Tom, Jennifer, Margaret —
I am pleased to report that we received this morning the closure letter from the multistate attorney general coalition regarding its inquiry into the Palomar Data Solutions data breach. The 29-state coalition has closed its investigation without taking any enforcement action against Quorum Insurance Holdings Corp. The closure letter, dated today, is signed on behalf of the coalition by AAG Diane Marchetti of the Connecticut Attorney General's Office, Consumer Protection Division, and AAG Mark Petrosian of the New York Attorney General's Office, Bureau of Internet and Technology. I have attached a copy for your review.
**Summary of the AG Engagement**
For context, the following is a brief recap of the timeline of this engagement:
- **September 8, 2023:** Joint demand letter received from the 29-state coalition, led by the Connecticut and New York Attorneys General. - **October 13, 2023:** Calderwood & Harkness submitted a comprehensive written response on Quorum's behalf, accompanied by Exhibits A through D (incident timeline and remedial measures; consumer notification samples and compliance checklist; Palomar vendor accountability summary; and Quorum information security program overview). - **November 3, 2023:** Supplemental information submission provided at the coalition's request, including updated credit monitoring enrollment statistics and a summary of the October 27, 2023 settlement agreement with Palomar Data Solutions. - **November 22, 2023:** Closure letter received — no enforcement action.
**Key Themes From the Closure Letter**
The closure letter contains several noteworthy elements that reflect favorably on Quorum's response:
- The coalition acknowledged the **vendor-originated nature** of the breach, recognizing that it originated at Palomar Data Solutions and not within Quorum's own systems or infrastructure. - The letter specifically recognized Quorum's **timely and comprehensive consumer notification program**, noting that 318,247 individuals across 29 states and the District of Columbia were notified between August 18 and September 15, 2023. - The AGs acknowledged the **remediation steps** taken, including the 24-month credit monitoring and identity theft protection offered to all affected individuals. - The letter noted Quorum's **vendor accountability actions**, including the indemnification settlement with Palomar and the enhanced security requirements imposed via MSA Amendment 3. - The coalition recognized Quorum's **cooperative and transparent engagement** throughout the inquiry process.
I should note, as you will see in the attached letter, that the closure includes standard reservation-of-rights language stating that the closure does not constitute an approval of Quorum's data security practices and does not preclude future action if new information arises. This is boilerplate language included in virtually all multistate AG closure letters and is not a cause for concern.
**Remaining Open Regulatory Tracks**
While this closure is a significant milestone, two regulatory matters remain open. We expect both to close favorably in the near term:
1. **Connecticut Insurance Department inquiry** — This inquiry is being handled by Examiner Richard Nakamura in the Financial Analysis Division, Cybersecurity Unit. We submitted the initial response on September 22, 2023, and supplemental information on October 20, 2023. We have received no follow-up requests and anticipate closure shortly.
2. **HHS-OCR inquiry (Region I, Boston)** — This inquiry relates to the HIPAA breach notification for the 41,203 individuals whose protected health information was compromised. We submitted our response on October 5, 2023. We also anticipate closure of this matter without further action.
We will promptly advise you when closures are received on either of these remaining tracks.
**Assessment**
This is a very favorable outcome. The multistate coalition encompassed all 29 states where affected individuals reside, and its closure without enforcement action eliminates the most significant remaining regulatory exposure arising from the Palomar breach. The result reflects the strength of Quorum's incident response across multiple dimensions: the vendor-originated nature of the breach, timely notifications that met all applicable statutory deadlines, a robust credit monitoring offering, and meaningful vendor accountability measures.
Notably, the Palomar settlement — the $4,200,000 cash payment plus the 18-month 8% fee reduction totaling approximately $6,156,000 in effective recovery — and the enhanced security measures under MSA Amendment 3 were among the key factors cited by the coalition in reaching its determination. These measures demonstrated to the AGs that Quorum took the breach seriously and held its vendor accountable.
**Next Steps**
- We will prepare a detailed analysis memorandum for distribution to the team early next week (we are targeting Monday, November 27). - I recommend that this development be included in the next briefing to the Board Audit Committee and Chairman Franklin Reeves. We are happy to assist in preparing materials for that presentation. - We will continue to monitor the Connecticut Insurance Department and HHS-OCR tracks and provide updates as developments occur. - Once all three regulatory tracks are closed, we will prepare a comprehensive matter closing memorandum and post-incident recommendations for the team's consideration.
This is a strong result, and it reflects the quality of Quorum's incident response and the collaborative effort across your team. The speed and thoroughness with which Quorum acted — from notification through remediation and vendor accountability — made a meaningful difference in the outcome. Please do not hesitate to reach out if you would like to discuss by phone at your convenience, including over the holiday weekend.
Best regards,
**Kevin Ostrowski** Partner, Privacy & Data Security Calderwood & Harkness LLP 1700 K Street NW, Suite 900 Washington, D.C. 20006 (202) 555-4718 kostrowski@calderwoodharkness.com
Calderwood & Harkness Matter No. 1025-00006
Attachment: Multistate AG Closure Letter (November 22, 2023) (PDF)
---
*CONFIDENTIALITY NOTICE: This email message, including any attachments, is a confidential attorney-client privileged communication and/or attorney work product. It is intended solely for the use of the individual(s) to whom it is addressed. If you are not an intended recipient, you are hereby notified that any review, disclosure, copying, distribution, or use of this communication or any of its contents is strictly prohibited. If you have received this communication in error, please notify the sender immediately by reply email and permanently delete all copies of this message and any attachments. This communication should not be forwarded or disclosed to any third party without the prior written approval of counsel. Thank you.*