PRIVILEGED AND CONFIDENTIAL ATTORNEY-CLIENT COMMUNICATION / ATTORNEY WORK PRODUCT
This memorandum is a privileged and confidential attorney-client communication and constitutes attorney work product. It has been prepared by Calderwood & Harkness LLP in connection with its engagement by Quorum Insurance Holdings Corp. for the purpose of providing legal advice regarding the data security incident described herein. This memorandum is protected from disclosure by the attorney-client privilege, the work product doctrine, and all other applicable privileges and protections. This memorandum and its contents are not to be disclosed, disseminated, distributed, or otherwise communicated to any third party without the prior written approval of counsel. Any unauthorized disclosure may result in waiver of applicable privileges. Recipients of this memorandum should treat it accordingly and take all necessary steps to maintain its confidential and privileged nature.
MEMORANDUM
May 4, 2023
FROM: Kevin Ostrowski, Partner, Privacy & Data Security, Calderwood & Harkness LLP Alan Burke, Associate, Privacy & Data Security, Calderwood & Harkness LLP
TO: David Naranjo, Chief Information Security Officer, Quorum Insurance Holdings Corp. Jennifer Liang, Chief Privacy Officer, Quorum Insurance Holdings Corp. Thomas R. Whitfield, General Counsel, Quorum Insurance Holdings Corp.
CC: Sara Hendricks, Associate, Calderwood & Harkness LLP Priya Deshmukh, VP, Vendor Risk Management, Quorum Insurance Holdings Corp. Robert Wentworth, SVP, Claims Operations, Quorum Insurance Holdings Corp.
RE: Activation of Quorum Insurance Holdings Corp. Incident Response Plan — Palomar Data Solutions Security Incident
MATTER NO.: 1025-00006
I. Purpose and Executive Summary
This memorandum formally activates the Incident Response Plan ("IRP") of Quorum Insurance Holdings Corp. ("Quorum" or the "Company") in connection with a data security incident reported by Palomar Data Solutions, Inc. ("Palomar"), a third-party claims-processing vendor that provides critical services to Quorum's personal lines division. The activation of the IRP is effective as of today, May 4, 2023, and this memorandum establishes the incident response team, sets forth immediate action items, and outlines the anticipated workstreams and preliminary timeline for the legal and operational response to the incident.
On April 21, 2023, Derek Copeland, General Counsel of Palomar, transmitted an email notification to Thomas R. Whitfield, General Counsel of Quorum, and David Naranjo, Chief Information Security Officer of Quorum, advising that Palomar had discovered anomalous activity on its network on April 18, 2023. The notification indicated that the anomalous activity was consistent with unauthorized access to Palomar's systems and the potential exfiltration of data, including data belonging to Quorum policyholders and claimants. The notification did not provide a definitive scope of the compromise, but indicated that the unauthorized activity may have involved sensitive personal information of individuals whose data Palomar processes on behalf of Quorum.
Calderwood & Harkness LLP ("Calderwood & Harkness" or "outside counsel") has been engaged by Quorum effective today, May 4, 2023, to coordinate the legal response to this incident. The scope of Calderwood & Harkness's engagement encompasses, without limitation: (i) oversight and coordination of the forensic investigation into the Palomar security incident; (ii) assessment and management of federal, state, and regulatory notification obligations; (iii) engagement with applicable regulatory authorities; (iv) coordination with Quorum's cyber-insurance carriers; (v) vendor accountability analysis and enforcement of Quorum's contractual rights under the Palomar Master Services Agreement; (vi) preservation of attorney-client privilege and work product protections throughout the investigation; and (vii) such other legal matters as may arise in connection with the incident.
The criticality of immediate, coordinated, and disciplined action across Quorum's incident response team cannot be overstated. The potential scope of this incident — encompassing personally identifiable information, financial information, and protected health information of Quorum policyholders and claimants across all fifty states — implicates a complex web of federal and state breach notification obligations, regulatory reporting requirements, and contractual and insurance considerations. The preservation of attorney-client privilege over the entirety of the investigation and response is of paramount importance, and all members of the incident response team must adhere strictly to the privilege protocols established by this memorandum and the forthcoming Privilege Protocol Memo.
II. Background — The Palomar Security Incident
A. Palomar's Role as Quorum Vendor
Palomar Data Solutions, Inc. is a Texas corporation headquartered at 7100 Greenville Avenue, Suite 450, Dallas, Texas 75231. Palomar provides claims data processing, document management, and analytics services to Quorum's personal lines division pursuant to a Master Services Agreement dated November 12, 2019 (the "MSA"), as amended by Amendment 1, dated March 3, 2021, and Amendment 2, dated September 15, 2022 (collectively, the "MSA" or the "Agreement"). Palomar is among Quorum's most significant third-party service providers, serving as the primary claims-processing vendor for the personal lines segment.
The annual contract value of the Palomar engagement, following Amendment 1, is approximately $16.3 million. Quorum is understood to be Palomar's second-largest client by revenue, with an approximate annual contract value of $14.2 million at the original execution of the MSA, a figure that has increased with subsequent amendments. The scale and criticality of this vendor relationship underscores the operational significance of the incident and the importance of a comprehensive and well-coordinated response.
Under the terms of the MSA, Palomar receives, processes, stores, and transmits a broad range of sensitive data on behalf of Quorum as part of its claims processing services. This data includes personally identifiable information ("PII") of Quorum policyholders and claimants, including names, dates of birth, Social Security numbers, and driver's license numbers. The data also includes financial information, such as bank account numbers and payment card numbers, used in connection with claims payments and premium processing. Additionally, in connection with Quorum's workers' compensation and health-related claims lines, Palomar processes protected health information ("PHI") as defined under the Health Insurance Portability and Accountability Act of 1996 ("HIPAA"), including health conditions, diagnosis codes, and treatment information. A Business Associate Agreement ("BAA") governs Palomar's handling of PHI on behalf of Quorum, which is incorporated as a component of the broader MSA framework.
