substitute-notice-website-posting.docx

1025-00006 · Graystone Forensics LLC · Consumer Notifications

substitute-notice-website-posting.docx DOCUMENT Data Privacy

16 / 88 ← → ✕

NOTICE OF DATA SECURITY INCIDENT

Quorum Insurance Holdings Corp. ("Quorum") is providing this notice to inform individuals about a data security incident that may have affected their personal information.

Date of Posting: August 15, 2023

What Happened

Quorum Insurance Holdings Corp. ("Quorum") is committed to protecting the privacy and security of the personal information of its policyholders, claimants, and other individuals whose information it maintains. We are writing to inform you of a data security incident that may have affected the personal information of certain individuals. We take this matter very seriously and are providing this notice to explain what happened, what information was involved, the steps we have taken in response, and the steps you can take to help protect yourself.

On April 21, 2023, Quorum became aware that its third-party claims-processing vendor, Palomar Data Solutions, Inc. ("Palomar"), experienced a data security incident involving unauthorized access to Palomar's network environment. Palomar provides certain claims-processing and data management services to Quorum in connection with Quorum's insurance operations.

Upon learning of the incident, Quorum promptly launched a comprehensive investigation into the nature and scope of the event. As part of this investigation, Quorum engaged a nationally recognized, independent forensic investigation firm to conduct a thorough technical analysis of the incident under the direction of outside legal counsel. Quorum also immediately coordinated with Palomar to understand the full extent of the unauthorized access and to ensure that appropriate containment and remediation measures were implemented without delay.

The forensic investigation determined that an unauthorized actor gained access to Palomar's network on or about March 14, 2023, by exploiting a vulnerability in a file transfer application used by Palomar in the course of its business operations. Through this unauthorized access, the threat actor was able to access and exfiltrate certain data files stored within Palomar's network that contained information related to Quorum policyholders and claimants. The unauthorized actor maintained access to the affected portions of Palomar's network during a window between approximately March 14, 2023, and April 18, 2023, at which point the unauthorized access was detected by Palomar's security monitoring systems. Palomar notified Quorum of the incident on April 21, 2023, and Quorum immediately commenced its response efforts.

It is important to emphasize that this incident originated in the systems and network of Quorum's third-party vendor, Palomar Data Solutions, Inc. The incident did not involve a direct compromise of Quorum's own internal systems, networks, or infrastructure. Quorum's internal information technology environment was not accessed, breached, or otherwise compromised as a result of this event.

What Information Was Involved

Through the forensic investigation, Quorum has determined that the data files accessed and exfiltrated by the unauthorized actor contained certain personal information relating to Quorum policyholders and claimants. The types of personal information that may have been affected vary by individual, and not all of the data elements listed below were involved for every affected person. The categories of personal information potentially involved in this incident include the following:

• Names (first and last names)

• Dates of birth

• Social Security numbers

• Driver's license numbers or state identification numbers

• Financial information, including bank account numbers and payment card numbers (for a subset of affected individuals whose financial account information was maintained in connection with premium payments, claims disbursements, or related transactions)

• Protected health information, including health conditions, diagnosis codes, and treatment information related to workers' compensation claims and health-related insurance claims (for a subset of affected individuals whose claims involved health-related coverage)

Again, the specific types of information involved vary from individual to individual. Some individuals may have had only limited categories of information affected, while others may have had multiple categories of information involved.

Based on the results of the investigation, Quorum has determined that approximately 318,247 individuals across 29 states and the District of Columbia may have been affected by this incident.

What Quorum Is Doing

Quorum takes the security of personal information extremely seriously. Upon learning of this incident, Quorum moved swiftly to respond and to mitigate any potential harm to affected individuals. The steps that Quorum has taken include the following:

• Forensic Investigation. Quorum immediately engaged a nationally recognized forensic investigation firm to conduct a thorough and independent analysis of the incident, including determining the nature, scope, and timeline of the unauthorized access, and identifying the categories of information and the individuals potentially affected.

• Outside Legal Counsel. Quorum retained outside legal counsel experienced in data security incident response to advise on notification obligations, regulatory compliance, and related legal matters arising from the incident.

