at the direction of counsel in connection with pending and anticipated legal matters. It is intended solely for the use of the addressees and should not be distributed, disclosed, or reproduced without the prior written approval of Calderwood & Harkness LLP. Distribution of this memorandum to any third party, including other Quorum Insurance Holdings Corp. employees, business units, or external advisors, may result in waiver of applicable privileges.
Right-click to update Table of Contents
I. Executive Summary
The purpose of this memorandum is to document the lessons learned from the data security incident originating from Quorum Insurance Holdings Corp.'s ("Quorum" or the "Company") third-party claims-processing vendor, Palomar Data Solutions, Inc. ("Palomar"), and to provide Calderwood & Harkness LLP's ("Calderwood & Harkness" or "outside counsel") actionable recommendations for strengthening Quorum's information security program, vendor risk management program, and incident response capabilities. This memorandum is prepared at the direction of counsel and represents Calderwood & Harkness's final advisory deliverable under Matter No. 1025-00006.
The Incident. Between approximately March 14 and April 18, 2023 — a period of approximately 35 days — a threat actor exploited CVE-2023-0669, a known remote code execution vulnerability in Palomar's GoAnywhere MFT file transfer appliance, to achieve unauthorized access to Palomar's network environment. During this window, the threat actor conducted lateral movement through Palomar's systems and exfiltrated structured data files containing personally identifiable information ("PII"), financial data, and protected health information ("PHI") of 318,247 Quorum policyholders and claimants across 29 states and the District of Columbia. The root cause of the breach was Palomar's failure to apply a vendor-issued patch for CVE-2023-0669 within the contractually mandated 30-day patching window, as confirmed by the privileged forensic investigation conducted by Graystone Forensics LLC under Calderwood & Harkness's direction.
Outcomes. The incident response engagement has been resolved with uniformly favorable regulatory outcomes. All consumer and regulatory notifications were completed in a timely manner consistent with applicable statutory requirements. The multistate attorney general coalition — comprising 29 states and led by the Connecticut Attorney General and the New York Attorney General — closed its inquiry on November 22, 2023, without enforcement action. The Connecticut Insurance Department concluded its inquiry on November 28, 2023, without adverse findings. The U.S. Department of Health and Human Services, Office for Civil Rights ("HHS-OCR") issued a no further action letter on November 30, 2023. Additionally, a vendor indemnification settlement with Palomar was executed on October 27, 2023, yielding an effective total recovery of $6,156,000 against total incident response costs of $8,230,250.
The Need for Systematic Remediation. While the favorable resolution of all regulatory inquiries and the successful cost recovery from Palomar are commendable outcomes, this favorable resolution should not obscure the systemic vulnerabilities that this incident revealed. The breach exposed concrete and actionable gaps in Quorum's vendor oversight architecture, contractual enforcement mechanisms, incident response mobilization timelines, regulatory compliance infrastructure, and data minimization practices. These gaps are addressable through the systematic remediation program recommended in this memorandum.
Engagement Closure. This engagement is closing effective December 1, 2023. This memorandum and the accompanying Document Retention & Privilege Log Protocol Memo (dated December 1, 2023) constitute the final deliverables under Matter No. 1025-00006. The recommendations contained herein represent Calderwood & Harkness's comprehensive advisory assessment, informed by the firm's experience managing the entirety of the incident response, regulatory engagement, and vendor indemnification processes.
Structure. This memorandum is organized into five categories of lessons learned, each paired with specific, prioritized remediation recommendations:
1. Vendor Risk Management Program
2. Contractual Protections and Enforcement
3. Incident Response Plan and Preparedness
4. Regulatory Notification and Compliance
5. Data Minimization and Security Architecture
These categories are followed by a financial summary and cost recovery context, an implementation roadmap with prioritized timelines, and concluding observations.
II. Incident Recap and Root Cause Analysis
A. Incident Overview
Palomar Data Solutions, Inc. is a data services firm that provides claims data processing, document management, and analytics services to Quorum's personal lines division. The relationship is governed by a Master Services Agreement originally executed on November 12, 2019, as subsequently amended by Amendment 1 (dated March 3, 2021) and Amendment 2 (dated September 15, 2022) (collectively, the "MSA"). Following the execution of Amendment 1, which added QuorumEdge platform data processing to Palomar's scope of services, the annual contract value ("ACV") increased from $14.2 million to $16.3 million. Quorum is understood to be Palomar's second-largest client by revenue, a fact that underscores both the significance of the commercial relationship and the volume of Quorum data entrusted to Palomar's environment.
In the ordinary course of its engagement, Palomar processes PII — including names, dates of birth, Social Security numbers, and driver's license numbers — financial data — including bank account numbers and payment card numbers — and PHI — including health conditions, diagnosis codes, and treatment information derived from workers' compensation and health-related insurance claims — on behalf of Quorum policyholders and claimants. The scope, sensitivity, and volume of data processed by Palomar placed this vendor at the apex of Quorum's third-party risk profile.
On or about March 14, 2023, a threat actor exploited CVE-2023-0669, a publicly disclosed remote code execution vulnerability affecting Severin Corporation's GoAnywhere Managed File Transfer ("MFT") application, to gain initial unauthorized access to Palomar's network environment through its GoAnywhere MFT file transfer appliance. Following this initial compromise, the threat actor achieved lateral movement through Palomar's internal network, identified and staged structured data files containing Quorum policyholder and claimant data, and exfiltrated those files over an approximately 35-day window, spanning from March 14 through April 18, 2023. The exfiltration activity was ultimately detected by Palomar's security operations center ("SOC") on April 18, 2023, when analysts identified anomalous outbound data transfers from a staging server. This detection ended the active exfiltration window, though the damage to Quorum's data had already been done.