The breadth and sensitivity of the data processed by Palomar on Quorum's behalf place this incident in the most serious category of potential data security events, warranting the immediate and comprehensive response outlined in this memorandum.
B. Incident Notification Timeline
The following is a chronological summary of the key dates associated with the discovery and notification of the Palomar security incident, based on information provided by Palomar to date:
April 18, 2023: Palomar's Security Operations Center ("SOC") detected unusual outbound data transfers originating from Palomar's network. The anomalous activity triggered an internal investigation by Palomar's information security team. According to information provided by Palomar, the SOC alert was generated by automated network monitoring tools that flagged the volume and destination of the outbound data transfers as inconsistent with normal operational patterns.
April 21, 2023: Derek Copeland, General Counsel of Palomar, notified Thomas R. Whitfield, General Counsel of Quorum, and David Naranjo, Chief Information Security Officer of Quorum, of the security incident via email. The notification stated that Palomar had identified unauthorized access to its network environment and that data belonging to Quorum may have been affected, including potential exfiltration of policyholder and claimant information. The notification was provided approximately three (3) calendar days after Palomar's internal discovery of the anomalous activity on April 18, 2023.
It is important to note that Section 9.4 of the MSA expressly requires Palomar to notify Quorum within forty-eight (48) hours of discovering a security incident affecting Quorum data. The April 21 notification was transmitted approximately seventy-two (72) hours after the April 18 discovery, representing an approximate twenty-four (24) hour delay relative to the contractual notification deadline. While the operational significance of this delay must be assessed in the context of the overall incident timeline, it represents a potential breach of Palomar's contractual obligations under the MSA and will be separately evaluated as part of the vendor accountability workstream described in Section IV.E below.
May 4, 2023: Quorum engages Calderwood & Harkness LLP as outside counsel to coordinate the legal response to the incident. This memorandum is issued concurrently with the opening of the engagement.
C. Preliminary Understanding of the Incident
The following summary of the incident is based on the limited information provided by Palomar to date and is subject to revision as the forensic investigation progresses. The facts set forth below are preliminary and have not been independently verified by Quorum or its advisors.
Based on information communicated by Palomar, the unauthorized access appears to have involved the exploitation of a known vulnerability designated as CVE-2023-0669 in Palomar's GoAnywhere MFT (Managed File Transfer) appliance. CVE-2023-0669 is a remote code execution vulnerability in Severin Corporation's GoAnywhere MFT product that was publicly disclosed in early February 2023 and has been widely exploited by threat actors, including the Strathmore & Co. ransomware group, in attacks against organizations across multiple industries. The exploitation of this vulnerability allows an attacker to achieve remote code execution on the GoAnywhere MFT server, potentially enabling unauthorized access to files and data processed through the managed file transfer platform.
Initial unauthorized access to Palomar's systems is believed to have occurred on or about March 14, 2023 — approximately five weeks before Palomar's SOC detected the anomalous activity on April 18, 2023. Anomalous activity consistent with unauthorized access and potential data exfiltration is believed to have occurred over an approximately thirty-five (35) day window, spanning from March 14, 2023, through April 18, 2023. The extended dwell time of the threat actor within Palomar's network is a significant concern and raises serious questions regarding the adequacy of Palomar's detection capabilities, monitoring practices, and patch management protocols — particularly given that CVE-2023-0669 was publicly disclosed and patches were made available in February 2023, approximately one month before the initial unauthorized access is believed to have occurred.
At this time, the full scope of the compromise remains unknown. Specifically, the following critical facts have not yet been established and will be the primary focus of the forensic investigation:
(i) The precise number of Quorum policyholders and claimants whose data was accessed or potentially exfiltrated;
(ii) The identity of the affected individuals;
(iii) The specific types and categories of data that were accessed or potentially exfiltrated (i.e., PII, financial data, PHI, or some combination thereof);
(iv) The states of residence of the affected individuals, which will be determinative of applicable breach notification obligations;
(v) The identity of the threat actor(s) responsible for the unauthorized access;
(vi) Whether the exfiltrated data has been published, sold, or otherwise disclosed by the threat actor(s); and
(vii) The full extent of the threat actor's lateral movement within Palomar's network and whether systems beyond the GoAnywhere MFT appliance were compromised.
It bears emphasis that Quorum's personal lines business operates across all fifty states, and the data processed by Palomar on Quorum's behalf encompasses the full spectrum of sensitive personal data categories that trigger notification obligations under state and federal law — including PII (names, dates of birth, Social Security numbers, driver's license numbers), financial information (bank account numbers, payment card numbers), and protected health information (health conditions, diagnosis codes, treatment information from workers' compensation and health-related claims). The potential breadth of this incident necessitates a comprehensive and expeditious forensic investigation.
III. Formal Activation of the Incident Response Plan
Pursuant to the authority vested in the General Counsel under Quorum's Incident Response Plan (Version 3.2, last revised October 14, 2022), and upon the recommendation of outside counsel, the IRP is hereby formally activated as of May 4, 2023, in connection with the Palomar data security incident described in Section II above. All protocols, procedures, and escalation pathways established by the IRP are now in effect and will remain in effect until the incident is resolved and the IRP is formally deactivated by the General Counsel in consultation with outside counsel.
The following individuals are designated as members of the Incident Response Team ("IRT") for the Palomar security incident, with the roles and responsibilities described below:
Thomas R. Whitfield, General Counsel, Quorum Insurance Holdings Corp. — Mr. Whitfield will serve as the executive sponsor of the incident response. In this capacity, he will serve as the primary interface between Quorum's internal team and outside counsel, and will hold authorization authority for legal decisions affecting the Company, including but not limited to decisions regarding regulatory notifications, consumer notifications, public disclosures, vendor enforcement actions, and insurance claim submissions. Mr. Whitfield will also be responsible for briefing Quorum's Chief Executive Officer and the Audit Committee of the Board of Directors as described in Section IV.H below.
