PRIVILEGED AND CONFIDENTIAL ATTORNEY-CLIENT PRIVILEGE / ATTORNEY WORK PRODUCT
FINAL FORENSIC INVESTIGATION REPORT
Security Incident Affecting Quorum Insurance Holdings Corp. Data Hosted by Palomar Data Solutions, Inc.
Report Date: July 14, 2023
Prepared By:
Graystone Forensics LLC 1950 Old Gallows Road, Suite 600 Tysons Corner, VA 22182
Report Authors:
Dr. Nolan Briggs, Managing Director, Incident Response Kendra Faulkner, Senior Forensic Analyst
Prepared For:
Calderwood & Harkness LLP 1700 K Street NW, Suite 900 Washington, D.C. 20006
Attn: Kevin Ostrowski, Partner, Privacy & Data Security
Alan Burke, Associate, Privacy & Data Security
Engagement Reference: Calderwood & Harkness Matter No. 1025-00006
PRIVILEGE NOTICE: This report was prepared at the direction of and for the exclusive use of Calderwood & Harkness LLP, counsel to Quorum Insurance Holdings Corp., in connection with the provision of legal advice regarding a data security incident. This report is protected by the attorney-client privilege and constitutes attorney work product prepared in anticipation of litigation and for the purpose of providing legal advice. It should not be disclosed to any third party without the prior written consent of Calderwood & Harkness LLP. Distribution, copying, or use of this report in any form without such consent may result in waiver of applicable privileges. Any inadvertent disclosure of this report does not constitute a waiver of any applicable privilege or protection.
Right-click to update Table of Contents
1. Executive Summary
This Final Forensic Investigation Report (this "Report") presents the final findings of Graystone Forensics LLC ("Graystone") in connection with its forensic investigation conducted at the direction of Calderwood & Harkness LLP ("Calderwood & Harkness" or "Counsel"), counsel to Quorum Insurance Holdings Corp. ("Quorum" or "QIH"), relating to a data security incident involving Palomar Data Solutions, Inc. ("Palomar"), a third-party claims-processing vendor to Quorum. This Report has been prepared for the exclusive use of Calderwood & Harkness in connection with the provision of legal advice to Quorum and is subject to the attorney-client privilege and attorney work product protections.
Scope of Engagement
Graystone was retained by Calderwood & Harkness on May 5, 2023, pursuant to a retention letter that established that all forensic investigation work would be conducted at the direction of Counsel and within the attorney-client privilege framework. The engagement was initiated following Quorum's receipt of notification from Palomar on April 21, 2023, that Palomar had experienced a security incident potentially affecting data belonging to Quorum policyholders and claimants. The investigation was designed to determine the nature and scope of the unauthorized access to Palomar's network, the methods employed by the threat actor, the specific data compromised, and the total number of affected individuals.
Summary of Key Findings
Based on the comprehensive forensic investigation described in this Report, Graystone has reached the following key findings:
Initial Access. A threat actor exploited a known, unpatched remote code execution vulnerability, designated CVE-2023-0669, in Palomar's GoAnywhere MFT (Managed File Transfer) file transfer appliance to gain initial unauthorized access to Palomar's network on or about March 14, 2023, at approximately 02:47 UTC. The vendor-released patch for this vulnerability had been available since approximately February 7, 2023 — approximately 35 days prior to the exploitation — and Palomar's own vulnerability scanning had identified the vulnerability on February 22, 2023, yet no remediation action was taken prior to the compromise.
Unauthorized Access Window. The threat actor maintained persistent access to Palomar's network and conducted lateral movement through multiple internal systems from March 14, 2023 through April 18, 2023, a period of approximately 35 days. During this time, the threat actor established persistence mechanisms, harvested credentials, moved laterally to internal file servers and database servers containing Quorum claims processing data, conducted reconnaissance, staged data for exfiltration, and exfiltrated substantial volumes of data from Palomar's network.
Detection and Containment. Palomar's Security Operations Center ("SOC") detected anomalous outbound data transfers on April 18, 2023, triggering containment procedures that resulted in the termination of the threat actor's access. The detection occurred approximately 35 days after initial compromise, indicating that the earlier phases of the attack — including initial exploitation, persistence, lateral movement, reconnaissance, and data staging — were not detected by Palomar's monitoring capabilities.
Data Exfiltration. The threat actor exfiltrated structured data files containing personally identifiable information ("PII"), financial information, and protected health information ("PHI") belonging to Quorum policyholders and claimants. Graystone estimates the total volume of exfiltrated data at approximately 47 GB of compressed data, representing approximately 112 GB uncompressed.
Total Affected Individuals. The total number of unique individuals affected by the incident is 318,247, residing across 29 states and the District of Columbia.
Data Categories Compromised. The categories of data compromised are as follows:
• PII (full legal names, dates of birth, Social Security numbers, driver's license numbers) for all 318,247 affected individuals;
• Financial information (bank account numbers, including routing and account numbers, and payment card numbers) for a subset of 84,619 individuals; and
• Protected health information (health conditions, diagnosis codes, and treatment information derived from workers' compensation and health-related insurance claims) for a subset of 41,203 individuals.
