QUORUM INSURANCE HOLDINGS CORP. 400 Constitution Plaza, Suite 2200 Hartford, CT 06103
August 12, 2023
[First Name] [Last Name] [Address Line 1] [Address Line 2] [City], CA [ZIP Code]
Dear [First Name] [Last Name]:
Quorum Insurance Holdings Corp. ("Quorum" or the "Company") is writing to notify you of a data security incident that may have involved your personal information. Quorum takes the security of personal information very seriously, and we are providing this notice to explain the incident, describe the steps Quorum has taken in response, and inform you of the resources available to you. We encourage you to read this letter carefully and to take advantage of the complimentary credit monitoring and identity theft protection services being offered to you, as described in detail below.
What Happened
Quorum utilizes a third-party vendor, Palomar Data Solutions, Inc. ("Palomar"), for claims data processing services related to Quorum's personal lines insurance business. Palomar has provided these data processing services to Quorum pursuant to a longstanding contractual relationship and is subject to contractual obligations regarding the security and confidentiality of data it processes on Quorum's behalf.
On or about April 21, 2023, Palomar notified Quorum that it had discovered a security incident involving unauthorized access to Palomar's network and systems. Upon receiving this notification, Quorum immediately initiated an investigation into the nature and scope of the incident. As part of this response, Quorum engaged specialized legal counsel at Calderwood & Harkness LLP and retained a leading, nationally recognized forensic investigation firm to conduct a comprehensive technical investigation under the direction of legal counsel.
The forensic investigation determined that an unauthorized third party exploited a previously identified vulnerability in a file transfer application used by Palomar to gain initial access to Palomar's network on or about March 14, 2023. The unauthorized access continued until approximately April 18, 2023, when Palomar's internal security team detected and contained the anomalous activity within its systems. During this approximately thirty-five (35) day period, the unauthorized actor accessed and exfiltrated certain data files that Palomar maintained on behalf of Quorum and other clients. Among the files accessed and exfiltrated were files containing personal information of Quorum policyholders and claimants, including California residents.
It is important to note that this incident originated within Palomar's systems and network infrastructure, and not within Quorum's own internal systems or network. Quorum's own information technology environment was not compromised as a result of this incident. Nevertheless, because the affected data included personal information entrusted to Quorum by its policyholders and claimants, Quorum is treating this matter with the utmost seriousness and is taking all steps it believes are appropriate to respond to the incident and to assist affected individuals, including you.
Following the completion of the forensic investigation, Quorum, with the assistance of its legal counsel and specialized data review vendors, undertook a comprehensive review of the affected data files to identify the specific individuals whose personal information was contained in the exfiltrated files and to determine the types of personal information involved for each individual. This review process was extensive and time-consuming due to the volume and complexity of the data involved, and was completed as expeditiously as possible. As a result of that review, Quorum determined that your personal information was among the data that may have been accessed or acquired by the unauthorized actor.
What Information Was Involved
The types of personal information involved in this incident varied by individual. Based on our thorough review of the affected data files, Quorum has determined that the following categories of your personal information may have been accessed or acquired by the unauthorized third party in connection with this incident:
Your name, date of birth, Social Security number, and/or driver's license number.
[If financial data is applicable:] In addition to the information described above, the data that may have been accessed or acquired also included financial account information, such as bank account numbers and/or payment card numbers, associated with your Quorum policy or claim.
[If protected health information / medical information is applicable:] In addition to the information described above, the data that may have been accessed or acquired also included health-related information, such as health conditions, diagnosis codes, and/or treatment information associated with workers' compensation or health-related insurance claims you submitted to or through Quorum. This information is considered medical information under California law.
To the extent any of your medical information or protected health information was involved in this incident, Quorum is providing this notice to you in compliance with the California Confidentiality of Medical Information Act (Cal. Civ. Code § 56 et seq.) in addition to the notice requirements of Cal. Civ. Code § 1798.82. Quorum is committed to protecting the confidentiality of your medical information and deeply regrets any concern this incident may cause you.
We want to assure you that Quorum has no evidence at this time that any of your personal information has been misused as a result of this incident. However, out of an abundance of caution, we are providing you with this notification and the complimentary services described below so that you may take steps to protect yourself.
