1025-00006 · Graystone Forensics LLC · Consumer Notifications

call-center-script-faq.docx DOCUMENT Data Privacy

10 / 88 ← → ✕

CALL CENTER SCRIPT & FREQUENTLY ASKED QUESTIONS

Quorum Insurance Holdings Corp. Data Security Incident

PRIVILEGED AND CONFIDENTIAL PREPARED AT THE DIRECTION OF COUNSEL ATTORNEY-CLIENT PRIVILEGED / ATTORNEY WORK PRODUCT

This document is privileged and confidential and has been prepared at the direction of counsel in connection with the provision of legal advice. This document is protected by the attorney-client privilege, the work product doctrine, and any other applicable protections. This document shall not be distributed beyond authorized Clearfield Notification Services LLC personnel without the prior written consent of Calderwood & Harkness LLP. Unauthorized disclosure, copying, or distribution of this document, in whole or in part, is strictly prohibited.

Prepared by:

Calderwood & Harkness LLP 1700 K Street NW, Suite 900 Washington, D.C. 20006

Prepared for:

Clearfield Notification Services LLC 4500 Rockside Road, Suite 210 Independence, OH 44131

Attn: Jerome Tillman, Account Manager

Date: August 14, 2023

Calderwood & Harkness Matter No.: 1025-00006

Authors: Alan Burke, Lead Associate, and Sara Hendricks, Working Associate, Privacy & Data Security Practice Group

Call Center Operations Window: August 18, 2023 through approximately November 10, 2023 (12-week window, commencing with first consumer notification mailing date)

NOTICE: This document is subject to attorney-client privilege and work product protection. It has been prepared at the direction of Calderwood & Harkness LLP in connection with the provision of legal advice to Quorum Insurance Holdings Corp. regarding the data security incident described herein. This document is provided to Clearfield Notification Services LLC solely for the purpose of enabling Clearfield personnel to respond to inbound consumer inquiries in connection with notification services. This document may not be disclosed, distributed, reproduced, or transmitted to any person or entity not authorized by Calderwood & Harkness LLP without prior written consent. Any unauthorized disclosure may result in a waiver of applicable privileges and protections, and Calderwood & Harkness LLP reserves all rights and remedies in connection therewith.

Right-click to update Table of Contents

Section 1: General Instructions for Call Center Agents

1.1 Purpose and Scope

This script and frequently asked questions guide (collectively, this "Script") is provided to Clearfield Notification Services LLC ("Clearfield") call center agents who are handling inbound telephone calls from individuals who have received a data breach notification letter from Quorum Insurance Holdings Corp. ("Quorum"). The purpose of this Script is to ensure that all agents provide consistent, accurate, and legally appropriate responses to callers, and that all communications with affected individuals are handled in a manner that is responsive to caller concerns while protecting the interests of Quorum and its counsel.

All calls received on the dedicated toll-free incident response line relate to a data security incident involving Quorum's third-party claims-processing vendor, Palomar Data Solutions, Inc. ("Palomar"). It is critical that agents understand that the incident originated in systems maintained by Palomar, not in Quorum's own internal systems. However, as described further in this Script, agents must not identify Palomar by name to callers. All references to Palomar during calls should be limited to "a third-party service provider" or "a vendor that provides claims processing services."

Agents must follow this Script and the approved responses contained herein at all times. Agents are not permitted to deviate from the scripted language, speculate about the incident or its causes, provide legal advice to callers, or offer personal opinions or commentary about Quorum, Palomar, or any other party. If a caller asks a question that is not addressed in this Script, the agent must escalate the call in accordance with the escalation protocol set forth in Section 1.5 below.

Approximately 318,247 notification letters are being mailed to affected individuals in rolling batches commencing August 18, 2023 and continuing through approximately September 15, 2023. The letters are being sent to individuals residing in 29 states and the District of Columbia. Call volume is expected to peak in the first three to four weeks following each mailing wave. Agents should be prepared for elevated call volumes during these periods and should manage their time accordingly while ensuring that each caller receives thorough, empathetic, and complete assistance.

1.2 Caller Verification Protocol

Before providing any account-specific information to a caller — including information about the types of personal data that may have been involved, the caller's enrollment status, or any activation codes — agents must verify the caller's identity using the following three-step verification process.

Verification requires the caller to provide each of the following:

(a) The caller's full name, as it appears on the notification letter the caller received;

(b) The unique PIN/reference number printed on the notification letter (this is a unique alphanumeric code assigned to each affected individual); and

All three elements must be successfully verified against the information contained in the Clearfield lookup system before the agent may proceed with providing account-specific information or assisting with credit monitoring enrollment.

If a caller is unable to provide the required verification information, the agent should politely explain that verification is required for security purposes and is designed to protect the caller's personal information. In such cases, the agent should provide the caller with the following mailing address and advise the caller that they may write in for assistance:

Quorum Insurance Holdings Corp. c/o Clearfield Notification Services LLC P.O. Box 5100 Independence, OH 44131-5100

Important: Agents must not read back or confirm any specific personal information to the caller beyond what the caller has already provided. For example, if a caller provides their name but cannot provide their reference number, the agent must not confirm whether that name appears in the system. This protocol is essential to prevent social engineering and to protect the personal information of affected individuals.

1.3 Tone and Demeanor Guidelines

The manner in which agents interact with callers is critically important. Many callers will be anxious, confused, or frustrated upon learning that their personal information may have been compromised. Agents should approach every call with the following principles in mind:

• Empathy: Demonstrate genuine empathy and understanding for the caller's situation. Acknowledge the caller's concern and validate their feelings. Phrases such as "I understand your concern" and "I appreciate you taking the time to call about this" are appropriate and encouraged.

• Calm and Patient: Maintain a calm, even, and patient tone throughout every call, including calls with upset or agitated callers. Do not rush callers, and allow them time to ask questions and express their concerns.

• Professional: Maintain a professional demeanor at all times. Use courteous language and avoid colloquialisms, slang, or casual speech that may be perceived as dismissive or unprofessional.

• Personalized: Use the caller's name when appropriate during the conversation. This conveys respect and attentiveness.

• Neutral: Do not express personal opinions about the incident, Quorum, Palomar Data Solutions, or any other party involved in the incident. Agents are not spokespersons for Quorum and should not characterize the incident in terms that go beyond the approved language set forth in this Script.

• No Legal Commentary: Do not discuss litigation, regulatory proceedings, potential legal claims, or any other legal matters. Do not speculate about the caller's legal rights or remedies. If a caller asks a legal question, provide the approved response from the FAQ section of this Script and, if necessary, escalate the call.

• No Technical Details: Do not discuss details about the threat actor, attack methodology, or the specific vulnerability exploited in the incident (CVE-2023-0669). Do not reference the GoAnywhere MFT platform or any other specific technology. If a caller asks technical questions about the breach, provide the approved general response and escalate if the caller presses for additional information.

1.4 Call Documentation Requirements

Accurate and thorough call documentation is essential for both operational and legal purposes. Agents must log every inbound call in the Clearfield CRM system. Each call log entry must include the following information:

(a) Date and time of the call;

(b) Caller's full name;

(d) Nature of the caller's inquiry (e.g., general incident questions, credit monitoring enrollment, complaint, media inquiry, legal inquiry, etc.);

(e) Resolution provided (e.g., enrolled in credit monitoring, provided protective steps, escalated to Tier 2, escalated to Tier 3, etc.);

(f) Any escalation taken, including the tier to which the call was escalated and the reason for escalation; and

(g) Call duration.

In addition, agents must make a specific notation in the CRM system if any of the following occur during the call:

• The caller references media reports or news articles about the incident;

• The caller states that they have retained legal counsel or are represented by an attorney;

• The caller references or identifies a specific law firm;

• The caller mentions a regulatory agency, state attorney general's office, or any government entity;

• The caller states that they intend to file a lawsuit or have already filed a lawsuit; or

• The caller identifies themselves as a member of the media.

