PRIVILEGED AND CONFIDENTIAL ATTORNEY-CLIENT COMMUNICATION / ATTORNEY WORK PRODUCT NOT FOR DISTRIBUTION WITHOUT PRIOR WRITTEN CONSENT OF CALDERWOOD & HARKNESS LLP
CALDERWOOD & HARKNESS LLP 1700 K Street NW, Suite 900 Washington, D.C. 20006
June 5, 2023
MEMORANDUM
PRIVILEGE LEGEND: This memorandum has been prepared at the direction of Kevin Ostrowski, Partner, Calderwood & Harkness LLP, for the sole purpose of providing legal advice to Quorum Insurance Holdings Corp. ("Quorum") in connection with the Palomar Data Solutions security incident. This memorandum constitutes a privileged and confidential attorney-client communication and attorney work product under the attorney-client privilege, the work product doctrine, and all other applicable privileges and protections. The information, analysis, and recommendations contained herein reflect the mental impressions, conclusions, opinions, and legal theories of counsel. This memorandum is not to be disclosed, distributed, or otherwise made available to any third party without the prior written consent of Calderwood & Harkness LLP. Any inadvertent disclosure of this memorandum or any portion thereof to any third party does not constitute a waiver of the attorney-client privilege, the work product doctrine, or any other applicable privilege or protection, and Calderwood & Harkness LLP and Quorum expressly reserve all rights to assert such privileges and protections. All rights reserved.
I. Executive Summary
The purpose of this memorandum is to analyze the legal implications of the privileged preliminary forensic findings report issued on June 2, 2023, by Graystone Forensics LLC ("Graystone"), through Dr. Nolan Briggs, Managing Director, Incident Response, and Kendra Faulkner, Senior Forensic Analyst, to Calderwood & Harkness LLP in connection with the security incident originating from the network environment of Palomar Data Solutions, Inc. ("Palomar"). This memorandum is intended to provide Quorum Insurance Holdings Corp. ("Quorum") with an assessment of the legal exposure, notification obligations, contractual remedies, and recommended next steps arising from the preliminary forensic findings.
The core conclusion of our analysis is as follows: Graystone's preliminary findings confirm that a threat actor successfully exfiltrated structured data files from Palomar's claims processing environment. Those files contained Quorum policyholder and claimant personally identifiable information ("PII"), financial data, and, with respect to a subset of affected individuals, what is likely to constitute protected health information ("PHI") under the Health Insurance Portability and Accountability Act ("HIPAA"). The unauthorized access and exfiltration occurred over an approximately thirty-five-day window, from on or about March 14, 2023, through April 18, 2023, before Palomar's Security Operations Center detected and terminated the anomalous outbound data transfers.
Based on these preliminary findings, there is a high likelihood that breach notification obligations will be triggered across multiple states, as well as under federal sector-specific requirements including the HIPAA Breach Notification Rule and the Connecticut Insurance Data Security Law. The estimated scope of affected individuals is significant. While the precise number awaits the completion of data mining — which Graystone estimates will conclude in mid-to-late July 2023 — preliminary indications suggest that potentially hundreds of thousands of Quorum policyholders and claimants across multiple states may be affected.
Critically, Graystone's preliminary findings also establish that the threat actor exploited a known remote code execution vulnerability — CVE-2023-0669 — in Palomar's GoAnywhere MFT file transfer appliance. Vendor-issued patches for this vulnerability were available prior to the date of exploitation. Palomar's failure to timely apply the available patch represents a clear breach of its contractual data security obligations under the Data Security Exhibit (Exhibit D) of the Master Services Agreement dated November 12, 2019 (as amended by Amendment 1, dated March 3, 2021, and Amendment 2, dated September 15, 2022) (the "MSA"), which requires patching of critical vulnerabilities within thirty days of vendor patch release.
Additionally, Palomar's notification to Quorum regarding the security incident was approximately twenty-four hours late under the contractual forty-eight-hour notification requirement set forth in Section 9.4 of the MSA. Palomar discovered the anomalous activity on April 18, 2023, but did not notify Quorum until April 21, 2023 — three calendar days after discovery and approximately one full day beyond the contractual deadline. This delay impaired Quorum's ability to initiate its own incident response procedures in a timely manner.