Vendor Security Posture. Graystone identified several deficiencies in Palomar's security posture that contributed to the incident, including the failure to timely patch a known critical vulnerability, the absence of endpoint detection and response ("EDR") tools on the GoAnywhere MFT appliance and certain internal servers, and network architecture that permitted lateral movement from the internet-facing MFT appliance to internal claims processing databases and file servers.
Threat Actor. The tools, techniques, and procedures ("TTPs") observed during the investigation are consistent with a financially motivated cybercriminal group that exploited CVE-2023-0669 across multiple organizations as part of a broader campaign that began in February 2023. Graystone assesses with moderate confidence that the threat actor is an organized cybercriminal group operating primarily for financial gain.
Current Status. As of the date of this Report, Graystone has found no evidence of continued unauthorized access to Palomar's network after April 18, 2023. No evidence has been identified of the exfiltrated data appearing on publicly accessible dark web forums or data leak sites. Graystone's threat intelligence monitoring is ongoing.
This Report supersedes the Preliminary Forensic Findings memorandum dated June 2, 2023, which was delivered to Calderwood & Harkness during the pendency of the investigation. The Preliminary Forensic Findings memorandum should be treated as superseded in its entirety; all factual findings and conclusions should be drawn from this Final Report.
2. Engagement Background and Scope
2.1 Engagement of Graystone Forensics
Graystone Forensics LLC was retained by Calderwood & Harkness LLP on May 5, 2023, pursuant to a retention letter dated May 4, 2023, establishing the terms and conditions under which Graystone would conduct a forensic investigation into the data security incident affecting Quorum data hosted by Palomar. The retention letter expressly provides that all work performed by Graystone in connection with the engagement would be conducted at the direction of Calderwood & Harkness, as counsel to Quorum, and that all reports, communications, findings, work papers, and work product generated by Graystone would be directed exclusively to Calderwood & Harkness and would be protected by the attorney-client privilege and the attorney work product doctrine.
Calderwood & Harkness serves as outside counsel to Quorum Insurance Holdings Corp. in connection with the data security incident described in this Report. Graystone understands that Calderwood & Harkness's representation of Quorum encompasses providing legal advice related to the incident, including with respect to applicable regulatory notification obligations, potential litigation, and contractual rights and remedies.
All communications between Graystone and Quorum personnel during the course of the investigation were coordinated through Calderwood & Harkness. Similarly, all communications between Graystone and Palomar personnel were coordinated through Calderwood & Harkness and Mercer, Haight & Dunlop LLP, Palomar's counsel, as described further below.
2.2 Background — Quorum Insurance Holdings Corp.
Quorum Insurance Holdings Corp. is a Delaware corporation, publicly traded on the Nasdaq Stock Market under the ticker symbol QIHC, with its principal executive offices located at 400 Constitution Plaza, Suite 2200, Hartford, Connecticut 06103. Quorum is a top-25 United States insurance holding company, as measured by direct premiums written, offering a diversified portfolio of insurance products including personal lines (homeowners, personal auto, umbrella), commercial lines (commercial property, general liability, commercial auto, workers' compensation), and specialty insurance (professional liability, directors and officers liability, cyber liability). Quorum operates a proprietary digital underwriting platform known as "QuorumEdge," which integrates data analytics, predictive modeling, and automated decision-making tools across its underwriting operations.
Quorum's personal lines division generates significant claims volume, which requires substantial data processing capabilities. In order to support claims data processing for its personal lines division, Quorum outsources certain claims data processing, document management, and related functions to Palomar Data Solutions, Inc. pursuant to a Master Services Agreement, as described in Section 2.3 below.
Quorum's General Counsel is Thomas R. Whitfield. Quorum's Chief Information Security Officer ("CISO") is David Naranjo.
2.3 Background — Palomar Data Solutions, Inc.
Palomar Data Solutions, Inc. is a Texas corporation headquartered at 7100 Greenville Avenue, Suite 450, Dallas, Texas 75231. Palomar provides claims data processing, document management, data analytics, and related technology services to insurance carriers and other financial services organizations. Palomar's client base includes multiple major insurance carriers across the United States. Quorum is Palomar's second-largest client by revenue.
Quorum and Palomar are parties to a Master Services Agreement dated November 12, 2019 (the "MSA"), under which Palomar provides claims data processing services for Quorum's personal lines division. The original annual contract value of the MSA was approximately $14.2 million. The MSA has been amended on two occasions:
• Amendment 1 (effective April 1, 2021): Expanded the scope of services to include additional document management and analytics functions, increasing the annual contract value to approximately $16.3 million.
• Amendment 2 (effective September 15, 2022): Updated the Data Security Exhibit (Exhibit D) to the MSA, including the addition of enhanced data security requirements, a requirement for Palomar to maintain a SOC 2 Type II audit, and updated incident notification provisions, including a 48-hour notification requirement under MSA Section 9.4.
The MSA, as amended, includes certain data security obligations on the part of Palomar, including requirements related to patch management, vulnerability scanning, incident notification, and the maintenance of appropriate administrative, technical, and physical safeguards for data processed on behalf of Quorum. These contractual provisions are referenced at various points in this Report for factual context; legal conclusions regarding Palomar's compliance or non-compliance with its contractual obligations are reserved for Calderwood & Harkness.