Any call that involves one or more of the above circumstances must be flagged for escalation in the CRM system and escalated in accordance with the escalation protocol set forth in Section 1.5 below.

1.5 Escalation Protocol

Clearfield's incident response call center operates on a three-tier escalation model. Agents should familiarize themselves with each tier and the circumstances that warrant escalation. Proper and timely escalation is critical to ensuring that sensitive inquiries are handled by personnel with the appropriate authority and expertise.

Tier 1 — Standard Agents

Tier 1 agents handle all standard inbound inquiries using the scripted responses and FAQ answers contained in this document. Tier 1 agents are authorized to provide incident summary information, describe the types of data involved (based on the caller's notification letter code), explain protective steps, and assist callers with enrollment in the complimentary credit monitoring and identity theft protection program. The vast majority of calls should be fully resolved at Tier 1.

Tier 2 — Supervisor Escalation

Calls must be escalated to a Tier 2 supervisor under any of the following circumstances:

• The caller requests to speak with a supervisor;

• The caller is upset, agitated, threatening, or abusive;

• The caller asks questions that are not covered by this Script or FAQ;

• The caller identifies themselves as a member of the media; or

• The Tier 1 agent is otherwise uncertain how to respond to the caller's inquiry.

When escalating to Tier 2, the agent should place the caller on a brief hold, contact the Tier 2 supervisor via the Clearfield internal supervisor line, provide a summary of the caller's inquiry and the reason for escalation, and transfer the call. Agents should avoid leaving callers on hold for extended periods and should check back with the caller periodically to advise them that their call is being transferred.

Tier 3 — Calderwood & Harkness Legal Escalation

Calls must be escalated immediately to Tier 3 (Calderwood & Harkness LLP) under any of the following circumstances:

• The caller identifies themselves as an attorney representing one or more affected individuals;

• The caller states that they are filing, intend to file, or have already filed a lawsuit against Quorum, Palomar, or any other party in connection with the incident;

• The caller identifies themselves as a government official, regulator, representative of a state attorney general's office, or representative of any other government agency; or

• The caller requests specific information about the forensic investigation, the vendor relationship, the contractual terms between Quorum and Palomar, or indemnification arrangements.

Tier 3 escalations should be routed through the Tier 2 supervisor, who will contact the designated Tier 3 point of contact:

Alan Burke, Lead Associate Calderwood & Harkness LLP Privacy & Data Security Practice Group

Dedicated incident response phone line and email address to be provided separately to Clearfield supervisors by Calderwood & Harkness LLP prior to the August 18, 2023 call center launch date.

Media Inquiries. If a caller identifies themselves as a reporter, journalist, or member of the media, the agent must not provide any comment, statement, or information whatsoever. The agent should politely advise the caller that media inquiries are handled by a separate communications team and immediately transfer the call to a Tier 2 supervisor. The Tier 2 supervisor will route the call to:

BrightPath Consulting Group Inc. Meredith Ashford, Managing Director Designated media response line to be provided separately to Clearfield supervisors.

Under no circumstances should any agent or supervisor provide any statement, comment, or response to media inquiries.

Section 2: Inbound Call Script — Standard Call Flow

This section provides the standard call flow script that agents should follow for each inbound call. The script is organized sequentially, beginning with the greeting and ending with the call closing. Agents should follow this flow naturally, adapting as needed based on the caller's specific questions and concerns, while always staying within the bounds of the approved language.

2.1 Greeting

Upon answering an inbound call, agents should use the following greeting:

"Thank you for calling the Quorum Insurance Holdings data security incident response line. My name is [Agent Name]. How may I assist you today?"

Allow the caller to state the purpose of their call. In the vast majority of cases, the caller will indicate that they received a notification letter in the mail and have questions about the incident or the credit monitoring services being offered.

If the caller indicates that they are calling about the notification letter, proceed to the caller verification protocol described in Section 1.2 before providing any account-specific information. The agent may say:

"I'd be happy to help you with that. For security purposes, I'll need to verify your identity before we get started. Could you please provide me with your full name as it appears on the letter you received?"

After collecting the caller's full name, proceed to request the unique PIN/reference number and the last four digits of the caller's Social Security number or date of birth. Once all three elements have been verified, proceed to address the caller's questions.

2.2 Incident Summary Statement (Approved Language)

When a caller asks "What happened?" or otherwise requests information about the data security incident, agents should use the following approved incident summary language:

"Quorum Insurance Holdings Corp. recently learned that one of its third-party service providers experienced a data security incident that may have involved some of your personal information. The incident involved unauthorized access to certain systems maintained by the service provider. Quorum is notifying you as a precaution and is offering complimentary credit monitoring and identity theft protection services."

If the caller asks for additional details, agents may provide the following supplemental information, using the approved language below:

• The incident involved a third-party vendor's systems, not Quorum's own internal systems.

• The unauthorized access occurred between approximately mid-March and mid-April 2023.

• Quorum was notified by the vendor and promptly launched an investigation with the assistance of leading cybersecurity experts.

• Applicable law enforcement authorities and regulators have been notified.

Critical Reminders:

• Do NOT name Palomar Data Solutions, Inc. to callers. Refer only to "a third-party service provider" or "a vendor that provides claims processing services."

• Do NOT discuss the specific vulnerability (CVE-2023-0669), the GoAnywhere MFT file transfer appliance, or any technical details of the attack vector or methodology.

• Do NOT identify the forensic investigation firm (Graystone Forensics LLC) by name.

• Do NOT speculate about the identity or motives of the threat actor.

2.3 Types of Information Involved

When a caller asks what types of personal information may have been involved in the incident, agents must refer to the caller's notification letter code and the Clearfield lookup system to determine which category of affected data applies to that individual. Three categories exist, and the appropriate response depends on the code associated with the caller's record.

General PII Callers (Majority of Affected Individuals)

For callers whose notification letter code indicates "PII" — representing the majority of the approximately 318,247 affected individuals — agents should use the following language:

"Based on our investigation, the information that may have been involved includes your name, date of birth, Social Security number, and/or driver's license number."

Financial Data Subset Callers (84,619 Individuals)

For callers whose notification letter code indicates "FIN" — representing approximately 84,619 individuals whose financial account information may also have been involved — agents should use the following language:

"In addition to the information I just described, our investigation indicates that your bank account number and/or payment card information may also have been involved."

PHI Subset Callers (41,203 Individuals)

For callers whose notification letter code indicates "PHI" — representing approximately 41,203 individuals whose protected health information may also have been involved — agents should use the following language:

"In addition to personal identifying information, our investigation indicates that certain health-related information associated with an insurance claim may also have been involved. This could include information such as health conditions, diagnosis codes, or treatment information related to a workers' compensation or health-related claim."

Agents must consult the lookup system for each verified caller to determine the specific data types that may have been affected. Do not guess or assume which category applies. If the lookup system does not return a clear result, escalate to a Tier 2 supervisor.

2.4 Steps Quorum Is Taking

When a caller asks what Quorum is doing in response to the incident, agents should use the following approved language:

"Quorum takes the security of your information very seriously. Upon learning of this incident, Quorum took immediate steps to investigate and respond. This included:

— Engaging a leading cybersecurity forensics firm to conduct a thorough investigation; — Notifying applicable law enforcement and regulatory authorities; — Working with the service provider to address the cause of the incident and enhance security measures; and — Notifying individuals whose information may have been involved.

As an added precaution, Quorum is offering you 24 months of complimentary credit monitoring and identity theft protection services at no cost to you."

This language should be delivered in a reassuring and confident tone that conveys that Quorum has taken the situation seriously and has acted responsibly.

2.5 Credit Monitoring Enrollment Instructions

Quorum is offering all affected individuals 24 months of complimentary credit monitoring and identity theft protection services through the Clearfield Notification Services LLC identity protection program. Agents should encourage all callers to enroll in these services.

Enrollment Methods. There are two methods by which affected individuals may enroll:

(a) Online enrollment: Callers may enroll online by visiting the dedicated enrollment URL printed on their notification letter. To enroll online, the caller will need the unique activation code printed on their letter.

