PRIVILEGED AND CONFIDENTIAL ATTORNEY-CLIENT COMMUNICATION ATTORNEY WORK PRODUCT
CALDERWOOD & HARKNESS LLP 1700 K Street NW, Suite 900 Washington, D.C. 20006 Tel: (202) 555-7400
Fax: (202) 555-7401
Matter No. 1025-00006
MEMORANDUM
TO: Thomas R. Whitfield, General Counsel, Quorum Insurance Holdings Corp.
FROM: Alan Burke, Lead Associate, Privacy & Data Security Sara Hendricks, Working Associate, Privacy & Data Security
CC: Kevin Ostrowski, Responsible Partner, Privacy & Data Security Rachel Bernstein, Billing Partner, Privacy & Data Security
DATE: May 8, 2023
RE: Initial Assessment of Vendor-Originated Data Security Incident — Palomar Data Solutions, Inc.
PRIVILEGE NOTICE: This memorandum has been prepared by Calderwood & Harkness LLP at the direction of counsel and in anticipation of litigation for the sole purpose of providing legal advice to Quorum Insurance Holdings Corp. The contents of this memorandum are protected by the attorney-client privilege and the attorney work product doctrine. This memorandum, and the information contained herein, shall not be disclosed, disseminated, distributed, or copied, in whole or in part, to any person or entity without the prior written authorization of Calderwood & Harkness LLP. Any unauthorized disclosure may result in an irrevocable waiver of applicable privileges.
I. Executive Summary
Calderwood & Harkness LLP was engaged on May 4, 2023, by Quorum Insurance Holdings Corp. ("Quorum" or the "Company") to manage the legal response to a data security incident originating from Quorum's third-party claims-processing vendor, Palomar Data Solutions, Inc. ("Palomar"). This memorandum sets forth our initial assessment of the incident based on the information available to date and identifies the key legal, regulatory, and contractual risks facing Quorum as the investigation proceeds.
Based on information received to date from Palomar and its outside counsel at Mercer, Haight & Dunlop LLP (partner Catherine Langford), the incident involves unauthorized access to Palomar's network beginning on or about March 14, 2023. The threat actor gained initial access through exploitation of a known remote code execution vulnerability, tracked as CVE-2023-0669, in Palomar's GoAnywhere MFT (Managed File Transfer) file transfer appliance. The vulnerability had been publicly disclosed and a vendor-issued patch was available prior to the date of exploitation, raising significant questions about whether Palomar timely applied the patch in accordance with its contractual obligations to Quorum.
Anomalous outbound data transfers were detected by Palomar's security operations center ("SOC") on April 18, 2023, approximately thirty-five (35) days after the initial intrusion. This extended dwell time — during which the threat actor appears to have conducted lateral movement, staged data, and exfiltrated files from Palomar's network — raises additional concerns regarding the adequacy of Palomar's network monitoring and intrusion detection capabilities.
Palomar provided written notification to Quorum on April 21, 2023, via email from Derek Copeland, Palomar's General Counsel, to Thomas R. Whitfield, Quorum's General Counsel, and David Naranjo, Quorum's Chief Information Security Officer. This notification was delivered approximately seventy-two (72) hours after Palomar's internal discovery of the incident on April 18, 2023, which is roughly twenty-four (24) hours beyond the forty-eight (48) hour notification window required under Section 9.4 of the Master Services Agreement between the parties.
The incident potentially exposes personally identifiable information ("PII"), financial data, and protected health information ("PHI") of Quorum policyholders and claimants whose data was processed by Palomar under the Master Services Agreement dated November 12, 2019, as amended (the "MSA"). Given the volume of personal lines claims data that Palomar processes on Quorum's behalf, the number of potentially affected individuals could be substantial, potentially reaching hundreds of thousands of individuals across all fifty states.
This memorandum provides an initial legal assessment of the incident, identifies key risk areas across regulatory, litigation, and contractual dimensions, outlines the immediate next steps that Calderwood & Harkness recommends, and summarizes preliminary contractual considerations relevant to vendor accountability. Supplemental memoranda addressing specific legal issues — including a comprehensive 50-state breach notification law survey, a detailed cyber-insurance coverage analysis, and a securities disclosure assessment — are being prepared separately and will follow in due course.
II. Background: Quorum-Palomar Relationship
A. The Master Services Agreement
Quorum and Palomar entered into a Master Services Agreement (the "MSA") on November 12, 2019, pursuant to which Palomar provides claims data processing, document management, and analytics services for Quorum's personal lines division. The MSA was the product of a competitive procurement process managed by Quorum's Strategic Sourcing group and was executed following completion of Quorum's standard vendor due diligence process, including an information security risk assessment.
The MSA has an initial term of five (5) years, expiring on November 11, 2024, subject to the termination provisions set forth in Section 14 of the agreement. The original annual contract value ("ACV") at inception was approximately $14,200,000, making Palomar one of Quorum's most significant third-party service providers by expenditure.
Since execution, the MSA has been amended twice:
Amendment 1 (executed March 3, 2021): This amendment expanded the scope of Palomar's services to include data processing for the QuorumEdge platform, Quorum's proprietary digital claims management system launched in late 2020. The addition of QuorumEdge data processing increased the ACV by $2,100,000, bringing the total ACV to $16,300,000 effective April 1, 2021. Amendment 1 also revised certain service-level agreements to accommodate the QuorumEdge integration and expanded the categories of data elements transmitted to Palomar for processing.
Amendment 2 (executed September 15, 2022): This amendment updated the Data Security Exhibit (Exhibit D) to the MSA, incorporating enhanced security requirements negotiated by Quorum's Vendor Risk Management team. Key changes included the addition of a requirement that Palomar provide annual SOC 2 Type II audit reports (to be audited by Kessler, Park & Associates CPA, PLLC, or another nationally recognized audit firm), updated cyber-liability insurance minimums, and strengthened incident response notification procedures. Amendment 2 reflected Quorum's broader initiative to enhance data security standards across its critical vendor relationships.
