Dear Assistant Attorney General Marchetti and Assistant Attorney General Petrosian:
I write on behalf of our client, Quorum Insurance Holdings Corp. ("Quorum"), a Delaware corporation publicly traded on the Nasdaq Stock Market (ticker: QIHC), with its principal offices at 400 Constitution Plaza, Suite 2200, Hartford, Connecticut 06103. Calderwood & Harkness LLP serves as outside counsel to Quorum in connection with this matter.
The purpose of this correspondence is to transmit Quorum's formal written response to the Joint Demand Letter dated September 8, 2023 (the "Joint Demand Letter"), issued by the Office of the Connecticut Attorney General and the Office of the New York Attorney General on behalf of the 29-state multistate coalition. The enclosed response addresses each of the items and inquiries raised in the Joint Demand Letter, and Quorum has endeavored to provide thorough and transparent information responsive to each area of inquiry.
**Summary of Enclosed Materials**
The following materials are attached to this email:
**1. Written Response Brief.** Quorum's comprehensive narrative response addresses the following topics in detail:
- **The Data Security Incident.** The incident originated at Quorum's third-party claims-processing vendor, Palomar Data Solutions, Inc. ("Palomar"), and involved the exploitation of a known vulnerability (CVE-2023-0669) in Palomar's file transfer appliance. Quorum itself was not the subject of a direct intrusion; rather, the unauthorized access occurred within Palomar's systems and affected data that Palomar maintained on Quorum's behalf.
- **Incident Timeline.** Initial unauthorized access occurred on or about March 14, 2023. Palomar discovered the unauthorized access on April 18, 2023, and notified Quorum on April 21, 2023. Upon receipt of Palomar's notification, Quorum promptly engaged outside counsel and retained qualified forensic investigators to assess the nature and scope of the incident. The response details the progression of the forensic investigation through its completion, as well as the subsequent consumer and regulatory notification process.
- **Scope of the Breach.** The incident affected approximately 318,247 individuals across 29 states and the District of Columbia. The categories of compromised data include personally identifiable information, financial information (affecting approximately 84,619 individuals), and protected health information (affecting approximately 41,203 individuals).
- **Remedial Measures.** Quorum's comprehensive remedial actions undertaken in response to the incident.
- **Consumer Notification Compliance.** Quorum's consumer notification efforts across all affected jurisdictions, demonstrating compliance with applicable state breach notification statutes.
- **Vendor Accountability.** Actions taken by Quorum to hold Palomar accountable for its role in the incident.
**2. Exhibit A — Incident Timeline and Remedial Measures Summary.** A detailed chronological timeline spanning from the date of initial unauthorized access (March 14, 2023) through the present, including all remedial steps undertaken by Quorum and required of Palomar.
**3. Exhibit B — Consumer Notification Samples and Compliance Checklist.** Copies of all consumer notification letter versions issued in connection with the incident, including the general PII notification, the SSN and financial data notification, the PHI/HIPAA-compliant notification, the California-specific notification, and the Massachusetts-specific notification. This exhibit also includes a jurisdiction-by-jurisdiction compliance checklist demonstrating that Quorum's notifications satisfied applicable statutory requirements with respect to timing, content, and method of delivery. Consumer notification mailings were transmitted during the window of August 18 through September 15, 2023.
**4. Exhibit C — Palomar Vendor Accountability Summary.** A summary of Quorum's vendor accountability actions with respect to Palomar, including identification of Palomar's contractual breaches — specifically, Palomar's failure to apply the relevant security patch within the 30-day remediation window required under the Data Security Exhibit to the parties' Master Services Agreement, and Palomar's notification to Quorum approximately 24 hours beyond the 48-hour notification requirement set forth in that agreement. This exhibit also addresses Quorum's indemnification demand under the Master Services Agreement dated November 12, 2019 (as amended), and the ongoing vendor remediation requirements that Quorum has imposed.
**5. Exhibit D — Quorum Information Security Program Overview.** A description of Quorum's information security program, including its governance structure, vendor risk management program, technical safeguards, and post-incident enhancements implemented in response to the incident.
**Continued Cooperation**
Quorum remains committed to cooperating fully with the multistate coalition's review of this matter. Should your offices require any additional information, documentation, or clarification beyond what has been provided in the enclosed materials, please do not hesitate to contact me directly. We are prepared to respond promptly to any follow-up questions or requests for supplemental information.
**Reservation of Rights**
Please note that this submission is made voluntarily and in the spirit of full cooperation with the multistate coalition. Quorum expressly reserves all applicable rights and privileges, including, without limitation, the attorney-client privilege and attorney work product protections, with respect to any materials not included in this submission. Nothing in this submission is intended to constitute a waiver of any such rights or privileges.
Thank you for your attention to this matter. We look forward to continuing to work constructively with your offices.
Respectfully,
Kevin Ostrowski Partner, Privacy & Data Security Calderwood & Harkness LLP 1700 K Street NW, Suite 900 Washington, D.C. 20006 Tel: (202) 555-4100 Email: kostrowski@calderwoodharkness.com
---
*CONFIDENTIALITY NOTICE: This email message, including any attachments, is intended solely for the use of the individual(s) or entity to whom it is addressed and may contain information that is privileged, confidential, and exempt from disclosure under applicable law. If you are not the intended recipient, or the employee or agent responsible for delivering this message to the intended recipient, you are hereby notified that any dissemination, distribution, or copying of this communication is strictly prohibited. If you have received this email in error, please notify the sender immediately by reply email and permanently delete the original message and all copies. Thank you.*