Palomar's Chief Technology Officer is Anita Raghavan. Palomar's General Counsel is Derek Copeland. Palomar is represented by Mercer, Haight & Dunlop LLP, with Partner Catherine Langford serving as lead counsel in connection with the incident.
2.4 Incident Notification Timeline
The incident notification timeline is as follows:
April 18, 2023: Palomar's Security Operations Center detected anomalous outbound data transfers from its network, triggering internal incident response procedures. Palomar initiated containment actions and began an internal assessment of the scope and nature of the security incident.
April 21, 2023: Derek Copeland, Palomar's General Counsel, notified Thomas R. Whitfield, Quorum's General Counsel, and David Naranjo, Quorum's CISO, of the security incident via email. The notification stated that Palomar had experienced a security incident involving unauthorized access to its network and that Palomar was investigating the potential impact on data processed on behalf of Quorum. Graystone notes that this notification occurred approximately three calendar days after Palomar's internal discovery on April 18, 2023. MSA Section 9.4, as amended by Amendment 2 (September 15, 2022), requires Palomar to notify Quorum within 48 hours of becoming aware of a security incident that may involve Quorum data. The notification on April 21, 2023, exceeded this 48-hour window by approximately 24 hours. This factual observation is noted for Calderwood & Harkness's legal analysis; no legal conclusions regarding the significance of this delay are drawn in this Report.
May 4, 2023: Calderwood & Harkness's engagement on behalf of Quorum was formally opened in connection with the incident.
May 5, 2023: Graystone Forensics was retained by Calderwood & Harkness under the attorney-client privilege framework to conduct the forensic investigation described in this Report.
2.5 Scope of Investigation
The scope of Graystone's forensic investigation, as directed by Calderwood & Harkness, encompassed the following objectives:
1. Attack Vector Identification: Determination of the initial attack vector and the specific method of unauthorized access to Palomar's network.
2. Timeline Reconstruction: Establishment of a comprehensive timeline of unauthorized activity, including the dates and methods of initial access, lateral movement, establishment of persistence, data staging, and data exfiltration.
3. Data Compromise Assessment: Identification and characterization of all data sets accessed and/or exfiltrated by the threat actor, with a specific focus on data belonging to Quorum policyholders and claimants.
4. Affected Individual Enumeration: Assessment of the categories and volume of compromised data, including PII, financial information, and PHI, and enumeration of all unique affected individuals, organized by state of residence.
5. Threat Actor Analysis: Assessment of the threat actor's tools, techniques, and procedures ("TTPs"), including attribution analysis and identification of indicators of compromise ("IOCs").
6. Security Posture Evaluation: Evaluation of aspects of Palomar's security posture relevant to the incident, including patch management practices, endpoint security coverage, network segmentation, and detection capabilities.
2.6 Methodology
Graystone employed the following investigative methodologies in conducting this forensic investigation:
Forensic Imaging and Analysis. Graystone conducted forensic imaging and analysis of affected Palomar systems, including servers, file transfer appliances, and network infrastructure devices. Forensic images were acquired using industry-standard forensic imaging tools and were verified through cryptographic hash validation to ensure the integrity of the evidence. A complete list of systems subjected to forensic analysis is provided in Appendix D.
Log Analysis. Graystone conducted a comprehensive review of Palomar system logs, including firewall logs, intrusion detection and prevention system ("IDS/IPS") logs, application logs (including GoAnywhere MFT application logs), authentication logs, and VPN logs. The log review covered the period from February 1, 2023 through May 15, 2023, to capture activity both before and after the period of unauthorized access. A complete enumeration of log sources reviewed is provided in Appendix E.
Network Traffic Analysis. Graystone analyzed available network traffic data, including network flow records and, where available, packet capture data, to identify and characterize communications between compromised internal systems and external threat actor infrastructure.
Malware Analysis and Reverse Engineering. Graystone conducted technical analysis and reverse engineering of malicious tools identified on compromised Palomar systems, including web shells, post-exploitation utilities, and tunneling tools deployed by the threat actor. The results of this analysis informed the threat actor attribution assessment described in Section 7.
Data Mining and Cross-Referencing. Following the forensic containment phase, Graystone conducted comprehensive data mining to identify the specific data files that were staged and exfiltrated. Reconstructed data sets were cross-referenced against Quorum's policyholder and claimant databases — provided by Quorum through Calderwood & Harkness — to identify individual affected persons and the specific data elements compromised for each individual.
Personnel Interviews. Graystone conducted interviews with Palomar IT and security personnel, including members of Palomar's SOC, systems administration team, and network engineering team. All interviews were coordinated through Calderwood & Harkness and Mercer, Haight & Dunlop LLP (Partner: Catherine Langford), Palomar's counsel, consistent with the agreed-upon protocols for the investigation.
Documentary Review. Graystone reviewed Palomar's patch management records, vulnerability scanning reports, security policies and procedures, system configuration documentation, and Palomar's most recent SOC 2 Type II audit report. The SOC 2 Type II audit was prepared by Kessler, Park & Associates CPA, PLLC, located in Dallas, Texas, with Vivian Park serving as the Engagement Partner.
Threat intelligence Correlation. Graystone correlated the findings of the investigation with publicly available threat intelligence and Graystone's proprietary threat intelligence databases regarding CVE-2023-0669 exploitation campaigns, known threat actor infrastructure, and related indicators of compromise.