David Naranjo, Chief Information Security Officer, Quorum Insurance Holdings Corp. — Mr. Naranjo will serve as the technical lead for the incident response. He will coordinate with Palomar's technical team, including Palomar's Chief Technology Officer, Anita Raghavan, regarding the status of Palomar's internal investigation and remediation efforts. Mr. Naranjo will also serve as the primary interface with the forensic investigators retained by outside counsel (Graystone Forensics LLC, as described in Section IV.B below) and will oversee any necessary internal IT remediation measures to ensure the security of Quorum's own systems and data.
Jennifer Liang, Chief Privacy Officer, Quorum Insurance Holdings Corp. — Ms. Liang will serve as the privacy and notification lead. She will coordinate with outside counsel on the assessment of federal and state notification obligations and will lead the internal effort to identify affected individuals and map the data involved in the incident. Ms. Liang will also oversee Quorum's data inventory and data mapping process as described in Section IV.F below.
Priya Deshmukh, Vice President, Vendor Risk Management, Quorum Insurance Holdings Corp. — Ms. Deshmukh will serve as the vendor accountability lead. She will serve as the point of contact for the review of Palomar's compliance with its obligations under the MSA, including the Data Security Exhibit, breach notification requirements, and indemnification provisions. Ms. Deshmukh will also monitor Palomar's remediation efforts and will compile Quorum's vendor risk management file for Palomar in support of the contractual analysis.
Robert Wentworth, Senior Vice President, Claims Operations, Quorum Insurance Holdings Corp. — Mr. Wentworth will lead the operational impact assessment and business continuity planning for Quorum's claims processing operations during the incident response period. He will also be responsible for compiling the data inventory for personal lines claims data processed by Palomar, including the identification of the geographic distribution of affected policyholders and claimants.
Kevin Ostrowski, Partner, Privacy & Data Security, Calderwood & Harkness LLP — Mr. Ostrowski will serve as the lead outside counsel for the incident. He will coordinate all legal workstreams, including forensic investigation oversight, notification compliance, regulatory engagement, vendor accountability, insurance coordination, and privilege management.
Alan Burke, Associate, Privacy & Data Security, Calderwood & Harkness LLP — Mr. Burke will serve as the day-to-day outside counsel contact for Quorum's incident response team. He will coordinate directly with the forensic investigation team at Graystone Forensics LLC and will prepare the contractual analysis of the Palomar MSA.
Sara Hendricks, Associate, Calderwood & Harkness LLP — Ms. Hendricks will provide notification compliance and regulatory filing support, including preparation of the 50-state breach notification law survey and drafting of consumer and regulatory notification materials.
The IRT will hold an initial kickoff call no later than May 5, 2023, at which time the forensic investigation scope, privilege protocols, and immediate action items will be discussed in detail. Following the kickoff call, the IRT will convene at least weekly, or more frequently as warranted by developments in the investigation or the need for time-sensitive decisions. Meeting schedules, agendas, and dial-in information will be circulated by Alan Burke.
IV. Immediate Action Items
The following action items require immediate attention and execution by the designated members of the IRT. Each action item is assigned a responsible party and a target completion date. Calderwood & Harkness will track progress on these items and will report status at each IRT meeting.
A. Evidence Preservation and Legal Hold
The preservation of all evidence related to the Palomar security incident is an immediate and non-negotiable priority. Calderwood & Harkness will prepare and circulate a draft Legal Hold Notice for issuance by Thomas R. Whitfield, in his capacity as General Counsel, to Quorum's Information Technology department and Claims Operations department no later than May 6, 2023. The Legal Hold Notice will be directed to David Naranjo, Robert Wentworth, and such other custodians as may be identified by Calderwood & Harkness in consultation with the IRT.
The Legal Hold Notice will direct the preservation of all documents, communications, and electronic records related to the Palomar data security incident, including but not limited to the following categories of materials:
(a) All communications between Quorum and Palomar regarding the breach, including but not limited to Derek Copeland's April 21, 2023 email notification to Thomas R. Whitfield and David Naranjo, and all subsequent communications between Quorum and Palomar personnel regarding the incident, its scope, remediation efforts, and any related operational matters;
(b) All internal Quorum communications regarding the Palomar data security incident, including emails, instant messages, memoranda, meeting notes, presentations, and any other records reflecting discussions, analyses, or decisions related to the incident;
(c) All data inventories, data maps, data flow diagrams, and records of data shared with, transmitted to, or made accessible to Palomar in connection with the claims processing services provided under the MSA;
(d) All records of Quorum's vendor risk management reviews of Palomar, including but not limited to annual vendor risk assessments, due diligence questionnaires and responses, SOC 2 Type II audit reports (audited by Kessler, Park & Associates CPA, PLLC), contractual compliance reviews, on-site assessment reports, and any previous security-related communications, findings, or remediation requests directed to Palomar;
(e) The Palomar Master Services Agreement dated November 12, 2019, Amendment 1 dated March 3, 2021, and Amendment 2 dated September 15, 2022, together with all exhibits, schedules, and attachments thereto, including but not limited to Exhibit D (Data Security), Exhibit E (Insurance Requirements), and the Business Associate Agreement;
(f) All records relating to Quorum's cyber-insurance policies, including the Atlas Mutual Insurance Company primary cyber-liability policy (Policy No. CYB-2023-041587) and the Pinnacle Surplus Lines Insurance Corp. excess cyber-liability policy (Policy No. XS-CYB-2023-7812), together with all related correspondence, broker communications, policy applications, and endorsements; and
(g) All system logs, network logs, access logs, audit trails, and other electronic records maintained by Quorum's IT department that are relevant to data transmissions to Palomar, access by Palomar personnel to Quorum systems or data, and the security of Quorum's own network environment.
Additionally, David Naranjo is directed to confirm, as promptly as practicable and no later than May 6, 2023, that Quorum's own systems and logs relevant to data transmissions to Palomar are preserved and are not subject to auto-deletion, log rotation, or any other automated processes that could result in the destruction of relevant evidence. If any such automated processes are identified, Mr. Naranjo should take immediate steps to suspend them for all relevant data sources and should confirm such suspension to Calderwood & Harkness in writing.
