Tom,
I am writing to confirm that Calderwood & Harkness is formally closing Matter No. 1025-00006, effective today, December 1, 2023. This engagement spanned approximately seven months and 212 days from our initial retention on May 4 through today's final resolution. I wanted to provide you and Jennifer with a comprehensive summary of outcomes across all workstreams before we close the file.
By any measure, the result here is favorable. All regulatory tracks have been closed without enforcement action, vendor accountability has been achieved through a meaningful settlement and enhanced contractual protections, and insurance recovery has been secured well in excess of Quorum's out-of-pocket exposure. Given the scope of this matter — a vendor-originated breach affecting 318,247 individuals across 29 states and the District of Columbia — these outcomes reflect the strength of Quorum's response posture and the quality of coordination across your team.
As you will recall, the incident originated from Palomar Data Solutions' failure to timely patch a known vulnerability (CVE-2023-0669) in its GoAnywhere MFT appliance, which resulted in an approximately 35-day exfiltration window running from mid-March through mid-April 2023. Palomar's notification to Quorum came roughly 24 hours past the 48-hour contractual requirement under Section 9.4 of the MSA — a fact that proved significant in our subsequent indemnification discussions. When the multistate regulatory inquiry materialized in September, we expanded the engagement scope on September 10 to encompass the regulatory defense and vendor indemnification workstreams, which ultimately constituted the most consequential components of the matter.
Below is a summary of outcomes across each major track.
**Regulatory Outcomes**
*Multistate Attorney General Coalition.* On September 8, 2023, we received a joint demand letter from AAG Diane Marchetti of the Connecticut Attorney General's office and AAG Mark Petrosian of the New York Attorney General's office, acting on behalf of a 29-state coalition. We submitted our comprehensive response on October 13, including Exhibits A through D, followed by a supplemental information submission on November 3. On November 22, the coalition issued a formal closure letter confirming no enforcement action. The coalition expressed satisfaction with Quorum's response, notification compliance, and remediation measures.
*Connecticut Insurance Department.* We filed the required notification on August 14, 2023, pursuant to Conn. Gen. Stat. § 38a-999b. Following our inquiry response on September 22 and a supplemental submission on October 20, Examiner Richard Nakamura confirmed closure of the Department's inquiry on November 28, 2023.
*HHS Office for Civil Rights.* Our breach notification was filed on August 15, 2023, under 45 C.F.R. § 164.408, covering the subset of 41,203 individuals whose protected health information was compromised. We submitted our inquiry response on October 5, and HHS-OCR issued a no further action letter yesterday, November 30, 2023.
Importantly, all consumer and regulatory notifications across all 29 states and the District of Columbia were filed timely between August 14 and August 25, 2023, and every applicable statutory deadline was met without exception.
**Vendor Accountability — Palomar Settlement**
We executed the Settlement Agreement and Mutual Release with Palomar Data Solutions, Inc. on October 27, 2023. The key terms include a $4,200,000 cash payment from Palomar to Quorum, due within 30 days of execution, together with an 18-month fee reduction of 8% on the MSA annual contract value, yielding approximately $1,956,000 in fee savings over that period. The total effective recovery from Palomar is $6,156,000.
Concurrently, we negotiated and executed MSA Amendment 3, which imposes materially enhanced data security obligations on Palomar going forward. These include a reduction of the critical patching window from 30 days to 14 days, mandatory deployment of endpoint detection and response capabilities, quarterly vulnerability scanning, an annual independent security assessment conducted at Palomar's expense, and a reduction of the incident notification window from 48 hours to 24 hours. Palomar's implementation deadline for the enhanced patch management and endpoint detection requirements is 90 days from execution. These enhanced provisions address the specific failures that gave rise to this incident and position Quorum with considerably stronger contractual protections for the ongoing vendor relationship.
**Consumer Notification Summary**
A total of 318,247 consumer notification letters were mailed in rolling mailings from August 18 through September 15, 2023. We deployed three versions of notification letters — general PII, financial data, and a PHI/HIPAA-compliant version — along with California-specific and Massachusetts-specific variants to address those states' particular requirements. All affected individuals were offered 24 months of complimentary credit monitoring and identity theft protection through Clearfield Notification Services LLC. The call center operated for a 12-week window, and I am pleased to report there were no significant escalation issues throughout the notification period.