As of the date of this memorandum, Palomar is understood to be Quorum's second-largest client by revenue, with the current ACV of $16,300,000 representing a material portion of Palomar's annual revenues. This revenue dependency may be relevant in evaluating Palomar's incentive to cooperate fully with Quorum's investigation and to meet its indemnification obligations.
Palomar's principal place of business is located at 7100 Greenville Avenue, Suite 450, Dallas, Texas 75231. Key Palomar personnel with whom Calderwood & Harkness anticipates engagement during the incident response include Marcus J. Trevino (Chief Executive Officer), Anita Raghavan (Chief Technology Officer), and Derek Copeland (General Counsel). Palomar's outside counsel for this matter is Catherine Langford, a partner in the Data Privacy & Cybersecurity practice at Mercer, Haight & Dunlop LLP.
B. Nature of Data Processed by Palomar
Under the MSA, Palomar processes structured claims data for Quorum's personal lines policyholders and claimants in connection with claims adjudication, analytics, and document management services. The data transmitted by Quorum to Palomar's processing environment encompasses multiple categories of sensitive personal information, including, but not limited to:
• Personally Identifiable Information (PII): Full legal names, dates of birth, Social Security numbers, driver's license numbers, home addresses, telephone numbers, and email addresses of policyholders and claimants.
• Financial Information: Bank account numbers (used for electronic claims disbursements and premium payment processing), payment card numbers, routing numbers, and associated financial account data.
• Protected Health Information (PHI): Health conditions, medical diagnosis codes (ICD-10), treatment information, provider identifiers, and related medical records data associated with workers' compensation claims and health-related insurance claims submitted through Quorum's personal lines division.
The scope and sensitivity of this data are significant. The inclusion of Social Security numbers, financial account information, and protected health information places this incident squarely within the most consequential category of data security events from a regulatory and litigation risk perspective. Social Security numbers, in particular, are considered among the most valuable data elements for purposes of identity theft and fraud, and their compromise invariably triggers notification obligations under the breach notification statutes of all fifty states.
The data at issue covers policyholders and claimants across all states in which Quorum operates its personal lines business. Quorum's personal lines division is active in all fifty states, the District of Columbia, and certain U.S. territories, meaning the geographic scope of potentially affected individuals is exceptionally broad and will implicate a correspondingly broad array of state and territorial breach notification laws.
Data is transmitted to Palomar's processing environment by the Quorum Claims Operations department, led by Senior Vice President Robert Wentworth. The transmission processes, data formats, and specific data elements shared with Palomar are governed by the data processing specifications set forth in Exhibit C to the MSA and the data security requirements in Exhibit D.
C. Vendor Risk Management Oversight
Quorum's Vendor Risk Management ("VRM") program, overseen by Vice President Priya Deshmukh within Quorum's Enterprise Risk Management function, is responsible for ongoing vendor due diligence, risk assessment, and oversight of third-party compliance with contractual requirements, including data security obligations. Palomar is classified as a "Tier 1 — Critical" vendor within Quorum's VRM framework, reflecting the volume and sensitivity of the data processed and the operational significance of the services provided.
Under the current MSA, as amended by Amendment 2, Exhibit D (the "Data Security Exhibit") establishes the following key data security obligations for Palomar:
• Safeguard Standards: Palomar is required to maintain "commercially reasonable" administrative, technical, and physical safeguards designed to protect the confidentiality, integrity, and availability of Quorum data in its possession, custody, or control. The standard of "commercially reasonable" safeguards is to be assessed in light of the sensitivity of the data processed, the size and complexity of Palomar's operations, and prevailing industry standards.
• Vulnerability and Patch Management: Palomar is required to patch critical vulnerabilities within thirty (30) days of vendor patch release. This requirement was incorporated into Exhibit D as part of Amendment 2 in September 2022, reflecting emerging best practices and Quorum's heightened focus on vulnerability management following several high-profile supply-chain incidents in the industry.
• Penetration Testing: Palomar is required to conduct annual penetration testing of its systems and network environment using a qualified, independent third-party testing firm, and to provide Quorum with a summary of results and remediation actions.
• SOC 2 Type II Reporting: As added by Amendment 2, Palomar is required to provide annual SOC 2 Type II audit reports, audited by Kessler, Park & Associates CPA, PLLC (or another nationally recognized audit firm approved by Quorum), covering the Trust Services Criteria for security, availability, and confidentiality.
Additionally, Exhibit E (the "Insurance Requirements") to the MSA requires Palomar to carry a minimum of $10,000,000 in cyber-liability insurance coverage, with Quorum named as an additional insured. We have requested, but have not yet received, confirmation of Palomar's current cyber-liability insurance coverage and carrier information.
The adequacy of Quorum's own vendor risk management oversight activities with respect to Palomar — including the frequency and depth of periodic assessments, the monitoring of remediation actions, and the review of SOC 2 reports — will be an important consideration as the investigation progresses, both from a defensive posture in potential regulatory proceedings and for purposes of internal lessons-learned assessment.
III. Incident Timeline and Known Facts
The following timeline is based on information received to date from Palomar, its counsel at Mercer, Haight & Dunlop LLP, and Quorum's internal records. All dates and facts remain subject to verification and refinement as the forensic investigation conducted by Graystone Forensics LLC progresses. Calderwood & Harkness has not independently verified the accuracy of Palomar's representations at this stage.
A. Initial Unauthorized Access — On or About March 14, 2023
Based on information provided by Palomar and its counsel, a threat actor exploited CVE-2023-0669, a known remote code execution vulnerability in Palomar's GoAnywhere MFT (Managed File Transfer) appliance, to gain initial unauthorized access to Palomar's network on or about March 14, 2023. GoAnywhere MFT is a widely used enterprise file transfer solution manufactured by Severin Corporation (formerly Strathmore Industries), and the CVE-2023-0669 vulnerability received significant public attention following its disclosure and subsequent widespread exploitation by multiple threat actors in early 2023.