2.7 Limitations
Graystone's investigation was subject to the following limitations, which should be considered in evaluating the findings and conclusions set forth in this Report:
Access Limitations. Graystone's access to Palomar's computing environment was facilitated through legal channels established between Calderwood & Harkness and Mercer, Haight & Dunlop LLP and was subject to certain limitations negotiated between counsel. Specifically, Graystone's access was limited to systems and data within or directly related to Palomar's claims processing environment that processes Quorum data. Certain Palomar internal systems outside the scope of the claims processing environment — including systems serving other Palomar clients and Palomar's corporate IT infrastructure unrelated to claims processing — were not within the scope of this investigation.
Evidence Availability. The conclusions set forth in this Report are based on available digital evidence, including forensic images, system logs, network traffic data, and documentary evidence. In certain instances, the threat actor engaged in limited anti-forensic activity, including the clearing of logs on certain compromised systems. While Graystone was able to reconstruct the material timeline of events through corroborating evidence from multiple sources, the absence of evidence of certain specific activity does not definitively preclude that such activity occurred. The forensic conclusions should be read with this inherent limitation of digital forensics in mind.
Temporal Limitations. Log retention periods for certain Palomar systems were limited, and certain historical log data predating February 2023 was not available for review. Graystone does not believe this limitation materially affected the investigation, as the period of unauthorized access (March 14 – April 18, 2023) falls within the available log coverage period.
3. Attack Vector Analysis
3.1 Vulnerability Identification — CVE-2023-0669
The initial point of compromise in this incident was Palomar's GoAnywhere MFT (Managed File Transfer) file transfer appliance. GoAnywhere MFT is a widely used enterprise file transfer solution that enables organizations to securely exchange data with business partners, clients, and internal systems. Palomar utilized GoAnywhere MFT as a primary mechanism for receiving and transmitting claims data files to and from Quorum and other clients.
The threat actor gained initial access to Palomar's network by exploiting CVE-2023-0669, a pre-authentication remote code execution ("RCE") vulnerability in the GoAnywhere MFT software. This vulnerability was publicly disclosed in early February 2023, and the software vendor released a patch on or about February 7, 2023.
CVE-2023-0669 is a critical-severity vulnerability that allows an unauthenticated attacker to execute arbitrary code on the GoAnywhere MFT server by exploiting a deserialization flaw present in the application's administrative console or license response endpoint. The vulnerability arises from the application's failure to properly validate and sanitize serialized Java objects received through certain exposed endpoints. An attacker who can reach the vulnerable endpoint over the network can craft and submit a malicious serialized object that, upon deserialization by the application, results in the execution of arbitrary commands on the underlying server with the privileges of the GoAnywhere MFT application process.
The critical nature of CVE-2023-0669 was widely recognized by the cybersecurity community. The vulnerability was assigned a CVSS (Common Vulnerability Scoring System) base score reflecting its critical severity. Following public disclosure and the release of proof-of-concept exploit code, widespread exploitation of CVE-2023-0669 was observed in the wild by multiple threat intelligence sources beginning in February 2023. Multiple threat actor groups — including both financially motivated cybercriminal organizations and opportunistic attackers — were observed leveraging the vulnerability to compromise organizations that had not applied the vendor patch. The exploitation campaign was the subject of advisories from multiple government cybersecurity agencies and industry organizations.
3.2 Palomar's Patch Status
Graystone's analysis of Palomar's patch management records and system configuration confirms that as of March 14, 2023 — the date of initial unauthorized access — Palomar had not applied the vendor patch for CVE-2023-0669 to its GoAnywhere MFT appliance. The patch had been available for approximately 35 days prior to the initial compromise, having been released by the vendor on or about February 7, 2023, with the exploitation occurring on March 14, 2023.
Graystone's review of Palomar's vulnerability scanning records further confirms that CVE-2023-0669 was identified as an unpatched vulnerability on Palomar's GoAnywhere MFT appliance in a vulnerability scan conducted on February 22, 2023, approximately 15 days after the patch was released. Despite this identification, no remediation action — including the application of the vendor patch, the implementation of compensating controls, or the temporary removal of the appliance from service — was taken prior to the threat actor's exploitation of the vulnerability on March 14, 2023. Graystone's interviews with Palomar IT personnel indicated that the patch had been placed into Palomar's standard change management queue but had not been prioritized for expedited deployment despite the vulnerability's critical severity rating and the availability of public exploit code.
From a contractual perspective, Graystone notes the following for Calderwood & Harkness's reference: the Master Services Agreement between Quorum and Palomar, as amended by Amendment 2 dated September 15, 2022, includes a Data Security Exhibit (Exhibit D) that sets forth certain data security requirements applicable to Palomar's processing of Quorum data. Exhibit D requires Palomar to apply patches for critical vulnerabilities within 30 calendar days of vendor patch release. The vendor patch for CVE-2023-0669 was released on or about February 7, 2023. The 30-day patching window under Exhibit D would have expired on or about March 9, 2023. Palomar had not applied the patch as of March 14, 2023, when the vulnerability was exploited — five days past the contractual 30-day patching deadline. This factual observation is provided for context; legal conclusions regarding the contractual significance of this failure are reserved for Calderwood & Harkness.