**Insurance Coverage**
The claim was filed with Atlas Mutual Insurance Company on May 8, 2023, under Policy No. CYB-2023-041587, Claim No. CYB-CLM-2023-05892. Atlas acknowledged coverage and accepted covered costs in excess of the $2,500,000 self-insured retention. On November 15, we submitted our proof of loss and final cost summary requesting reimbursement of $5,730,250, representing total incident costs of $8,230,250 less the SIR. Total costs remained well within the $15,000,000 primary policy limit, and the Pinnacle Surplus Lines excess layer was not implicated.
Rachel will continue to coordinate with Paul Enriquez at Atlas regarding final claims payment processing. This is purely administrative and does not require the engagement to remain open.
**Financial Summary — Total Incident Costs and Recovery**
For your records, the total incident response costs were $8,230,250, broken down as follows:
- Graystone Forensics LLC (forensic investigation): $1,847,000 - Clearfield Notification Services LLC (notification, call center, credit monitoring): $3,214,500 - BrightPath Consulting Group Inc. (crisis communications): $385,000 - Calderwood & Harkness LLP (legal fees): $2,163,750 - Quorum internal costs (IT remediation, employee overtime): approximately $620,000
Against those costs, Quorum's recovery sources are as follows:
- Palomar settlement (cash payment plus fee reduction): $6,156,000 - Atlas Mutual insurance reimbursement (pending final processing): $5,730,250
The combined recovery of $11,886,250 significantly exceeds total incident costs, reflecting the favorable positioning we were able to achieve through both the insurance coverage and the vendor indemnification track.
**Attachments**
I am attaching two memoranda for your review:
First, a Post-Incident Lessons Learned and Remediation Recommendations Memo, dated November 30, 2023, prepared by Alan and me and addressed to you, Jennifer, David Naranjo, and Priya Deshmukh. This memo sets out our recommendations for enhancing Quorum's vendor risk management framework, shortening contractual notification windows across your vendor portfolio, expanding third-party audit requirements, implementing regular tabletop exercises, and reviewing data minimization practices. I would encourage the leadership team to review these recommendations and would welcome the opportunity to discuss implementation priorities at your convenience.
Second, a Document Retention and Privilege Log Protocol Memo, dated today, prepared by Alan and addressed to you and Jennifer. This memo establishes the protocol for retention and organization of all privileged and non-privileged documents related to this matter, including privilege log maintenance, recommended retention periods, segregation of attorney-client privileged materials and work product, and procedures for handling any future document requests or discovery demands. I would underscore the importance of adhering to this protocol to maintain privilege protections going forward.
**Closing**
Tom, I want to express my genuine appreciation for the working relationship we have had with you, Jennifer, David, Priya, and the broader Quorum team throughout this matter. The smooth coordination and Quorum's consistently proactive approach contributed materially to the favorable outcomes we achieved across every workstream. I also want to acknowledge the strong collaboration across the full incident response team, including the professionals at Graystone Forensics, Clearfield Notification Services, and BrightPath Consulting Group, each of whom performed well under significant time pressure.
Rachel, Alan, and I remain available for any follow-up questions as you work through the attached recommendations and document retention protocol. We would also welcome the opportunity to assist with any future vendor risk matters, privacy and data security needs, or other issues where we can be of service.
It was a privilege to work with your team on this engagement, and I am glad we were able to bring it to a successful close.
Best regards,
Kevin M. Ostrowski Partner, Privacy & Data Security Calderwood & Harkness LLP 1700 K Street NW, Suite 900 Washington, D.C. 20006 T: (202) 555-4180 E: kostrowski@calderwoodharkness.com
---
CONFIDENTIALITY NOTICE: This electronic message and any attachments are confidential and may be protected by the attorney-client privilege, the work product doctrine, or other applicable protections. This communication is intended solely for the use of the individual or entity to whom it is addressed. If you are not the intended recipient, or the employee or agent responsible for delivering the message to the intended recipient, you are hereby notified that any review, dissemination, distribution, or copying of this communication is strictly prohibited. If you have received this communication in error, please notify the sender immediately by reply e-mail and permanently delete the original message and all copies. Thank you.