B. Retention of Forensic Investigators Under Privilege
Calderwood & Harkness will retain Graystone Forensics LLC ("Graystone") to conduct the forensic investigation of the Palomar security incident. Graystone is a Virginia limited liability company headquartered at 1950 Old Gallows Road, Suite 600, Tysons Corner, Virginia 22182. Graystone is a nationally recognized digital forensics and incident response firm with extensive experience in investigating data security incidents affecting the financial services and insurance industries.
The engagement will be led by Dr. Nolan Briggs, Managing Director, Incident Response, who will serve as the senior forensic investigator responsible for the overall direction of the investigation. The analyst lead for the engagement will be Kendra Faulkner, Senior Forensic Analyst, who will coordinate the day-to-day forensic analysis and evidence collection.
Graystone will be retained under the attorney-client privilege umbrella, at the express direction of Calderwood & Harkness LLP, effective May 5, 2023. A formal retention letter will be issued by Calderwood & Harkness to Graystone setting forth the terms of the engagement, the scope of Graystone's retention, and the privilege framework governing all aspects of Graystone's work. Specifically, Graystone's retention will be structured as follows to maximize privilege protection:
(i) Graystone is being retained by Calderwood & Harkness LLP, not by Quorum directly, for the purpose of assisting outside counsel in providing legal advice to Quorum regarding the Palomar security incident;
(ii) All Graystone findings, reports, work papers, analyses, and communications will be directed exclusively to Calderwood & Harkness LLP and will not be transmitted directly to Quorum or any other party without the prior authorization of Calderwood & Harkness;
(iii) All Graystone work product will be clearly marked as privileged and confidential attorney-client communication and attorney work product; and
(iv) Graystone personnel will be instructed to treat all aspects of the engagement as subject to the attorney-client privilege and work product doctrine.
A detailed scope of work and investigation plan will be finalized in coordination with Dr. Briggs and Ms. Faulkner by May 7, 2023. Based on preliminary discussions, the anticipated focus areas of the forensic investigation include:
(i) Confirmation of the threat actor's entry vector, specifically the exploitation of CVE-2023-0669 in Palomar's GoAnywhere MFT appliance, and assessment of whether additional vulnerabilities or entry vectors were utilized;
(ii) Establishment of a detailed timeline of unauthorized access and any lateral movement by the threat actor within Palomar's network;
(iii) Identification of the specific data sets, files, databases, and repositories that were accessed by the threat actor and/or exfiltrated from Palomar's network;
(iv) Assessment of the types and categories of data compromised, with specific attention to the presence of PII, financial information, and PHI belonging to Quorum policyholders and claimants;
(v) Determination of the scope of affected individuals, including the total number of individuals whose data was compromised and the states of residence of those individuals; and
(vi) Assessment of the threat actor's identity, methodology, and any indicators of compromise that may inform the risk of further exploitation or publication of exfiltrated data.
Preliminary forensic findings are targeted for delivery to Calderwood & Harkness in early June 2023. A final forensic report is targeted for completion in mid-July 2023. These timelines are subject to adjustment based on the complexity of the investigation, the cooperation of Palomar in providing access to relevant systems and data, and any unforeseen developments.
C. Communications Lockdown and Privilege Protocol
The protection of attorney-client privilege and work product protections is essential to preserving Quorum's legal position and ensuring the integrity of the investigation. Accordingly, the following communications protocols are effective immediately:
External Communications. All external communications regarding the Palomar data security incident — whether directed to Palomar, regulators, law enforcement, policyholders, claimants, media, investors, business partners, or any other third party — must be channeled through or approved in advance by Calderwood & Harkness LLP. No member of the IRT or any other Quorum employee should issue any external communication regarding the incident without prior coordination with outside counsel.
Communications with Palomar. No Quorum personnel should communicate with Palomar regarding the substance of the security incident or the investigation without prior coordination with and approval by Calderwood & Harkness. This restriction applies to all forms of communication, including email, telephone, video conference, in-person meetings, and written correspondence. Operational communications between Quorum and Palomar that are necessary for the continued performance of claims processing services under the MSA may continue in the ordinary course of business; however, such operational communications must not address, reference, or discuss the breach investigation, the forensic investigation, remediation status, fault, causation, liability, or any other matter related to the security incident. If any Palomar personnel or Palomar's counsel (Mercer, Haight & Dunlop LLP; Catherine Langford, Partner) initiate communications with Quorum regarding the incident, such communications should be immediately redirected to Calderwood & Harkness.
Media, Investors, and Policyholders. No statements to the media, investors, analysts, regulators, policyholders, claimants, or any other external audience should be made at this time regarding the incident. Any inquiries received from any such parties should be directed to Thomas R. Whitfield, who will coordinate the response with Calderwood & Harkness.
Privilege Protocol Memo. Calderwood & Harkness will prepare and issue a detailed Privilege Protocol Memo to all members of the IRT and the broader engagement team, to be distributed no later than May 5, 2023. The Privilege Protocol Memo will set forth comprehensive guidance on document marking requirements, communication channel restrictions, procedures for handling forensic work product, and best practices for preserving privilege in the context of this investigation. All IRT members and Quorum personnel involved in the incident response are expected to review and comply with the Privilege Protocol Memo.
Crisis Communications Firm. Calderwood & Harkness anticipates that the engagement of a crisis communications firm may become necessary as the investigation matures and the scope of the incident becomes clearer. BrightPath Consulting Group Inc. ("BrightPath"), led by Meredith Ashford, Managing Director, has been identified as a potential engagement for external and internal communications strategy. The timing and scope of BrightPath's engagement will be assessed in the coming weeks based on the results of the forensic investigation and the determination of notification obligations. If engaged, BrightPath will be retained through Calderwood & Harkness under the privilege umbrella, consistent with the structure described above for Graystone.