(b) Phone enrollment (preferred for callers who need assistance): Agents may assist callers with enrollment during the call by walking the caller through the enrollment process on-screen. To complete phone enrollment, the agent will need to collect the caller's name, mailing address, email address (if available), and the activation code from the caller's notification letter. Upon successful enrollment, the agent should confirm enrollment with the caller and provide a confirmation number.

Enrollment Deadline. Callers should be advised that the enrollment code printed on their notification letter has an activation deadline. The specific deadline varies by state and is printed on the caller's letter. In general, activation codes must be used within 90 days of the date of the notification letter. Agents should encourage callers to enroll as soon as possible to take full advantage of the complimentary services.

Services Included. The complimentary credit monitoring and identity theft protection services include the following:

• Three-bureau credit monitoring (Harborview Enterprises, Penrose Group, and Penmark Enterprises);

• Identity theft detection alerts;

• Dark web monitoring;

• Identity theft insurance up to applicable policy limits; and

• Access to a dedicated fraud resolution specialist.

Duration. The complimentary services are provided for a period of 24 months from the date of enrollment. At the conclusion of the 24-month period, enrollees will have the option to continue services at their own expense or discontinue the service.

Planning Note. For internal planning purposes, the estimated enrollment take-rate is approximately 40% of the 318,247 affected individuals, which corresponds to approximately 127,299 enrollees. Agents should encourage enrollment during each call, as the credit monitoring services provide a meaningful layer of protection for affected individuals.

2.6 Recommended Protective Steps

In addition to encouraging enrollment in the complimentary credit monitoring program, agents should advise all callers of the following recommended protective steps. This information should be provided to all callers regardless of the type of data that may have been involved.

Steps for All Callers

"In addition to enrolling in the complimentary credit monitoring, we recommend that you take the following steps to help protect your information:"

(a) "Review your account statements and credit reports regularly for any unauthorized activity."

(b) "Consider placing a fraud alert or credit freeze on your credit file by contacting each of the three national credit bureaus. I can provide you with their contact information:"

• Harborview Enterprises: 1-800-525-6285

• Penrose Group: 1-888-397-3742

• Penmark Enterprises: 1-800-680-7289

(c) "Obtain a free copy of your credit report from annualcreditreport.com. Under federal law, you are entitled to one free credit report from each of the three national credit bureaus every twelve months."

(d) "Be cautious of unsolicited communications asking for personal information. Quorum will never ask for your Social Security number, password, or financial account information by phone or email in connection with this incident."

(e) "If you believe you are the victim of identity theft, file a report with your local law enforcement and the Federal Trade Commission at identitytheft.gov or by calling 1-877-438-4338."

Additional Steps for Financial Data Subset Callers

For callers whose records indicate that financial account information may have been involved (code "FIN"), agents should provide the following additional recommendation:

"We also recommend that you closely monitor your bank account and payment card statements for unauthorized transactions. If you notice any suspicious activity, contact your financial institution immediately."

Additional Steps for PHI Subset Callers

For callers whose records indicate that protected health information may have been involved (code "PHI"), agents should provide the following additional recommendation:

"You may also wish to review any explanation of benefits statements you receive from your health insurer for any services you did not receive, and report any discrepancies to your insurer."

2.7 Closing the Call

After addressing all of the caller's questions and completing any enrollment assistance, agents should close the call using the following language:

"Is there anything else I can help you with today?"

If the caller has no further questions:

"Thank you for calling. If you have additional questions in the future, please don't hesitate to call us back at this number. We're available Monday through Friday from 8:00 AM to 8:00 PM Eastern Time, and Saturday from 9:00 AM to 5:00 PM Eastern Time. Have a good day."

Agents should ensure that all call documentation has been completed in the CRM system before moving to the next call.

Hours of Operation for the 12-Week Call Center Window:

Section 3: Frequently Asked Questions (FAQ) — Agent Reference

This section provides approved answers to frequently asked questions that callers may raise. Agents should use the responses provided below verbatim or in close paraphrase. If a caller's question is not addressed in this FAQ, the agent should escalate the call to a Tier 2 supervisor.

3.1 General Incident Questions

Q1: What happened?

A: Use the approved incident summary language from Section 2.2:

Q2: When did this happen?

"The unauthorized access to the service provider's systems occurred between approximately mid-March and mid-April 2023. The service provider discovered the unauthorized activity in mid-April 2023 and notified Quorum promptly. Quorum immediately began an investigation with the help of leading cybersecurity experts."

Q3: Who is the third-party vendor / service provider?

"I'm not able to share the specific name of the service provider at this time. The vendor provides claims processing services to Quorum."

If the caller presses for the identity of the vendor or expresses dissatisfaction with this response, acknowledge the caller's concern and escalate to a Tier 2 supervisor.

Q4: How did the breach happen?

"An unauthorized individual gained access to certain systems maintained by a third-party service provider. The investigation determined that the unauthorized individual exploited a vulnerability in the service provider's system. The vulnerability has since been addressed."

Do NOT mention CVE-2023-0669, GoAnywhere MFT, or any specific technical details. If the caller asks for technical details about the vulnerability or attack method, advise the caller that you are not able to provide additional technical details and offer to escalate the call to a Tier 2 supervisor if the caller has further concerns.

Q5: Was Quorum's own system breached?

"Based on the investigation conducted by independent cybersecurity experts, the unauthorized access occurred within systems maintained by the third-party service provider, not Quorum's own internal systems."

Q6: How many people were affected?

"Approximately 318,000 individuals across multiple states received notification letters."

Q7: Has the vulnerability been fixed?

"Yes. The service provider has addressed the vulnerability that was exploited and has implemented additional security measures to help prevent a similar incident in the future. Quorum is also working with the service provider to ensure enhanced security controls going forward."

Q8: Was law enforcement notified?

"Yes, applicable law enforcement authorities have been notified."

If the caller asks which law enforcement agencies were notified or requests additional details, advise the caller that you are not able to provide further details regarding the law enforcement engagement but confirm that appropriate authorities were notified.

Q9: Were regulators notified?

"Yes, Quorum has notified all applicable state and federal regulatory authorities as required by law."

Q10: Why did it take so long for me to be notified?

"After learning of the incident, Quorum engaged leading cybersecurity experts to conduct a thorough forensic investigation to understand the scope of the incident and identify the specific individuals whose information may have been affected. This investigation took time to complete, and Quorum sent notifications as quickly as possible after the investigation was completed. Quorum complied with all applicable notification timing requirements."

3.2 Personal Information Questions

Q11: What specific information of mine was involved?

A: Refer to the caller's notification letter code and the Clearfield lookup system to identify the specific data categories that may have been involved. Provide the appropriate response from Section 2.3 based on whether the caller falls into the PII, Financial, or PHI category. In addition:

"The specific types of information that may have been involved are described in your notification letter."