3.3 Initial Exploitation
On or about March 14, 2023, at approximately 02:47 UTC, Graystone identified log entries on Palomar's GoAnywhere MFT appliance consistent with the exploitation of CVE-2023-0669. Specifically, the GoAnywhere MFT application logs recorded an anomalous request to a vulnerable endpoint that is characteristic of the known exploit methodology for this vulnerability. The request originated from an external IP address that Graystone has identified as part of the threat actor's infrastructure (see Appendix C for detailed indicators of compromise).
The exploitation proceeded as follows:
The threat actor submitted a crafted serialized Java object to the vulnerable endpoint on the GoAnywhere MFT appliance. Upon deserialization by the GoAnywhere MFT application, the malicious object triggered the execution of arbitrary code on the server. This initial code execution provided the threat actor with command-line access to the GoAnywhere MFT server operating under the privileges of the GoAnywhere MFT application service account.
Upon successful exploitation, the threat actor deployed a web shell on the GoAnywhere MFT server. The web shell is a server-side script that provides a persistent backdoor, allowing the threat actor to execute commands on the server, upload and download files, and interact with the server's file system and network connections through a web-based interface. The web shell was placed in a directory within the GoAnywhere MFT application's web root, enabling the threat actor to access it remotely through HTTP/HTTPS connections.
The deployment of the web shell provided the threat actor with a reliable, persistent remote access mechanism that did not depend on continued exploitation of the CVE-2023-0669 vulnerability. This web shell served as the threat actor's primary interface for subsequent post-exploitation activities, including credential harvesting, lateral movement, and data staging.
Forensic analysis of the web shell confirmed that it was a variant of a web shell family commonly associated with threat actors known to have exploited CVE-2023-0669 as part of the broader campaign observed beginning in February 2023. The file hash values for the web shell are provided in Appendix C.
4. Post-Exploitation Activity and Lateral Movement
4.1 Establishment of Persistence
Following the initial exploitation of CVE-2023-0669 and the deployment of the web shell on or about March 14, 2023, the threat actor took steps to establish multiple persistence mechanisms on the GoAnywhere MFT server to ensure continued access even in the event that one mechanism was discovered and removed. In addition to the web shell described in Section 3.3, the threat actor created a scheduled task on the GoAnywhere MFT server configured to execute at regular intervals. This scheduled task was designed to re-establish connectivity to an external command-and-control ("C2") server in the event that the web shell was removed or the threat actor's session was interrupted.
Graystone's analysis of the scheduled task configuration confirmed that it was programmed to execute a script that initiated an encrypted outbound connection to a specific external IP address and port. This C2 infrastructure — detailed further in Section 7 and Appendix C — utilized IP addresses and domain names consistent with known threat actor infrastructure tracked by Graystone's threat intelligence team. The use of encrypted outbound connections for C2 communications made the traffic more difficult to distinguish from legitimate HTTPS traffic, reducing the likelihood of detection by Palomar's network monitoring tools.
The persistence mechanisms deployed by the threat actor remained operational throughout the 35-day unauthorized access window, from March 14, 2023 through April 18, 2023. Graystone's analysis of the GoAnywhere MFT server's forensic image confirmed that both the web shell and the scheduled task were present and active at the time of containment.
4.2 Credential Harvesting
Between approximately March 14 and March 18, 2023, the threat actor utilized post-exploitation tools on the GoAnywhere MFT server to harvest credentials stored on or accessible through the server. The credential harvesting activity targeted multiple categories of credentials, with a focus on service accounts that possessed elevated privileges on Palomar's internal network.
Specifically, Graystone's forensic analysis identified evidence that the threat actor:
• Extracted stored credentials from the GoAnywhere MFT application's configuration files, which included service account credentials used by the GoAnywhere MFT application to connect to internal Palomar systems for file transfer operations.
• Utilized a credential dumping tool to extract cached credentials from the server's operating system memory.
• Enumerated Active Directory accounts accessible from the GoAnywhere MFT server to identify accounts with administrative or elevated privileges.
The compromised service accounts included accounts with read access to Palomar's internal file storage systems and claims processing databases. Critically, these service accounts had been provisioned with access privileges that extended well beyond the GoAnywhere MFT appliance itself, providing the threat actor with the credentials necessary to authenticate to internal Palomar systems. Graystone notes that the breadth of access associated with these service accounts reflects an opportunity for Palomar to implement more granular access controls and the principle of least privilege in its service account management.
4.3 Lateral Movement
Beginning on or about March 18, 2023, having obtained service account credentials with elevated privileges, the threat actor commenced lateral movement from the GoAnywhere MFT server to internal Palomar systems. Lateral movement refers to the technique by which an attacker, having gained initial access to one system within a network, uses that foothold to access additional systems within the same network, progressively expanding the scope of compromise.
Graystone's analysis of authentication logs, network flow data, and forensic artifacts on affected systems confirmed that the threat actor moved laterally from the GoAnywhere MFT server to the following categories of internal Palomar systems:
• Internal File Servers: The threat actor accessed Palomar's internal file servers that host claims processing data files, including structured data files (CSV exports, flat files) and unstructured documents associated with claims processed on behalf of Quorum and other Palomar clients. The threat actor authenticated to these file servers using the compromised service account credentials.
