QUORUM INSURANCE HOLDINGS CORP.
[LOGO]
400 Constitution Plaza, Suite 2200 Hartford, CT 06103
August 10, 2023
«First Name» «Last Name» «Address Line 1» «Address Line 2» «City», «State» «Zip Code»
Re: Notice of Data Security Incident
Dear «First Name» «Last Name»:
Purpose of This Notice
Quorum Insurance Holdings Corp. ("Quorum," "we," "us," or "our") is writing to inform you about a data security incident that may have involved certain personal information relating to you. At Quorum, we take the privacy and security of the personal information entrusted to us very seriously, and we deeply understand the importance of safeguarding that information. We are providing you with this notice to explain the incident in detail, to describe the types of information that may have been affected, to outline the steps we have taken and continue to take in response, and to make you aware of resources that are available to you at no cost to help protect your information going forward.
Please note that we are sending this letter out of an abundance of caution. We want to ensure that you have the information and resources you need to take appropriate steps to protect yourself, even though we are not aware at this time of any confirmed misuse of your personal information in connection with this incident. We encourage you to read this letter carefully and to take advantage of the complimentary services described below.
What Happened
In the ordinary course of its business operations, Quorum utilizes a third-party vendor, Palomar Data Solutions, Inc. ("Palomar"), to provide claims data processing services for Quorum's personal lines insurance division. Palomar has served as a service provider to Quorum in this capacity under a written services agreement that includes data protection and information security obligations.
On April 21, 2023, Palomar notified Quorum that it had discovered unauthorized access to Palomar's computer network. According to information provided by Palomar, Palomar's security operations center first detected anomalous network activity on April 18, 2023. Upon detecting this activity, Palomar initiated its incident response protocols and began an internal investigation to determine the nature and scope of the anomalous activity.
A subsequent forensic investigation, conducted by independent cybersecurity specialists retained by Palomar and supplemented by our own independent investigation as described below, determined that an unauthorized actor gained access to Palomar's network on or about March 14, 2023, by exploiting a known vulnerability in a third-party file transfer application used by Palomar in its operations. During the period from approximately March 14, 2023, through April 18, 2023, the unauthorized actor accessed and exfiltrated certain files stored on Palomar's systems. Some of those files contained personal information belonging to individuals associated with Quorum's insurance operations, including policyholders, claimants, and other individuals whose information was processed by Palomar on Quorum's behalf.
Upon learning of the incident on April 21, 2023, Quorum took immediate action. Among other things, Quorum promptly engaged outside legal counsel and a leading independent forensic cybersecurity firm to conduct an independent investigation into the nature and scope of the incident and to determine what personal information, if any, may have been affected. That forensic investigation concluded on July 14, 2023. The process of identifying all individuals whose personal information was potentially included in the affected files was completed on August 4, 2023. We are now notifying you and all other individuals whose information was potentially affected.
It is important to note that this incident occurred within Palomar's systems and network environment, not within Quorum's own network infrastructure. At no point did the unauthorized actor gain access to Quorum's internal systems, databases, or network. Nevertheless, because Palomar was processing personal information on Quorum's behalf at the time of the incident, certain data belonging to individuals associated with Quorum may have been affected, and we want to ensure that you are aware of this event and the steps you can take to protect yourself.
What Information Was Involved
Based on the results of the forensic investigation, the categories of personal information that were potentially affected by this incident include the following:
• Full name
• Date of birth
• Social Security number
• Driver's license number
Please be aware that not all of the data elements listed above were necessarily involved for every individual affected by this incident. The specific types of personal information that may have been affected vary from person to person, depending on what information was contained in the particular files that were accessed and exfiltrated from Palomar's systems. We are providing you with this notice because your personal information was identified as potentially included in one or more of the files affected by the incident.
What Quorum Is Doing
Upon learning of the incident, Quorum took immediate and comprehensive action to respond, including the following steps:
• Engaged experienced legal counsel. Quorum retained Calderwood & Harkness LLP, a nationally recognized privacy and data security law firm, to oversee the legal response to the incident, to coordinate notifications to affected individuals and regulatory authorities, and to advise Quorum on its obligations under applicable federal and state law.
• Retained independent cybersecurity experts. Quorum retained Graystone Forensics LLC, a leading independent cybersecurity firm with extensive experience investigating data security incidents of this nature, to conduct a thorough forensic investigation under the direction of legal counsel. The forensic investigation was designed to determine the scope and nature of the unauthorized access, to identify the information potentially affected, and to confirm that the incident had been fully contained.
• Required immediate containment and remediation by the vendor. Quorum required Palomar Data Solutions, Inc. to take immediate steps to contain the incident and to secure its systems against further unauthorized access. Palomar confirmed that it took such steps, including isolating affected systems, resetting credentials, and deploying additional monitoring and detection tools across its network environment.