CVE-2023-0669 is a publicly disclosed vulnerability that was assigned a high severity rating. A vendor-issued patch was made available by Severin Corporation prior to the date of exploitation against Palomar's systems. The precise date on which the patch was released by the vendor relative to the March 14 exploitation date is a critical fact that the forensic investigation will need to establish definitively; however, preliminary indications from publicly available information suggest that the patch had been available for a sufficient period to fall within the thirty (30) day patching window required under Exhibit D of the MSA.
Preliminary indications strongly suggest that Palomar had not applied the available patch to its GoAnywhere MFT appliance at the time of exploitation. If confirmed through the forensic investigation, this failure would constitute a significant departure from Palomar's contractual obligations under Exhibit D of the MSA and would represent a critical contributing factor to the incident. The failure to apply a known, available patch to a critical vulnerability in an internet-facing file transfer appliance reflects a deficiency in Palomar's vulnerability management program that will be central to any indemnification claim or breach-of-contract action.
B. Lateral Movement and Data Exfiltration — March 14 Through April 18, 2023
Following initial access through the GoAnywhere MFT vulnerability, the threat actor appears to have conducted lateral movement within Palomar's network environment over an approximately thirty-five (35) day period, from on or about March 14, 2023, through April 18, 2023. During this window, the threat actor expanded its foothold beyond the initially compromised GoAnywhere MFT appliance and moved through additional segments of Palomar's internal network.
Palomar has reported to its counsel, and its counsel has communicated to Calderwood & Harkness, that the threat actor staged and exfiltrated data files during this window. However, the precise volume and nature of the exfiltrated data remain under investigation. Palomar has not yet provided a definitive accounting of which data sets were accessed or exfiltrated, nor has Palomar confirmed whether the exfiltrated data specifically included Quorum policyholder and claimant data as opposed to data belonging to Palomar's other clients, or a combination thereof.
The extended dwell time of approximately thirty-five (35) days raises serious questions about the effectiveness of Palomar's network monitoring, intrusion detection systems, endpoint detection and response capabilities, and security logging practices. An intrusion of this duration — during which a threat actor was actively moving through the network, accessing data repositories, and staging files for exfiltration — should, in a well-monitored environment, have been detected significantly earlier. The forensic investigation will seek to determine what, if any, alerts were generated during this period and whether Palomar's SOC failed to identify or act upon indicators of compromise in a timely manner.
C. Discovery of Anomalous Activity — April 18, 2023
On April 18, 2023, Palomar's SOC detected unusual outbound data transfers that were inconsistent with normal operational patterns. The specific alert or monitoring tool that flagged the anomalous activity has not yet been disclosed to Calderwood & Harkness, and this information will be requested as part of the forensic investigation and Palomar cooperation process.
Upon detection, Palomar states that it initiated containment measures, including isolating affected systems and blocking the identified exfiltration channels. Palomar also engaged its internal incident response resources to begin an initial assessment of the scope and nature of the compromise. The adequacy and timeliness of these containment measures are subject to verification.
April 18, 2023, also marks the apparent end of the active exfiltration window, as Palomar's containment actions are reported to have terminated the threat actor's access to the network. Whether the threat actor had completed its intended exfiltration before detection, or whether Palomar's containment actions prevented further data loss, remains to be determined.
D. Notification to Quorum — April 21, 2023
Derek Copeland, Palomar's General Counsel, provided written notification of the incident to Thomas R. Whitfield, Quorum's General Counsel, and David Naranjo, Quorum's Chief Information Security Officer, via email on April 21, 2023. The notification was received three (3) calendar days after Palomar's internal discovery of the anomalous activity on April 18, 2023.
This notification timeline is significant for two reasons. First, Section 9.4 of the MSA requires Palomar to notify Quorum of any security incident affecting Quorum data within forty-eight (48) hours of Palomar's discovery of such incident. Forty-eight hours from the April 18 discovery would have required notification by approximately April 20, 2023. The notification delivered on April 21 was therefore approximately twenty-four (24) hours late relative to the contractual deadline. This delay constitutes a potential breach of the MSA's notification provisions and may have impacted Quorum's ability to initiate its own incident response activities on a timely basis.
Second, the notification email itself, which Calderwood & Harkness has reviewed, provided only limited information regarding the nature and scope of the incident. While it is not unusual for initial notifications to contain incomplete information given the early stage of investigation, the level of detail provided by Palomar was minimal and did not include critical information regarding the attack vector, the duration of unauthorized access, or the categories of data potentially affected. Subsequent communications have provided incrementally more detail, but significant gaps in Palomar's disclosure remain.
E. Subsequent Events
The following events have occurred since Quorum's receipt of Palomar's initial notification:
May 4, 2023: Quorum formally engaged Calderwood & Harkness LLP to manage the legal response to the incident, including the retention and direction of forensic investigators, regulatory compliance, breach notification analysis, and contractual enforcement.
May 5, 2023: Calderwood & Harkness retained Graystone Forensics LLC, a nationally recognized digital forensics and incident response firm, to conduct the technical forensic investigation under the umbrella of attorney-client privilege. The engagement is led by Dr. Nolan Briggs, Managing Director, Incident Response, with senior forensic analyst Kendra Faulkner serving as the day-to-day investigative lead. Graystone was retained through Calderwood & Harkness, rather than directly by Quorum, to maximize the protection of the forensic work product under the attorney-client privilege and work product doctrines.
May 6, 2023: Legal hold notices were issued to the Quorum IT department (directed to David Naranjo, CISO) and the Claims Operations department (directed to Robert Wentworth, SVP) instructing all personnel within those departments to preserve all documents, communications, and electronically stored information potentially relevant to the incident, the Palomar relationship, and the data transmitted to Palomar.
