Tom and Jennifer,
I am writing to alert you to a significant regulatory development in the Palomar data incident matter (Calderwood & Harkness Matter No. 1025-00006). This afternoon, our office received a joint demand letter issued by the Connecticut Attorney General's Office and the New York Attorney General's Office, acting on behalf of a multistate coalition of 29 state attorneys general. The letter is signed by Assistant Attorney General Diane Marchetti of the Connecticut AG's Consumer Protection Division and Assistant Attorney General Mark Petrosian of the New York AG's Bureau of Internet and Technology. I have attached a copy of the demand letter for your immediate review. Please see "Multistate AG Joint Demand Letter (Sept. 8, 2023).pdf."
The coalition comprises the 29 states in which affected individuals reside and potentially the District of Columbia. While the letter is styled as an investigative inquiry and does not allege any specific statutory violation at this stage, its scope and tone make clear that the coalition is conducting a thorough examination of Quorum's response to the incident and, in particular, its vendor oversight practices with respect to Palomar Data Solutions, Inc. I want to walk you through the substance of the letter, share my initial assessment, and lay out the steps we need to take promptly.
The demand letter requests detailed information across several categories. First, the coalition seeks a full timeline of the incident, from the initial unauthorized access on March 14, 2023, through Quorum's discovery and consumer notification efforts. Second, it requests a comprehensive explanation of the root cause of the breach, including the exploitation of CVE-2023-0669, the GoAnywhere MFT vulnerability, at Palomar's environment. Third, the letter asks for a detailed accounting of the scope of compromised data — the 318,247 affected individuals, the categories of PII involved (names, dates of birth, Social Security numbers, driver's license numbers), the 84,619 individuals whose financial information was exposed, and the 41,203 individuals whose protected health information was compromised. Fourth, the coalition requests information regarding Quorum's vendor oversight and risk management practices concerning Palomar, including the contractual data security requirements under the Master Services Agreement dated November 12, 2019, as amended. Fifth, the letter seeks details of Quorum's consumer notification efforts, including the content of the notification letters, the mailing window of August 18 through September 15, 2023, and the credit monitoring and identity theft protection offering of 24 months. Sixth, the coalition asks about remedial measures taken by both Quorum and Palomar, including Palomar's remediation of the vulnerability and any contractual accountability measures Quorum has pursued. Finally, the letter requests information about Quorum's own information security program and any enhancements implemented in response to the incident. The letter sets a response deadline of approximately 35 days from receipt, which places our submission date at approximately October 13, 2023.
Let me share my initial assessment. The demand is broad, but it is consistent with what we anticipated and have been preparing for. Nothing in the letter catches us off guard. Several factors position Quorum favorably. Most importantly, this was a vendor-originated breach — Palomar's failure to timely patch a known vulnerability, not a failure in Quorum's own systems or security controls. The attorneys general will want to see that Quorum exercised appropriate vendor oversight, and we will need to present that case carefully, but the fundamental narrative is one of a vendor's operational failure, not a lapse in Quorum's own environment. Quorum's timely compliance with all applicable state notification statutes is another strong point; all regulatory filings were made between August 14 and August 25, 2023, and all fell within the statutory deadlines of each respective jurisdiction. The consumer-facing response — 24 months of credit monitoring and identity theft protection services, administered through Clearfield Notification Services — reflects a robust and consumer-friendly approach that should be well received.
On the vendor accountability front, Palomar's contractual breaches are well documented and should be presented as part of our narrative. Palomar failed to patch the GoAnywhere vulnerability within 30 days as required under Exhibit D of the MSA, and its notification to Quorum came approximately 24 hours past the 48-hour contractual notification requirement in Section 9.4. Our ongoing indemnification negotiations with Palomar — Quorum's demand of $8,230,250, Palomar's inadequate initial response offering only a $1,500,000 goodwill credit, and the rebuttal letter we sent on July 25 — can and should be referenced in the response to demonstrate that Quorum is actively holding its vendor accountable. This is precisely the kind of fact pattern the attorneys general want to see from the data controller.