B. Root Cause: Unpatched Vulnerability
The root cause of this incident was Palomar's failure to patch a known, critical vulnerability within the contractually mandated timeframe. CVE-2023-0669 was a publicly known vulnerability with a Common Vulnerability Scoring System ("CVSS") score indicating critical severity. A vendor-issued patch was made available by Severin Corporation prior to the date of initial exploitation on March 14, 2023. Palomar's Data Security Exhibit — Exhibit D of the MSA, as amended by Amendment 2 (dated September 15, 2022) — expressly required Palomar to patch critical vulnerabilities within 30 days of the applicable vendor's patch release. Palomar failed to comply with this obligation.
This patching failure was confirmed as the direct and proximate cause of the breach by Graystone Forensics LLC ("Graystone"), the forensic investigation firm retained under privilege by Calderwood & Harkness on May 5, 2023. The Graystone engagement was led by Dr. Nolan Briggs (Managing Director) and Kendra Faulkner (Senior Forensic Analyst). In its final forensic report, dated July 14, 2023, Graystone confirmed that (a) the GoAnywhere MFT appliance operated by Palomar remained unpatched against CVE-2023-0669 at the time of initial exploitation; (b) the patch had been available for a period exceeding the contractual 30-day window; and (c) the unpatched vulnerability was the attack vector through which the threat actor gained initial access. No evidence was identified suggesting that any Quorum system, network, or security control contributed to or facilitated the compromise; the breach was entirely vendor-originated.
C. Notification Delay
MSA Section 9.4, as incorporated by Amendment 2, required Palomar to notify Quorum of any security incident affecting Quorum data within 48 hours of Palomar's discovery of such incident. Palomar's SOC detected the anomalous activity on April 18, 2023. However, Palomar did not notify Quorum until April 21, 2023 — approximately 72 hours after discovery — when Quorum received an email from Derek Copeland, Palomar's General Counsel, addressed to Thomas R. Whitfield (General Counsel) and David Naranjo (CISO). This notification was delivered approximately 24 hours past the contractual 48-hour deadline, constituting a breach of MSA Section 9.4.
While, in this instance, the approximately 24-hour delay did not materially alter Quorum's response posture — Calderwood & Harkness was not engaged until May 4, 2023, and the forensic investigation commenced on May 5, 2023 — the notification delay represents a meaningful contractual breach that could have been consequential in a faster-moving incident. In a scenario involving active, ongoing data destruction, ransomware deployment, or a threat actor with continued access to live systems, a 24-hour delay in vendor notification could have materially impaired Quorum's ability to contain the incident and mitigate harm. This delay reinforced the importance of both shortening contractual notification windows and establishing verification mechanisms to ensure vendor compliance with notification obligations.
D. Scope of Compromise
The forensic investigation confirmed that the breach compromised the data of 318,247 total affected individuals across 29 states and the District of Columbia. The data types compromised included:
• PII (names, dates of birth, Social Security numbers, and driver's license numbers): all 318,247 affected individuals.
• Financial information (bank account numbers and/or payment card numbers): 84,619 individuals.
• PHI (health conditions, diagnosis codes, and treatment information derived from workers' compensation and health-related insurance claims): 41,203 individuals.
The breadth of data types compromised — spanning PII, financial data, and PHI — triggered notification obligations under a complex matrix of federal and state laws, including the HIPAA Breach Notification Rule, state data breach notification statutes in 29 jurisdictions, and the Connecticut Insurance Data Security Law.
The table below sets forth the most affected jurisdictions by individual count:
The concentration of affected individuals in Connecticut and New York — Quorum's domiciliary state and largest market, respectively — was a significant factor in the regulatory dynamics that followed, as discussed in Section VI below.
III. Lessons Learned — Category 1: Vendor Risk Management Program
A. Pre-Engagement Due Diligence Gaps
Quorum's existing vendor risk management program, overseen by Priya Deshmukh (VP, Vendor Risk Management), incorporated a number of standard industry practices, including pre-engagement security questionnaires administered to prospective vendors, standard contractual data security requirements embedded in vendor agreements, and periodic review of vendor compliance with security obligations. These measures reflect a reasonable baseline vendor risk management posture and contributed to the inclusion of patching and notification requirements in the Palomar MSA that ultimately formed the basis for the vendor indemnification recovery.
However, the incident exposed several critical gaps in the program's design and execution that, had they been addressed earlier, could have enabled Quorum to detect Palomar's patching non-compliance before it was exploited. Most significantly, the program lacked continuous, risk-tiered monitoring of critical vendors' security posture between annual review cycles. The vendor risk management program applied a largely uniform monitoring cadence across its vendor population, without differentiating between vendors based on the sensitivity or volume of data processed, the criticality of the vendor's services to Quorum's operations, or the level of system access granted to the vendor. As a result, Palomar — a Tier 1 vendor by any reasonable measure, given the sensitivity and volume of data it processed and its integration into Quorum's core claims operations — received substantially the same monitoring cadence and oversight intensity as lower-risk vendors processing far less sensitive data.
Additionally, the requirement that Palomar obtain and maintain a SOC 2 Type II audit report was not included in the original MSA executed in November 2019. This requirement was only added in Amendment 2, dated September 15, 2022 — more than two years after the commencement of the vendor relationship. Palomar's SOC 2 Type II audit was performed by Kessler, Park & Associates CPA, PLLC, a Dallas, Texas-based accounting firm (engagement partner: Vivian Park). While the existence of a SOC 2 report provides a degree of assurance regarding the design and operating effectiveness of certain security controls, the scope of that audit, its recency relative to the date of the breach, and the extent to which it covered the specific controls relevant to vulnerability management and patch deployment should be critically evaluated. A SOC 2 report is not a substitute for continuous, independent verification of a vendor's actual security practices.
