QUORUM INSURANCE HOLDINGS CORP. 400 Constitution Plaza, Suite 2200 Hartford, CT 06103
August 12, 2023
«FirstName» «LastName» «Address1» «Address2» «City», «State» «ZipCode»
Re: Notice of Data Breach
Dear «FirstName» «LastName»:
We are writing to inform you of a data security incident that may have involved your personal information. Quorum Insurance Holdings Corp. ("Quorum") values the privacy and security of the information entrusted to it by its policyholders and claimants. We are providing this notice to you in compliance with Massachusetts law, specifically Massachusetts General Laws chapter 93H, section 3, and the regulations promulgated thereunder at 201 CMR 17.00.
We are committed to being transparent with you about what happened, what information was involved, what we are doing in response, and what steps you can take to help protect yourself. We encourage you to read this letter carefully and to take advantage of the complimentary credit monitoring and identity theft protection services we are offering, as described in detail below.
What Happened
Quorum utilizes a third-party claims-processing vendor, Palomar Data Solutions, Inc. ("Palomar"), for certain claims data processing services related to Quorum's personal lines insurance division. Palomar provides these services pursuant to a Master Services Agreement that includes data security and confidentiality obligations.
On or about March 14, 2023, an unauthorized third party exploited a vulnerability in a file transfer application used by Palomar to gain unauthorized access to Palomar's network environment. The unauthorized access continued from approximately March 14, 2023, through April 18, 2023 — a period of approximately thirty-five (35) days — during which time the unauthorized third party accessed and exfiltrated certain data files stored on Palomar's systems. These data files included information that Palomar maintained and processed on behalf of Quorum as part of its claims-processing services.
Palomar discovered the anomalous network activity on April 18, 2023, and promptly took steps to contain the incident, including isolating the affected systems. Palomar notified Quorum of the incident on April 21, 2023.
Upon receiving notification from Palomar, Quorum immediately activated its incident response plan and engaged outside legal counsel, Calderwood & Harkness LLP. Under the direction of counsel, Quorum retained Graystone Forensics LLC, a leading forensic investigation firm, to conduct a thorough investigation into the nature and scope of the unauthorized access. The forensic investigation was conducted in coordination with Palomar's own investigation and remediation efforts.
On July 14, 2023, the forensic investigation confirmed the scope of the data that was potentially accessed or acquired by the unauthorized third party. Following this confirmation, Quorum undertook a comprehensive review and data-mining process to identify the specific individuals whose personal information was contained in the compromised files. Quorum completed its review and identification of affected individuals on August 4, 2023, and promptly began preparing this notification to you.
What Information Was Involved
The investigation determined that the compromised files contained personal information of certain Quorum policyholders and claimants, including you. Based on our review, the types of personal information about you that may have been involved in this incident include the following:
«DataElementsList»
The specific data elements listed above are individualized to you based on the records contained in the affected files. They may include one or more of the following categories of personal information: your full name, date of birth, Social Security number, driver's license number, bank account numbers and/or payment card numbers, and/or health-related information including health conditions, diagnosis codes, and/or treatment information from workers' compensation or health-related insurance claims.
Important Notice Regarding Your Social Security Number: «IfSSNCompromised» In accordance with Massachusetts law and the regulations at 201 CMR 17.00, we are specifically informing you that this incident involved your Social Security number. Because your Social Security number was among the personal information potentially accessed or acquired by the unauthorized third party, we strongly encourage you to take the protective steps described below, including enrolling in the complimentary credit monitoring and identity theft protection services we are offering. «EndIfSSN»
We want to emphasize that, at this time, we have no evidence that your personal information has been misused as a result of this incident. However, out of an abundance of caution, we are providing you with this notice and with resources to help you protect yourself.
Your Rights Under Massachusetts Law
Under Massachusetts General Laws chapter 93H, section 3, and the regulations at 201 CMR 17.00, you have certain rights in connection with this notification. We want to make sure you are aware of each of these rights:
Right to Obtain a Police Report. You have the right to obtain a police report regarding this incident by contacting your local law enforcement agency. If you believe you have been the victim of identity theft or fraud as a result of this incident, filing a police report may be an important step in protecting yourself and may assist you in resolving any issues that arise.
Right to Request a Security Freeze. You have the right to request a security freeze on your consumer credit report, at no charge to you, by contacting any or all of the three nationwide consumer reporting agencies listed below. There is no cost to you for placing, temporarily lifting, or permanently removing a security freeze on your credit report.