Turning to next steps, I recommend we move promptly on the following items:
1. Internal kick-off call. I would like to schedule a call early the week of September 11 with you, Jennifer, David Naranjo, and Priya Deshmukh to discuss our response strategy in detail. We will prepare a detailed strategy memo in advance of that call so that our discussion can be focused and productive.
2. Engagement scope expansion. This multistate AG inquiry, combined with the pending Connecticut Insurance Department engagement and the HHS-OCR inquiry, warrants formally expanding the scope of Calderwood & Harkness's engagement to encompass regulatory defense. I will send a scope expansion letter separately; you should expect to receive that on or about September 10.
3. Strategy memorandum. Alan Burke and the team will prepare a comprehensive strategy memo analyzing the demand letter point by point, identifying the key themes and sensitivities, and recommending our approach for the response. We are targeting delivery of that memo by September 11, 2023.
4. Document and information gathering. Tom and Jennifer, I would ask that you begin assembling the key internal documents we will need to prepare the response. Specifically, we will need Quorum's information security program documentation; vendor risk management policies and all Palomar oversight records from Priya Deshmukh's files; the complete Palomar MSA document set, including the original MSA, Amendment 1 dated March 3, 2021, and Amendment 2 dated September 15, 2022, with particular attention to Exhibit D (Data Security) and Exhibit E (Insurance Requirements); copies of all consumer notification letter versions sent (PII, financial, PHI, the California-specific version, and the Massachusetts-specific version); confirmation of all regulatory filings, which should be cross-referenced against the regulatory notification tracker we finalized on August 25, 2023; relevant internal communications regarding the incident response; and any post-incident remediation or security enhancement documentation.
5. Response timeline. We will target submission of the formal response by the October 13 deadline. The response will likely include several exhibits, including a detailed incident timeline, consumer notification letter samples, a vendor accountability summary, and an overview of Quorum's information security program.
6. Board notification. Tom, I recommend that you brief Franklin Reeves, as Chair of the Audit Committee, on this development at your earliest opportunity. We are happy to assist you in preparing a concise update for that conversation.
7. Insurance notification. We should consider whether it is appropriate at this time to notify Atlas Mutual Insurance Company — Paul Enriquez is our contact there — that regulatory defense costs may be incurred in connection with this multistate inquiry. Regulatory defense costs are covered under Policy No. CYB-2023-041587 in excess of the $2,500,000 self-insured retention. Rachel Bernstein will take the lead on coordinating with Atlas on coverage and notification.
8. Crisis communications. I would suggest coordinating with Meredith Ashford at BrightPath Consulting Group to ensure we have a media response framework in place in the event the multistate inquiry generates press attention. At this stage, the inquiry itself is not public, and I do not expect immediate media interest, but prudent preparation is warranted.
Tom, Jennifer — I want to be clear that while this is a serious development that demands our full attention, it is a manageable one. Quorum's proactive, comprehensive response to the Palomar incident — timely notifications, a strong consumer protection offering, documented vendor accountability efforts — positions you well. It is my strong recommendation that we take a cooperative and transparent approach with the multistate coalition. In my experience, that posture offers the best path to closure without enforcement action, and the facts here support it.
I am available to discuss the letter by phone this evening or at any point over the weekend if either of you would like to talk through it in more detail. Please do not hesitate to call my cell.
Best regards,
Kevin M. Ostrowski Partner Calderwood & Harkness LLP 1700 K Street NW, Suite 950 Washington, DC 20006 (202) 555-0174 (direct) (202) 555-0938 (cell) kostrowski@calderwoodharkness.com
---
PRIVILEGED & CONFIDENTIAL — ATTORNEY-CLIENT COMMUNICATION / ATTORNEY WORK PRODUCT
This email and any attachments are protected by the attorney-client privilege and/or the work product doctrine and are intended solely for the use of the addressee(s). This communication contains confidential legal advice and analysis. If you are not the intended recipient, please notify the sender immediately and delete this message. This communication should not be forwarded, disclosed, or shared with any third party without the prior written consent of counsel, as doing so may result in a waiver of applicable privileges.