B. Lack of Real-Time Vendor Security Posture Visibility
Perhaps the most consequential gap revealed by this incident was Quorum's complete lack of any mechanism for real-time or near-real-time visibility into Palomar's vulnerability management status, patching cadence, or threat landscape exposure. Quorum's vendor risk management program relied on periodic, point-in-time assessments — security questionnaires, annual reviews, and the SOC 2 report — to evaluate Palomar's security posture. Between these periodic assessment points, Quorum had no independent means of verifying whether Palomar was, in fact, maintaining the security practices it had contractually committed to.
The practical consequence of this gap is stark: the breach was caused by an unpatched critical vulnerability that persisted in Palomar's environment for longer than the contractually mandated 30-day patching window. Quorum had no means to detect this non-compliance until after the breach had already occurred, the data had been exfiltrated, and Palomar itself belatedly notified Quorum. In effect, Quorum was relying entirely on Palomar's self-governance and self-reporting for assurance that critical security obligations were being met — an approach that proved insufficient.
The availability of third-party security rating and monitoring platforms that provide continuous external visibility into an organization's security posture — including vulnerability exposure, patching cadence, and network hygiene indicators — means that Quorum has viable options for closing this visibility gap without requiring invasive, real-time access to vendor systems. While no external monitoring tool provides a complete picture of a vendor's internal security environment, such tools would have provided Quorum with early indicators of Palomar's vulnerability exposure and potentially flagged the unpatched GoAnywhere MFT appliance before it was exploited.
C. Recommendations — Vendor Risk Management Enhancements
Based on the foregoing analysis, Calderwood & Harkness recommends that Quorum implement the following vendor risk management enhancements:
1. Implement a Formal Vendor Risk Tiering Framework. Quorum should establish a formal, documented framework for tiering all vendors into risk categories — Tier 1 (highest risk) through Tier 3 (lowest risk) — based on objective criteria including the sensitivity of data processed by the vendor, the volume of data processed, the level of system access granted to the vendor, and the criticality of the vendor's services to Quorum's core business operations. Palomar and any comparable data-processing vendor handling PII, financial data, or PHI on behalf of Quorum should be classified as Tier 1. The tiering framework should drive differentiated oversight requirements, including monitoring cadence, audit frequency, contractual requirements, and escalation protocols. The framework should be reviewed and updated annually to reflect changes in vendor relationships and the evolving threat landscape.
2. Deploy Continuous Security Monitoring for Tier 1 Vendors. Quorum should procure and deploy one or more third-party security rating and monitoring tools that provide continuous external visibility into Tier 1 vendors' security posture. These tools should, at a minimum, provide ongoing monitoring of vulnerability exposure, patching cadence, network hygiene, and publicly observable indicators of security risk. Alerts generated by these monitoring tools should be routed to both the CISO's office and the Vendor Risk Management function, with defined escalation procedures for material findings. While these tools provide an external perspective and are not a substitute for contractual audit rights and direct assessments, they offer an essential early-warning capability that Quorum currently lacks.
3. Enhance Pre-Engagement Security Due Diligence. Quorum should enhance its pre-engagement security due diligence requirements for all prospective Tier 1 vendors. Before contract execution, Tier 1 vendor candidates should be required to provide, at a minimum: (a) a current SOC 2 Type II audit report with a report period ending no more than 12 months prior to the date of engagement; (b) results of a recent penetration test conducted by a qualified third-party assessor; and (c) documentation of the vendor's vulnerability management program, including patching cadence targets and escalation procedures. These requirements should be incorporated into the vendor onboarding process managed by the Vendor Risk Management function.
4. Quarterly Vendor Security Reviews for Tier 1 Vendors. Quorum should move from an annual to a quarterly security review cadence for all Tier 1 vendors. Quarterly reviews should include, at a minimum, review of the vendor's patching logs covering the preceding quarter, review of vulnerability scan results, an assessment of the vendor's incident response readiness, and discussion of any material changes to the vendor's security environment, personnel, or technology stack. These quarterly reviews should be documented and retained by the Vendor Risk Management function.
5. Active Enforcement of Right-to-Audit Provisions. Quorum should actively and routinely exercise the right-to-audit provisions contained in its Tier 1 vendor agreements. Quorum should schedule annual on-site or virtual security assessments for all Tier 1 vendors, conducted by qualified internal or external assessors. Calderwood & Harkness notes that MSA Amendment 3 (executed October 27, 2023) now requires Palomar to submit to annual independent security assessments at Palomar's own expense. This requirement should serve as the baseline standard for all Tier 1 vendor agreements, and Quorum should ensure that similar provisions are incorporated into new and renewed Tier 1 contracts.
6. Establish a Cross-Functional Vendor Risk Committee. Quorum should establish a standing Vendor Risk Committee to provide governance oversight of Tier 1 vendor relationships and the vendor risk management program as a whole. The Committee should include representatives from the General Counsel's office (Thomas Whitfield or designee), the CISO (David Naranjo or designee), the CPO (Jennifer Liang or designee), the Vendor Risk Management function (Priya Deshmukh or designee), and Claims Operations (Robert Wentworth or designee). The Committee should meet at least quarterly, with standing agenda items including review of Tier 1 vendor security monitoring results, review of audit and assessment findings, discussion of vendor risk escalations, and evaluation of new or expanded vendor engagements involving sensitive data. The Committee should operate under a formal charter that defines its authority, membership, meeting cadence, and reporting lines to senior management and the Board Audit Committee.
IV. Lessons Learned — Category 2: Contractual Protections and Enforcement
A. Notification Window
The 48-hour contractual notification window established in MSA Section 9.4 proved adequate in principle as a baseline requirement, providing Quorum with a reasonable expectation of timely notification in the event of a security incident. However, as discussed in Section II.C above, Palomar breached this obligation by approximately 24 hours, delivering notification approximately 72 hours after its discovery of the anomalous activity. While this delay did not, in this instance, materially alter the trajectory of Quorum's incident response, the breach of the notification obligation underscored the importance of both establishing shorter contractual notification windows for high-risk vendor relationships and implementing mechanisms to verify and enforce compliance with those obligations.