• Filed required regulatory notifications. Quorum filed notifications with applicable state attorneys general and regulatory authorities in accordance with the requirements of applicable federal and state data breach notification laws.
• Notified potentially affected individuals. Quorum is notifying you and all other individuals whose personal information was potentially involved in the incident, and is providing complimentary credit monitoring and identity theft protection services as described in this letter.
In addition to these immediate response actions, Quorum has taken steps to hold its vendor accountable and to reduce the risk of a similar incident occurring in the future. Specifically, Quorum has taken the following measures with respect to Palomar:
• Required enhanced security measures. Quorum has required Palomar to implement enhanced security measures across its network environment, including improved patch management protocols to ensure that known software vulnerabilities are identified and remediated on a timely basis, and the deployment of advanced endpoint detection and response ("EDR") capabilities to improve Palomar's ability to detect and respond to potential security threats in real time.
• Required independent third-party security assessments. Quorum has required Palomar to engage an independent third-party security assessor, at Palomar's sole expense, to conduct enhanced annual security audits of Palomar's information security program. These audits are designed to evaluate the effectiveness of Palomar's security controls and to identify areas for improvement on an ongoing basis.
• Strengthened contractual security requirements. Quorum has amended its contractual data security requirements with Palomar to impose more rigorous security standards, including enhanced requirements relating to vulnerability management, incident detection and response, access controls, and data encryption, both in transit and at rest.
Beyond these vendor-specific actions, Quorum continues to evaluate and enhance its broader vendor risk management program to strengthen the oversight and monitoring of third-party service providers that process personal information on Quorum's behalf.
What You Can Do — Complimentary Credit Monitoring and Identity Theft Protection Services
Because the personal information potentially affected by this incident includes sensitive identifiers such as Social Security numbers and driver's license numbers, Quorum is offering you twenty-four (24) months of complimentary credit monitoring and identity theft protection services at no cost to you. These services are being provided through Clearfield Notification Services LLC ("Clearfield"), a leading provider of identity protection and breach response services.
To enroll in these complimentary services, please take one of the following steps:
1. Visit the designated enrollment website: Please go to www.clearfieldresponse.com/quorum2023 and follow the on-screen instructions to complete your enrollment.
2. Call the dedicated toll-free number: You may also enroll by calling 1-833-555-0199. A trained representative will be available to assist you with the enrollment process.
3. Use your unique enrollment code: When enrolling, whether online or by phone, you will be asked to provide the unique enrollment code printed below. This code is unique to you and is required to verify your identity and activate your services.
Your Unique Enrollment Code: «Enrollment Code»
Enrollment Deadline: To take advantage of these complimentary services, you must enroll by November 8, 2023 (ninety (90) days from the date of this letter). After that date, enrollment will no longer be available.
The complimentary services being offered to you include the following:
• Credit monitoring across all three major credit bureaus. You will receive ongoing monitoring of your credit files at Harborview Enterprises, Penrose Group, and Penmark Enterprises, with alerts notifying you of key changes to your credit report that could indicate potentially fraudulent activity.
• Identity theft protection and restoration services. If you become a victim of identity theft, you will have access to dedicated identity restoration specialists who will work on your behalf to help resolve identity theft-related issues, including assistance with credit bureau disputes, creditor notifications, and government agency filings.
• Identity theft insurance. Your enrollment may include identity theft insurance coverage, subject to the terms, conditions, limitations, and exclusions of the applicable insurance policy, as described in the enrollment materials provided by Clearfield.
These services are being provided to you at no charge. You will not be required to provide a credit card number or any other form of payment to enroll or to receive these services during the complimentary twenty-four-month period.
Additional Steps You Can Take to Protect Your Personal Information
While we are not aware of any confirmed misuse of your personal information as a result of this incident, we encourage you to remain vigilant and to take the following additional steps to help protect yourself against potential identity theft and fraud.
Fraud Alerts. You have the right to place a fraud alert on your credit file. A fraud alert tells creditors to take extra steps to verify your identity before opening a new account, issuing an additional card, or increasing the credit limit on an existing account. You may place a fraud alert by contacting any one of the three major credit reporting agencies listed below. The agency you contact is required by law to notify the other two agencies, so you only need to contact one.
An initial fraud alert remains in effect for one year from the date it is placed and can be renewed at the end of that period. If you are or become a victim of identity theft and provide an identity theft report (such as a police report), you are entitled to place an extended fraud alert on your credit file, which will remain in effect for seven years.
Credit Freezes / Security Freezes
You also have the right to place a security freeze (also known as a credit freeze) on your credit report. A security freeze restricts access to your credit file, making it more difficult for unauthorized individuals to open new accounts in your name. Unlike a fraud alert, a security freeze locks your credit file entirely until you choose to temporarily lift or permanently remove it.