CALL CENTER SCRIPT & FREQUENTLY ASKED QUESTIONS
Quorum Insurance Holdings Corp. Data Security Incident
PRIVILEGED AND CONFIDENTIAL PREPARED AT THE DIRECTION OF COUNSEL ATTORNEY-CLIENT PRIVILEGED / ATTORNEY WORK PRODUCT
This document is privileged and confidential and has been prepared at the direction of counsel in connection with the provision of legal advice. This document is protected by the attorney-client privilege, the work product doctrine, and any other applicable protections. This document shall not be distributed beyond authorized Clearfield Notification Services LLC personnel without the prior written consent of Calderwood & Harkness LLP. Unauthorized disclosure, copying, or distribution of this document, in whole or in part, is strictly prohibited.
Prepared by:
Calderwood & Harkness LLP 1700 K Street NW, Suite 900 Washington, D.C. 20006
Prepared for:
Clearfield Notification Services LLC 4500 Rockside Road, Suite 210 Independence, OH 44131
Attn: Jerome Tillman, Account Manager
Date: August 14, 2023
Calderwood & Harkness Matter No.: 1025-00006
Authors: Alan Burke, Lead Associate, and Sara Hendricks, Working Associate, Privacy & Data Security Practice Group
Call Center Operations Window: August 18, 2023 through approximately November 10, 2023 (12-week window, commencing with first consumer notification mailing date)
NOTICE: This document is subject to attorney-client privilege and work product protection. It has been prepared at the direction of Calderwood & Harkness LLP in connection with the provision of legal advice to Quorum Insurance Holdings Corp. regarding the data security incident described herein. This document is provided to Clearfield Notification Services LLC solely for the purpose of enabling Clearfield personnel to respond to inbound consumer inquiries in connection with notification services. This document may not be disclosed, distributed, reproduced, or transmitted to any person or entity not authorized by Calderwood & Harkness LLP without prior written consent. Any unauthorized disclosure may result in a waiver of applicable privileges and protections, and Calderwood & Harkness LLP reserves all rights and remedies in connection therewith.
Right-click to update Table of Contents
Section 1: General Instructions for Call Center Agents
1.1 Purpose and Scope
This script and frequently asked questions guide (collectively, this "Script") is provided to Clearfield Notification Services LLC ("Clearfield") call center agents who are handling inbound telephone calls from individuals who have received a data breach notification letter from Quorum Insurance Holdings Corp. ("Quorum"). The purpose of this Script is to ensure that all agents provide consistent, accurate, and legally appropriate responses to callers, and that all communications with affected individuals are handled in a manner that is responsive to caller concerns while protecting the interests of Quorum and its counsel.
All calls received on the dedicated toll-free incident response line relate to a data security incident involving Quorum's third-party claims-processing vendor, Palomar Data Solutions, Inc. ("Palomar"). It is critical that agents understand that the incident originated in systems maintained by Palomar, not in Quorum's own internal systems. However, as described further in this Script, agents must not identify Palomar by name to callers. All references to Palomar during calls should be limited to "a third-party service provider" or "a vendor that provides claims processing services."
Agents must follow this Script and the approved responses contained herein at all times. Agents are not permitted to deviate from the scripted language, speculate about the incident or its causes, provide legal advice to callers, or offer personal opinions or commentary about Quorum, Palomar, or any other party. If a caller asks a question that is not addressed in this Script, the agent must escalate the call in accordance with the escalation protocol set forth in Section 1.5 below.
Approximately 318,247 notification letters are being mailed to affected individuals in rolling batches commencing August 18, 2023 and continuing through approximately September 15, 2023. The letters are being sent to individuals residing in 29 states and the District of Columbia. Call volume is expected to peak in the first three to four weeks following each mailing wave. Agents should be prepared for elevated call volumes during these periods and should manage their time accordingly while ensuring that each caller receives thorough, empathetic, and complete assistance.
1.2 Caller Verification Protocol
Before providing any account-specific information to a caller — including information about the types of personal data that may have been involved, the caller's enrollment status, or any activation codes — agents must verify the caller's identity using the following three-step verification process.
Verification requires the caller to provide each of the following:
(a) The caller's full name, as it appears on the notification letter the caller received;
(b) The unique PIN/reference number printed on the notification letter (this is a unique alphanumeric code assigned to each affected individual); and
(c) The last four digits of the caller's Social Security number or, alternatively, the caller's date of birth.
All three elements must be successfully verified against the information contained in the Clearfield lookup system before the agent may proceed with providing account-specific information or assisting with credit monitoring enrollment.
If a caller is unable to provide the required verification information, the agent should politely explain that verification is required for security purposes and is designed to protect the caller's personal information. In such cases, the agent should provide the caller with the following mailing address and advise the caller that they may write in for assistance:
Quorum Insurance Holdings Corp. c/o Clearfield Notification Services LLC P.O. Box 5100 Independence, OH 44131-5100
Important: Agents must not read back or confirm any specific personal information to the caller beyond what the caller has already provided. For example, if a caller provides their name but cannot provide their reference number, the agent must not confirm whether that name appears in the system. This protocol is essential to prevent social engineering and to protect the personal information of affected individuals.
1.3 Tone and Demeanor Guidelines
The manner in which agents interact with callers is critically important. Many callers will be anxious, confused, or frustrated upon learning that their personal information may have been compromised. Agents should approach every call with the following principles in mind:
•  Empathy: Demonstrate genuine empathy and understanding for the caller's situation. Acknowledge the caller's concern and validate their feelings. Phrases such as "I understand your concern" and "I appreciate you taking the time to call about this" are appropriate and encouraged.
•  Calm and Patient: Maintain a calm, even, and patient tone throughout every call, including calls with upset or agitated callers. Do not rush callers, and allow them time to ask questions and express their concerns.
•  Professional: Maintain a professional demeanor at all times. Use courteous language and avoid colloquialisms, slang, or casual speech that may be perceived as dismissive or unprofessional.
•  Personalized: Use the caller's name when appropriate during the conversation. This conveys respect and attentiveness.
•  Neutral: Do not express personal opinions about the incident, Quorum, Palomar Data Solutions, or any other party involved in the incident. Agents are not spokespersons for Quorum and should not characterize the incident in terms that go beyond the approved language set forth in this Script.
•  No Legal Commentary: Do not discuss litigation, regulatory proceedings, potential legal claims, or any other legal matters. Do not speculate about the caller's legal rights or remedies. If a caller asks a legal question, provide the approved response from the FAQ section of this Script and, if necessary, escalate the call.
•  No Technical Details: Do not discuss details about the threat actor, attack methodology, or the specific vulnerability exploited in the incident (CVE-2023-0669). Do not reference the GoAnywhere MFT platform or any other specific technology. If a caller asks technical questions about the breach, provide the approved general response and escalate if the caller presses for additional information.
1.4 Call Documentation Requirements
Accurate and thorough call documentation is essential for both operational and legal purposes. Agents must log every inbound call in the Clearfield CRM system. Each call log entry must include the following information:
(a) Date and time of the call;
(b) Caller's full name;
(c) Caller's unique reference number (if verified);
(d) Nature of the caller's inquiry (e.g., general incident questions, credit monitoring enrollment, complaint, media inquiry, legal inquiry, etc.);
(e) Resolution provided (e.g., enrolled in credit monitoring, provided protective steps, escalated to Tier 2, escalated to Tier 3, etc.);
(f) Any escalation taken, including the tier to which the call was escalated and the reason for escalation; and
(g) Call duration.
In addition, agents must make a specific notation in the CRM system if any of the following occur during the call:
•  The caller references media reports or news articles about the incident;
•  The caller states that they have retained legal counsel or are represented by an attorney;
•  The caller references or identifies a specific law firm;
•  The caller mentions a regulatory agency, state attorney general's office, or any government entity;
•  The caller states that they intend to file a lawsuit or have already filed a lawsuit; or
•  The caller identifies themselves as a member of the media.
Any call that involves one or more of the above circumstances must be flagged for escalation in the CRM system and escalated in accordance with the escalation protocol set forth in Section 1.5 below.
1.5 Escalation Protocol