Given the sensitivity and volume of data processed by Palomar — encompassing PII, financial data, and PHI for over 318,000 individuals — a shorter mandatory notification window is advisable for Palomar and all similarly situated Tier 1 vendors. A 24-hour notification window, measured from the vendor's discovery of a confirmed or reasonably suspected security incident, provides Quorum with the earliest practicable notice while remaining a commercially reasonable requirement for vendors with mature security operations. MSA Amendment 3, executed on October 27, 2023 as part of the vendor indemnification settlement, reduced Palomar's notification obligation from 48 hours to 24 hours. This enhanced standard should be adopted as the baseline for all Tier 1 vendor agreements going forward.
B. Patching Requirements
The 30-day critical vulnerability patching requirement contained in Exhibit D of the MSA (as amended by Amendment 2) was a reasonable contractual provision and, in fact, provided the legal basis for Quorum's indemnification claim against Palomar, as Palomar's breach of this obligation was the direct and proximate cause of the incident. However, the patching requirement was not enforced through any verification mechanism prior to the breach. Quorum had no means of confirming whether Palomar was, in fact, patching critical vulnerabilities within the 30-day window — a gap that, as discussed in Section III.B above, contributed directly to the undetected persistence of the CVE-2023-0669 vulnerability in Palomar's environment.
MSA Amendment 3, executed October 27, 2023, shortened the critical vulnerability patching window for Palomar from 30 days to 14 days. This enhanced standard reflects the accelerated pace at which threat actors exploit newly disclosed vulnerabilities and is consistent with emerging industry best practices and regulatory expectations. The 14-day patching standard should be adopted as the baseline for all new and renewed Tier 1 vendor agreements.
Critically, the experience with Palomar demonstrates that contractual patching requirements are only as effective as the mechanisms in place to verify and enforce them. Accordingly, Calderwood & Harkness recommends that all Tier 1 vendor agreements include a provision requiring the vendor to provide evidence of patch deployment within a specified period upon Quorum's request. Such evidence may take the form of patch management reports, system scan results, or attestations from the vendor's CISO or equivalent security officer. This verification mechanism, combined with the continuous monitoring tools recommended in Section III.C.2, will provide Quorum with layered assurance of vendor patching compliance.
C. Indemnification Provisions
The indemnification provisions of the MSA, as amended, established a cap on Palomar's indemnification obligations equal to two times (2×) the trailing twelve-month fees paid by Quorum — a cap of $32,600,000 based on the $16.3 million ACV. This cap was adequate to cover the total incident response costs of $8,230,250, and the indemnification provisions provided the legal foundation for the successful recovery from Palomar.
The settlement negotiated with Palomar, memorialized in the Settlement Agreement and Mutual Release executed October 27, 2023, yielded an effective total recovery of $6,156,000, comprising a cash payment of $4,200,000 and fee reductions of $1,956,000 over an 18-month period (calculated as an 8% reduction of the $16.3 million ACV applied over 18 months). This recovery represents approximately 74.8% of total incident response costs — a favorable result in the context of vendor indemnification disputes, which frequently involve protracted litigation and uncertain outcomes.
For future Tier 1 vendor agreements, Quorum should evaluate whether the 2× trailing twelve-month fee cap remains appropriate or should be increased, particularly for vendors processing PHI or large volumes of financial data. In this instance, the cap was more than sufficient, but a larger incident — involving, for example, a broader data set, regulatory fines or penalties, or class action litigation — could readily exceed a 2× fee cap, leaving Quorum with significant unrecovered losses. Quorum should also consider the inclusion of express, uncapped indemnification for regulatory fines and penalties arising directly from vendor security failures, carved out from the general indemnification cap. While such provisions are commercially challenging to negotiate, the increasing likelihood and magnitude of regulatory penalties for data breaches — including potential HIPAA civil monetary penalties and state AG enforcement actions — warrant the effort.
D. Insurance Requirements
MSA Exhibit E required Palomar to maintain a minimum of $10 million in cyber liability insurance coverage. At the time the MSA was originally executed in November 2019, a $10 million minimum may have been consistent with prevailing market expectations. However, in light of the evolving threat landscape, the increasing costs of breach response, and the potential for regulatory fines and class action litigation, a $10 million minimum is no longer adequate for Tier 1 vendors processing the volume and sensitivity of data entrusted to Palomar.
Calderwood & Harkness recommends that Quorum increase the minimum cyber liability coverage requirement to a range of $15 million to $25 million for Tier 1 vendors processing sensitive data on behalf of Quorum. The specific minimum within this range should be calibrated to the volume and sensitivity of data processed by the particular vendor. In addition, Quorum should require that it be named as an additional insured on the vendor's cyber liability policy, ensuring that Quorum has direct access to policy proceeds in the event of a vendor-originated incident. Finally, Quorum should require annual delivery and verification of certificates of insurance demonstrating that the vendor maintains coverage meeting or exceeding the contractual minimums, with the vendor obligated to provide prompt notice of any material reduction, cancellation, or non-renewal of coverage.
E. Recommendations — Contractual Enhancements
Based on the foregoing analysis, Calderwood & Harkness recommends the following contractual enhancements:
1. Standard 24-Hour Notification Window. Quorum should adopt a 24-hour incident notification requirement as the default standard for all Tier 1 vendor agreements. The notification obligation should be triggered upon the vendor's discovery of a confirmed or reasonably suspected security incident affecting Quorum data, and the notification should be directed to both the General Counsel and the CISO via pre-designated contact methods. This standard is consistent with the enhanced notification window now applicable to Palomar under MSA Amendment 3.