In light of the foregoing, we recommend that Quorum proceed immediately with the following actions:
(a) Data Mining: Authorize Graystone to proceed with the data mining phase necessary to identify the specific individuals affected by the breach, their states of residence, and the particular data elements compromised for each individual;
(b) State-by-State Notification Analysis: Direct Calderwood & Harkness to complete the 50-state breach notification law survey already underway and, upon completion of data mining, to prepare a comprehensive state-by-state notification trigger analysis identifying each jurisdiction's specific requirements;
(c) Preservation of Contractual Indemnification Claims: Preserve all rights against Palomar under the MSA, including indemnification rights under Section 12.2, and authorize Calderwood & Harkness to prepare a detailed contractual analysis memorandum and, at the appropriate time, issue a formal demand to Palomar's counsel;
(d) Insurance Carrier Coordination: Continue coordination with Atlas Mutual Insurance Company (Claim No. CYB-CLM-2023-05892) to ensure timely and complete coverage for all qualifying incident response costs.
The detailed analysis supporting these recommendations is set forth below.
II. Background and Procedural Posture
A. Engagement Context
Calderwood & Harkness LLP was engaged by Quorum Insurance Holdings Corp. on May 4, 2023, to serve as outside legal counsel in connection with the security incident affecting Quorum's data that was initially reported by Palomar Data Solutions, Inc. The engagement followed Quorum's receipt of an initial security incident notification from Palomar on April 21, 2023, transmitted via email from Derek Copeland, Palomar's General Counsel, to Thomas R. Whitfield, General Counsel of Quorum, and David Naranjo, Quorum's Chief Information Security Officer. Kevin Ostrowski, Partner in Calderwood & Harkness's Privacy & Data Security Practice Group, serves as the Responsible Partner for this engagement.
Quorum Insurance Holdings Corp. is a Delaware corporation and publicly traded insurance and financial technology company, listed on the Nasdaq Stock Market under the ticker symbol QIHC. Quorum is headquartered at 400 Constitution Plaza, Suite 2200, Hartford, Connecticut 06103. For fiscal year 2022, Quorum reported approximately $4.82 billion in annual revenue and employed approximately 11,400 individuals. Quorum operates in all fifty states and the District of Columbia, offering a broad portfolio of personal and commercial lines insurance products, as well as financial technology solutions through its QuorumEdge platform. As a publicly traded insurance holding company domiciled in Connecticut, Quorum is subject to multiple overlapping regulatory regimes, including state insurance department oversight, state and federal privacy laws, securities disclosure requirements, and sector-specific data protection obligations under HIPAA.
Palomar Data Solutions, Inc. is a Texas corporation headquartered at 7100 Greenville Avenue, Suite 450, Dallas, Texas 75231. Palomar provides data processing, claims administration, and analytics services to insurance carriers and financial services companies. Palomar processes claims data for Quorum's personal lines division under the Master Services Agreement executed on November 12, 2019, which has a five-year term expiring on November 11, 2024. The MSA has been amended twice:
•  Amendment 1 (executed March 3, 2021): Expanded the scope of services to include data processing for Quorum's QuorumEdge platform, a customer-facing digital claims portal. This amendment increased the annual contract value ("ACV") from $14.2 million to $16.3 million per year.
•  Amendment 2 (executed September 15, 2022): Updated the Data Security Exhibit (Exhibit D) to incorporate enhanced security requirements, including the addition of a SOC 2 Type II audit requirement for Palomar's claims processing environment and updated minimum cyber-insurance coverage requirements for Palomar.
Palomar is Quorum's second-largest vendor by revenue, with the current ACV of $16.3 million per year, reflecting the expanded scope under Amendment 1. The nature and volume of data processed by Palomar on Quorum's behalf are significant; Palomar handles the full lifecycle of claims data processing for Quorum's personal lines division, encompassing policyholder identification, claims intake, adjudication support, payment processing, and data warehousing. In performing these services, Palomar receives, processes, stores, and transmits large volumes of Quorum policyholder and claimant PII, financial data, and — for workers' compensation and certain health-related claims — protected health information.
B. Forensic Investigation Engagement
Graystone Forensics LLC is a Virginia limited liability company headquartered at 1950 Old Gallows Road, Suite 600, Tysons Corner, Virginia 22182. Graystone specializes in digital forensic investigations, incident response, and threat intelligence services for complex cybersecurity incidents. Graystone was retained on May 5, 2023, under the attorney-client privilege umbrella of Calderwood & Harkness LLP, at the direction of Kevin Ostrowski, the Responsible Partner for this matter. The engagement of Graystone under the privilege umbrella ensures that Graystone's forensic investigation, findings, and all communications with Calderwood & Harkness are protected by the attorney-client privilege and the work product doctrine, as Graystone was retained for the purpose of assisting counsel in providing legal advice to Quorum regarding its rights and obligations arising from the security incident.