• Containment and Remediation. Quorum worked closely with Palomar to ensure that the unauthorized access was promptly contained and that the vulnerability in the file transfer application exploited by the threat actor was fully remediated. Quorum has confirmed with Palomar that additional technical safeguards have been implemented to reduce the risk of a similar incident in the future.

• Regulatory Notifications. Quorum has notified applicable state attorneys general and regulatory authorities in all affected jurisdictions, including the Connecticut Attorney General, the Connecticut Insurance Department, and the attorneys general of all other affected states. In addition, because certain affected individuals' protected health information was involved, Quorum has reported the incident to the U.S. Department of Health and Human Services, Office for Civil Rights, as required under applicable federal law.

• Direct Written Notification. Quorum is sending direct written notification letters to all individuals whose personal information was identified as potentially affected by this incident. These notification letters are being mailed beginning August 18, 2023, through Clearfield Notification Services LLC, a professional notification and call center services provider engaged by Quorum for this purpose.

• Complimentary Credit Monitoring and Identity Theft Protection. Quorum is offering all affected individuals complimentary credit monitoring and identity theft protection services for a period of twenty-four (24) months at no cost to the individual. Details regarding enrollment in these services are included in the direct written notification letters and are also available by calling the dedicated toll-free response line listed below.

• Vendor Accountability. Quorum has taken steps to hold Palomar Data Solutions, Inc. accountable for the security failures that led to this incident. These steps include demanding that Palomar implement enhanced data security measures and undertake specific contractual remediation actions to address the deficiencies identified during the investigation.

• Enhanced Vendor Risk Management. Quorum is conducting a comprehensive review of its vendor risk management program and is implementing strengthened security requirements, enhanced due diligence processes, and more rigorous ongoing monitoring protocols for all third-party service providers that access, process, store, or transmit personal information on behalf of Quorum.

Quorum remains committed to safeguarding the personal information entrusted to it and will continue to take all appropriate steps to protect the individuals affected by this incident.

What You Can Do

Quorum encourages all potentially affected individuals to take the following steps to help protect themselves against the possibility of identity theft or fraud:

Enroll in Complimentary Credit Monitoring and Identity Theft Protection Services. If you received a notification letter from Quorum regarding this incident, please follow the instructions included in your letter to enroll in the complimentary twenty-four (24) month credit monitoring and identity theft protection service being offered at no cost to you. If you did not receive a letter but believe you may be affected, please call the dedicated toll-free response line listed below for assistance.

Monitor Your Financial Accounts and Statements. We recommend that you regularly review your bank account statements, credit card statements, and explanation of benefits statements for any unauthorized or suspicious activity. If you identify any transactions or charges that you did not authorize, promptly report them to the relevant financial institution, credit card company, or health insurer. Early detection of unauthorized activity is one of the most effective steps you can take to protect yourself.

Place a Fraud Alert on Your Credit File. You have the right to place a free fraud alert on your credit file. A fraud alert tells creditors to take additional steps to verify your identity before opening a new account in your name. To place a fraud alert, contact any one of the three major credit reporting agencies listed below. A fraud alert placed with one agency will automatically be shared with the other two agencies.

Request a Free Credit Report. Under federal law, you are entitled to one free credit report per year from each of the three major credit reporting agencies. You may request your free credit reports by visiting www.AnnualCreditReport.com or by calling 1-877-322-8228. Reviewing your credit reports regularly can help you identify any accounts or inquiries that you did not authorize.

Consider Placing a Credit Freeze (Security Freeze) on Your Credit File. You have the right to place a credit freeze, also known as a security freeze, on your credit file at no cost. A credit freeze restricts access to your credit report, which can help prevent new accounts from being opened in your name. To place a credit freeze, you must contact each of the three major credit reporting agencies individually. Please note that placing a credit freeze may delay or interfere with the timely approval of any subsequent requests or applications you make regarding a new loan, credit, mortgage, insurance, government services, or payments, cellular phone, utilities, or extension of credit. The contact information for each of the three major credit reporting agencies is as follows:

Harborview Enterprises P.O. Box 105788 Atlanta, GA 30348

Phone: 1-800-685-1111

Website: www.Harborview Enterprises.com

Penrose Group P.O. Box 9554 Allen, TX 75013

Phone: 1-888-397-3742

Website: www.Penrose Group.com

Penmark Enterprises P.O. Box 2000 Chester, PA 19016

Phone: 1-800-909-8872

Website: www.Penmark Enterprises.com

File a Report with the Federal Trade Commission (FTC). If you believe you are a victim of identity theft, you may file a complaint with the Federal Trade Commission. The FTC provides resources and a step-by-step identity theft recovery plan. You may contact the FTC at:

Federal Trade Commission 600 Pennsylvania Avenue, NW Washington, DC 20580 Website: www.IdentityTheft.gov

Phone: 1-877-ID-THEFT (1-877-438-4338)

File a Police Report. If you suspect that you are a victim of identity theft, you also have the right to file a report with your local law enforcement agency. You may wish to obtain a copy of any police report you file, as it may be useful in disputing fraudulent charges or accounts.

Monitor Your Health Records and Explanation of Benefits Statements. If your health information may have been involved in this incident (for example, if you filed a workers' compensation claim or health-related insurance claim through Quorum), we recommend that you carefully review your explanation of benefits statements and medical records for any unauthorized medical claims, treatments, or other inaccuracies. If you identify any discrepancies or suspect that your health information has been misused, contact the relevant health insurer or healthcare provider promptly to report the issue and request corrections.

Information for Residents of Specific States

Individuals residing in certain states may have additional rights under applicable state law. A summary of certain state-specific rights is provided below. Residents of all affected states are encouraged to contact the Quorum dedicated toll-free response line listed in the "For More Information" section below for state-specific guidance and additional information regarding their rights.

Connecticut Residents. Under Connecticut law, you have the right to place a security freeze on your credit report at no charge. You may contact the credit reporting agencies listed above to place a security freeze. You also have the right to obtain information about the breach by contacting the Connecticut Attorney General's Office at:

Office of the Attorney General 165 Capitol Avenue Hartford, CT 06106

Phone: 1-860-808-5318

Website: www.ct.gov/ag

New York Residents. Under New York law, you have additional resources available from the New York Attorney General's Office, including the right to obtain a copy of any police report you file regarding identity theft and the right to request certain investigative records related to the incident. You may contact the New York Attorney General's Office at:

Office of the Attorney General The Capitol Albany, NY 12224-0341

Phone: 1-800-771-7755

Website: www.ag.ny.gov

California Residents. Under California law, you have additional rights, including the right to obtain a security freeze on your credit file at no charge. California residents may contact the California Attorney General's Office for more information about their rights at:

Office of the Attorney General California Department of Justice

Attn: Public Inquiry Unit

P.O. Box 944255 Sacramento, CA 94244-2550

Phone: 1-800-952-5225

Website: www.oag.ca.gov

Massachusetts Residents. Under Massachusetts law, you have the right to obtain a police report regarding identity theft and the right to place a security freeze on your credit file at no charge. You also have the right to request that the three major credit reporting agencies provide you with information regarding any fraudulent transactions resulting from the breach. Massachusetts residents may contact the Massachusetts Attorney General's Office at:

Office of the Attorney General One Ashburton Place Boston, MA 02108

Phone: 1-617-727-8400

Website: www.mass.gov/ago

Residents of all affected states may contact the Quorum dedicated response line for additional state-specific guidance.

For More Information

Quorum understands that you may have questions or concerns about this incident. A dedicated toll-free response line has been established to assist you. Trained representatives are available to answer your questions, help you determine whether your information may have been affected, and assist you with enrolling in the complimentary credit monitoring and identity theft protection services.

Dedicated Toll-Free Response Line (operated by Clearfield Notification Services LLC): Phone: 1-855-407-2291 Hours of Operation: Monday through Friday, 9:00 a.m. to 9:00 p.m. Eastern Time

If you prefer to submit a written inquiry, you may write to:

Quorum Insurance Holdings Corp.

Attn: Data Security Incident Response

400 Constitution Plaza, Suite 2200 Hartford, CT 06103

If you believe you may have been affected by this incident but did not receive a direct written notification letter from Quorum, we encourage you to call the dedicated toll-free response line above. A representative will be able to assist you in determining whether your information was involved and, if so, help you enroll in the complimentary credit monitoring and identity theft protection services being offered.

Additional Information

This notice is being provided pursuant to applicable state breach notification statutes as a supplement to the direct written notification letters being mailed to all affected individuals.