2. 14-Day Critical Patching Standard. Quorum should adopt a 14-day critical vulnerability patching requirement as the default standard for all Tier 1 vendor agreements. The patching obligation should apply to all vulnerabilities rated "critical" or "high" under the Common Vulnerability Scoring System (CVSS) or equivalent industry-standard rating system. Vendors should be contractually obligated to provide evidence of patch deployment within five business days of Quorum's written request. Failure to patch within the 14-day window should be treated as a material breach of the agreement.
3. Enhanced Indemnification Terms. Quorum should review and, where commercially practicable, increase indemnification caps for Tier 1 data-processing vendors beyond the current 2× trailing twelve-month fee standard. Quorum should also negotiate carve-outs from general liability caps for data security breaches, ensuring that the costs of breach response, regulatory fines, class action settlements, and related expenses are not subject to the same cap that governs ordinary commercial indemnification obligations. Express, uncapped indemnification for regulatory fines and penalties arising from vendor security failures should be pursued as a negotiating priority.
4. Heightened Insurance Minimums. Quorum should increase minimum cyber liability coverage requirements to a range of $15 million to $25 million for Tier 1 vendors processing sensitive data on behalf of Quorum. Quorum should require additional insured status on all Tier 1 vendor cyber liability policies and require annual certificate of insurance delivery with prompt notice of any material change in coverage.
5. Mandatory Endpoint Detection and Response (EDR). Quorum should require all Tier 1 vendors to deploy and maintain endpoint detection and response ("EDR") solutions on all systems that process, store, or have access to Quorum data. This requirement is now applicable to Palomar under MSA Amendment 3 and should be extended to all Tier 1 vendor agreements. The EDR requirement should include a contractual obligation for the vendor to maintain current EDR signatures and to monitor EDR alerts on a 24/7 basis, either through an internal SOC or a qualified managed detection and response ("MDR") provider.
6. Periodic Contract Review Cadence. Quorum should establish a 12-month review cycle for all Tier 1 vendor agreements to ensure that data security exhibits, insurance requirements, indemnification provisions, and other risk-relevant contractual terms remain current with the evolving threat landscape, regulatory requirements, and Quorum's own security standards. Contract reviews should be coordinated between the General Counsel's office, the CISO, the CPO, and the Vendor Risk Management function, and should be tracked as a standing agenda item for the Vendor Risk Committee recommended in Section III.C.6 above.
V. Lessons Learned — Category 3: Incident Response Plan and Preparedness
A. Incident Response Plan Activation
Quorum's incident response plan was activated on May 4, 2023, when Calderwood & Harkness was engaged as outside counsel to lead the legal response to the incident. This engagement occurred approximately 13 days after Palomar's initial notification on April 21, 2023. The intervening period — April 21 through May 4 — was occupied by internal assessment and escalation activities within Quorum, including preliminary evaluation of the Palomar notification by the General Counsel and CISO, internal consultations regarding the scope and significance of the reported incident, and the decision to engage outside counsel.
While these internal activities were reasonable and necessary, the 13-day gap between vendor notification and outside counsel engagement represents an area for improvement. In a vendor-originated data breach, the first days and weeks after notification are critical for establishing the privilege framework, initiating forensic investigation, preserving evidence, and assessing notification obligations. A more compressed timeline from vendor notification to outside counsel engagement and forensic investigation launch would strengthen Quorum's response posture and reduce the risk that critical evidence is lost or degraded during the intervening period.
It is notable that once Calderwood & Harkness was engaged on May 4, 2023, the Graystone Forensics engagement was initiated the following day, May 5, 2023 — an efficient one-day mobilization that reflected the urgency of the investigation. The efficiency of this downstream mobilization underscores the importance of reducing the upstream gap between initial vendor notification and outside counsel engagement.
B. Internal Coordination
The incident response team — comprising Thomas R. Whitfield (General Counsel), David Naranjo (CISO), Jennifer Liang (CPO), Priya Deshmukh (VP, Vendor Risk Management), and Robert Wentworth (SVP, Claims Operations) — functioned effectively once assembled. Communication among team members was consistent, decision-making was well-coordinated, and each member brought essential subject matter expertise to the response effort. The team's collaborative approach contributed significantly to the favorable outcomes achieved.
The initial internal communications between the General Counsel and CISO upon receipt of Palomar's April 21, 2023 notification were appropriately handled, with both officers recognizing the potential severity of the reported incident and beginning preliminary assessment activities. However, the escalation from initial notification to full incident response team activation and outside counsel engagement followed an informal path rather than a documented, predefined escalation protocol. Formalizing escalation triggers — defining the specific criteria that mandate immediate escalation to the full incident response team and engagement of outside counsel — and pre-designating roles and responsibilities for each team member would strengthen future response and reduce the risk of delay in mobilization.
Board reporting during the incident response was timely and appropriately detailed. Franklin Reeves, Chair of the Board Audit Committee, received an initial briefing on May 11, 2023 — seven days after outside counsel engagement — followed by subsequent briefings on July 21, 2023 (forensic findings update), October 16, 2023 (regulatory engagement and vendor settlement update), and November 29, 2023 (matter resolution and closure). The cadence and content of these briefings were well-calibrated to the Board's need for oversight without creating undue interference with the response team's operational activities. This cadence should be formalized as the standard model for future incident response Board reporting.
C. Forensic Investigation Privilege Structure
The privilege protocol established for this engagement — retaining Graystone Forensics LLC under the direction and control of Calderwood & Harkness, with all forensic reports, findings, and work product flowing to counsel and marked as attorney-client privileged and attorney work product — functioned as designed throughout the engagement. The protocol was documented in the Privilege Protocol Memo dated May 5, 2023, distributed to all members of the incident response team and to Graystone.
All forensic work product generated during the engagement was properly marked with the applicable privilege legends, channeled through Calderwood & Harkness, and stored in accordance with the retention and access protocols specified in the Privilege Protocol Memo. No inadvertent disclosures or privilege breaches occurred during the engagement. The Graystone final forensic report (dated July 14, 2023) was delivered to Calderwood & Harkness and shared with the Quorum incident response team under the umbrella of the attorney-client privilege, preserving the confidentiality of the forensic findings.