D. Cyber-Insurance Notification
Timely notification to Quorum's cyber-insurance carriers is a contractual requirement under the applicable policies and is essential to preserving Quorum's coverage rights. Calderwood & Harkness will prepare and submit a formal notice of claim to Quorum's primary cyber-liability insurer, Atlas Mutual Insurance Company ("Atlas"), under Policy No. CYB-2023-041587, no later than May 8, 2023. The notice will be directed to Paul Enriquez, Claims Adjuster, at Atlas, and will provide sufficient detail regarding the incident to satisfy the policy's notice requirements while preserving Quorum's privilege and avoiding unnecessary disclosure of work product.
Simultaneously, a precautionary notice of potential claim will be transmitted to Pinnacle Surplus Lines Insurance Corp. ("Pinnacle"), Quorum's excess cyber-liability insurer, under Policy No. XS-CYB-2023-7812. This notice will be directed to Lisa Garner, Claims Contact, at Pinnacle. While the excess layer may not ultimately be implicated depending on the scope of the incident and associated costs, timely precautionary notice is advisable to preserve Quorum's rights under the excess policy.
In connection with the foregoing, Quorum's cyber-insurance broker, Whitmore Risk Advisors Inc. ("Whitmore"), should be notified of the claim filing. Sandra Whitmore-Kim, Lead Broker, should be advised of the incident and the submission of notices to both Atlas and Pinnacle. Ms. Whitmore-Kim's assistance may be required in facilitating communications with the carriers and in navigating any consent or pre-approval requirements applicable to vendor selection.
For the reference of the IRT, the key parameters of Quorum's cyber-insurance tower are as follows:
Atlas Mutual Insurance Company — Primary Cyber-Liability Policy (Policy No. CYB-2023-041587):
• Per-occurrence limit: $15,000,000
• Self-insured retention ("SIR"): $2,500,000
• Coverage period: January 1, 2023 through January 1, 2024
Pinnacle Surplus Lines Insurance Corp. — Excess Cyber-Liability Policy (Policy No. XS-CYB-2023-7812):
• Excess limit: $25,000,000 excess of $15,000,000
• Total tower: $40,000,000
• Coverage period: January 1, 2023 through January 1, 2024
Coverage Scope (subject to policy terms, conditions, and exclusions):
• First-party forensic investigation costs
• Notification costs (printing, mailing, call center)
• Credit monitoring and identity theft protection services
• Crisis communications and public relations costs
• Regulatory defense costs (attorneys' fees and expenses)
• Regulatory fines and penalties (where insurable by law)
Calderwood & Harkness will prepare a comprehensive coverage analysis memorandum by May 9, 2023, assessing the scope and applicability of coverage under both layers of the cyber-insurance tower. The coverage analysis will identify any consent requirements, cooperation obligations, pre-approved or panel vendor requirements, and other policy conditions that may affect the selection of forensic investigators, notification vendors, crisis communications firms, and other service providers. All vendors engaged in connection with the incident response — including Graystone Forensics LLC, Clearfield Notification Services (if engaged for consumer notification mailing services), and BrightPath Consulting Group Inc. — should be selected with attention to any insurer pre-approval or panel requirements, to the extent applicable, to avoid jeopardizing coverage.
E. Vendor Accountability — Initial Steps
A thorough analysis of Quorum's contractual rights and remedies against Palomar under the MSA is a critical workstream. Alan Burke will conduct an initial review of the Palomar MSA (as amended by Amendment 1 and Amendment 2) with particular attention to the following contractual provisions:
Data Security Exhibit (Exhibit D, as amended by Amendment 2, September 15, 2022): Exhibit D sets forth Palomar's obligations with respect to the protection and security of Quorum data. Key provisions include: (i) the requirement that Palomar implement and maintain commercially reasonable administrative, technical, and physical safeguards to protect the confidentiality, integrity, and availability of Quorum data; (ii) a thirty (30) day critical vulnerability patching obligation requiring Palomar to apply security patches for critical and high-severity vulnerabilities within thirty days of release; (iii) the requirement that Palomar conduct annual penetration testing of its network and applications and provide the results to Quorum; and (iv) the requirement that Palomar obtain and maintain a SOC 2 Type II audit report, audited by an independent third-party auditor, on an annual basis. Given that CVE-2023-0669 was publicly disclosed and patches were made available in February 2023, and the initial unauthorized access is believed to have occurred on or about March 14, 2023, a critical question for the vendor accountability workstream is whether Palomar complied with its thirty-day patching obligation and, if not, whether such failure constituted a material breach of the MSA.
Breach Notification Clause (Section 9.4): Section 9.4 of the MSA requires Palomar to notify Quorum within forty-eight (48) hours of discovering a security incident affecting Quorum data. As noted in Section II.B above, Palomar's April 21, 2023 notification was provided approximately seventy-two hours after the April 18 discovery, representing an approximate twenty-four (24) hour delay relative to the contractual deadline. The legal and practical implications of this delay will be assessed.
Indemnification (Section 12.2): Section 12.2 of the MSA sets forth Palomar's indemnification obligations with respect to third-party claims, losses, damages, costs, and expenses arising from Palomar's breach of its data security obligations. The scope of Palomar's indemnification obligation, including whether it covers first-party costs such as forensic investigation expenses, notification costs, and credit monitoring, will be carefully analyzed. The MSA contains a liability cap equal to two times (2×) the trailing twelve-month fees paid to Palomar, which, based on the current annual contract value of $16.3 million, yields a maximum contractual liability cap of $32,600,000. The enforceability and applicability of this cap, as well as any exceptions to the cap (e.g., for willful misconduct, gross negligence, or breaches of data security obligations), will be assessed.
Insurance Requirements (Exhibit E): Exhibit E requires Palomar to obtain and maintain minimum insurance coverage, including cyber-liability insurance with a minimum coverage limit of $10,000,000. Calderwood & Harkness will request evidence of Palomar's compliance with this requirement, including copies of Palomar's current cyber-liability insurance certificate and policy.