May 7, 2023: The scope of work and investigation plan for Graystone Forensics was finalized in consultation with Calderwood & Harkness and Quorum's IT security team. The investigation plan encompasses forensic imaging and analysis of available log data, network traffic analysis, identification of compromised systems and data repositories, determination of the scope and nature of exfiltrated data, and attribution analysis to the extent possible.
May 8, 2023: A cyber-insurance claim was filed with Atlas Mutual Insurance Company under Quorum's primary cyber-liability policy (Policy No. CYB-2023-041587). The claim was assigned Claim No. CYB-CLM-2023-05892 and was assigned to claims adjuster Paul Enriquez. Precautionary notice was also provided to Pinnacle Surplus Lines Insurance Corp. under the excess layer policy.
IV. Preliminary Assessment of Compromised Data
A. Categories of Potentially Affected Data
Based on the nature and scope of data transmitted by Quorum to Palomar under the MSA, and in the absence of definitive forensic findings as to which specific data sets were exfiltrated, the following categories of information are potentially compromised as a result of the incident:
Personally Identifiable Information (PII): Full legal names, dates of birth, Social Security numbers, driver's license numbers, home addresses, telephone numbers, and email addresses of Quorum policyholders and claimants whose claims data was processed by Palomar. Social Security numbers and driver's license numbers are among the most sensitive categories of PII and their compromise will trigger notification obligations under virtually every state breach notification statute.
Financial Information: Bank account numbers (including routing numbers) used for electronic claims disbursements and premium payment processing, as well as payment card numbers associated with premium payments. The compromise of bank account numbers and payment card numbers triggers additional notification and remediation obligations, including potential obligations under the Payment Card Industry Data Security Standard (PCI DSS) framework to the extent payment card data is involved.
Protected Health Information (PHI): Health conditions, medical diagnosis codes (ICD-10), treatment information, healthcare provider identifiers, and related medical records data associated with workers' compensation claims and health-related insurance claims. This information constitutes "protected health information" as defined under the Health Insurance Portability and Accountability Act of 1996 ("HIPAA") and its implementing regulations, and its compromise triggers the HIPAA Breach Notification Rule (45 C.F.R. Part 164, Subpart D), subject to the covered entity and business associate analysis discussed in Section V.C below.
The presence of all three categories of sensitive data — PII, financial information, and PHI — in the potentially compromised data set places this incident at the highest tier of severity from a regulatory notification, consumer protection, and litigation risk perspective. The combination of Social Security numbers with health information is particularly concerning, as it simultaneously triggers obligations under both general state breach notification laws and the HIPAA framework.
B. Estimated Scope of Affected Individuals
At this preliminary stage of the investigation, the precise number and identities of affected individuals have not been determined. The identification of specific affected individuals will be a primary objective of the Graystone forensic investigation and the subsequent data mining exercise described below. Until the forensic analysis can identify which specific data sets and files were exfiltrated, it is not possible to provide a definitive count of affected individuals.
However, given the volume of personal lines claims data processed by Palomar on Quorum's behalf — encompassing claims adjudication, analytics, and document management for Quorum's entire personal lines division — the potential exposure is significant. Preliminary estimates, based on discussions with the Quorum Claims Operations team and the volume of data historically transmitted to Palomar, suggest that the incident could potentially affect hundreds of thousands of individuals across multiple states. The precise number will depend on factors including which data repositories the threat actor accessed, the date range of records stored in those repositories, and the extent of the exfiltration.
Quorum's personal lines division operates across all fifty states and the District of Columbia. Accordingly, affected individuals likely reside in numerous jurisdictions, each of which has its own breach notification statute with distinct triggering definitions, timing requirements, content mandates, and regulator notification obligations. The geographic breadth of potentially affected individuals will substantially increase the complexity and cost of the notification process.
C. Data Mining Requirements
Once Graystone Forensics completes its forensic analysis and identifies the specific data sets and files that were exfiltrated by the threat actor, a comprehensive data mining exercise will be required. The purpose of the data mining exercise is to:
1. Identify the specific individuals whose personal information was compromised;
2. Determine the types of data compromised for each affected individual (e.g., name and Social Security number, name and financial account information, name and PHI, or some combination thereof);
3. Match each affected individual to their state of residence to determine which state's breach notification statute applies; and
4. Identify any individuals who may be subject to specialized notification requirements (e.g., minors, military service members, or individuals subject to state-specific protections such as those under the California Consumer Privacy Act).
This data mining process is typically time-intensive and resource-intensive, particularly where the compromised data sets are large and involve multiple data formats. Calderwood & Harkness will coordinate with Graystone Forensics and, if necessary, a specialized data mining vendor to ensure that this process is conducted efficiently and that the results are sufficiently reliable to support accurate and compliant notification efforts. The data mining exercise will directly inform the scope, content, and timing of all notification obligations.
V. Preliminary Legal Risk Assessment
A. State Breach Notification Obligations
If the forensic investigation confirms that PII, financial data, or PHI of Quorum policyholders and claimants was accessed or exfiltrated by the threat actor, notification obligations will be triggered under the breach notification statutes of every state in which affected individuals reside. As of the date of this memorandum, all fifty states, the District of Columbia, Guam, Puerto Rico, and the U.S. Virgin Islands have enacted breach notification laws imposing obligations on entities that experience unauthorized access to or acquisition of personal information.
Key jurisdictions likely to be affected — based on the geographic distribution of Quorum's personal lines business and policyholder base — include, but are not limited to, the following:
Connecticut (Quorum's state of domicile): Conn. Gen. Stat. § 36a-701b requires notification to affected individuals and the Connecticut Attorney General within sixty (60) days of discovery. Connecticut amended its breach notification law effective October 1, 2021, expanding the definition of personal information to include certain health-related data and imposing additional requirements for notice content and identity theft prevention services.