Clearfield's incident response call center operates on a three-tier escalation model. Agents should familiarize themselves with each tier and the circumstances that warrant escalation. Proper and timely escalation is critical to ensuring that sensitive inquiries are handled by personnel with the appropriate authority and expertise.
Tier 1 — Standard Agents
Tier 1 agents handle all standard inbound inquiries using the scripted responses and FAQ answers contained in this document. Tier 1 agents are authorized to provide incident summary information, describe the types of data involved (based on the caller's notification letter code), explain protective steps, and assist callers with enrollment in the complimentary credit monitoring and identity theft protection program. The vast majority of calls should be fully resolved at Tier 1.
Tier 2 — Supervisor Escalation
Calls must be escalated to a Tier 2 supervisor under any of the following circumstances:
•  The caller requests to speak with a supervisor;
•  The caller is upset, agitated, threatening, or abusive;
•  The caller asks questions that are not covered by this Script or FAQ;
•  The caller identifies themselves as a member of the media; or
•  The Tier 1 agent is otherwise uncertain how to respond to the caller's inquiry.
When escalating to Tier 2, the agent should place the caller on a brief hold, contact the Tier 2 supervisor via the Clearfield internal supervisor line, provide a summary of the caller's inquiry and the reason for escalation, and transfer the call. Agents should avoid leaving callers on hold for extended periods and should check back with the caller periodically to advise them that their call is being transferred.
Tier 3 — Calderwood & Harkness Legal Escalation
Calls must be escalated immediately to Tier 3 (Calderwood & Harkness LLP) under any of the following circumstances:
•  The caller identifies themselves as an attorney representing one or more affected individuals;
•  The caller states that they are filing, intend to file, or have already filed a lawsuit against Quorum, Palomar, or any other party in connection with the incident;
•  The caller identifies themselves as a government official, regulator, representative of a state attorney general's office, or representative of any other government agency; or
•  The caller requests specific information about the forensic investigation, the vendor relationship, the contractual terms between Quorum and Palomar, or indemnification arrangements.
Tier 3 escalations should be routed through the Tier 2 supervisor, who will contact the designated Tier 3 point of contact:
Alan Burke, Lead Associate Calderwood & Harkness LLP Privacy & Data Security Practice Group
Dedicated incident response phone line and email address to be provided separately to Clearfield supervisors by Calderwood & Harkness LLP prior to the August 18, 2023 call center launch date.
Media Inquiries.  If a caller identifies themselves as a reporter, journalist, or member of the media, the agent must not provide any comment, statement, or information whatsoever. The agent should politely advise the caller that media inquiries are handled by a separate communications team and immediately transfer the call to a Tier 2 supervisor. The Tier 2 supervisor will route the call to:
BrightPath Consulting Group Inc. Meredith Ashford, Managing Director Designated media response line to be provided separately to Clearfield supervisors.
Under no circumstances should any agent or supervisor provide any statement, comment, or response to media inquiries.
Section 2: Inbound Call Script — Standard Call Flow
This section provides the standard call flow script that agents should follow for each inbound call. The script is organized sequentially, beginning with the greeting and ending with the call closing. Agents should follow this flow naturally, adapting as needed based on the caller's specific questions and concerns, while always staying within the bounds of the approved language.
2.1 Greeting
Upon answering an inbound call, agents should use the following greeting:
"Thank you for calling the Quorum Insurance Holdings data security incident response line. My name is [Agent Name]. How may I assist you today?"
Allow the caller to state the purpose of their call. In the vast majority of cases, the caller will indicate that they received a notification letter in the mail and have questions about the incident or the credit monitoring services being offered.
If the caller indicates that they are calling about the notification letter, proceed to the caller verification protocol described in Section 1.2 before providing any account-specific information. The agent may say:
"I'd be happy to help you with that. For security purposes, I'll need to verify your identity before we get started. Could you please provide me with your full name as it appears on the letter you received?"
After collecting the caller's full name, proceed to request the unique PIN/reference number and the last four digits of the caller's Social Security number or date of birth. Once all three elements have been verified, proceed to address the caller's questions.
2.2 Incident Summary Statement (Approved Language)
When a caller asks "What happened?" or otherwise requests information about the data security incident, agents should use the following approved incident summary language:
"Quorum Insurance Holdings Corp. recently learned that one of its third-party service providers experienced a data security incident that may have involved some of your personal information. The incident involved unauthorized access to certain systems maintained by the service provider. Quorum is notifying you as a precaution and is offering complimentary credit monitoring and identity theft protection services."
If the caller asks for additional details, agents may provide the following supplemental information, using the approved language below:
•  The incident involved a third-party vendor's systems, not Quorum's own internal systems.
•  The unauthorized access occurred between approximately mid-March and mid-April 2023.
•  Quorum was notified by the vendor and promptly launched an investigation with the assistance of leading cybersecurity experts.
•  Applicable law enforcement authorities and regulators have been notified.
Critical Reminders:
•  Do NOT name Palomar Data Solutions, Inc. to callers. Refer only to "a third-party service provider" or "a vendor that provides claims processing services."
•  Do NOT discuss the specific vulnerability (CVE-2023-0669), the GoAnywhere MFT file transfer appliance, or any technical details of the attack vector or methodology.
•  Do NOT identify the forensic investigation firm (Graystone Forensics LLC) by name.
•  Do NOT speculate about the identity or motives of the threat actor.
2.3 Types of Information Involved
When a caller asks what types of personal information may have been involved in the incident, agents must refer to the caller's notification letter code and the Clearfield lookup system to determine which category of affected data applies to that individual. Three categories exist, and the appropriate response depends on the code associated with the caller's record.
General PII Callers (Majority of Affected Individuals)
For callers whose notification letter code indicates "PII" — representing the majority of the approximately 318,247 affected individuals — agents should use the following language:
"Based on our investigation, the information that may have been involved includes your name, date of birth, Social Security number, and/or driver's license number."
Financial Data Subset Callers (84,619 Individuals)
For callers whose notification letter code indicates "FIN" — representing approximately 84,619 individuals whose financial account information may also have been involved — agents should use the following language:
"In addition to the information I just described, our investigation indicates that your bank account number and/or payment card information may also have been involved."
PHI Subset Callers (41,203 Individuals)
For callers whose notification letter code indicates "PHI" — representing approximately 41,203 individuals whose protected health information may also have been involved — agents should use the following language:
"In addition to personal identifying information, our investigation indicates that certain health-related information associated with an insurance claim may also have been involved. This could include information such as health conditions, diagnosis codes, or treatment information related to a workers' compensation or health-related claim."
Agents must consult the lookup system for each verified caller to determine the specific data types that may have been affected. Do not guess or assume which category applies. If the lookup system does not return a clear result, escalate to a Tier 2 supervisor.
2.4 Steps Quorum Is Taking
When a caller asks what Quorum is doing in response to the incident, agents should use the following approved language:
"Quorum takes the security of your information very seriously. Upon learning of this incident, Quorum took immediate steps to investigate and respond. This included:
— Engaging a leading cybersecurity forensics firm to conduct a thorough investigation; — Notifying applicable law enforcement and regulatory authorities; — Working with the service provider to address the cause of the incident and enhance security measures; and — Notifying individuals whose information may have been involved.
As an added precaution, Quorum is offering you 24 months of complimentary credit monitoring and identity theft protection services at no cost to you."
This language should be delivered in a reassuring and confident tone that conveys that Quorum has taken the situation seriously and has acted responsibly.
2.5 Credit Monitoring Enrollment Instructions
Quorum is offering all affected individuals 24 months of complimentary credit monitoring and identity theft protection services through the Clearfield Notification Services LLC identity protection program. Agents should encourage all callers to enroll in these services.
Enrollment Methods.  There are two methods by which affected individuals may enroll:
(a) Online enrollment: Callers may enroll online by visiting the dedicated enrollment URL printed on their notification letter. To enroll online, the caller will need the unique activation code printed on their letter.
(b) Phone enrollment (preferred for callers who need assistance): Agents may assist callers with enrollment during the call by walking the caller through the enrollment process on-screen. To complete phone enrollment, the agent will need to collect the caller's name, mailing address, email address (if available), and the activation code from the caller's notification letter. Upon successful enrollment, the agent should confirm enrollment with the caller and provide a confirmation number.
Enrollment Deadline.  Callers should be advised that the enrollment code printed on their notification letter has an activation deadline. The specific deadline varies by state and is printed on the caller's letter. In general, activation codes must be used within 90 days of the date of the notification letter. Agents should encourage callers to enroll as soon as possible to take full advantage of the complimentary services.
Services Included.  The complimentary credit monitoring and identity theft protection services include the following:
•  Three-bureau credit monitoring (Harborview Enterprises, Penrose Group, and Penmark Enterprises);
•  Identity theft detection alerts;
•  Dark web monitoring;
•  Identity theft insurance up to applicable policy limits; and
•  Access to a dedicated fraud resolution specialist.
Duration.  The complimentary services are provided for a period of 24 months from the date of enrollment. At the conclusion of the 24-month period, enrollees will have the option to continue services at their own expense or discontinue the service.
Planning Note.  For internal planning purposes, the estimated enrollment take-rate is approximately 40% of the 318,247 affected individuals, which corresponds to approximately 127,299 enrollees. Agents should encourage enrollment during each call, as the credit monitoring services provide a meaningful layer of protection for affected individuals.
2.6 Recommended Protective Steps
In addition to encouraging enrollment in the complimentary credit monitoring program, agents should advise all callers of the following recommended protective steps. This information should be provided to all callers regardless of the type of data that may have been involved.
Steps for All Callers
"In addition to enrolling in the complimentary credit monitoring, we recommend that you take the following steps to help protect your information:"
(a) "Review your account statements and credit reports regularly for any unauthorized activity."
(b) "Consider placing a fraud alert or credit freeze on your credit file by contacting each of the three national credit bureaus. I can provide you with their contact information:"
•  Harborview Enterprises: 1-800-525-6285
•  Penrose Group: 1-888-397-3742
•  Penmark Enterprises: 1-800-680-7289
(c) "Obtain a free copy of your credit report from annualcreditreport.com. Under federal law, you are entitled to one free credit report from each of the three national credit bureaus every twelve months."
(d) "Be cautious of unsolicited communications asking for personal information. Quorum will never ask for your Social Security number, password, or financial account information by phone or email in connection with this incident."
(e) "If you believe you are the victim of identity theft, file a report with your local law enforcement and the Federal Trade Commission at identitytheft.gov or by calling 1-877-438-4338."
Additional Steps for Financial Data Subset Callers
For callers whose records indicate that financial account information may have been involved (code "FIN"), agents should provide the following additional recommendation:
"We also recommend that you closely monitor your bank account and payment card statements for unauthorized transactions. If you notice any suspicious activity, contact your financial institution immediately."
Additional Steps for PHI Subset Callers
For callers whose records indicate that protected health information may have been involved (code "PHI"), agents should provide the following additional recommendation:
"You may also wish to review any explanation of benefits statements you receive from your health insurer for any services you did not receive, and report any discrepancies to your insurer."
2.7 Closing the Call
After addressing all of the caller's questions and completing any enrollment assistance, agents should close the call using the following language:
"Is there anything else I can help you with today?"
If the caller has no further questions:
"Thank you for calling. If you have additional questions in the future, please don't hesitate to call us back at this number. We're available Monday through Friday from 8:00 AM to 8:00 PM Eastern Time, and Saturday from 9:00 AM to 5:00 PM Eastern Time. Have a good day."
Agents should ensure that all call documentation has been completed in the CRM system before moving to the next call.
Hours of Operation for the 12-Week Call Center Window:
Section 3: Frequently Asked Questions (FAQ) — Agent Reference
This section provides approved answers to frequently asked questions that callers may raise. Agents should use the responses provided below verbatim or in close paraphrase. If a caller's question is not addressed in this FAQ, the agent should escalate the call to a Tier 2 supervisor.
3.1 General Incident Questions
Q1: What happened?
A: Use the approved incident summary language from Section 2.2:
"Quorum Insurance Holdings Corp. recently learned that one of its third-party service providers experienced a data security incident that may have involved some of your personal information. The incident involved unauthorized access to certain systems maintained by the service provider. Quorum is notifying you as a precaution and is offering complimentary credit monitoring and identity theft protection services."
Q2: When did this happen?
A:
"The unauthorized access to the service provider's systems occurred between approximately mid-March and mid-April 2023. The service provider discovered the unauthorized activity in mid-April 2023 and notified Quorum promptly. Quorum immediately began an investigation with the help of leading cybersecurity experts."
Q3: Who is the third-party vendor / service provider?
A:
"I'm not able to share the specific name of the service provider at this time. The vendor provides claims processing services to Quorum."
If the caller presses for the identity of the vendor or expresses dissatisfaction with this response, acknowledge the caller's concern and escalate to a Tier 2 supervisor.
Q4: How did the breach happen?
A:
"An unauthorized individual gained access to certain systems maintained by a third-party service provider. The investigation determined that the unauthorized individual exploited a vulnerability in the service provider's system. The vulnerability has since been addressed."
Do NOT mention CVE-2023-0669, GoAnywhere MFT, or any specific technical details. If the caller asks for technical details about the vulnerability or attack method, advise the caller that you are not able to provide additional technical details and offer to escalate the call to a Tier 2 supervisor if the caller has further concerns.
Q5: Was Quorum's own system breached?
A:
"Based on the investigation conducted by independent cybersecurity experts, the unauthorized access occurred within systems maintained by the third-party service provider, not Quorum's own internal systems."
Q6: How many people were affected?
A:
"Approximately 318,000 individuals across multiple states received notification letters."
Q7: Has the vulnerability been fixed?
A:
"Yes. The service provider has addressed the vulnerability that was exploited and has implemented additional security measures to help prevent a similar incident in the future. Quorum is also working with the service provider to ensure enhanced security controls going forward."
Q8: Was law enforcement notified?
A:
"Yes, applicable law enforcement authorities have been notified."
If the caller asks which law enforcement agencies were notified or requests additional details, advise the caller that you are not able to provide further details regarding the law enforcement engagement but confirm that appropriate authorities were notified.
Q9: Were regulators notified?
A:
"Yes, Quorum has notified all applicable state and federal regulatory authorities as required by law."
Q10: Why did it take so long for me to be notified?
A:
"After learning of the incident, Quorum engaged leading cybersecurity experts to conduct a thorough forensic investigation to understand the scope of the incident and identify the specific individuals whose information may have been affected. This investigation took time to complete, and Quorum sent notifications as quickly as possible after the investigation was completed. Quorum complied with all applicable notification timing requirements."
3.2 Personal Information Questions
Q11: What specific information of mine was involved?
A: Refer to the caller's notification letter code and the Clearfield lookup system to identify the specific data categories that may have been involved. Provide the appropriate response from Section 2.3 based on whether the caller falls into the PII, Financial, or PHI category. In addition:
"The specific types of information that may have been involved are described in your notification letter."
Q12: Is my Social Security number compromised?
A:
"Based on the investigation, Social Security numbers were among the types of information that may have been accessed. We strongly recommend that you enroll in the complimentary credit monitoring and identity theft protection services and consider placing a fraud alert or credit freeze on your credit file."
Q13: Has my information been misused?
A:
"At this time, Quorum is not aware of any confirmed misuse of your personal information resulting from this incident. However, we recommend that you remain vigilant and take the protective steps outlined in your notification letter and that I described earlier."