Termination for Cause (Section 14.2): Section 14.2 provides that either party may terminate the MSA for cause upon thirty (30) days' written notice if the other party commits a material breach that is not cured within such thirty-day period. Whether the security incident and/or Palomar's failure to comply with its data security and notification obligations constitutes a material breach triggering Quorum's termination rights will be assessed. Any decision regarding termination will need to be carefully considered in light of the operational implications for Quorum's claims processing operations and the availability of alternative vendors.
A detailed contractual analysis memorandum will be prepared by Alan Burke and circulated to the IRT by May 12, 2023.
Separately, Priya Deshmukh should compile Quorum's complete vendor risk management file for Palomar, including all past vendor risk assessments, due diligence questionnaires and Palomar's responses, SOC 2 Type II audit reports (audited by Kessler, Park & Associates CPA, PLLC), on-site assessment records, any previous security-related communications or remediation requests directed to Palomar, and records of any prior security incidents or near-misses involving Palomar. This file will be critical to assessing Quorum's own vendor oversight practices and to supporting any indemnification or other claims against Palomar.
It is imperative that Quorum not make any statements to Palomar or Palomar's counsel — Mercer, Haight & Dunlop LLP (Catherine Langford, Partner) — regarding indemnification, fault, causation, liability, or any other matter bearing on Palomar's contractual or legal responsibility for the incident until Calderwood & Harkness has completed its contractual analysis and provided guidance. Any such premature communications could compromise Quorum's legal position and should be strictly avoided.
F. Data Inventory and Mapping
The identification and mapping of the data involved in the incident is a foundational prerequisite for the forensic investigation, the notification trigger analysis, and the ultimate determination of Quorum's legal obligations. Jennifer Liang, in coordination with Robert Wentworth and David Naranjo, should immediately commence the compilation of a comprehensive inventory of the categories and types of data that Quorum transmits to or makes accessible to Palomar for claims processing purposes.
This data inventory should include, at a minimum, the following categories of data:
Personally Identifiable Information (PII):
• Full legal names of policyholders and claimants
• Dates of birth
• Social Security numbers
• Driver's license numbers and state identification numbers
• Home addresses, email addresses, and telephone numbers
Financial Information:
• Bank account numbers (routing and account numbers)
• Payment card numbers (credit and debit card numbers, expiration dates, and security codes)
• Claims payment history and amounts
• Premium payment information
Protected Health Information (PHI):
• Health conditions and medical diagnoses
• Diagnosis codes (ICD-10 and other coding systems)
• Treatment information, including records of medical procedures, prescriptions, and provider information
• Workers' compensation claim information, including injury descriptions, treatment plans, and return-to-work assessments
• Health-related claim information from Quorum's personal lines health-adjacent coverage products
This data inventory will be critical to multiple workstreams within the incident response. First, it will inform the scope of the forensic investigation by identifying the data sets and repositories at risk of compromise. Second, it will be essential to assessing Quorum's notification obligations under the various state breach notification statutes, each of which defines the categories of personal information that trigger notification requirements differently. Third, to the extent PHI is confirmed to be among the compromised data, the data inventory will be necessary for the assessment of obligations under the HIPAA Breach Notification Rule (45 C.F.R. § 164.408 et seq.) and the Connecticut Insurance Data Security Law (Conn. Gen. Stat. § 38a-999b).
In addition to the data inventory, Robert Wentworth should identify and compile the geographic distribution of Quorum's personal lines policyholders and claimants whose data is processed by Palomar, broken down by state of residence. This geographic analysis will be essential to the notification trigger analysis, as different states impose different notification deadlines, content requirements, and regulatory filing obligations. Given that Quorum's personal lines business operates across all fifty states, the geographic distribution analysis should encompass all jurisdictions.
G. Regulatory Notification — Preliminary Assessment
Calderwood & Harkness will begin a preliminary assessment of the state and federal regulatory notification obligations that may be triggered depending on the scope and nature of the compromised data as established by the forensic investigation. This assessment will be comprehensive and will address the full range of applicable legal requirements, including the following:
State Breach Notification Statutes. All fifty states and the District of Columbia have enacted data breach notification statutes that impose notification obligations on entities that experience a breach of security involving personal information of state residents. The specific notification triggers, deadlines, content requirements, and regulatory filing obligations vary significantly among jurisdictions. Calderwood & Harkness will conduct a comprehensive 50-state survey of applicable breach notification laws, with priority focus on the states where Quorum has the most significant concentrations of policyholders and claimants, including Connecticut, New York, California, Texas, Florida, Pennsylvania, Illinois, New Jersey, Ohio, and Massachusetts. Each of these states has enacted breach notification statutes with specific and, in some cases, particularly demanding requirements.
HIPAA Breach Notification Rule (45 C.F.R. Part 164, Subpart D). To the extent that PHI from workers' compensation and health-related claims is confirmed to have been compromised, Quorum may have notification obligations under the HIPAA Breach Notification Rule. Under the Rule, a covered entity must notify affected individuals, the U.S. Department of Health and Human Services Office for Civil Rights ("HHS-OCR"), and, in certain cases, the media, following a breach of unsecured PHI. Quorum's status as a covered entity and Palomar's status as a business associate under HIPAA, as well as the applicability of the HIPAA breach notification requirements to this incident, will be assessed as part of this workstream. The applicable HHS-OCR regional office is Region I, located in Boston, Massachusetts.
Connecticut Insurance Data Security Law (Conn. Gen. Stat. § 38a-999b). As a Connecticut-domiciled insurance holding company, Quorum is subject to the Connecticut Insurance Data Security Law, which imposes specific cybersecurity requirements and breach notification obligations on insurance licensees. The Connecticut Insurance Department's Cybersecurity Unit, under Examiner Richard Nakamura, oversees compliance with this statute. Notification to the Commissioner of Insurance may be required within specified timeframes following a cybersecurity event, and Calderwood & Harkness will assess Quorum's obligations under this statute.
New York SHIELD Act (N.Y. Gen. Bus. Law § 899-aa). The New York SHIELD Act imposes breach notification obligations on any person or business that owns or licenses computerized data that includes private information of New York residents, and requires notification to the New York Attorney General, the Department of State, and the Division of State Police. Given the likely significant number of Quorum policyholders residing in New York, compliance with the SHIELD Act will be a priority.