New York: N.Y. Gen. Bus. Law § 899-aa, as amended by the Stop Hacks and Improve Electronic Data Security Act (SHIELD Act), requires notification to affected individuals and to the New York Attorney General, the Department of State, and the Division of State Police. New York's statute includes an expansive definition of "private information" encompassing biometric data, email credentials, and financial account data with or without access codes.
California: Cal. Civ. Code § 1798.82 requires notification to affected individuals and, where more than 500 California residents are affected, to the California Attorney General. Separately, the California Consumer Privacy Act (CCPA) as amended by the California Privacy Rights Act (CPRA) provides a private right of action for data breaches involving certain categories of personal information, with statutory damages of $100 to $750 per consumer per incident, or actual damages, whichever is greater.
Texas: Tex. Bus. & Com. Code § 521.053 requires notification to affected individuals without unreasonable delay and notification to the Texas Attorney General where more than 250 Texas residents are affected.
Florida: Fla. Stat. § 501.171 requires notification to affected individuals within thirty (30) days of determination of the breach and notification to the Florida Department of Legal Affairs where more than 500 Florida residents are affected.
Pennsylvania: 73 Pa. Stat. § 2303 requires notification to affected individuals without unreasonable delay, with no specific statutory deadline.
Illinois: 815 ILCS 530/10 requires notification to affected individuals and to the Illinois Attorney General in the most expedient time possible, without unreasonable delay.
Each state's statute has its own nuances with respect to the definition of "personal information" that triggers notification, the standard for determining whether a "breach" has occurred (e.g., acquisition vs. access), safe harbors for encrypted data, timing requirements, content mandates for notification letters, and requirements for notification to state attorneys general and other regulatory bodies. The interaction among these various state statutes, and the coordination of notification across multiple jurisdictions, will require careful analysis and planning.
Calderwood & Harkness is separately preparing a comprehensive 50-state breach notification law survey to map all applicable requirements, identify critical deadlines, and establish a coordinated notification strategy. This survey is targeted for completion in early June 2023 and will serve as the foundation for the notification plan once the scope of affected individuals and data is determined through the forensic investigation and data mining process.
B. Connecticut Insurance Data Security Law
As a Connecticut-domiciled insurance holding company, Quorum is subject to the Connecticut Insurance Data Security Law, codified at Conn. Gen. Stat. § 38a-999b, which imposes specific cybersecurity requirements on insurers, including notification obligations to the Connecticut Insurance Department in the event of a "cybersecurity event." This statute, modeled on the National Association of Insurance Commissioners (NAIC) Insurance Data Security Model Law, operates independently of and in addition to Connecticut's general breach notification statute.
Under § 38a-999b(e), a domestic insurer that is the subject of a cybersecurity event must notify the Insurance Commissioner within three (3) business days after making a determination that a cybersecurity event has occurred. This timeline is significantly more compressed than the notification deadlines under most general breach notification statutes and will require Quorum to make an early determination regarding whether the incident constitutes a "cybersecurity event" within the meaning of the statute.
Quorum will need to assess the notification timing under this statute carefully, as the clock for the three-business-day notification window may already be running, depending on when Quorum is deemed to have made a "determination" that a cybersecurity event has occurred. Calderwood & Harkness is analyzing this question and will provide a supplemental recommendation promptly.
The assigned examiner at the Connecticut Insurance Department for cybersecurity matters is Richard Nakamura of the Financial Analysis Division, Cybersecurity Unit. Calderwood & Harkness recommends that any notification to the Connecticut Insurance Department be coordinated through counsel to ensure accuracy, completeness, and appropriate positioning.
C. HIPAA Breach Notification Rule
To the extent that protected health information of workers' compensation and health-related claimants was compromised in the incident, notification obligations under the HIPAA Breach Notification Rule (45 C.F.R. Part 164, Subpart D) may be triggered. The HIPAA Breach Notification Rule requires covered entities to provide notification of a breach of unsecured PHI to affected individuals, the Secretary of the U.S. Department of Health and Human Services ("HHS"), and, in certain circumstances, prominent media outlets.
Specifically, under 45 C.F.R. § 164.408, if a breach affects 500 or more individuals, the covered entity must notify the HHS Office for Civil Rights ("OCR") without unreasonable delay and in no case later than sixty (60) days from the date of discovery of the breach. Where a breach affects 500 or more residents of a single state or jurisdiction, notification must also be provided to prominent media outlets serving that state or jurisdiction. For breaches affecting fewer than 500 individuals, notification to HHS may be provided annually.
The applicability of HIPAA to the incident will require careful analysis of whether Quorum, in its capacity as an insurer processing workers' compensation and health-related claims, operates as a "covered entity" under HIPAA, and whether Palomar operates as a "business associate" of Quorum with respect to the PHI at issue. If Palomar is a business associate, the HIPAA breach notification obligations may run directly to Palomar in the first instance, with a corresponding obligation to notify Quorum as the covered entity. The existence and terms of any Business Associate Agreement ("BAA") between Quorum and Palomar will be relevant to this analysis and should be located and reviewed.
Calderwood & Harkness will conduct a detailed HIPAA applicability analysis as part of the supplemental memoranda referenced above.
D. Multistate Attorney General Enforcement Risk
Large-scale data breaches affecting residents of multiple states frequently attract the attention of multistate attorney general coalitions, which have become increasingly active in investigating and prosecuting data security failures. Such multistate investigations typically involve the issuance of civil investigative demands ("CIDs"), extensive document production and interrogatory responses, and the potential for negotiated settlements involving substantial monetary payments, injunctive relief (including mandated security improvements), and ongoing compliance monitoring.
The attorneys general of Connecticut and New York have been particularly active in data breach enforcement in recent years and can be expected to take a keen interest in a breach affecting a major Connecticut-domiciled insurer. Other state attorneys general with active data privacy enforcement programs — including those of California, Massachusetts, Illinois, Indiana, and Ohio — may also seek to participate in any multistate investigation.