• Database Servers: The threat actor accessed database servers containing structured claims data for multiple Palomar clients, including Quorum. These database servers hosted the claims processing databases that store policyholder and claimant records, including PII, financial information, and health-related claims data. The threat actor executed database queries to enumerate available databases, tables, and records, and subsequently extracted data from tables containing Quorum policyholder and claimant information.
• Document Management System: The threat actor accessed components of Palomar's document management system, which stores claims-related documents such as claims forms, medical records, correspondence, and supporting documentation. While the primary focus of the threat actor's data staging and exfiltration activity (described in Section 5) was on structured data files rather than individual documents, the threat actor's access to the document management system represents an additional dimension of the compromise.
Lateral movement was accomplished primarily via two protocols:
• Remote Desktop Protocol ("RDP"): The threat actor used RDP to establish interactive remote desktop sessions with internal Palomar servers, using the harvested service account credentials for authentication. RDP provided the threat actor with a graphical interface for navigating the file systems and interacting with applications on the compromised internal servers.
• Server Message Block ("SMB"): The threat actor used SMB — a network file sharing protocol — to access shared directories and files on internal file servers. SMB connections were authenticated using the harvested service account credentials.
In addition to leveraging the web shell and scheduled task on the GoAnywhere MFT server, the threat actor deployed additional tools on certain internal systems to maintain access and facilitate operations. Notably, the threat actor deployed a tunneling utility on one of the compromised internal file servers. This tunneling utility established an encrypted communications channel between the internal server and the external C2 infrastructure, enabling the threat actor to route commands and data through the tunnel without direct exposure of the internal systems to the internet. The use of this tunneling utility further obscured the threat actor's activity from Palomar's network monitoring tools.
4.4 Reconnaissance and Data Identification
Between approximately March 18 and March 28, 2023, the threat actor conducted extensive reconnaissance of Palomar's file systems and databases to identify and locate data of interest. This reconnaissance phase preceded the data staging and exfiltration activity described in Section 5.
Forensic analysis of file system access timestamps, database query logs, and user session artifacts confirms that the threat actor systematically explored Palomar's internal file shares and database structures. The reconnaissance activity included:
• Enumeration of shared directories on internal file servers, including browsing of directory structures and examination of file naming conventions to identify data sets associated with specific Palomar clients.
• Execution of database queries on the claims processing database servers to enumerate databases, schemas, tables, and column names. The threat actor executed queries targeting tables containing policyholder and claimant data fields such as names, dates of birth, Social Security numbers, financial account information, and health-related information.
• Identification of data sets associated with Quorum. Log analysis and forensic artifacts confirm that the threat actor specifically queried and accessed databases and file shares containing Quorum policyholder and claimant data. While the threat actor also accessed data associated with other Palomar clients, the scope of this investigation is limited to the impact on Quorum data.
The threat actor's reconnaissance activity demonstrated a methodical approach to identifying and targeting the most sensitive categories of personal information, consistent with a financially motivated threat actor seeking data with the highest potential value for monetization through fraud, identity theft, or extortion.
5. Data Staging and Exfiltration
5.1 Data Staging
Beginning on or about March 28, 2023, following the completion of the reconnaissance phase, the threat actor began staging data for exfiltration from Palomar's network. Data staging refers to the process by which an attacker collects and consolidates targeted data into a centralized location within the compromised network, preparing it for transfer out of the network.
Graystone's forensic analysis identified a staging directory that was created by the threat actor on one of the compromised internal Palomar servers. The threat actor copied structured data files from multiple internal Palomar systems to this centralized staging directory. The staged data included, but was not limited to:
• Exports from Palomar's claims processing databases containing Quorum policyholder and claimant records, including fields containing PII (names, dates of birth, Social Security numbers, driver's license numbers), financial information (bank account numbers, payment card numbers), and health-related data (health conditions, diagnosis codes, treatment information).
• Structured data files (CSV format) extracted from Palomar's internal file servers, which contained similar categories of Quorum policyholder and claimant data.
The staged files were processed by the threat actor prior to exfiltration. Specifically, the files were compressed using commonly available archiving tools to reduce file size and facilitate transfer. In some instances, the compressed archives were encrypted by the threat actor using password-protected archive formats, an anti-forensic technique designed to obscure the contents of the files during transfer and to reduce the effectiveness of data loss prevention ("DLP") tools that might inspect outbound file transfers for sensitive data patterns.
5.2 Exfiltration Methodology
Data exfiltration — the unauthorized transfer of data out of the compromised network — occurred in multiple tranches over a period of approximately 19 days, from approximately March 30, 2023 through April 18, 2023.
The threat actor exfiltrated data using encrypted channels over HTTPS (Hypertext Transfer Protocol Secure) to external infrastructure. The destination infrastructure consisted of IP addresses associated with the threat actor's command-and-control infrastructure and cloud storage endpoints. The use of HTTPS for exfiltration leveraged the same encrypted protocol used for legitimate web traffic, making the exfiltration traffic more difficult to distinguish from normal network activity through cursory inspection.