Q14: I am a policyholder / claimant with Quorum. Will this affect my policy or claim?
A:
"This incident does not affect the terms, coverage, or status of your insurance policy or any pending claim with Quorum."
If the caller has questions about their insurance policy or a pending claim, advise the caller: "For questions about your insurance policy or an active claim, please contact Quorum directly using the contact information on your policy documents." Do not provide Quorum's general customer service number in connection with this call line.
3.3 Credit Monitoring and Identity Protection Questions
Q15: What credit monitoring services are being offered?
A:
"Quorum is offering 24 months of complimentary credit monitoring and identity theft protection services. These services include three-bureau credit monitoring, identity theft detection alerts, dark web monitoring, identity theft insurance up to applicable policy limits, and access to a dedicated fraud resolution specialist."
Q16: How do I enroll?
A: Use the enrollment instructions from Section 2.5. Advise the caller that they may enroll online using the dedicated URL and activation code printed on their notification letter, or that you can assist them with enrollment over the phone during the call. If assisting with phone enrollment, walk the caller through the enrollment process on-screen, collect the necessary information, and provide a confirmation number upon successful enrollment.
Q17: Is there a cost to me?
A:
"No. The credit monitoring and identity theft protection services are being offered at no cost to you for a period of 24 months."
Q18: I lost my notification letter / I don't have my activation code.
A:
"I can verify your identity and look up your activation code in our system."
Follow the verification protocol set forth in Section 1.2. Once the caller's identity has been successfully verified, use the Clearfield lookup system to retrieve the caller's activation code and provide it to the verified caller. If the caller cannot be verified through the standard protocol, advise the caller to submit a written request to the mailing address provided in Section 1.2.
Q19: Can I enroll family members who are also affected?
A:
"Each affected individual will receive their own notification letter with a unique enrollment code. If a family member has received a notification letter, they should use the code on their own letter to enroll. If a family member believes they may be affected but has not received a letter, they should call this number and we can check our records."
Q20: What if I already have credit monitoring?
A:
"Even if you already have credit monitoring through another provider, you are welcome to enroll in this complimentary service as an additional layer of protection. There is no conflict in having multiple credit monitoring services."
Q21: What happens after the 24-month period?
A:
"At the end of the 24-month complimentary period, you will have the option to continue the services at your own expense if you choose, or you may discontinue the service."
3.4 Fraud Alert and Credit Freeze Questions
Q22: How do I place a fraud alert?
A:
"You can place a fraud alert by contacting any one of the three national credit bureaus. The bureau you contact is required to notify the other two. Here are the contact numbers:
— Harborview Enterprises: 1-800-525-6285 — Penrose Group: 1-888-397-3742 — Penmark Enterprises: 1-800-680-7289
An initial fraud alert lasts for one year and is free."
Q23: How do I place a credit freeze?
A:
"A credit freeze restricts access to your credit report. You will need to contact each of the three credit bureaus separately to place a freeze. A credit freeze is free. Here are the contact numbers:
— Harborview Enterprises: 1-800-525-6285 — Penrose Group: 1-888-397-3742 — Penmark Enterprises: 1-800-680-7289
You will receive a PIN or password from each bureau that you will need to lift the freeze when you want to apply for credit."
Q24: What is the difference between a fraud alert and a credit freeze?
A:
"A fraud alert notifies creditors to take additional steps to verify your identity before extending credit. A credit freeze prevents creditors from accessing your credit report entirely, which makes it more difficult for someone to open new accounts in your name. A freeze provides a higher level of protection but requires you to lift it temporarily when you want to apply for credit."
3.5 Complaint, Legal, and Regulatory Questions
Q25: I want to file a complaint.
A:
"I'm sorry you feel that way. I can document your concern and have a supervisor contact you. Would you like me to do that?"
Document the caller's complaint in the CRM system and escalate to a Tier 2 supervisor. Note the specific nature of the caller's complaint in the escalation notes.
Q26: I want to speak with someone at Quorum directly.
A:
"This call center has been set up specifically to handle questions about this incident. I would be happy to assist you. If you have a concern that I cannot address, I can escalate your call to a supervisor."
If the caller insists on speaking with someone at Quorum, escalate to a Tier 2 supervisor. Do not provide the caller with Quorum's general customer service number or any direct contact information for Quorum personnel.
Q27: I have an attorney / I am represented by counsel.
A:
"Thank you for letting me know. I am going to note that on your account and transfer you to a supervisor who can assist you further."
Immediately escalate to a Tier 2 supervisor, who should then escalate to Tier 3 — Calderwood & Harkness LLP, Alan Burke. Document this in the CRM system, including the name of the attorney or law firm if provided by the caller.
Q28: I intend to file a lawsuit / I have already filed a lawsuit.
A:
"I understand. I need to transfer you to someone who can assist you with that."
Immediately escalate to Tier 3 — Calderwood & Harkness LLP, Alan Burke. Document this in the CRM system, including any details provided by the caller regarding the lawsuit or intended filing.
Q29: I am a reporter / member of the media.
A:
"Thank you for contacting us. Media inquiries are handled separately. Let me transfer you to the appropriate contact."
Do not provide any comment, statement, or information to the caller. Immediately escalate to a Tier 2 supervisor, who will route the call to BrightPath Consulting Group Inc. (Meredith Ashford, Managing Director) via the designated media response line.
Q30: I am from the attorney general's office / a government agency.
A:
"Thank you. Let me immediately connect you with the appropriate person."
Immediately escalate to Tier 3 — Calderwood & Harkness LLP, Alan Burke. Document this in the CRM system, including the name, title, and agency of the caller if provided.
Q31: Can I sue Quorum for this?
A:
"I'm not able to provide legal advice. If you have legal questions, we recommend that you consult with an attorney of your choosing."
Q32: Am I entitled to compensation or damages?
A:
"I'm not able to address that question. I can tell you that Quorum is offering 24 months of complimentary credit monitoring and identity theft protection services. If you have further questions about your legal rights, we recommend consulting with an attorney."
3.6 State-Specific Questions
Q33: I live in [State]. Does my state have specific rights?
A:
"Your notification letter was prepared in compliance with the laws of your state of residence. If you have specific questions about your rights under your state's laws, we recommend consulting the website of your state attorney general's office or consulting with an attorney."
Agent Note: Do not attempt to interpret or explain state-specific data breach notification laws or consumer protection statutes. If the caller presses on state-specific legal requirements or asserts that their state requires something different from what is described in the notification letter, acknowledge the caller's concern and escalate to a Tier 2 supervisor.
Q34: I live in California. Do I have additional rights under the CCPA?
A:
"Your notification letter was prepared in compliance with California law, including applicable California privacy laws. Quorum takes its obligations under California law seriously. For specific legal questions, we recommend consulting with an attorney or visiting the California Attorney General's website."
Do not attempt to describe, interpret, or explain the California Consumer Privacy Act (CCPA), the California Privacy Rights Act (CPRA), or any other specific California statute.
3.7 PHI-Specific Questions
The following questions apply only to the 41,203 individuals whose notification letter code indicates "PHI." Agents should only provide PHI-specific responses to callers who have been verified and whose records indicate PHI involvement.
Q35: What health information was involved?
A:
"Based on the investigation, certain health-related information associated with an insurance claim you may have had with Quorum may have been accessed. This could include information such as health conditions, diagnosis codes, or treatment information related to a workers' compensation or health-related claim. The specific types of information are described in your notification letter."
Q36: Can I file a complaint with HHS?
A:
"Yes. If you believe your health information privacy rights have been violated, you have the right to file a complaint with the U.S. Department of Health and Human Services, Office for Civil Rights. You can file a complaint online at hhs.gov/ocr/complaints, or by calling 1-800-368-1019."
Q37: Is Quorum a HIPAA covered entity?
A:
"Quorum maintains health-related information in connection with certain insurance products and takes its obligations regarding that information seriously. If you have specific questions about HIPAA, we recommend consulting with an attorney or the HHS Office for Civil Rights."
Do not make any representations regarding Quorum's HIPAA status, whether Quorum is a "covered entity" or "business associate" under HIPAA, or Quorum's specific HIPAA compliance obligations. If the caller presses on this issue, escalate to a Tier 2 supervisor.
3.8 Financial Data-Specific Questions