The integrity of the privilege structure was a significant asset during the regulatory engagement phase. Calderwood & Harkness was able to provide regulators with sufficient information to demonstrate the thoroughness and rigor of Quorum's investigation and response without disclosing privileged forensic work product. This approach was instrumental in achieving the favorable regulatory outcomes described in Section VI below.
D. Recommendations — Incident Response Enhancements
Based on the foregoing analysis, Calderwood & Harkness recommends the following incident response enhancements:
1. Semi-Annual Tabletop Exercise Program. Quorum should implement a semi-annual tabletop exercise program that simulates vendor-originated data breach scenarios of varying scope and complexity. Each exercise should be designed to test specific elements of the incident response plan, including internal escalation procedures, outside counsel and forensic vendor mobilization, regulatory notification decision-making, consumer notification logistics, crisis communications, and Board reporting. Participants should include the General Counsel, CISO, CPO, VP Vendor Risk Management, SVP Claims Operations, and Board Audit Committee representatives. Calderwood & Harkness is available to assist with scenario design, facilitation, and post-exercise assessment if requested by Quorum.
2. Pre-Negotiated Vendor Panels. Quorum should establish and maintain pre-negotiated retainer agreements with a panel of forensic investigation firms (such as Graystone Forensics LLC), notification vendors (such as Clearfield Notification Services LLC), and crisis communications firms (such as BrightPath Consulting Group, Inc.) to enable immediate engagement upon incident detection. Pre-negotiated retainers eliminate the need for scope negotiation, rate negotiation, and contracting during the critical early hours of an incident response, reducing mobilization time and ensuring that qualified resources are available without delay. These retainer agreements should be reviewed and updated annually to ensure that pricing, scope, and vendor capabilities remain current.
3. Compressed Engagement Timeline Target. Quorum should establish an organizational target of engaging outside counsel within 72 hours of receiving a vendor breach notification for incidents involving Tier 1 vendors or incidents that, based on the vendor's initial notification, appear to involve a significant volume of records, PHI, or financial data. The current experience — 13 days between Palomar's April 21, 2023 notification and Calderwood & Harkness's May 4, 2023 engagement — represents a timeline that, while understandable in context, should be substantially compressed. Achieving a 72-hour engagement target will require pre-defined escalation triggers, pre-designated decision-making authority for the General Counsel or CISO to engage outside counsel without additional internal approvals, and pre-negotiated engagement terms with one or more outside counsel firms.
4. Formalized Escalation Protocol. Quorum should develop and document a formal internal escalation protocol that defines the specific criteria triggering mandatory escalation to the full incident response team and engagement of outside counsel. Recommended escalation triggers include: (a) any vendor security incident involving more than 1,000 individual records; (b) any incident involving PHI; (c) any incident involving financial data (bank account numbers, payment card numbers, or similar sensitive financial information); (d) any incident involving a Tier 1 vendor; and (e) any incident involving potential ransomware or destructive malware. The escalation protocol should specify designated escalation chains (identifying the specific individuals responsible at each step), response time targets for each escalation step, and pre-assigned roles and responsibilities for all incident response team members. The escalation protocol should be distributed to all relevant personnel and tested during tabletop exercises.
5. Board Reporting Playbook. Quorum should formalize the cadence and content framework for Board Audit Committee briefings during active incident response, based on the model employed during this engagement. The playbook should specify: (a) an initial report to the Audit Committee Chair within 10 business days of outside counsel engagement, providing a factual summary of the incident, preliminary scope assessment, and planned investigative steps; (b) a forensic findings update upon completion of the forensic investigation; (c) a regulatory engagement update summarizing the status of all regulatory notifications and inquiries; and (d) a closure report summarizing the final resolution of all regulatory, litigation, and vendor accountability matters. The playbook should be maintained as an appendix to the incident response plan.
6. Privilege Protocol Template. Quorum should maintain a standing privilege protocol template, based on the May 5, 2023 Privilege Protocol Memo developed for this engagement, for immediate deployment in future incidents. The template should be pre-approved by the General Counsel and should include standard privilege legends, instructions for marking and channeling privileged communications and work product, protocols for retaining forensic investigators, notification vendors, and crisis communications firms under counsel's direction, and guidelines for interactions with regulators and other third parties. Having a pre-approved template will enable the privilege framework to be established within hours of outside counsel engagement, rather than requiring development from scratch during the early stages of each new incident.
VI. Lessons Learned — Category 4: Regulatory Notification and Compliance
A. Multistate Notification Complexity
The scope of this incident — 318,247 affected individuals spanning 29 states and the District of Columbia, with data types triggering obligations under multiple state breach notification statutes, the HIPAA Breach Notification Rule, and the Connecticut Insurance Data Security Law — generated a regulatory notification challenge of significant complexity. Each of the 29 affected states (and the District of Columbia) maintains its own breach notification statute with distinct requirements regarding notification timing (ranging from 30 to 60 days, with some states imposing "without unreasonable delay" standards), notification content (with varying requirements for the specific information that must be included in consumer notification letters), notification format (some states requiring specific formatting or prescribed language), and regulatory filing requirements (some states requiring advance or concurrent notification to the state attorney general, consumer protection agency, or other regulator).
Calderwood & Harkness's 50-state breach notification law survey, prepared on June 8, 2023, and the state-by-state notification timeline and content requirements matrix, prepared on August 1, 2023, were essential tools for navigating this regulatory landscape. These resources enabled the incident response team to develop a comprehensive notification strategy that satisfied the most stringent applicable requirements in each jurisdiction while maintaining a consistent, accurate, and legally defensible approach across all 29 states and the District of Columbia.