What We Are Doing
Upon learning of the incident, Quorum took immediate and comprehensive steps to investigate and respond, including the following:
• Engaging Legal Counsel. Quorum engaged Calderwood & Harkness LLP, a nationally recognized privacy and data security law firm, to manage and oversee all aspects of the Company's incident response, including regulatory notifications, individual notifications, and coordination with Palomar.
• Retaining Forensic Investigators. Quorum retained a leading forensic investigation firm to conduct a thorough technical investigation of the incident under the direction and privilege of legal counsel. The forensic investigation included an assessment of the attack vector, the scope and duration of the unauthorized access, and the identification of affected data.
• Notifying Regulators and Law Enforcement. Quorum has notified applicable regulators, including the California Attorney General, as well as other state regulators and federal agencies, of the incident. A copy of this notification letter was submitted to the California Attorney General on August 16, 2023, as required by Cal. Civ. Code § 1798.82(f) for incidents affecting more than 500 California residents. Quorum has also notified law enforcement authorities and is cooperating fully with any ongoing investigations.
• Working with Palomar to Contain and Remediate. Quorum worked closely with Palomar to understand the full scope of the incident and to ensure that the vulnerability exploited by the threat actor was contained and remediated. Quorum required Palomar to implement enhanced security measures in the wake of the incident, including but not limited to:
• Accelerated patch management protocols to address known and emerging software vulnerabilities on an expedited basis;
• Enhanced endpoint detection and response ("EDR") capabilities across Palomar's network and systems;
• Engagement of an independent third-party security assessor to conduct a comprehensive review of Palomar's information security program and to provide recommendations for further improvements; and
• Implementation of additional access controls and network segmentation measures to limit the potential scope of any future unauthorized access.
• Providing Complimentary Credit Monitoring and Identity Theft Protection. Quorum is providing all affected individuals, including you, with complimentary credit monitoring and identity theft protection services for a period of twenty-four (24) months at no cost to you. Details regarding these services and instructions for enrollment are provided below and in the enclosed materials.
• Reviewing and Strengthening Internal Practices. In addition to the remediation measures required of Palomar, Quorum is reviewing its own vendor management and oversight practices and is implementing enhanced due diligence and monitoring procedures for third-party service providers that handle personal information on Quorum's behalf.
Quorum is committed to taking all reasonable and appropriate steps to protect the personal information entrusted to it and to minimize the risk of harm from this incident.
What You Can Do
While Quorum has no evidence that your personal information has been misused as a result of this incident, we recommend that you take the following precautionary steps to help protect yourself:
1. Enroll in Complimentary Credit Monitoring and Identity Theft Protection Services. We strongly encourage you to enroll in the complimentary twenty-four (24) month credit monitoring and identity theft protection services being offered to you at no cost. Instructions for enrollment are provided in the section below and in the enclosed materials.
2. Review Account Statements and Explanation of Benefits Forms. We recommend that you carefully review your financial account statements, credit card statements, and any explanation of benefits ("EOB") forms you receive from your health insurer for any suspicious or unauthorized activity. If you identify any transactions or charges that you did not authorize, contact the relevant financial institution or insurer immediately.
3. Monitor Your Credit Reports. You are entitled to one free credit report annually from each of the three major nationwide credit reporting agencies—Harborview Enterprises, Penrose Group, and Penmark Enterprises. You may request your free credit reports by visiting www.annualcreditreport.com, by calling 1-877-322-8228, or by writing to Annual Credit Report Request Service, P.O. Box 105281, Atlanta, GA 30348-5281. Review your credit reports carefully for any accounts or inquiries that you do not recognize.