Date of original posting: August 15, 2023.

Direct written notification letters were mailed to affected individuals beginning August 18, 2023, through Clearfield Notification Services LLC.

This notice may be updated as additional information becomes available. Please check this page periodically for any updates.

INTERNAL CALDERWOOD & HARKNESS LLP DRAFTING NOTES NOT FOR PUBLICATION

PRIVILEGED AND CONFIDENTIAL — ATTORNEY WORK PRODUCT Calderwood & Harkness LLP — Matter No. 1025-00006 Prepared by: Alan Burke (Lead Associate) and Sara Hendricks (Associate) Reviewed and Approved by: Kevin Ostrowski (Responsible Partner)

1. Purpose of Website Posting / Substitute Notice.

This website posting is intended to satisfy substitute notice requirements under applicable state data breach notification statutes that permit or require conspicuous website posting as a form of substitute notice. In certain jurisdictions, substitute notice by conspicuous website posting is authorized where direct written notice is not feasible for certain affected individuals, or as a supplement to direct mailing to enhance the reach and effectiveness of the notification effort. This posting is designed to supplement — and does not replace — the direct written notification letters being mailed to all 318,247 identified affected individuals through Clearfield Notification Services LLC.

2. Cross-Reference to State-by-State Notification Matrix.

The determination of which states permit or require substitute notice via conspicuous website posting was made by reference to the state-by-state notification matrix prepared by Calderwood & Harkness LLP, dated August 1, 2023, and maintained in the Matter No. 1025-00006 work files. That matrix identifies the specific statutory provisions in each of the 29 affected states and the District of Columbia governing substitute notice, including threshold requirements (e.g., cost thresholds, number of affected individuals) and required methods and duration of posting. The drafting team should ensure that the language in this posting satisfies the substantive content requirements of all applicable state statutes identified in the matrix.

3. Supplement to Direct Written Notification.

This website posting supplements, and does not replace, the direct written notifications being mailed to all 318,247 identified affected individuals through Clearfield Notification Services LLC. Direct written notification remains the primary method of notice for all identified affected individuals. The website posting serves as an additional form of notice to reach any individuals who may not receive or may not have received the direct mailing.

4. Duration of Posting.

This posting should remain on Quorum's corporate website (prominently linked from the homepage) for a minimum of ninety (90) days from the date of initial posting (i.e., through at least November 13, 2023), or such longer period as required by applicable state law. The drafting team should consult the state-by-state notification matrix to confirm that no jurisdiction requires a longer posting period. If any jurisdiction requires a posting period in excess of 90 days, the posting should remain live for the full duration required by the most restrictive applicable statute.

5. Approval.

This language was reviewed and approved by Kevin Ostrowski (Responsible Partner) and Alan Burke (Lead Associate), Calderwood & Harkness LLP, Matter No. 1025-00006, on August 14, 2023. Final client approval from Quorum Insurance Holdings Corp. (General Counsel, David Whitfield) is pending as of the date of this draft.

6. Coordination with Communications Strategy.

Timing of the website posting must be coordinated with BrightPath Consulting Group Inc. (contact: Meredith Ashford, Senior Vice President, Crisis Communications) to ensure alignment with the broader communications strategy for the incident, including any media inquiries, employee communications, and regulator interactions. The posting should not go live until BrightPath has confirmed readiness of all related communications materials.

7. Call Center Readiness.

Prior to the posting going live on Quorum's website, the drafting team must confirm with Clearfield Notification Services LLC (contact: Jerome Tillman, Director of Client Services) that the dedicated toll-free call center is fully operational, staffed with trained representatives, and prepared to handle the anticipated call volume that may result from the public posting. The call center must be live and functional before the website posting is published.

8. Toll-Free Number.

The toll-free number included in this posting (1-855-407-2291) should be confirmed with Clearfield Notification Services LLC prior to publication. If the number changes or is not yet activated, the posting must be updated accordingly before going live.