Proactive, transparent engagement with applicable regulatory authorities, combined with rigorous compliance with all notification obligations and the implementation of meaningful remediation measures, will be critical to minimizing enforcement risk and demonstrating Quorum's commitment to responsible incident response. Calderwood & Harkness will advise on the appropriate timing and manner of any regulatory engagement as the investigation progresses and the scope of the incident becomes clearer.
E. Regulatory and Civil Litigation Exposure
Beyond attorney general enforcement, the incident could give rise to putative consumer class action litigation. Data breach class actions have become a well-established category of consumer litigation, with plaintiffs typically asserting claims based on negligence, breach of implied contract, unjust enrichment, and violations of state consumer protection statutes and data breach notification laws. The availability of statutory damages under certain state laws — most notably the California Consumer Privacy Act, which provides for statutory damages of $100 to $750 per consumer per incident for breaches involving certain categories of personal information — can create significant aggregate exposure in cases involving large numbers of affected individuals.
In addition to private litigation risk, Quorum must assess its obligations under the federal securities laws. Quorum Insurance Holdings Corp. is a publicly traded company listed on the Nasdaq Stock Market under the ticker symbol QIHC. As of May 2023, Quorum's market capitalization is approximately $6.1 billion, and the Company reported fiscal year 2022 annual revenue of $4.82 billion. Given this profile, the incident implicates potential disclosure obligations under the Securities and Exchange Commission's ("SEC") cybersecurity incident disclosure rules.
In particular, the SEC's recently adopted cybersecurity disclosure rules require registrants to disclose material cybersecurity incidents on Form 8-K under new Item 1.05. While the effective date and specific requirements of these rules are subject to implementation timelines, Quorum should proactively assess whether the Palomar incident, once the scope is determined, constitutes a material cybersecurity incident requiring disclosure under Item 1.05 or requires disclosure in the Company's periodic reports (Form 10-Q or Form 10-K) under existing guidance. Calderwood & Harkness will prepare a separate analysis of SEC disclosure obligations and materiality assessment once the scope of the incident is better defined through the forensic investigation.
The financial magnitude of potential exposure should be assessed in the context of Quorum's overall financial profile. While the total costs of the incident — including forensic investigation, notification, credit monitoring, regulatory fines, litigation defense, and potential settlements — cannot be estimated with precision at this stage, incidents of comparable scope in the insurance industry have resulted in aggregate costs ranging from tens of millions to hundreds of millions of dollars. Quorum's cyber-insurance tower of $40,000,000 (discussed in Section VII below) and its contractual indemnification rights under the Palomar MSA (discussed in Section VI.C below) will serve as important risk-mitigation mechanisms.
VI. Contractual Considerations — Palomar MSA
Calderwood & Harkness has conducted a preliminary review of the MSA and its amendments to identify the key contractual provisions relevant to the incident and Quorum's rights against Palomar. The following summarizes our initial analysis of Palomar's potential contractual breaches, Quorum's indemnification rights, and available termination remedies.
A. Data Security Exhibit (Exhibit D) — Potential Breaches by Palomar
The Data Security Exhibit (Exhibit D), as updated by Amendment 2, establishes Palomar's data security obligations with respect to Quorum data in Palomar's possession, custody, or control. Based on the facts known to date, there are several potential breaches of Exhibit D by Palomar:
Failure to Timely Patch Critical Vulnerabilities. Exhibit D requires Palomar to patch critical vulnerabilities within thirty (30) days of vendor patch release. The CVE-2023-0669 vulnerability in the GoAnywhere MFT appliance was publicly disclosed and a vendor-issued patch was made available prior to the March 14, 2023 exploitation. Preliminary information strongly suggests that Palomar had not applied the available patch at the time the threat actor exploited the vulnerability to gain initial access. If confirmed, this failure to timely patch constitutes a clear breach of the patch management requirement in Exhibit D and represents the proximate cause of the initial intrusion.
Adequacy of Safeguards. Exhibit D requires Palomar to maintain "commercially reasonable" administrative, technical, and physical safeguards to protect Quorum data. Multiple aspects of the incident raise questions about the adequacy of Palomar's safeguards. The thirty-five (35) day undetected dwell time during which the threat actor conducted lateral movement and data exfiltration within Palomar's network suggests deficiencies in Palomar's network monitoring, intrusion detection, endpoint detection and response, and security logging capabilities. A "commercially reasonable" security program for an organization of Palomar's size and the sensitivity of the data it processes would be expected to detect anomalous lateral movement and large-scale data staging and exfiltration significantly sooner than thirty-five days.
SOC 2 Type II Audit Compliance. Amendment 2, executed September 15, 2022, added a requirement that Palomar provide annual SOC 2 Type II audit reports. Calderwood & Harkness recommends that Quorum obtain and review the most recent SOC 2 Type II report (audited by Kessler, Park & Associates CPA, PLLC) to assess whether the audit identified any deficiencies, exceptions, or qualifications related to patch management, vulnerability remediation, network monitoring, or intrusion detection. If the SOC 2 report identified deficiencies in these areas and Palomar failed to remediate them, this would constitute additional evidence of Palomar's failure to satisfy its contractual obligations and could strengthen Quorum's indemnification claims.
B. Breach Notification Obligation (Section 9.4) — Late Notification
Section 9.4 of the MSA requires Palomar to notify Quorum of any security incident affecting Quorum data within forty-eight (48) hours of Palomar's discovery of such incident. As set forth in the timeline above, Palomar discovered the anomalous activity on April 18, 2023, and did not provide notification to Quorum until April 21, 2023 — approximately seventy-two (72) hours after discovery, or roughly twenty-four (24) hours past the contractual forty-eight-hour deadline.