Exfiltration was conducted in incremental sessions rather than as a single bulk transfer. The threat actor transferred data in multiple discrete sessions spread across the 19-day exfiltration window. Individual exfiltration sessions were typically conducted during overnight hours (UTC), a timing pattern consistent with efforts to reduce the likelihood of detection based on network volume anomalies during Palomar's normal business hours. The incremental approach and off-hours timing further demonstrated the threat actor's operational security awareness and effort to evade detection.
Based on Graystone's analysis of network flow data, forensic artifacts on the staging server, and the reconstructed data sets, Graystone estimates the total volume of exfiltrated data at approximately 47 GB of compressed data, which represents an estimated approximately 112 GB of data in uncompressed form. This volume is consistent with the totality of the structured data files containing Quorum policyholder and claimant data identified during the data mining phase of the investigation.
5.3 Detection and Containment
On April 18, 2023, Palomar's Security Operations Center detected unusual outbound data transfers from the compromised internal server to external IP addresses. The transfers triggered alerts in Palomar's network monitoring tools based on anomalous outbound data transfer volume — specifically, the volume of HTTPS traffic from the compromised server to external destinations exceeded baseline thresholds established by Palomar's monitoring configuration.
Upon detection of the anomalous activity, Palomar's SOC initiated containment procedures, which included the following actions:
• Isolation of the affected internal server from the network to prevent further data transfers.
• blocking of the identified external IP addresses at Palomar's perimeter firewall.
• Isolation of the GoAnywhere MFT appliance and other systems identified as potentially compromised during Palomar's initial triage.
• Initiation of Palomar's incident response protocols, including engagement of Palomar's internal incident response team and notification of Palomar's management and legal counsel.
As a result of these containment actions, the threat actor's access to Palomar's network was effectively terminated as of April 18, 2023. Graystone's post-containment analysis confirmed that the containment actions were successful in eliminating the threat actor's access. Graystone has found no evidence of threat actor activity on Palomar's network after April 18, 2023.
It is noted, however, that the detection occurred approximately 35 days after initial compromise. While Palomar's SOC ultimately detected the exfiltration based on anomalous data transfer volume, the earlier phases of the attack — including the initial exploitation of CVE-2023-0669, the deployment of persistence mechanisms, credential harvesting, lateral movement, reconnaissance, and data staging — were not detected by Palomar's monitoring capabilities. The implications of this detection gap for Palomar's security posture are discussed further in Section 8.
5.4 Exfiltration Window Summary
The following table summarizes the phases of the unauthorized activity and the approximate duration of each phase:
6. Compromised Data Analysis
6.1 Data Mining Methodology
Following the forensic containment phase, Graystone conducted a comprehensive data mining effort to identify the specific data files that were staged and exfiltrated by the threat actor and to determine the precise scope of the data compromise. This data mining effort was one of the most resource-intensive components of the investigation and was completed on August 4, 2023.
Graystone's data mining methodology involved the following steps:
Reconstruction of Exfiltrated Data Sets. Graystone reconstructed the exfiltrated data sets by analyzing forensic images of the staging server identified during the investigation. Graystone recovered the compressed archive files that had been created by the threat actor in the staging directory, as well as file system artifacts (including file system metadata, deleted file remnants, and file allocation records) that provided additional evidence of the files that had been staged. Graystone also analyzed database query logs from the compromised database servers to identify the specific queries executed by the threat actor and the data extracted by those queries. Network flow data was used to corroborate the volume and timing of data transfers.
Cross-Referencing Against Quorum Databases. The reconstructed data sets were cross-referenced against Quorum's policyholder and claimant databases. Quorum, through Calderwood & Harkness, provided Graystone with reference data sets from Quorum's systems to enable this cross-referencing. The cross-referencing process identified unique individuals whose data appeared in the exfiltrated files and determined the specific data elements compromised for each individual.
De-Duplication and Validation. Graystone performed de-duplication procedures to ensure that each affected individual was counted only once, even if the individual's data appeared in multiple exfiltrated files or data sources. Validation checks were performed to confirm the accuracy of the affected individual counts and the data element categorizations.
State of Residence Assignment. For purposes of state-by-state notification analysis, Graystone assigned each affected individual to a state of residence based on the most recent address information available in the compromised data records, cross-referenced against Quorum's current policyholder records.
Data mining and affected individual identification were completed on August 4, 2023.
6.2 Total Affected Individuals
Based on the data mining analysis described above, the total number of unique affected individuals whose data was compromised in this incident is 318,247. These individuals are Quorum policyholders and/or claimants whose personal information was processed by Palomar under the Master Services Agreement in connection with Quorum's personal lines division claims.
The affected individuals reside across 29 states and the District of Columbia. The geographic distribution reflects the footprint of Quorum's personal lines insurance business.
6.3 Categories of Compromised Data
The compromised data falls into three categories: personally identifiable information ("PII"), financial information, and protected health information ("PHI"). The following subsections detail each category.
6.3.1 Personally Identifiable Information (PII)
Number of affected individuals: 318,247 (all affected individuals)
The following PII data elements were compromised for all 318,247 affected individuals:
• Full legal names (first name, middle name or initial where available, and last name)
• Dates of birth
• Social Security numbers
• Driver's license numbers (state of issuance and license number)
This data was present in structured claims processing files maintained by Palomar in connection with Quorum's personal lines division claims. The combination of these data elements — particularly full names, dates of birth, and Social Security numbers — constitutes a high-risk data set for identity theft and fraud purposes, as these elements are commonly used for identity verification by financial institutions, government agencies, and other organizations.