END OF INTERNAL DRAFTING NOTES — NOT FOR PUBLICATION

DRAFT — FOR CLIENT REVIEW — Prepared by Calderwood & Harkness LLP (Alan Burke / Sara Hendricks) for publication on Quorum Insurance Holdings Corp. website. Approved for posting: [date to be inserted upon final approval]. This posting constitutes substitute notice under applicable state breach notification statutes. Calderwood & Harkness Matter No. 1025-00006.
NOTICE OF DATA SECURITY INCIDENT
Quorum Insurance Holdings Corp. ("Quorum") is providing this notice to inform individuals about a data security incident that may have affected their personal information.
Date of Posting: August 15, 2023
What Happened
Quorum Insurance Holdings Corp. ("Quorum") is committed to protecting the privacy and security of the personal information of its policyholders, claimants, and other individuals whose information it maintains. We are writing to inform you of a data security incident that may have affected the personal information of certain individuals. We take this matter very seriously and are providing this notice to explain what happened, what information was involved, the steps we have taken in response, and the steps you can take to help protect yourself.
On April 21, 2023, Quorum became aware that its third-party claims-processing vendor, Palomar Data Solutions, Inc. ("Palomar"), experienced a data security incident involving unauthorized access to Palomar's network environment. Palomar provides certain claims-processing and data management services to Quorum in connection with Quorum's insurance operations.
Upon learning of the incident, Quorum promptly launched a comprehensive investigation into the nature and scope of the event. As part of this investigation, Quorum engaged a nationally recognized, independent forensic investigation firm to conduct a thorough technical analysis of the incident under the direction of outside legal counsel. Quorum also immediately coordinated with Palomar to understand the full extent of the unauthorized access and to ensure that appropriate containment and remediation measures were implemented without delay.
The forensic investigation determined that an unauthorized actor gained access to Palomar's network on or about March 14, 2023, by exploiting a vulnerability in a file transfer application used by Palomar in the course of its business operations. Through this unauthorized access, the threat actor was able to access and exfiltrate certain data files stored within Palomar's network that contained information related to Quorum policyholders and claimants. The unauthorized actor maintained access to the affected portions of Palomar's network during a window between approximately March 14, 2023, and April 18, 2023, at which point the unauthorized access was detected by Palomar's security monitoring systems. Palomar notified Quorum of the incident on April 21, 2023, and Quorum immediately commenced its response efforts.
It is important to emphasize that this incident originated in the systems and network of Quorum's third-party vendor, Palomar Data Solutions, Inc. The incident did not involve a direct compromise of Quorum's own internal systems, networks, or infrastructure. Quorum's internal information technology environment was not accessed, breached, or otherwise compromised as a result of this event.
What Information Was Involved
Through the forensic investigation, Quorum has determined that the data files accessed and exfiltrated by the unauthorized actor contained certain personal information relating to Quorum policyholders and claimants. The types of personal information that may have been affected vary by individual, and not all of the data elements listed below were involved for every affected person. The categories of personal information potentially involved in this incident include the following:
• Names (first and last names)
• Dates of birth
• Social Security numbers
• Driver's license numbers or state identification numbers
• Financial information, including bank account numbers and payment card numbers (for a subset of affected individuals whose financial account information was maintained in connection with premium payments, claims disbursements, or related transactions)
• Protected health information, including health conditions, diagnosis codes, and treatment information related to workers' compensation claims and health-related insurance claims (for a subset of affected individuals whose claims involved health-related coverage)
Again, the specific types of information involved vary from individual to individual. Some individuals may have had only limited categories of information affected, while others may have had multiple categories of information involved.
Based on the results of the investigation, Quorum has determined that approximately 318,247 individuals across 29 states and the District of Columbia may have been affected by this incident.
What Quorum Is Doing
Quorum takes the security of personal information extremely seriously. Upon learning of this incident, Quorum moved swiftly to respond and to mitigate any potential harm to affected individuals. The steps that Quorum has taken include the following:
• Forensic Investigation. Quorum immediately engaged a nationally recognized forensic investigation firm to conduct a thorough and independent analysis of the incident, including determining the nature, scope, and timeline of the unauthorized access, and identifying the categories of information and the individuals potentially affected.