This constitutes a potential breach of Section 9.4 of the MSA. While the delay was approximately one day, the significance of timely notification in the context of a data security incident cannot be overstated. Each hour of delay in notifying the data owner reduces the ability to implement effective containment measures, initiate forensic investigation, and comply with downstream regulatory notification obligations. The late notification may have impacted Quorum's ability to commence its own incident response activities sooner and could be relevant to any regulatory inquiry into the timeliness of Quorum's own response.
C. Indemnification (Section 12.2)
Section 12.2 of the MSA provides that Palomar shall indemnify, defend, and hold harmless Quorum and its affiliates, officers, directors, employees, and agents from and against any and all losses, damages, liabilities, costs, and expenses (including reasonable attorneys' fees and costs of investigation and remediation) arising from or related to Palomar's breach of its data security obligations under the MSA, including the obligations set forth in Exhibit D.
The indemnification provision is subject to a liability cap of two times (2×) the trailing twelve-month fees paid by Quorum to Palomar. Under the current annual contract value of $16,300,000, the liability cap equals $32,600,000. This cap applies to direct damages and indemnification obligations; consequential damages are excluded under Section 12.4 of the MSA, subject to a carve-out for data security breaches.
Calderwood & Harkness recommends that Quorum take the following steps to preserve and maximize its indemnification rights:
1. Issue a formal written indemnification demand to Palomar, through its counsel at Mercer, Haight & Dunlop LLP, putting Palomar on notice of its indemnification obligations and reserving all rights under Section 12.2;
2. Begin immediately documenting all costs attributable to the incident, including internal labor costs, external counsel fees, forensic investigation costs, notification costs, credit monitoring costs, crisis communications costs, regulatory engagement costs, and any other costs arising from or related to the incident;
3. Maintain a detailed cost ledger segregating costs into categories that correspond to the indemnification and insurance coverage frameworks; and
4. Preserve all evidence relevant to Palomar's breaches of the MSA, including the failure to patch, the extended dwell time, and the late notification.
D. Termination for Cause (Section 14.2)
Section 14.2 of the MSA permits either party to terminate the MSA upon material breach by the other party, provided that the non-breaching party provides written notice of the breach and the breaching party fails to cure the breach within thirty (30) days of receipt of such notice.
Should the forensic investigation confirm that Palomar's failures — including the failure to timely patch a known critical vulnerability, the potential inadequacy of its security safeguards, and the late notification — constitute a material breach of the MSA, Quorum would have the right to terminate the MSA for cause upon expiration of the thirty-day cure period (assuming Palomar is unable to cure, which is likely given the nature of the breaches). Termination rights should be considered as part of the overall vendor accountability strategy.
However, any exercise of termination rights must be weighed carefully against practical considerations. The MSA term runs through November 11, 2024, and Palomar currently processes significant volumes of Quorum claims data that are critical to the Company's ongoing operations. Termination of the MSA would require a comprehensive transition plan to migrate claims data processing to an alternative vendor or to Quorum's internal systems, a process that could take several months and involve substantial transition costs and operational risk. Calderwood & Harkness recommends that Quorum's IT, Operations, and Strategic Sourcing teams begin preliminary contingency planning for a potential transition, even if a decision to terminate has not yet been made, to ensure that Quorum is not operationally dependent on a vendor whose security practices have been called into serious question.
VII. Cyber-Insurance Coverage
Quorum maintains a cyber-liability insurance tower placed by its insurance broker, Whitmore Risk Advisors Inc. (contact: Sandra Whitmore-Kim, Managing Director). The tower consists of a primary layer and a single excess layer, providing aggregate coverage of $40,000,000. The coverage structure is as follows:
Primary Layer:
• Carrier: Atlas Mutual Insurance Company
• Policy Number: CYB-2023-041587
• Coverage Period: January 1, 2023 – January 1, 2024
• Per-Occurrence Limit: $15,000,000
• Aggregate Limit: $15,000,000
• Self-Insured Retention (SIR): $2,500,000
Excess Layer:
• Carrier: Pinnacle Surplus Lines Insurance Corp.
• Policy Number: XS-CYB-2023-7812
• Coverage Period: January 1, 2023 – January 1, 2024
• Limit: $25,000,000 excess of $15,000,000 primary
• Terms: Follow-form to the Atlas Mutual primary policy
The total available coverage under the tower is $40,000,000, subject to the $2,500,000 SIR. Quorum will bear the first $2,500,000 in covered costs out of pocket before the Atlas Mutual primary policy responds.
Notice of claim was filed with Atlas Mutual Insurance Company on May 8, 2023, and the claim was assigned Claim No. CYB-CLM-2023-05892. The claim has been assigned to claims adjuster Paul Enriquez at Atlas Mutual. Precautionary notice was also filed with Pinnacle Surplus Lines Insurance Corp. (claims contact: Lisa Garner) to preserve coverage under the excess layer in the event that losses exceed the primary policy limits.
The Atlas Mutual primary policy is expected to cover the following categories of costs in excess of the $2,500,000 SIR:
• First-party forensic investigation costs (including the Graystone Forensics engagement);
• Notification costs (including printing, mailing, and call center services);
• Credit monitoring and identity theft protection services for affected individuals;
• Crisis communications and public relations costs;
• Regulatory defense costs, including attorneys' fees and costs associated with responding to regulatory inquiries, investigations, and enforcement proceedings; and
• Legal defense costs in connection with any private litigation arising from the incident.
Calderwood & Harkness notes that it is important to coordinate with Atlas Mutual early and frequently regarding the scope of covered costs, the selection of vendors and service providers, and any carrier consent requirements. Many cyber-liability policies require the policyholder to obtain carrier approval for the selection of forensic investigators, breach notification vendors, and other service providers; however, given that Calderwood & Harkness and Graystone Forensics were retained prior to the filing of the insurance claim, it will be necessary to confirm that Atlas Mutual will agree to cover costs incurred by these pre-approved vendors.