California Civil Code § 1798.82 and the Confidentiality of Medical Information Act (CMIA). California imposes notification obligations on any person or business that owns or licenses computerized data that includes personal information of California residents. Additionally, the CMIA imposes specific obligations with respect to medical information. California also requires notification to the California Attorney General when more than 500 California residents are affected.
Massachusetts Breach Notification Statute (Mass. Gen. Laws ch. 93H, § 3; 201 CMR 17.00). Massachusetts requires notification to the Massachusetts Attorney General and the Office of Consumer Affairs and Business Regulation, and imposes specific content requirements for consumer notifications. Massachusetts also maintains data security regulations (201 CMR 17.00) that impose affirmative security program requirements.
A comprehensive 50-state breach notification law survey, tailored to the specific data categories at issue in the Palomar incident, will be prepared by Sara Hendricks and circulated to the IRT by early June 2023.
It is important to emphasize that no regulatory notifications should be filed at this time. Premature notification, before the scope of the compromised data and the identity of affected individuals have been established through the forensic investigation, would be inadvisable and could result in inaccurate or incomplete filings. Notification timing will be assessed by Calderwood & Harkness once the forensic investigation has established the scope of compromised data, the categories of data involved, and the number and residency of affected individuals. Applicable notification deadlines under state law will be tracked, and a notification timeline will be prepared to ensure compliance with all applicable requirements.
H. Board and Management Reporting
Given the potential significance of the Palomar security incident to Quorum's operations, financial position, and regulatory standing, appropriate reporting to Quorum's senior management and Board of Directors is essential. The following reporting actions are recommended:
Audit Committee Briefing. A privileged briefing memorandum will be prepared by Calderwood & Harkness for Franklin Reeves, Chair of the Audit Committee of Quorum's Board of Directors, providing an initial incident report. The briefing memorandum will summarize the nature and preliminary scope of the incident, the actions taken to date, the composition and activities of the IRT, and the anticipated next steps. The target date for delivery of the Audit Committee briefing memorandum is May 11, 2023. The briefing memorandum will be clearly marked as privileged and confidential, and Mr. Whitfield should ensure that its distribution is limited to members of the Audit Committee and that it is handled in accordance with the privilege protocols established by this memorandum.
CEO Notification. Thomas R. Whitfield should advise Margaret D. Calloway, Chief Executive Officer of Quorum, of the Palomar security incident and the engagement of Calderwood & Harkness as outside counsel. This notification should occur promptly and should include a high-level summary of the incident, the activation of the IRP, and the immediate action items being undertaken. Ms. Calloway should be advised that a more detailed briefing will be provided as the investigation progresses and that all information regarding the incident is privileged and confidential.
SEC Disclosure Obligations. Calderwood & Harkness will assess Quorum's potential disclosure obligations under the federal securities laws in due course as the investigation matures and the financial impact of the incident becomes quantifiable. Quorum Insurance Holdings Corp. is a publicly traded company listed on the Nasdaq Global Select Market under the ticker symbol QIHC, with fiscal year 2022 revenue of approximately $4.82 billion and a market capitalization of approximately $6.1 billion as of May 2023. Potential disclosure obligations to be assessed include the requirement to file a Current Report on Form 8-K under Item 1.05 (Material Cybersecurity Incidents) within four business days of determining that a cybersecurity incident is material, as well as the potential need to update risk factor disclosures in the Company's Quarterly Report on Form 10-Q and Annual Report on Form 10-K. A separate disclosure analysis memorandum will be prepared by Calderwood & Harkness. A materiality analysis will be conducted once the scope of the incident is established and the associated costs — including forensic investigation costs, notification costs, credit monitoring costs, regulatory defense costs, potential regulatory fines and penalties, and potential litigation exposure — can be reasonably estimated.
V. Anticipated Workstream Timeline (Preliminary)
The following is a preliminary timeline for the major workstreams associated with the incident response. These timelines are subject to adjustment as the forensic investigation progresses, additional facts come to light, and circumstances evolve. Calderwood & Harkness will provide updated timeline projections at each IRT meeting.
These timelines are preliminary in nature and are provided for planning purposes. The actual pace of the response will be driven by the findings of the forensic investigation, the cooperation of Palomar in providing access to relevant systems and information, applicable regulatory deadlines, and the overall scope and complexity of the incident as it becomes known.
VI. Key Contacts and Communication Protocols
The following table sets forth the key contacts for the Palomar incident response. All IRT members should maintain current contact information for the individuals listed below and should ensure that communications regarding the incident are directed to the appropriate parties.
Communication Protocols. The following communication protocols are effective immediately and will remain in effect throughout the duration of the incident response:
1. All substantive communications regarding the Palomar data security incident — whether internal to Quorum, between Quorum and outside counsel, or between any members of the IRT — should be clearly marked with the following legend: "PRIVILEGED AND CONFIDENTIAL — ATTORNEY-CLIENT COMMUNICATION." This marking should appear in the subject line of all emails and at the top of all written documents and memoranda.
2. Outside counsel (Kevin Ostrowski, Alan Burke, or Sara Hendricks) should be included on all email communications and all written correspondence related to the incident. No substantive discussions of the incident should take place via email, telephone, or in person without the inclusion or prior coordination of outside counsel.
3. A dedicated secure communication channel will be established for the IRT to facilitate the exchange of sensitive information related to the incident. Details regarding the secure communication channel, including access credentials and usage protocols, will be provided by David Naranjo in coordination with Calderwood & Harkness. Pending the establishment of the secure channel, all communications should be transmitted via encrypted email.
4. Hard copy documents related to the incident should be stored securely, with access limited to members of the IRT and such other individuals as may be specifically authorized by Thomas R. Whitfield or Calderwood & Harkness.