• Outside Legal Counsel. Quorum retained outside legal counsel experienced in data security incident response to advise on notification obligations, regulatory compliance, and related legal matters arising from the incident.
• Containment and Remediation. Quorum worked closely with Palomar to ensure that the unauthorized access was promptly contained and that the vulnerability in the file transfer application exploited by the threat actor was fully remediated. Quorum has confirmed with Palomar that additional technical safeguards have been implemented to reduce the risk of a similar incident in the future.
• Regulatory Notifications. Quorum has notified applicable state attorneys general and regulatory authorities in all affected jurisdictions, including the Connecticut Attorney General, the Connecticut Insurance Department, and the attorneys general of all other affected states. In addition, because certain affected individuals' protected health information was involved, Quorum has reported the incident to the U.S. Department of Health and Human Services, Office for Civil Rights, as required under applicable federal law.
• Direct Written Notification. Quorum is sending direct written notification letters to all individuals whose personal information was identified as potentially affected by this incident. These notification letters are being mailed beginning August 18, 2023, through Clearfield Notification Services LLC, a professional notification and call center services provider engaged by Quorum for this purpose.
• Complimentary Credit Monitoring and Identity Theft Protection. Quorum is offering all affected individuals complimentary credit monitoring and identity theft protection services for a period of twenty-four (24) months at no cost to the individual. Details regarding enrollment in these services are included in the direct written notification letters and are also available by calling the dedicated toll-free response line listed below.
• Vendor Accountability. Quorum has taken steps to hold Palomar Data Solutions, Inc. accountable for the security failures that led to this incident. These steps include demanding that Palomar implement enhanced data security measures and undertake specific contractual remediation actions to address the deficiencies identified during the investigation.
• Enhanced Vendor Risk Management. Quorum is conducting a comprehensive review of its vendor risk management program and is implementing strengthened security requirements, enhanced due diligence processes, and more rigorous ongoing monitoring protocols for all third-party service providers that access, process, store, or transmit personal information on behalf of Quorum.
Quorum remains committed to safeguarding the personal information entrusted to it and will continue to take all appropriate steps to protect the individuals affected by this incident.
What You Can Do
Quorum encourages all potentially affected individuals to take the following steps to help protect themselves against the possibility of identity theft or fraud:
Enroll in Complimentary Credit Monitoring and Identity Theft Protection Services. If you received a notification letter from Quorum regarding this incident, please follow the instructions included in your letter to enroll in the complimentary twenty-four (24) month credit monitoring and identity theft protection service being offered at no cost to you. If you did not receive a letter but believe you may be affected, please call the dedicated toll-free response line listed below for assistance.
Monitor Your Financial Accounts and Statements. We recommend that you regularly review your bank account statements, credit card statements, and explanation of benefits statements for any unauthorized or suspicious activity. If you identify any transactions or charges that you did not authorize, promptly report them to the relevant financial institution, credit card company, or health insurer. Early detection of unauthorized activity is one of the most effective steps you can take to protect yourself.
Place a Fraud Alert on Your Credit File. You have the right to place a free fraud alert on your credit file. A fraud alert tells creditors to take additional steps to verify your identity before opening a new account in your name. To place a fraud alert, contact any one of the three major credit reporting agencies listed below. A fraud alert placed with one agency will automatically be shared with the other two agencies.
Request a Free Credit Report. Under federal law, you are entitled to one free credit report per year from each of the three major credit reporting agencies. You may request your free credit reports by visiting www.AnnualCreditReport.com or by calling 1-877-322-8228. Reviewing your credit reports regularly can help you identify any accounts or inquiries that you did not authorize.
Consider Placing a Credit Freeze (Security Freeze) on Your Credit File. You have the right to place a credit freeze, also known as a security freeze, on your credit file at no cost. A credit freeze restricts access to your credit report, which can help prevent new accounts from being opened in your name. To place a credit freeze, you must contact each of the three major credit reporting agencies individually. Please note that placing a credit freeze may delay or interfere with the timely approval of any subsequent requests or applications you make regarding a new loan, credit, mortgage, insurance, government services, or payments, cellular phone, utilities, or extension of credit. The contact information for each of the three major credit reporting agencies is as follows:
Harborview Enterprises P.O. Box 105788 Atlanta, GA 30348
Phone: 1-800-685-1111
Website: www.Harborview Enterprises.com
Penrose Group P.O. Box 9554 Allen, TX 75013
Phone: 1-888-397-3742
Website: www.Penrose Group.com
Penmark Enterprises P.O. Box 2000 Chester, PA 19016
Phone: 1-800-909-8872
Website: www.Penmark Enterprises.com
File a Report with the Federal Trade Commission (FTC). If you believe you are a victim of identity theft, you may file a complaint with the Federal Trade Commission. The FTC provides resources and a step-by-step identity theft recovery plan. You may contact the FTC at:
Federal Trade Commission 600 Pennsylvania Avenue, NW Washington, DC 20580 Website: www.IdentityTheft.gov
Phone: 1-877-ID-THEFT (1-877-438-4338)
File a Police Report. If you suspect that you are a victim of identity theft, you also have the right to file a report with your local law enforcement agency. You may wish to obtain a copy of any police report you file, as it may be useful in disputing fraudulent charges or accounts.
Monitor Your Health Records and Explanation of Benefits Statements. If your health information may have been involved in this incident (for example, if you filed a workers' compensation claim or health-related insurance claim through Quorum), we recommend that you carefully review your explanation of benefits statements and medical records for any unauthorized medical claims, treatments, or other inaccuracies. If you identify any discrepancies or suspect that your health information has been misused, contact the relevant health insurer or healthcare provider promptly to report the issue and request corrections.
Information for Residents of Specific States
Individuals residing in certain states may have additional rights under applicable state law. A summary of certain state-specific rights is provided below. Residents of all affected states are encouraged to contact the Quorum dedicated toll-free response line listed in the "For More Information" section below for state-specific guidance and additional information regarding their rights.
Connecticut Residents. Under Connecticut law, you have the right to place a security freeze on your credit report at no charge. You may contact the credit reporting agencies listed above to place a security freeze. You also have the right to obtain information about the breach by contacting the Connecticut Attorney General's Office at:
Office of the Attorney General 165 Capitol Avenue Hartford, CT 06106
Phone: 1-860-808-5318
Website: www.ct.gov/ag
New York Residents. Under New York law, you have additional resources available from the New York Attorney General's Office, including the right to obtain a copy of any police report you file regarding identity theft and the right to request certain investigative records related to the incident. You may contact the New York Attorney General's Office at:
Office of the Attorney General The Capitol Albany, NY 12224-0341
Phone: 1-800-771-7755
Website: www.ag.ny.gov
California Residents. Under California law, you have additional rights, including the right to obtain a security freeze on your credit file at no charge. California residents may contact the California Attorney General's Office for more information about their rights at:
Office of the Attorney General California Department of Justice
Attn: Public Inquiry Unit
P.O. Box 944255 Sacramento, CA 94244-2550
Phone: 1-800-952-5225
Website: www.oag.ca.gov
Massachusetts Residents. Under Massachusetts law, you have the right to obtain a police report regarding identity theft and the right to place a security freeze on your credit file at no charge. You also have the right to request that the three major credit reporting agencies provide you with information regarding any fraudulent transactions resulting from the breach. Massachusetts residents may contact the Massachusetts Attorney General's Office at:
Office of the Attorney General One Ashburton Place Boston, MA 02108
Phone: 1-617-727-8400
Website: www.mass.gov/ago
Residents of all affected states may contact the Quorum dedicated response line for additional state-specific guidance.
For More Information
Quorum understands that you may have questions or concerns about this incident. A dedicated toll-free response line has been established to assist you. Trained representatives are available to answer your questions, help you determine whether your information may have been affected, and assist you with enrolling in the complimentary credit monitoring and identity theft protection services.
Dedicated Toll-Free Response Line (operated by Clearfield Notification Services LLC): Phone: 1-855-407-2291 Hours of Operation: Monday through Friday, 9:00 a.m. to 9:00 p.m. Eastern Time
If you prefer to submit a written inquiry, you may write to:
Quorum Insurance Holdings Corp.
Attn: Data Security Incident Response
400 Constitution Plaza, Suite 2200 Hartford, CT 06103
If you believe you may have been affected by this incident but did not receive a direct written notification letter from Quorum, we encourage you to call the dedicated toll-free response line above. A representative will be able to assist you in determining whether your information was involved and, if so, help you enroll in the complimentary credit monitoring and identity theft protection services being offered.