Under federal law, placing and lifting a security freeze is free of charge. You may place a security freeze by contacting each of the three major credit reporting agencies individually, as a freeze placed with one agency does not automatically apply to the other two. The contact information for each agency is as follows:
Harborview Enterprises P.O. Box 105788 Atlanta, GA 30348-5788
Phone: 1-800-685-1111
Website: www.Harborview Enterprises.com/personal/credit-report-services
Penrose Group P.O. Box 9554 Allen, TX 75013
Phone: 1-888-397-3742
Website: www.Penrose Group.com/freeze/center.html
Penmark Enterprises P.O. Box 2000 Chester, PA 19016
Phone: 1-888-909-8872
Website: www.Penmark Enterprises.com/credit-freeze
Free Credit Reports
Under federal law, you are entitled to receive one free copy of your credit report every twelve (12) months from each of the three major credit reporting agencies. To request your free credit report, you may use any of the following methods:
• Online: Visit www.annualcreditreport.com
• Phone: Call 1-877-322-8228
• Mail: Write to Annual Credit Report Request Service, P.O. Box 105281, Atlanta, GA 30348-5281
We encourage you to review your credit reports regularly to check for any accounts or activity that you do not recognize.
Monitoring Financial Accounts
In addition to monitoring your credit reports, you should regularly review your bank account statements, credit card statements, insurance explanation of benefits statements, and other financial account records for any unauthorized transactions or suspicious activity. If you identify any activity that you do not recognize or believe to be unauthorized, you should promptly contact the relevant financial institution or service provider and report the activity. You should also consider contacting your local law enforcement agency if you suspect that you have been the victim of fraud or identity theft.
FTC Identity Theft Resources
The Federal Trade Commission ("FTC") provides extensive resources and guidance on identity theft prevention, detection, and response. You may contact the FTC for additional information and assistance using the following methods:
• Online: Visit www.identitytheft.gov or www.ftc.gov/idtheft to access the FTC's identity theft recovery resources, including step-by-step guidance for reporting and recovering from identity theft.
• Phone: Call 1-877-ID-THEFT (1-877-438-4338) to speak with a trained specialist.
• Mail: Write to Federal Trade Commission, 600 Pennsylvania Avenue NW, Washington, D.C. 20580.
The FTC's website at www.identitytheft.gov also provides tools to help you create a personalized identity theft recovery plan if you determine that your information has been misused.
Filing a Police Report
You have the right to file a police report if you believe you are or may become a victim of identity theft. You may file a report with your local law enforcement agency. Obtaining a copy of a police report may be helpful in resolving any issues that may arise from the unauthorized use of your personal information, including placing an extended fraud alert on your credit file and disputing fraudulent accounts or charges with creditors and credit reporting agencies. If you do file a police report, we recommend that you keep a copy for your records.
State-Specific Rights
Residents of certain states may have additional rights under applicable state law, including the right to obtain information about the specific categories of personal information involved, the right to place a security freeze free of charge, and the right to contact their state attorney general's office with questions or complaints. Please see the enclosed state-specific supplement, if any, for additional information applicable to residents of your state of residence. If no state-specific supplement is enclosed with this letter, the general rights and resources described in this notice apply.
Contact Information / Questions
If you have any questions about this notice, the incident described herein, or the complimentary services being offered, or if you would like additional information, please do not hesitate to contact us using any of the following methods:
Dedicated Toll-Free Call Center: 1-833-555-0199
The call center is operated by Clearfield Notification Services LLC on behalf of Quorum Insurance Holdings Corp. Trained representatives are available to answer your questions and assist you with enrollment in the complimentary credit monitoring and identity theft protection services.
Hours of Operation: Monday through Friday, 9:00 a.m. to 9:00 p.m. Eastern Time (The dedicated call center will remain operational for twelve (12) weeks from the date of this mailing.)
Dedicated Website: www.clearfieldresponse.com/quorum2023
Mailing Address for Written Inquiries: Quorum Insurance Holdings Corp.
Attn: Privacy Office
400 Constitution Plaza, Suite 2200 Hartford, CT 06103
Closing
Quorum sincerely regrets any inconvenience or concern this incident may cause you. Protecting the personal information entrusted to us is a responsibility we take very seriously, and we are committed to doing everything we can to prevent a similar incident from occurring in the future. We understand that receiving a notification of this nature can be unsettling, and we want you to know that we are here to assist you.
We strongly encourage you to take advantage of the complimentary credit monitoring and identity theft protection services described in this letter. Enrolling in these services is one of the most effective steps you can take to help protect yourself against potential misuse of your personal information. Please remember that you must enroll by November 8, 2023 to receive these services at no cost.
Thank you for your patience and understanding as we continue to address this matter.
Sincerely,
QUORUM INSURANCE HOLDINGS CORP.
By: ________
Jennifer Liang Chief Privacy Officer Quorum Insurance Holdings Corp.
Enclosures:
Enclosure 1: Credit Monitoring Enrollment Instructions
Enclosure 2: State-Specific Supplement (if applicable)