6.3.2 Financial Information
Number of affected individuals: 84,619 (a subset of the 318,247 total affected individuals)
The following financial information data elements were compromised for 84,619 individuals:
• Bank account numbers (including both routing numbers and account numbers)
• Payment card numbers (credit card and debit card numbers used for premium payments or claim disbursements)
This financial information was associated with claims involving direct deposit disbursements (where claimants provided bank account information for electronic claims payments) and payment card-based transactions (where policyholders used payment cards for premium payments or where claims payments were issued to payment cards). Not all affected individuals had financial information in the compromised data; the 84,619 figure represents the subset of individuals for whom such information was present in the exfiltrated files.
6.3.3 Protected Health Information (PHI)
Number of affected individuals: 41,203 (a subset of the 318,247 total affected individuals)
The following protected health information data elements were compromised for 41,203 individuals:
• Health conditions (descriptions of medical conditions, injuries, or diagnoses associated with insurance claims)
• Diagnosis codes (ICD-10 codes — the International Classification of Diseases, Tenth Revision — codes used to classify and code diagnoses, symptoms, and medical procedures)
• Treatment information (descriptions of medical treatments, therapies, and procedures associated with insurance claims)
This data was associated with workers' compensation claims and health-related insurance claims processed by Palomar on behalf of Quorum. These claims inherently involve health-related information, as the basis for the claim is a workplace injury, illness, or other health condition. The data was maintained by Palomar in structured claims processing databases that included fields for health-related information provided by claimants, healthcare providers, and claims adjusters.
The presence of PHI in the compromised data triggers the applicability of the Health Insurance Portability and Accountability Act ("HIPAA") Breach Notification Rule, codified at 45 C.F.R. Part 164, Subpart D, which establishes requirements for notification to affected individuals, the U.S. Department of Health and Human Services ("HHS"), and, in certain circumstances, the media, following a breach of unsecured PHI. Graystone notes this regulatory implication for Calderwood & Harkness's legal analysis; all legal conclusions regarding HIPAA applicability, the characterization of this incident under HIPAA, and the specific notification requirements and timelines are reserved for Calderwood & Harkness.
6.4 State-by-State Breakdown of Affected Individuals
The following table provides a summary of the number of affected individuals by state of residence for the ten states with more than 10,000 affected residents, with the remaining jurisdictions shown in aggregate:
The concentration of affected individuals in Connecticut reflects Quorum's headquarters location and the significant volume of personal lines business written in that state. The distribution across New York, California, Texas, Florida, and other major states is consistent with Quorum's nationwide personal lines footprint.
A detailed state-by-state breakdown for all 29 states and the District of Columbia, including subtotals by data category (PII only, PII plus financial information, PII plus PHI, and PII plus financial information plus PHI) for each jurisdiction, is provided in Appendix B. The detailed breakdown in Appendix B is intended to support Calderwood & Harkness's analysis of state-specific notification obligations, as each state's data breach notification statute may define "personal information" differently and may establish different thresholds and timelines for notification.
6.5 Data Overlap Analysis
Graystone's data mining identified overlap among the three categories of compromised data. Some individuals appear in multiple data categories — for example, an individual may have both PII and financial information compromised, or both PII and PHI compromised, or all three categories of data compromised for the same individual.
The total figure of 318,247 represents unique individuals; there is no double-counting across categories. The relationship among the categories is as follows:
• All 318,247 affected individuals had PII (names, dates of birth, Social Security numbers, driver's license numbers) compromised.
• Of the 318,247 total, 84,619 individuals also had financial information (bank account numbers and/or payment card numbers) compromised.
• Of the 318,247 total, 41,203 individuals also had PHI (health conditions, diagnosis codes, and/or treatment information) compromised.
• Of the individuals with financial information compromised, approximately 12,340 individuals also had PHI compromised — representing the subset of individuals for whom all three categories of data (PII, financial information, and PHI) were present in the exfiltrated data.
This overlap analysis is relevant to Calderwood & Harkness's determination of the appropriate notification content for each affected individual, as individuals with multiple categories of compromised data may require different notification language or different types of remediation services (e.g., credit monitoring, identity theft protection, and/or healthcare identity protection services).
7. Threat Actor Attribution and Characterization
7.1 Threat Actor Profile
Based on the totality of the evidence gathered during the investigation, Graystone has developed a threat actor profile that characterizes the entity or entities responsible for the unauthorized access and data exfiltration.
The tools, techniques, and procedures ("TTPs") observed during this investigation are consistent with a financially motivated cybercriminal group. The exploitation of CVE-2023-0669 in GoAnywhere MFT was not an isolated incident directed specifically at Palomar; rather, it was consistent with a broader exploitation campaign observed by multiple threat intelligence organizations and government cybersecurity agencies in which multiple threat actor groups leveraged the vulnerability to compromise organizations worldwide that had not applied the vendor patch. This campaign, which began in February 2023 shortly after the public disclosure of CVE-2023-0669 and the release of exploit code, targeted a wide range of organizations across multiple industry sectors, including financial services, healthcare, government, and technology.