All regulatory notifications were filed in a timely manner, between August 14 and August 25, 2023. All consumer notification letters were mailed between August 18 and September 15, 2023, with the staggered mailing schedule reflecting the logistical requirements of producing, personalizing, and mailing over 318,000 individual notification packages through Clearfield Notification Services LLC. Each notification package included the required consumer notification letter, information regarding the 24-month credit monitoring and identity theft protection services offered by Quorum, and supplemental identity theft prevention resources as required by certain state statutes.
The complexity of managing 29-plus simultaneous state filings, each with its own requirements and deadlines, underscores the need for Quorum to invest in pre-built compliance templates, automated tracking systems, and standing relationships with outside counsel experienced in multistate breach notification compliance. While the notification process was executed successfully in this instance, the reliance on manual tracking and ad hoc template development introduced unnecessary risk and resource burden.
B. HIPAA Notification
The presence of PHI among the compromised data elements — specifically, health conditions, diagnosis codes, and treatment information derived from workers' compensation and health-related insurance claims for 41,203 individuals — triggered notification obligations under the HIPAA Breach Notification Rule, codified at 45 C.F.R. Part 164, Subpart D. As a covered entity under HIPAA, Quorum was required to provide individual notice to affected individuals, notification to HHS-OCR, and, because the breach affected more than 500 individuals in multiple states, prominent media notice in accordance with 45 C.F.R. § 164.406.
The HHS-OCR notification was filed on August 15, 2023, within the 60-day window prescribed by 45 C.F.R. § 164.408. The required media notice was issued concurrently. Individual notices to the 41,203 affected individuals whose PHI was compromised were included within the broader consumer notification mailing and complied with the content requirements of 45 C.F.R. § 164.404(c).
HHS-OCR issued its no further action letter on November 30, 2023, concluding its review of the breach notification and finding no basis for further investigation or enforcement action. This favorable outcome reflects the timeliness and completeness of Quorum's HIPAA notifications, the thoroughness of the investigation documented in the breach notification submission, and the remedial measures implemented by Quorum in response to the incident.
Looking forward, Quorum should evaluate whether the volume of PHI processed by third-party vendors — 41,203 individuals in this instance — can be reduced through data minimization measures. The processing of PHI by a third-party vendor introduces HIPAA compliance obligations and regulatory exposure that could be mitigated by limiting the PHI data elements shared with vendors to the minimum necessary for the performance of their contractual obligations, consistent with the HIPAA minimum necessary standard and the data minimization recommendations set forth in Section VII below.
C. Connecticut Insurance Data Security Law
As a Connecticut-domiciled insurance holding company, Quorum is subject to the Connecticut Insurance Data Security Law, Conn. Gen. Stat. § 38a-999b, which imposes specific requirements on insurers regarding the establishment and maintenance of information security programs, oversight of third-party service providers, investigation of cybersecurity events, and notification of cybersecurity events to the Connecticut Insurance Commissioner. This statute, modeled on the National Association of Insurance Commissioners ("NAIC") Insurance Data Security Model Law, reflects the heightened regulatory expectations applicable to insurance industry participants.
The Connecticut Insurance Department opened an inquiry following Quorum's August 14, 2023 regulatory notification. The inquiry was managed by Richard Nakamura of the Department's Financial Analysis Division, Cybersecurity Unit. Calderwood & Harkness coordinated Quorum's response to the Department's information requests, demonstrating the vendor-originated nature of the breach, Quorum's own robust information security program, the timeliness of Quorum's response and notifications, and the vendor accountability measures pursued by Quorum, including the indemnification demand, settlement, and MSA Amendment 3. The inquiry was closed on November 28, 2023, without adverse findings.
Quorum should ensure ongoing compliance with the Connecticut Insurance Data Security Law's requirements, including the maintenance of a comprehensive written information security program, risk-based oversight of third-party service providers (including the vendor risk management enhancements recommended in this memorandum), investigation and notification procedures for cybersecurity events, and annual certification of compliance to the Connecticut Insurance Commissioner. The remediation measures recommended in this memorandum are designed, in part, to strengthen Quorum's compliance with these requirements.
D. Multistate AG Engagement
The multistate attorney general coalition opened its inquiry on September 8, 2023, following receipt of the regulatory notifications filed between August 14 and August 25, 2023. The coalition comprised 29 state attorneys general and was led by Assistant Attorney General Diane Marchetti of the Connecticut Attorney General's office and Assistant Attorney General Mark Petrosian of the New York Attorney General's office. The involvement of the Connecticut and New York AGs in leadership positions reflected the concentration of affected individuals in those two states (52,114 and 47,831, respectively).
Calderwood & Harkness developed and executed a response strategy grounded in cooperative, transparent engagement with the multistate coalition. The strategy emphasized the vendor-originated nature of the breach, the fact that Palomar's patching failure — not any deficiency in Quorum's own security program — was the root cause, the timeliness and completeness of Quorum's consumer and regulatory notifications, the robust remedial measures undertaken by Quorum (including vendor indemnification demand, settlement, MSA Amendment 3, and the programmatic enhancements under development), and Quorum's demonstrated commitment to vendor accountability.
Quorum's initial written response to the multistate coalition's inquiry was submitted on October 13, 2023. Supplemental information, responding to follow-up questions from the coalition, was provided on November 3, 2023. The coalition issued its closure letter on November 22, 2023, concluding the inquiry without enforcement action and without requiring Quorum to enter into an assurance of voluntary compliance, consent decree, or other regulatory agreement.
Several key factors contributed to this favorable resolution: (a) the timeliness of all consumer and regulatory notifications, filed well within applicable statutory deadlines; (b) the offer of 24-month credit monitoring and identity theft protection services to all affected individuals, exceeding the standard typically expected by regulators; (c) the vendor accountability measures pursued by Quorum, including the indemnification demand, negotiated settlement, and comprehensive MSA Amendment 3 imposing enhanced security requirements on Palomar; and (d) Quorum's demonstration of its own robust information security program, including existing policies, procedures, and technical controls, which underscored that the breach was attributable to vendor failure rather than any deficiency in Quorum's own security posture.