VII. Closing
The Palomar data security incident presents significant legal, operational, and reputational risks to Quorum Insurance Holdings Corp. The potential scope of the compromise — involving sensitive personal information, financial data, and protected health information of Quorum policyholders and claimants across all fifty states — demands an immediate, coordinated, and disciplined response. The actions outlined in this memorandum are designed to ensure that Quorum meets its legal obligations, preserves its contractual rights, protects attorney-client privilege, and positions itself to manage the financial and operational impact of the incident effectively.
We request that each recipient of this memorandum confirm, in writing to Alan Burke at Calderwood & Harkness, no later than the close of business on May 5, 2023, that they have reviewed this memorandum in its entirety and are prepared to commence their assigned responsibilities as outlined herein. Confirmation should be sent via email to Mr. Burke and should include a copy to Kevin Ostrowski and Thomas R. Whitfield.
Calderwood & Harkness LLP is available to Quorum's incident response team on an around-the-clock basis during the initial response phase. Kevin Ostrowski may be reached directly at (202) 555-0147 (office), (202) 555-0293 (mobile), or kostrowski@calderwoodharkness.com. Alan Burke may be reached directly at (202) 555-0184 (office), (202) 555-0361 (mobile), or aburke@calderwoodharkness.com. IRT members should not hesitate to contact outside counsel at any time if questions or issues arise regarding the incident or the matters addressed in this memorandum.
The next IRT meeting is scheduled for no later than May 5, 2023. A calendar invitation and dial-in information will be circulated by Alan Burke today.
Respectfully submitted,
CALDERWOOD & HARKNESS LLP
By: ________
Kevin Ostrowski Partner, Privacy & Data Security Calderwood & Harkness LLP 1700 K Street NW, Suite 900 Washington, D.C. 20006
By: ________
Alan Burke Associate, Privacy & Data Security Calderwood & Harkness LLP 1700 K Street NW, Suite 900 Washington, D.C. 20006
PRIVILEGED AND CONFIDENTIAL — ATTORNEY-CLIENT COMMUNICATION / ATTORNEY WORK PRODUCT. This memorandum is prepared by Calderwood & Harkness LLP in connection with its engagement by Quorum Insurance Holdings Corp. for the purpose of providing legal advice. It is protected from disclosure by the attorney-client privilege, the work product doctrine, and all other applicable privileges and protections. Do not distribute, copy, or disclose without the prior written approval of Calderwood & Harkness LLP.
| Timeframe | Key Activities | ||
| May 4–7, 2023 | IRP activation (this memorandum); issuance of Legal Hold Notice; retention of Graystone Forensics LLC and finalization of scope of work; submission of cyber-insurance notices to Atlas and Pinnacle; issuance of Privilege Protocol Memo; IRT kickoff call | ||
| May 8–12, 2023 | Preparation and circulation of initial incident assessment memorandum; completion of cyber-insurance coverage analysis memorandum; completion of initial contractual analysis of Palomar MSA; preparation and delivery of Audit Committee briefing memorandum to Franklin Reeves | ||
| May–June 2023 | Graystone forensic investigation (on-site and remote analysis); preliminary forensic findings targeted for early June; comprehensive 50-state breach notification law survey prepared by Sara Hendricks; data inventory and mapping by Jennifer Liang and Robert Wentworth | ||
| June–July 2023 | Graystone final forensic report targeted for mid-July; notification trigger analysis based on forensic findings; HIPAA breach notification analysis; preparation of state-specific compliance memoranda for priority jurisdictions; vendor accountability and indemnification analysis refinement | ||
| July–August 2023 | Data mining and affected individual identification; drafting of consumer notification letters; drafting of regulatory notification filings; selection and engagement of notification mailing vendor (Clearfield Notification Services or comparable provider); selection and engagement of call center and credit monitoring provider | ||
| August–September 2023 | Consumer notification mailing; filing of regulatory notifications with applicable state attorneys general, regulators, and federal agencies; activation of dedicated call center for consumer inquiries; activation of credit monitoring and/or identity theft protection services for affected individuals | ||
| Ongoing | Vendor accountability and indemnification workstream (correspondence with Palomar; potential enforcement of contractual rights); regulatory engagement and response to regulatory inquiries; insurance coordination and cost recovery; litigation monitoring and defense (if class action or other litigation is filed); SEC disclosure analysis and, if applicable, Form 8-K filing | ||
| Name | Role | Organization | Contact Purpose |
| Kevin Ostrowski | Responsible Partner, Privacy & Data Security | Calderwood & Harkness LLP, 1700 K Street NW, Suite 900, Washington, D.C. 20006 | Outside counsel lead; overall legal strategy and coordination |
| Alan Burke | Lead Associate, Privacy & Data Security | Calderwood & Harkness LLP | Day-to-day outside counsel contact; forensic investigation coordination |
| Sara Hendricks | Working Associate | Calderwood & Harkness LLP | Notification compliance and regulatory filing support |
| Thomas R. Whitfield | General Counsel | Quorum Insurance Holdings Corp., 400 Constitution Plaza, Suite 2200, Hartford, CT 06103 | Executive sponsor; authorization authority for legal decisions |
| David Naranjo | Chief Information Security Officer | Quorum Insurance Holdings Corp. | Technical lead; forensic coordination; internal IT remediation |
| Jennifer Liang | Chief Privacy Officer | Quorum Insurance Holdings Corp. | Privacy and notification lead; data inventory and mapping |
| Priya Deshmukh | VP, Vendor Risk Management | Quorum Insurance Holdings Corp. | Vendor accountability lead; MSA compliance review |
| Robert Wentworth | SVP, Claims Operations | Quorum Insurance Holdings Corp. | Claims data inventory; operational impact and business continuity |
| Dr. Nolan Briggs | Managing Director, Incident Response | Graystone Forensics LLC, 1950 Old Gallows Rd., Suite 600, Tysons Corner, VA 22182 | Forensic investigation lead |
| Sandra Whitmore-Kim | Lead Broker | Whitmore Risk Advisors Inc. | Cyber-insurance broker; carrier coordination |
| Paul Enriquez | Claims Adjuster | Atlas Mutual Insurance Company | Primary cyber-liability insurer; claims contact |