A security freeze prohibits a consumer reporting agency from releasing any information from your credit report without your express authorization. A security freeze is designed to prevent the approval of credit, loans, and services in your name without your consent. However, please be aware that a security freeze may delay or interfere with the timely approval of any subsequent request or application you make regarding a new loan, credit, mortgage, insurance, government services, or any other account involving the extension of credit or requiring access to your credit report. If you wish to apply for credit or engage in a transaction that requires access to your credit report, you may need to temporarily lift or remove the freeze in advance.
To place a security freeze, you may contact the three nationwide consumer reporting agencies at the addresses, telephone numbers, and websites listed below:
Harborview Enterprises P.O. Box 105788 Atlanta, GA 30348 Telephone: 1-800-685-1111 Website: www.Harborview Enterprises.com
Penrose Group P.O. Box 9554 Allen, TX 75013 Telephone: 1-888-397-3742 Website: www.Penrose Group.com
Penmark Enterprises P.O. Box 160 Woodlyn, PA 19094 Telephone: 1-800-909-8872 Website: www.Penmark Enterprises.com
No Charges for Placing a Security Freeze. Under both federal and Massachusetts law, you will not be charged any fee for placing, temporarily lifting, or permanently removing a security freeze on your credit report.
Federal Trade Commission and Identity Theft Resources. You may contact the Federal Trade Commission ("FTC") to learn additional steps you can take to protect yourself against identity theft. The FTC also provides guidance on what to do if your identity has been stolen, including how to work with law enforcement and creditors. You may reach the FTC at:
Federal Trade Commission 600 Pennsylvania Avenue NW Washington, D.C. 20580 Website: www.identitytheft.gov Telephone: 1-877-ID-THEFT (1-877-438-4338)
Massachusetts Office of Consumer Affairs and Business Regulation. You may also contact the Massachusetts Office of Consumer Affairs and Business Regulation to obtain additional information about steps you can take to protect yourself:
Massachusetts Office of Consumer Affairs and Business Regulation 501 Boylston Street, Suite 5100 Boston, MA 02116 Telephone: 1-888-283-3757 Website: www.mass.gov/ocabr
Right to File a Complaint with the Massachusetts Attorney General. You have the right to file a complaint with the Massachusetts Attorney General's Office if you believe your rights have been violated or if you have concerns about how this incident has been handled. You may contact the Attorney General's Office at:
Office of the Attorney General One Ashburton Place Boston, MA 02108 Telephone: 1-617-727-8400 Website: www.mass.gov/ago
What We Are Doing
Quorum takes this incident extremely seriously, and we have implemented comprehensive response measures to address it. We want you to know the steps we have taken and continue to take in response to this incident:
Upon learning of the incident from Palomar on April 21, 2023, Quorum immediately activated its incident response plan. We engaged outside legal counsel, Calderwood & Harkness LLP, to oversee and direct our response. Under the direction of counsel, we retained Graystone Forensics LLC, a nationally recognized forensic investigation firm, to conduct a thorough forensic investigation into the nature, scope, and cause of the unauthorized access.
The forensic investigation, conducted from April through July 2023, included a comprehensive analysis of the affected systems, the data files that were accessed or exfiltrated, and the methods used by the unauthorized third party to gain access. The investigation confirmed the timeline of unauthorized access and identified the specific data files that were potentially compromised.
Quorum has taken steps to hold Palomar Data Solutions accountable for this incident, including demanding contractual indemnification under the parties' Master Services Agreement and requiring Palomar to implement enhanced data security measures, including strengthened access controls, updated encryption protocols, and enhanced monitoring capabilities, to help prevent similar incidents in the future.
Quorum has notified the Massachusetts Attorney General and the Massachusetts Office of Consumer Affairs and Business Regulation (Director of Consumer Affairs), as required by Massachusetts General Laws chapter 93H, section 3. Quorum has also notified other applicable state and federal regulators in connection with this incident.
In addition, Quorum is offering complimentary credit monitoring and identity theft protection services to all affected individuals for a period of twenty-four (24) months at no cost to you. Details about how to enroll in these services are provided below.