The following questions apply only to the 84,619 individuals whose notification letter code indicates "FIN." Agents should only provide financial data-specific responses to callers who have been verified and whose records indicate financial data involvement.
Q38: Were my bank account or credit card numbers exposed?
A:
"Based on the investigation, financial account information such as bank account numbers and/or payment card numbers may have been among the types of information accessed. We strongly recommend that you closely monitor your financial account statements and contact your financial institution if you notice any suspicious activity."
Q39: Should I close my bank account or get a new credit card?
A:
"That is a personal decision we recommend discussing with your financial institution. Your bank or credit card company can advise you on the best steps to protect your accounts."
Q40: Will Quorum reimburse me if there is unauthorized activity on my account?
A:
"I'm not able to make any commitments regarding reimbursement. If you experience unauthorized activity, please contact your financial institution immediately, as many financial institutions have fraud protection policies. You may also file a report with your local law enforcement."
Do not make any promises, commitments, or representations regarding reimbursement, indemnification, or compensation. If the caller presses on this issue or becomes agitated, acknowledge the caller's concern and escalate to a Tier 2 supervisor if appropriate.
Section 4: Quick Reference Card for Agents
This section is designed as a quick-reference summary for agents to keep readily accessible during calls. It consolidates key facts, escalation contacts, and the "Do Not Discuss" list in an at-a-glance format.
4.1 Key Facts at a Glance
4.2 Escalation Contact Matrix
4.3 Do Not Discuss List
The following topics are strictly off-limits and must not be discussed with any caller under any circumstances. If a caller raises any of these topics, provide the appropriate approved response from the FAQ section if one exists, or escalate the call.
1.  Name of the third-party vendor — Do not identify Palomar Data Solutions, Inc. by name. Refer only to "a third-party service provider" or "a vendor that provides claims processing services."
2.  Technical details of the attack — Do not reference CVE-2023-0669, the GoAnywhere MFT file transfer appliance, or any specific vulnerability, exploit, or attack methodology.
3.  Details of the forensic investigation or the investigating firm — Do not identify Graystone Forensics LLC by name or discuss the scope, methodology, findings, or timeline of the forensic investigation beyond the approved language.
4.  Identity or details about the threat actor — Do not speculate about or identify the threat actor, any ransomware group, or any individual or entity responsible for the unauthorized access.
5.  Details of any regulatory inquiry, multistate attorney general investigation, or insurance claim — Do not confirm or deny any regulatory investigation, AG inquiry, or insurance-related proceeding.
6.  Any pending or potential litigation — Do not discuss any lawsuit, class action, demand letter, or legal proceeding, whether pending, threatened, or anticipated.
7.  Details of the vendor contractual relationship or indemnification — Do not discuss the terms of the agreement between Quorum and Palomar, including any data processing agreement, service level agreement, indemnification clause, or insurance requirements.
8.  Quorum's internal security architecture or systems — Do not discuss Quorum's own IT infrastructure, security controls, data storage practices, or internal systems.
9.  Financial costs of the incident response — Do not discuss the cost of the notification, credit monitoring, forensic investigation, legal representation, or any other aspect of Quorum's incident response.
10.  Number of individuals who have or have not enrolled in credit monitoring — Do not provide enrollment statistics, take-rates, or any aggregate data about enrollment.
11.  Any information about other affected individuals — Do not disclose any information about other callers, other affected individuals, or any personally identifiable information belonging to anyone other than the verified caller.
Section 5: Script Updates and Version Control
Version History
Approvals
This version of the Call Center Script and FAQ has been reviewed and approved by the following individuals:
•  Prepared by: Alan Burke, Lead Associate, and Sara Hendricks, Working Associate, Privacy & Data Security Practice Group, Calderwood & Harkness LLP
•  Approved by: Kevin Ostrowski, Responsible Partner, Calderwood & Harkness LLP
•  Reviewed by: Jennifer Liang, Chief Privacy Officer, Quorum Insurance Holdings Corp.
Distribution
This document has been prepared for distribution to Clearfield Notification Services LLC call center agents and supervisors. Jerome Tillman, Account Manager at Clearfield, is responsible for managing the internal distribution of this document within Clearfield's authorized personnel. This document may not be further distributed, shared, copied, or transmitted to any person or entity outside of authorized Clearfield personnel without the prior written consent of Calderwood & Harkness LLP.
Update Protocol
Any updates, revisions, amendments, or supplements to this Script or FAQ must be approved in writing by Calderwood & Harkness LLP before implementation. Under no circumstances may Clearfield agents, supervisors, or management modify, supplement, or deviate from the approved language in this document without prior written authorization from Calderwood & Harkness.
When updates are approved and issued, agents will be notified of the updates through the Clearfield supervisory chain. Updated versions will be distributed with a revised version number and date, and all prior versions should be retired and removed from agent workstations.
If agents encounter questions or situations that are not addressed in this document, the question or situation should be escalated to a Tier 2 supervisor. Tier 2 supervisors should consult Calderwood & Harkness LLP before providing any response that is not contained in this Script. In no case should a supervisor or agent improvise or create a new response without prior legal approval.
Training Requirements
All Clearfield call center agents assigned to the Quorum Insurance Holdings Corp. data security incident response line must complete training on this Script prior to the August 18, 2023 mailing start date. Training must cover all sections of this document, including the call flow script, FAQ responses, verification protocol, escalation protocol, tone and demeanor guidelines, call documentation requirements, and the "Do Not Discuss" list.
Training records, including the date of training, the name of each trained agent, and confirmation of completion, must be maintained by Clearfield Notification Services LLC. Calderwood & Harkness LLP may request copies of training records at any time.
Agents who are added to the call center team after the initial training date must complete training before handling any inbound calls.
— END OF DOCUMENT —
PRIVILEGED AND CONFIDENTIAL — PREPARED AT THE DIRECTION OF COUNSEL Calderwood & Harkness LLP | Matter No. 1025-00006 Call Center Script & FAQ — Quorum Insurance Holdings Corp. Data Security Incident Version 1.0 — August 14, 2023
Day | Hours (Eastern Time)
Monday | 8:00 AM – 8:00 PM
Tuesday | 8:00 AM – 8:00 PM
Wednesday | 8:00 AM – 8:00 PM
Thursday | 8:00 AM – 8:00 PM
Friday | 8:00 AM – 8:00 PM
Saturday | 9:00 AM – 5:00 PM
Sunday | Closed
Item | Detail
Company Name | Quorum Insurance Holdings Corp.
Incident Type | Data security incident involving a third-party service provider
Approx. Number of Affected Individuals | 318,247
Approx. Period of Unauthorized Access | Mid-March to mid-April 2023
Types of Information (General PII) | Names, dates of birth, Social Security numbers, driver's license numbers
Types of Information (Financial Subset) | Bank account numbers and/or payment card numbers (in addition to General PII)
Types of Information (PHI Subset) | Health conditions, diagnosis codes, treatment information related to insurance claims (in addition to General PII)
Financial Subset Population | Approximately 84,619 individuals
PHI Subset Population | Approximately 41,203 individuals
Credit Monitoring Offered | 24 months, complimentary
Credit Monitoring Services | Three-bureau monitoring, dark web monitoring, identity theft detection alerts, identity theft insurance, dedicated fraud resolution specialist
States Affected | 29 states and the District of Columbia
Notification Mailing Window | August 18 – approximately September 15, 2023
Call Center Hours (Mon–Fri) | 8:00 AM – 8:00 PM Eastern Time
Call Center Hours (Saturday) | 9:00 AM – 5:00 PM Eastern Time
Call Center Hours (Sunday) | Closed
Call Center Operations Window | August 18, 2023 – approximately November 10, 2023 (12 weeks)
Escalation Tier | Contact | When to Escalate
Tier 2 (Supervisor) | Clearfield internal supervisor line — to be provided by Jerome Tillman | Caller requests supervisor; caller is upset or threatening; question not covered by script; caller is media
Tier 3 (Legal — Calderwood & Harkness LLP) | Alan Burke, Lead Associate — dedicated incident response phone line and email to be provided separately | Caller is attorney for affected individuals; caller is filing/has filed lawsuit; caller is government official/regulator/AG; caller requests forensic investigation or vendor relationship details
Media Inquiries | BrightPath Consulting Group Inc., Meredith Ashford, Managing Director — dedicated media response line to be provided separately | Any caller identifying as media/reporter/journalist
Insurance Claim Questions from Callers | Direct caller to Quorum using contact information on their policy documents | "For questions about your insurance policy or an active claim, please contact Quorum directly using the contact information on your policy documents." Do not provide Quorum's general customer service number in connection with this call line.
Version | Date | Authors | Status
1.0 | August 14, 2023 | Alan Burke, Sara Hendricks | Current / Active

CALL CENTER SCRIPT & FREQUENTLY ASKED QUESTIONS

Record

Parties

Dates

Amounts