4. Consider Placing a Fraud Alert on Your Credit Files. A fraud alert tells creditors to take additional steps to verify your identity before opening a new account in your name. You may place an initial fraud alert on your credit file, which will last for one year, by contacting any one of the three major credit reporting agencies listed below. The agency you contact is required to notify the other two agencies:
Harborview Enterprises P.O. Box 105069, Atlanta, GA 30348-5069 Telephone: 1-800-525-6285 www.Harborview Enterprises.com
Penrose Group P.O. Box 2002, Allen, TX 75013-0949 Telephone: 1-888-397-3742 www.Penrose Group.com
Penmark Enterprises P.O. Box 2000, Chester, PA 19016 Telephone: 1-800-680-7289 www.Penmark Enterprises.com
5. Consider Placing a Security Freeze on Your Credit Report. Under California law (Cal. Civ. Code § 1785.11.2), you have the right to place a security freeze on your credit report free of charge. A security freeze prohibits a credit reporting agency from releasing any information from your credit report without your express authorization. A security freeze is designed to prevent credit, loans, and other services from being approved in your name without your consent. However, please be aware that placing a security freeze on your credit report may delay, interfere with, or prevent the timely approval of any requests you make for new loans, mortgages, credit, employment, housing, or other services. To place a security freeze, you must contact each of the three major credit reporting agencies listed above individually. You will be required to provide certain personal information, which may vary depending on the agency. When you place a security freeze, you will be provided with a unique personal identification number ("PIN") or password that you will need to use if you later wish to temporarily lift or permanently remove the freeze.
6. Report Suspected Identity Theft. If you believe you are a victim of identity theft or suspect that your personal information has been misused, we recommend that you take the following steps:
• File a report with your local law enforcement agency. Obtain a copy of the police report, as it may be useful in disputing unauthorized transactions or accounts.
• File a complaint with the Federal Trade Commission ("FTC"). You may file a complaint with the FTC online at www.IdentityTheft.gov, by calling 1-877-438-4338, or by writing to the Federal Trade Commission, 600 Pennsylvania Avenue, NW, Washington, DC 20580. The FTC's website also provides detailed guidance on steps you can take if your identity has been stolen, including how to create a personalized identity theft recovery plan.
• Contact the California Attorney General's Office. You may contact the California Attorney General for additional information about your rights under California law by visiting www.oag.ca.gov or by calling 1-800-952-5225.
[If financial information was involved:] Additional Steps for Individuals Whose Financial Information Was Involved. Because your financial account information, such as bank account numbers and/or payment card numbers, may have been involved in this incident, we recommend that you take the following additional precautions:
• Monitor your bank and payment card account statements closely for any unauthorized transactions or activity.
• If you detect any unauthorized transactions, contact your financial institution immediately to report the suspicious activity. Your financial institution can assist you in disputing unauthorized charges and replacing affected accounts or cards.
• Consider closing any accounts that may have been compromised and opening new accounts with new account numbers.
• Contact your financial institution to inquire about additional security measures, such as transaction alerts or two-factor authentication, that may be available for your accounts.
[If health / medical information was involved:] Additional Steps for Individuals Whose Health Information Was Involved. Because your health-related or medical information may have been involved in this incident, we recommend that you take the following additional precautions:
• Review all explanation of benefits ("EOB") statements you receive from your health insurer(s) for any medical services, prescriptions, or equipment that you did not receive or authorize. Medical identity theft can result in fraudulent claims being filed under your name or health insurance policy.
• If you identify any suspicious or unauthorized charges or services on your EOB statements, report them to your health insurer immediately.
• Report suspected medical identity theft to the Federal Trade Commission at www.IdentityTheft.gov or by calling 1-877-438-4338.
• Request a copy of your medical records from your healthcare providers to ensure that your records have not been altered or that fraudulent entries have not been added.
Complimentary Credit Monitoring and Identity Theft Protection Services
Quorum is offering you complimentary credit monitoring and identity theft protection services for a period of twenty-four (24) months at no cost to you. These services are being provided through Clearfield Notification Services LLC ("Clearfield"), a nationally recognized provider of breach response and identity protection services.
How to Enroll. To enroll in the complimentary credit monitoring and identity theft protection services, please follow the instructions below:
1. Visit the enrollment website at: www.clearfieldnotification.com/quorum
2. Enter your unique Activation Code: [Activation Code]
3. Follow the on-screen instructions to complete your enrollment. You will be asked to provide certain personal information to verify your identity and activate the monitoring services.
Enrollment Deadline. You must enroll by November 15, 2023 to take advantage of the complimentary services. After this date, your unique activation code will expire and you will no longer be able to enroll at no cost.