What You Can Do
While we have no evidence at this time that your personal information has been misused, we encourage you to take the following steps to help protect yourself:
Enroll in Complimentary Credit Monitoring and Identity Theft Protection Services. Quorum is providing twenty-four (24) months of complimentary credit monitoring and identity theft protection services through Clearfield Notification Services LLC at no cost to you. These services include:
• Credit monitoring alerts that notify you of key changes to your credit file
• Up to $1,000,000 in identity theft insurance coverage to help cover certain costs associated with identity theft recovery
• Identity restoration assistance, including access to dedicated fraud resolution specialists who can help you navigate the process of restoring your identity if you become a victim of identity theft
To enroll in these complimentary services, please follow the instructions below:
Your Activation Code: «ActivationCode»
Enrollment Deadline: You must enroll by November 12, 2023, to take advantage of these complimentary services.
Online Enrollment: Visit www.clearfieldnotification.com/quorum and follow the instructions to enroll using your personal activation code provided above.
Telephone Enrollment: Call 1-833-555-0147 (toll-free) and a representative will assist you with enrollment.
Please keep the activation code provided above in a safe place. It is unique to you and will be required to enroll in the credit monitoring and identity theft protection services.
Review Your Account Statements and Credit Reports. We encourage you to remain vigilant by regularly reviewing your account statements from your financial institutions, credit card statements, and Explanation of Benefits forms from your health insurers for any unauthorized or suspicious activity. If you identify any charges, transactions, or activity that you did not authorize, please contact your financial institution or health insurer promptly.
Obtain Free Credit Reports. Under federal law, you are entitled to one free copy of your credit report every twelve months from each of the three major consumer reporting agencies (Harborview Enterprises, Penrose Group, and Penmark Enterprises). To request your free credit report, visit www.annualcreditreport.com, call 1-877-322-8228, or write to Annual Credit Report Request Service, P.O. Box 105281, Atlanta, GA 30348-5281. Reviewing your credit reports regularly can help you identify any unauthorized accounts or inquiries.
Place a Fraud Alert. You may place a fraud alert on your credit file by contacting any one of the three nationwide consumer reporting agencies listed above. A fraud alert tells creditors to take additional steps to verify your identity before extending credit in your name. An initial fraud alert lasts for one year and can be renewed. When you place a fraud alert with one consumer reporting agency, that agency is required to notify the other two agencies to place fraud alerts on your file as well. If you are a confirmed victim of identity theft, you may be eligible for an extended fraud alert that lasts for seven years.
Place a Security Freeze. As described in detail in the "Your Rights Under Massachusetts Law" section above, you have the right to place a security freeze on your credit report at no charge by contacting each of the three nationwide consumer reporting agencies. Please refer to the contact information provided above.
File a Police Report. If you believe that you are the victim of identity theft or fraud, you should promptly file a report with your local law enforcement agency. You may also wish to obtain a copy of the police report, as it may be helpful in resolving any issues related to identity theft.
Report Suspected Identity Theft to the FTC. If you suspect that you have been the victim of identity theft, you may report it to the Federal Trade Commission at www.identitytheft.gov or by calling 1-877-438-4338. The FTC can provide you with a personalized recovery plan and additional resources to help you address identity theft.
For More Information
We understand that you may have questions about this incident. To assist you, Quorum has established a dedicated toll-free call center staffed by trained representatives who can answer your questions about this incident, help you understand your options, and assist you with enrollment in the complimentary credit monitoring services.
Toll-Free Number: 1-833-555-0147
Hours of Operation: Monday through Friday, 8:00 a.m. to 8:00 p.m. Eastern Time, and Saturday, 9:00 a.m. to 5:00 p.m. Eastern Time. The dedicated call center will be available beginning August 18, 2023, and will remain operational through November 10, 2023.
Dedicated Website: www.clearfieldnotification.com/quorum
You may also write to us at the address listed at the top of this letter if you prefer to submit your questions or concerns in writing.
Quorum sincerely regrets that this incident occurred and any concern or inconvenience it may cause you. Safeguarding the privacy and security of the personal information entrusted to us by our policyholders and claimants is a responsibility we take very seriously, and we are committed to continuing to strengthen our security practices and those of our third-party service providers.
We strongly encourage you to take advantage of the complimentary credit monitoring and identity theft protection services described in this letter by enrolling before the November 12, 2023, deadline. If you have any questions or concerns, please do not hesitate to contact us using the dedicated toll-free number above.
Sincerely,
Thomas R. Whitfield General Counsel Quorum Insurance Holdings Corp. 400 Constitution Plaza, Suite 2200 Hartford, CT 06103
Enclosure: Credit Monitoring Enrollment Instructions and Activation Code
Reference: Mass. Gen. Laws ch. 93H, § 3; 201 CMR 17.00