A Common Interest Agreement between Quorum and Atlas Mutual is being prepared to facilitate the sharing of privileged information related to the incident without waiver of attorney-client privilege or work product protection. The target date for execution of this agreement is during the week of May 8, 2023.
A detailed cyber-insurance coverage analysis memorandum, including a comprehensive review of the Atlas Mutual policy terms, conditions, exclusions, and any potentially applicable coverage defenses, is being prepared separately by Calderwood & Harkness and will be circulated under separate cover.
VIII. Immediate Next Steps and Recommendations
Based on our initial assessment, Calderwood & Harkness recommends the following immediate next steps:
A. Forensic Investigation
Graystone Forensics LLC has been retained under the attorney-client privilege umbrella and the scope of work and investigation plan were finalized as of May 7, 2023. The forensic investigation is the single most critical workstream at this stage, as it will establish the foundational facts upon which all downstream legal, regulatory, and notification decisions will be based.
The investigation is led by Dr. Nolan Briggs, Managing Director of Incident Response at Graystone, with senior forensic analyst Kendra Faulkner serving as the day-to-day investigative lead. Preliminary findings are targeted for delivery in early June 2023, with more detailed findings to follow as the analysis progresses.
All forensic work product, including reports, analyses, and communications, is to be directed exclusively to Calderwood & Harkness to maintain the protection of the attorney-client privilege and work product doctrine. Quorum personnel should not communicate directly with Graystone regarding investigation findings without first coordinating with Calderwood & Harkness.
B. Evidence Preservation
Legal hold notices have been issued to the Quorum IT department (directed to David Naranjo, CISO) and the Claims Operations department (directed to Robert Wentworth, SVP) as of May 6, 2023. These holds require preservation of all documents, communications, and electronically stored information potentially relevant to the incident, the Palomar vendor relationship, data transmission practices, and vendor risk management activities.
In addition, Calderwood & Harkness recommends that a formal written request be directed to Palomar — through its counsel, Catherine Langford at Mercer, Haight & Dunlop LLP — requesting that Palomar issue corresponding internal litigation holds on all relevant systems, log files, network traffic data, access records, email communications, and other materials related to the incident. The preservation of evidence within Palomar's environment is critical, as the forensic investigation will depend heavily on access to Palomar's system logs and other technical data, and any destruction or alteration of this evidence could be severely prejudicial to Quorum's interests.
C. Palomar Engagement
Calderwood & Harkness recommends that Quorum issue a formal written demand to Palomar for full cooperation with the forensic investigation, including the provision of all relevant system logs, network diagrams, access records, patch management records, vulnerability scan reports, and incident response documentation. This demand should also request the following specific materials:
• Palomar's most recent SOC 2 Type II audit report (audited by Kessler, Park & Associates CPA, PLLC), including any management letters, findings, exceptions, or remediation plans;
• Palomar's internal incident response documentation, including its incident response plan, the timeline of its internal investigation, and all communications with its forensic investigators;
• Documentation of Palomar's patch management program, including records of when the CVE-2023-0669 patch was received, assessed, and (if at all) applied;
• Palomar's current cyber-liability insurance coverage information, including carrier, policy number, limits, and SIR; and
• Confirmation of whether Palomar has received communications from any regulatory body, law enforcement agency, or third party regarding the incident.
All communications with Palomar regarding the incident should be coordinated through Calderwood & Harkness to preserve privilege and protect Quorum's contractual and litigation positions. Quorum personnel should avoid direct substantive communications with Palomar personnel regarding the incident without prior coordination with the Calderwood & Harkness team.
D. Insurance Coordination
Calderwood & Harkness recommends maintaining ongoing communication with Atlas Mutual Insurance Company (claims adjuster Paul Enriquez) regarding the claim, the scope of covered costs, and any carrier consent requirements for vendor selections and expenditures. The following specific actions are recommended:
• Confirm that Atlas Mutual will agree to cover the costs of Calderwood & Harkness's engagement and the Graystone Forensics engagement as pre-approved vendors;
• Submit an initial estimated loss reserve to Atlas Mutual once the scope of the incident is better understood;
• Execute the Common Interest Agreement between Quorum and Atlas Mutual (target: week of May 8, 2023) to facilitate privileged information sharing; and
• Coordinate with Sandra Whitmore-Kim at Whitmore Risk Advisors regarding any broker-level communications with the carriers.
E. Board and Management Reporting
Given the potential magnitude of the incident and Quorum's obligations as a publicly traded company, Calderwood & Harkness recommends that the Quorum Board of Directors be briefed promptly regarding the incident. In particular, we recommend:
• A briefing to Franklin Reeves, Chair of the Audit Committee of the Board of Directors, at the earliest practicable date, followed by a formal presentation to the full Audit Committee;
• Preparation of a separate Board Audit Committee briefing memorandum, which Calderwood & Harkness is currently drafting, to provide the Audit Committee with a concise summary of the incident, the legal and regulatory risk landscape, and the incident response plan; and
• A briefing to CEO Margaret D. Calloway in conjunction with the General Counsel's assessment, to ensure that senior executive leadership is fully informed and aligned on the response strategy.
Board-level engagement is important not only for governance purposes but also to demonstrate, in any subsequent regulatory or litigation context, that Quorum's leadership exercised appropriate oversight and took the incident seriously from the outset.
F. Crisis Communications
Quorum has engaged BrightPath Consulting Group Inc. (Meredith Ashford, Managing Director) to manage external and internal communications strategy related to the incident. BrightPath is coordinating with Calderwood & Harkness on messaging, timing, and audience for all communications.
Calderwood & Harkness strongly recommends that no public statement, press release, or media response be issued until the forensic investigation has established the scope of the incident with sufficient certainty to support accurate public disclosures. Premature or inaccurate public statements can create significant legal risk, including potential exposure to securities fraud claims if statements are later shown to be materially misleading.