Tom and David,
I am writing in my capacity as General Counsel of Palomar Data Solutions, Inc. ("Palomar"). This email constitutes formal notification pursuant to Section 9.4 of the Master Services Agreement dated November 12, 2019, as amended (the "MSA"), between Palomar Data Solutions, Inc. and Quorum Insurance Holdings Corp. ("Quorum"). This communication is confidential and is subject to any applicable common interest privileges and the contractual confidentiality obligations set forth in the MSA.
**Description of Incident**
On April 18, 2023, Palomar's Security Operations Center ("SOC") detected anomalous outbound data transfer activity originating from systems within Palomar's claims data processing environment. Upon detection, Palomar immediately initiated its incident response protocols, including isolation of affected systems and engagement of internal cybersecurity personnel.
Our preliminary investigation indicates that an unauthorized third party gained access to certain Palomar network systems. Based on initial log analysis, the unauthorized access may have commenced on or about March 14, 2023. The threat actor appears to have exploited a vulnerability in Palomar's file transfer appliance — specifically, the GoAnywhere MFT platform — to gain initial access to Palomar's environment.
[*AB Note (5/4/23): Palomar's SOC discovered the anomalous activity on April 18, 2023. This notification was sent April 21, 2023, at 4:47 PM EDT — approximately 72 hours after discovery. MSA Section 9.4 requires notification within 48 hours of discovery of a security incident affecting Quorum data. The notification is therefore approximately 24 hours late. This constitutes a documented breach of the MSA notification obligation and should be flagged for the indemnification analysis under Section 12.2 and any demand letter.*]
[*AB Note (5/4/23): The referenced vulnerability is almost certainly CVE-2023-0669 — a known remote code execution vulnerability in Severin Corporation's GoAnywhere MFT platform. A patch for this vulnerability was publicly available prior to March 14, 2023 (the apparent date of initial unauthorized access). MSA Exhibit D (Data Security Requirements), as amended by Amendment 2 dated September 15, 2022, requires Palomar to patch critical vulnerabilities within 30 days of vendor patch release. Need to confirm exact patch release date and Palomar's patching timeline during the forensic investigation to establish whether Palomar failed to meet the 30-day patching requirement. If so, this would constitute a separate breach of the MSA data security obligations.*]
Palomar is still assessing the full scope and nature of the incident. However, based on our preliminary findings, we believe that data processed on behalf of Quorum may have been accessed or exfiltrated during the period of unauthorized access.
[*AB Note (5/4/23): Based on Copeland's statements, unauthorized access commenced on or about March 14, 2023, and was not detected until April 18, 2023. The potential exfiltration window is therefore approximately 35 days. This extended dwell time raises significant questions about the adequacy of Palomar's monitoring and detection capabilities and is relevant to the analysis of Palomar's data security obligations under Exhibit D.*]
**Data Potentially Affected**
The affected systems reside within Palomar's claims data processing environment, which processes personal lines claims data for Quorum under the MSA. The categories of data potentially at risk include:
- Policyholder and claimant names - Dates of birth - Social Security numbers - Driver's license numbers - Financial account information - Claims-related information, which may include health-related data associated with workers' compensation and health-related claims
We are working diligently to determine the precise volume and categories of data that may have been compromised. We will provide a more detailed assessment as the investigation progresses.
[*AB Note (5/4/23): The data categories described — including SSNs, financial account information, and health-related claims data — suggest the breach could trigger (1) state breach notification obligations across multiple jurisdictions, (2) HIPAA Breach Notification Rule obligations with respect to the PHI component from workers' compensation and health claims, and (3) obligations under the Connecticut Insurance Data Security Law (Conn. Gen. Stat. § 38a-38 et seq.). Forensic investigation will need to confirm the scope of compromised data and identify affected individuals by state of residence to determine the full range of notification obligations.*]
**Palomar's Response Actions**
Palomar has taken the following steps in response to this incident:
1. The identified unauthorized access vector has been contained and affected systems have been isolated from the broader network environment. 2. Palomar has engaged its internal incident response team and is in the process of retaining a third-party forensic investigation firm to conduct a thorough independent investigation. 3. Palomar has notified law enforcement as appropriate. 4. Palomar is implementing additional security measures to prevent further unauthorized access.
Palomar commits to providing Quorum with regular updates as the investigation proceeds and as additional information becomes available regarding the scope and impact of the incident.
**Cooperation and Next Steps**
I would like to propose scheduling a call early next week to discuss this incident in further detail, including coordination between the parties' respective IT security and information security teams. I believe close collaboration between our organizations will be essential as the investigation advances.
In the interim, I ask that you please direct any immediate questions or communications regarding this matter to me directly. I can be reached at the contact information below.
**Reservation of Rights**
This notice is provided in accordance with Palomar's contractual obligations under the MSA and applicable law. Nothing in this communication should be construed as an admission of fault, liability, or breach of any contractual provision. The investigation into this incident is in its early stages, and the facts as stated herein are preliminary in nature and subject to revision as additional information becomes available. Palomar expressly reserves all of its rights under the MSA and applicable law.
[*AB Note (5/4/23): Standard protective disclaimer by Palomar's counsel. This language does not affect Quorum's contractual rights under the MSA indemnification provisions (Section 12.2) or Quorum's ability to assert breach of the data security and notification obligations. Palomar's late notification (see annotation above) and potential patching failures are independently documented and are not waived or prejudiced by this reservation of rights.*]
[*AB Note (5/4/23): Marcus J. Trevino (CEO) and Anita Raghavan (CTO) are copied on this email, indicating executive-level awareness of the incident at Palomar as of April 21, 2023. Notable that Palomar's outside counsel — subsequently identified as Catherine Langford of Mercer, Haight & Dunlop LLP — is not copied. It is unclear whether Palomar had engaged outside counsel at this stage.*]
Regards,
Derek Copeland General Counsel Palomar Data Solutions, Inc. 7100 Greenville Avenue, Suite 450 Dallas, TX 75231 Direct: (214) 559-8340 Email: dcopeland@palomardata.com
CONFIDENTIALITY NOTICE: This email and any attachments are for the exclusive and confidential use of the intended recipient. If you are not the intended recipient, please do not read, distribute, or take action based on this message. If you have received this communication in error, please notify the sender immediately and delete this message from your system.
---
[*AB File Note (5/4/23): Copy retained for C&H matter file, Matter No. 1025-00006. Original forwarded to C&H by T. Whitfield on May 4, 2023, upon engagement. See also Incident Response Activation Memo (same date) and Initial Incident Assessment Memo (May 8, 2023).*]