Additional Information
This notice is being provided pursuant to applicable state breach notification statutes as a supplement to the direct written notification letters being mailed to all affected individuals.
Date of original posting: August 15, 2023.
Direct written notification letters were mailed to affected individuals beginning August 18, 2023, through Clearfield Notification Services LLC.
This notice may be updated as additional information becomes available. Please check this page periodically for any updates.
© 2023 Quorum Insurance Holdings Corp. All rights reserved.
INTERNAL CALDERWOOD & HARKNESS LLP DRAFTING NOTES NOT FOR PUBLICATION
PRIVILEGED AND CONFIDENTIAL — ATTORNEY WORK PRODUCT Calderwood & Harkness LLP — Matter No. 1025-00006 Prepared by: Alan Burke (Lead Associate) and Sara Hendricks (Associate) Reviewed and Approved by: Kevin Ostrowski (Responsible Partner)
1. Purpose of Website Posting / Substitute Notice.
This website posting is intended to satisfy substitute notice requirements under applicable state data breach notification statutes that permit or require conspicuous website posting as a form of substitute notice. In certain jurisdictions, substitute notice by conspicuous website posting is authorized where direct written notice is not feasible for certain affected individuals, or as a supplement to direct mailing to enhance the reach and effectiveness of the notification effort. This posting is designed to supplement — and does not replace — the direct written notification letters being mailed to all 318,247 identified affected individuals through Clearfield Notification Services LLC.
2. Cross-Reference to State-by-State Notification Matrix.
The determination of which states permit or require substitute notice via conspicuous website posting was made by reference to the state-by-state notification matrix prepared by Calderwood & Harkness LLP, dated August 1, 2023, and maintained in the Matter No. 1025-00006 work files. That matrix identifies the specific statutory provisions in each of the 29 affected states and the District of Columbia governing substitute notice, including threshold requirements (e.g., cost thresholds, number of affected individuals) and required methods and duration of posting. The drafting team should ensure that the language in this posting satisfies the substantive content requirements of all applicable state statutes identified in the matrix.
3. Supplement to Direct Written Notification.
This website posting supplements, and does not replace, the direct written notifications being mailed to all 318,247 identified affected individuals through Clearfield Notification Services LLC. Direct written notification remains the primary method of notice for all identified affected individuals. The website posting serves as an additional form of notice to reach any individuals who may not receive or may not have received the direct mailing.
4. Duration of Posting.
This posting should remain on Quorum's corporate website (prominently linked from the homepage) for a minimum of ninety (90) days from the date of initial posting (i.e., through at least November 13, 2023), or such longer period as required by applicable state law. The drafting team should consult the state-by-state notification matrix to confirm that no jurisdiction requires a longer posting period. If any jurisdiction requires a posting period in excess of 90 days, the posting should remain live for the full duration required by the most restrictive applicable statute.
5. Approval.
This language was reviewed and approved by Kevin Ostrowski (Responsible Partner) and Alan Burke (Lead Associate), Calderwood & Harkness LLP, Matter No. 1025-00006, on August 14, 2023. Final client approval from Quorum Insurance Holdings Corp. (General Counsel, David Whitfield) is pending as of the date of this draft.
6. Coordination with Communications Strategy.
Timing of the website posting must be coordinated with BrightPath Consulting Group Inc. (contact: Meredith Ashford, Senior Vice President, Crisis Communications) to ensure alignment with the broader communications strategy for the incident, including any media inquiries, employee communications, and regulator interactions. The posting should not go live until BrightPath has confirmed readiness of all related communications materials.
7. Call Center Readiness.
Prior to the posting going live on Quorum's website, the drafting team must confirm with Clearfield Notification Services LLC (contact: Jerome Tillman, Director of Client Services) that the dedicated toll-free call center is fully operational, staffed with trained representatives, and prepared to handle the anticipated call volume that may result from the public posting. The call center must be live and functional before the website posting is published.
8. Toll-Free Number.
The toll-free number included in this posting (1-855-407-2291) should be confirmed with Clearfield Notification Services LLC prior to publication. If the number changes or is not yet activated, the posting must be updated accordingly before going live.
END OF INTERNAL DRAFTING NOTES — NOT FOR PUBLICATION

NOTICE OF DATA SECURITY INCIDENT

INTERNAL CALDERWOOD & HARKNESS LLP DRAFTING NOTES NOT FOR PUBLICATION

Record

Parties

Dates

Amounts