Dear AAG Marchetti and AAG Petrosian,
I hope this message finds you well. I am writing on behalf of our client, Quorum Insurance Holdings Corp. (Nasdaq: QIHC), to transmit the enclosed Supplemental Information Submission to the 29-state multistate attorney general coalition, which you jointly lead. This submission is attached as a PDF to this email.
As you know, Quorum provided a comprehensive written response on October 13, 2023, together with Exhibits A through D, in response to the coalition's joint demand letter dated September 8, 2023. The enclosed supplemental submission responds to the coalition's subsequent requests for additional information and addresses two principal categories of materials, summarized briefly below.
**1. Updated Credit Monitoring Enrollment Statistics**
As detailed in our October 13 response, consumer notification mailings were completed during the window of August 18 through September 15, 2023, reaching all 318,247 affected individuals across 29 states and the District of Columbia. Each notified individual was offered 24 months of complimentary credit monitoring and identity theft protection services through Clearfield Notification Services LLC.
We are now able to provide updated enrollment figures. As of the date of this submission, approximately 127,299 individuals have enrolled in the credit monitoring program, reflecting an approximately 40% take-rate. Call center operations, administered by Clearfield, were active for a 12-week window following the commencement of notifications and handled inquiries from affected individuals throughout that period. Clearfield continues to administer the credit monitoring program, which remains available to all notified individuals for the full 24-month term.
**2. Palomar Data Solutions Vendor Accountability — Settlement Summary**
On October 27, 2023, Quorum and Palomar Data Solutions, Inc. reached a negotiated resolution of Quorum's indemnification claims arising from the data security incident. The principal terms of the settlement are as follows:
- A cash payment of $4,200,000 from Palomar to Quorum; - An 18-month fee reduction of 8% under the Master Services Agreement (originally dated November 12, 2019, as amended), representing approximately $1,956,000 in savings (calculated based on the $16,300,000 annual contract value × 8% × 1.5 years); - Total effective recovery to Quorum of approximately $6,156,000; - Palomar's engagement, at its own expense, of an independent third-party security assessor to conduct enhanced annual security audits of Palomar's information security environment; and - Palomar's commitment to implement enhanced patch management protocols and endpoint detection and response (EDR) capabilities within 90 days of the settlement date.
These enhanced security obligations were formalized through a Third Amendment to the MSA ("Amendment 3"), executed October 27, 2023. Amendment 3 also shortened the incident notification window from 48 hours to 24 hours and reduced the critical vulnerability patching window from 30 days to 14 days.
The settlement reflects Quorum's position that Palomar breached its data security obligations under Exhibit D of the MSA by failing to timely patch CVE-2023-0669 — the GoAnywhere MFT vulnerability that served as the threat actor's entry vector — and by providing late notification to Quorum, approximately 24 hours past the contractual 48-hour requirement.
**Contextual Background**
We respectfully reiterate that this incident was vendor-originated. The unauthorized access occurred within Palomar's network environment, not Quorum's. Quorum's own information security program was not compromised; the breach resulted from the exploitation of an unpatched vulnerability in Palomar's managed file transfer appliance.
Quorum filed all required consumer and regulatory notifications in a timely manner across all 29 affected states and the District of Columbia, including notifications to both the Connecticut Attorney General's Office (filed August 14, 2023) and the New York Attorney General's Office (filed August 16, 2023).
**Continued Cooperation**
Quorum remains committed to full transparency and cooperation with the coalition. Should you or any members of the coalition require additional information, or should you find it helpful to schedule a call or meeting to discuss any aspect of this submission, please do not hesitate to contact me or Kevin Ostrowski, the responsible partner on this matter, at the contact information provided below.
Thank you for your continued engagement and attention to this matter. We appreciate the coalition's thoughtful approach and look forward to continuing to work with you toward resolution.
Respectfully,
**Alan Burke** Associate Calderwood & Harkness LLP Privacy & Data Security Practice 1700 K Street NW, Suite 900 Washington, D.C. 20006 Direct: (202) 555-4138 Email: aburke@calderwoodharkness.com
**Kevin Ostrowski**, Partner Direct: (202) 555-4102 Email: kostrowski@calderwoodharkness.com
Calderwood & Harkness Matter No. 1025-00006
**Attachment:** Supplemental Information Submission to Multistate Attorney General Coalition (November 3, 2023) [PDF]
---
*CONFIDENTIALITY NOTICE: This email message and any attachments are intended solely for the use of the individual or entity to whom they are addressed and may contain information that is privileged, confidential, and exempt from disclosure under applicable law, including attorney-client privileged communications and attorney work product. If you are not the intended recipient, you are hereby notified that any dissemination, distribution, copying, or other use of this message or its attachments is strictly prohibited. If you have received this communication in error, please notify the sender immediately by reply email and permanently delete the original message and all attachments. Thank you.*