Services Included. Your complimentary twenty-four (24) month membership includes the following services:
• Credit Monitoring. Ongoing monitoring of your credit file at one or more of the three major credit reporting agencies for certain changes or activity, such as new account openings, credit inquiries, and address changes. You will receive alerts when potentially suspicious activity is detected.
• Identity Theft Insurance. Up to $1,000,000 in identity theft insurance coverage to help reimburse you for certain out-of-pocket expenses incurred as a result of identity theft, subject to the terms and conditions of the insurance policy.
• Identity Restoration Services. Access to dedicated identity restoration specialists who can assist you in the event that you become a victim of identity theft. These specialists will work with you to help resolve identity theft issues, including assistance with contacting creditors, filing disputes, and navigating the identity recovery process.
These services are being made available to all 38,206 affected California residents, as well as to all other affected individuals nationwide. Enrollment is voluntary but strongly encouraged.
If you have any questions about the enrollment process or the services included, please contact Clearfield directly using the toll-free telephone number provided in the section below.
For More Information
If you have any questions about this incident, your notification, or the complimentary credit monitoring and identity theft protection services being offered to you, please do not hesitate to contact us. We have established the following resources to assist you:
Toll-Free Call Center. A dedicated toll-free call center, operated by Clearfield Notification Services LLC, has been established to answer your questions and assist you with enrollment in the complimentary credit monitoring and identity theft protection services. You may reach the call center at:
Telephone: 1-877-904-2618
Hours of Operation: Monday through Friday, 9:00 a.m. to 9:00 p.m. Eastern Time (excluding federal holidays)
The call center will be available for a twelve (12) week period beginning on the date of this letter. Trained representatives are available to answer your questions in English and Spanish.
Written Inquiries. If you prefer to submit your questions or concerns in writing, you may write to us at the following address:
Quorum Insurance Holdings Corp.
Attn: Privacy Office
400 Constitution Plaza, Suite 2200 Hartford, CT 06103
Additional Information Online. Additional information about this incident, including a copy of this notification and frequently asked questions, is available on Quorum's website at www.quoruminsurance.com/security-incident. This webpage also serves as Quorum's substitute notice posting in compliance with applicable notification requirements.
We sincerely regret any concern or inconvenience this incident may cause you. Protecting the personal information of our policyholders, claimants, and other individuals is a responsibility that Quorum takes very seriously. We are committed to continually strengthening the safeguards we use to protect personal information and to working diligently to reduce the risk of a similar incident occurring in the future.
We appreciate your patience and understanding as we have worked to investigate this incident and to provide you with this notification and the resources to help protect your personal information.
Sincerely,
QUORUM INSURANCE HOLDINGS CORP.
By: ________
Jennifer Liang Chief Privacy Officer Quorum Insurance Holdings Corp.
Enclosure: Credit Monitoring Enrollment Instructions and Activation Code
Your unique Activation Code: [Activation Code] Enrollment Website: www.clearfieldnotification.com/quorum Enrollment Deadline: November 15, 2023
NOTICE REGARDING LEGAL BASIS FOR THIS NOTIFICATION
This notification is being provided pursuant to Cal. Civ. Code § 1798.82, which requires notification to California residents whose unencrypted personal information was, or is reasonably believed to have been, accessed or acquired by an unauthorized person as a result of a data security breach. This notification follows the format prescribed by Cal. Civ. Code § 1798.82(d), which requires that the notification be presented under the headings "What Happened," "What Information Was Involved," "What We Are Doing," "What You Can Do," and "For More Information."
For recipients whose medical information or protected health information was involved in this incident, this notification is also being provided in compliance with the California Confidentiality of Medical Information Act (Cal. Civ. Code § 56 et seq.), which imposes additional notification requirements when medical information is subject to unauthorized access or disclosure.
This notice is being provided on behalf of Quorum Insurance Holdings Corp. in connection with the data security incident that occurred within the systems and network of its third-party vendor, Palomar Data Solutions, Inc. A copy of this notification was submitted to the California Attorney General on August 16, 2023, as required by Cal. Civ. Code § 1798.82(f) for breaches affecting more than 500 California residents.
If you have questions about your rights under California law, you may contact the California Attorney General at www.oag.ca.gov or at 1-800-952-5225.