E. Recommendations — Regulatory Compliance Enhancements
Based on the foregoing analysis, Calderwood & Harkness recommends the following regulatory compliance enhancements:
1. Maintain an Updated Notification Law Database. Quorum should invest in a continuously updated breach notification law database or subscription service to supplement the notification law survey work performed by outside counsel during active incident response. State data breach notification laws evolve frequently — multiple states amend their statutes each legislative session, and new requirements regarding notification timing, content, and regulatory filing are regularly enacted. Maintaining an up-to-date database will enable Quorum to perform rapid preliminary assessments of notification obligations upon learning of a potential incident, reducing the time required to develop a comprehensive notification strategy.
2. Pre-Built Notification Templates. Quorum should develop and maintain a library of pre-drafted notification letter templates for the most common data element combinations (PII only, PII plus financial data, PII plus PHI, PII plus financial data plus PHI) in the jurisdictions where Quorum has the highest concentrations of policyholders: Connecticut, New York, California, Texas, Florida, Pennsylvania, Illinois, New Jersey, Ohio, and Massachusetts. These templates should be designed to comply with the most stringent content and formatting requirements in each jurisdiction and should be reviewed and updated at least annually by outside counsel. Having pre-built templates available will significantly reduce the time and cost associated with developing notification materials during an active incident response.
3. Regulatory Relationship Management. Quorum should consider proactive engagement with the Connecticut Insurance Department and other key state regulators regarding Quorum's cybersecurity program enhancements, outside of any incident context. Proactive engagement — such as participating in industry working groups, attending regulator-sponsored cybersecurity events, or scheduling informational briefings with key regulatory contacts — can build goodwill, establish Quorum as a responsible industry participant committed to data security, and create constructive relationships that may prove valuable in the event of a future incident. This approach is consistent with the cooperative engagement strategy that proved effective during the multistate AG inquiry.
4. HIPAA Compliance Program Review. Quorum should conduct a comprehensive review of its HIPAA compliance program, including a review of all business associate agreements ("BAAs") with vendors that process, store, or have access to PHI on behalf of Quorum. The review should ensure that all BAAs are current, contain the required provisions under 45 C.F.R. § 164.314(a), and are consistent with current HHS-OCR enforcement priorities. The review should also evaluate whether Quorum's HIPAA policies and procedures regarding breach investigation, risk assessment, and notification are current and aligned with OCR's published guidance and enforcement trends.
VII. Lessons Learned — Category 5: Data Minimization and Security Architecture
A. Volume and Sensitivity of Data Shared with Vendors
One of the most fundamental lessons of this incident is that the scope and severity of a vendor-originated breach are directly proportional to the volume and sensitivity of data accessible within the vendor's environment. Palomar processed data for 318,247 individuals, encompassing Social Security numbers, financial account numbers, and protected health information — a substantial volume and breadth of sensitive data entrusted to a single third-party vendor. Every one of these data elements was within the threat actor's reach once initial access to Palomar's network was achieved.
Quorum should critically evaluate whether the full complement of data elements currently shared with Palomar (and similarly situated vendors) is necessary for the performance of claims processing operations, or whether data minimization techniques — including truncation, masking, tokenization, or pseudonymization — could reduce the volume and sensitivity of data exposure in the event of a future compromise. For example, claims processing operations may not require full Social Security numbers in all instances; truncated SSNs (last four digits) or alternative identifiers may be sufficient for many processing functions. Similarly, full bank account numbers or payment card numbers may be replaceable with tokenized values for certain processing activities. Each data element shared with a vendor represents incremental risk; reducing the data shared reduces the potential impact of any future breach.
B. QuorumEdge Platform Data
The risk implications of data sharing expansions are further illustrated by the history of the Palomar engagement. MSA Amendment 1, executed on March 3, 2021, added QuorumEdge platform data processing to Palomar's scope of services. This expansion increased the ACV from $14.2 million to $16.3 million and, more significantly for present purposes, expanded the categories and volume of data processed by Palomar to include data from the QuorumEdge platform. At the time Amendment 1 was executed, no formal data protection impact assessment was conducted to evaluate the security implications of expanding the data-sharing arrangement with Palomar.
The QuorumEdge expansion illustrates a broader principle: any expansion of data sharing with a vendor — whether through the addition of new data categories, new data sources, new processing activities, or new system integrations — should be accompanied by a formal data protection impact assessment and a re-evaluation of the vendor's security posture. The security assurances that were adequate for the original scope of the vendor relationship may not be adequate for an expanded scope, particularly when the expansion introduces new data types, larger data volumes, or new attack surfaces.
C. Recommendations — Data Minimization and Architecture
Based on the foregoing analysis, Calderwood & Harkness recommends the following data minimization and security architecture measures:
1. Comprehensive Data Minimization Review. Quorum should conduct a comprehensive review of all data elements shared with Tier 1 vendors, beginning with Palomar and extending to all other Tier 1 data-processing vendors. The review should identify specific opportunities to reduce the volume and sensitivity of data transferred to each vendor, evaluating whether Social Security numbers, full financial account numbers, granular PHI data elements, and other sensitive information are operationally necessary in the vendor's environment or whether truncated, masked, tokenized, or otherwise de-identified alternatives would suffice for the vendor's contracted processing activities. The review should be led by the CISO in coordination with the CPO, VP Vendor Risk Management, and SVP Claims Operations, with legal support from the General Counsel's office to address contractual, regulatory, and privacy law implications.
2

MEMORANDUM

MATTER NO.: 1025-00006

Record

Parties

Dates

Amounts