The engagement is led by Dr. Nolan Briggs, Managing Director of Graystone's Incident Response practice, with Kendra Faulkner, Senior Forensic Analyst, serving as the analyst lead. Dr. Briggs and Ms. Faulkner bring extensive experience in investigating large-scale data breach incidents in the insurance and financial services sectors. The scope of work for the engagement was finalized on May 7, 2023, following consultation among Calderwood & Harkness, Quorum's CISO David Naranjo, and Graystone. The scope of work encompasses the following core objectives:
(i) Determination of the threat actor's entry vector and initial access methodology;
(ii) Reconstruction of the complete timeline of unauthorized access, including any lateral movement within Palomar's network environment;
(iii) Identification and characterization of all datasets exfiltrated from Palomar's environment, with particular focus on data containing Quorum policyholder and claimant information; and
(iv) Assessment of the types and categories of data compromised, including the identification of PII, financial data, and PHI elements within the exfiltrated datasets.
Graystone's preliminary findings report was delivered to Calderwood & Harkness on June 2, 2023. This memorandum provides Calderwood & Harkness's legal analysis of the findings contained in that privileged report.
C. Insurance Claim Status
Quorum filed a cyber-insurance claim with its primary cyber-liability carrier, Atlas Mutual Insurance Company, on May 8, 2023. The relevant policy details are as follows:
•  Primary Policy: Atlas Mutual Insurance Company, Policy No. CYB-2023-041587. The primary policy provides a $15,000,000 per-occurrence limit of liability, subject to a $2,500,000 self-insured retention ("SIR"). The policy covers first-party costs including forensic investigation, legal fees, breach notification, credit monitoring, call center services, crisis communications, and regulatory defense costs, as well as third-party liability coverage for claims arising from a data breach.
•  Excess Policy: Pinnacle Surplus Lines Insurance Corp., Policy No. XS-CYB-2023-7812. The excess policy provides $25,000,000 in excess of the $15,000,000 primary layer, bringing the total cyber-insurance tower to $40,000,000 above the $2,500,000 SIR.
The claim was filed with Atlas under Claim No. CYB-CLM-2023-05892. Paul Enriquez has been assigned as the Atlas claims adjuster for this matter. Sandra Whitmore-Kim of Whitmore Risk Advisors Inc., Quorum's insurance broker, is coordinating between Quorum, Atlas, and Calderwood & Harkness on coverage matters. Precautionary notice was provided to Pinnacle Surplus Lines Insurance Corp. on May 8, 2023, contemporaneously with the primary claim filing, to preserve Quorum's rights under the excess policy in the event that total incident response costs exceed the primary layer.
III. Summary of Graystone Preliminary Forensic Findings
The following is a summary of the key findings set forth in Graystone's privileged preliminary forensic findings report dated June 2, 2023. The findings summarized below remain preliminary in nature; Graystone's investigation is ongoing, and certain conclusions — including the final enumeration of affected individuals and the state-by-state breakdown of affected residents — will not be available until completion of the data mining phase. Calderwood & Harkness has reviewed and analyzed these findings for the purpose of providing the legal analysis set forth in Sections IV through VI below.
A. Attack Vector
Graystone's investigation has determined that the threat actor exploited a known remote code execution vulnerability in Palomar's GoAnywhere MFT (Managed File Transfer) file transfer appliance. The vulnerability, tracked as CVE-2023-0669, is a pre-authentication deserialization vulnerability that permits remote code execution on vulnerable GoAnywhere MFT instances. This vulnerability was publicly disclosed, and the vendor (Severin Corporation, formerly Strathmore Industries) issued security patches addressing the vulnerability prior to the date on which the threat actor exploited the vulnerability in Palomar's environment.
CVE-2023-0669 has been widely reported in the cybersecurity community as a high-severity vulnerability actively exploited in the wild by threat actors, including groups associated with ransomware and data extortion campaigns. The vulnerability has been the subject of advisories from the Cybersecurity and Infrastructure Security Agency ("CISA"), which added CVE-2023-0669 to its Known Exploited Vulnerabilities Catalog. Graystone's preliminary findings indicate that Palomar's GoAnywhere MFT instance was not patched at the time of exploitation, despite the availability of vendor-issued patches.
The exploitation of CVE-2023-0669 granted the threat actor initial unauthorized access to Palomar's network infrastructure via the compromised GoAnywhere MFT appliance. From this initial foothold, the threat actor conducted further activities within Palomar's environment, as detailed below.
B. Timeline of Unauthorized Access and Exfiltration
Graystone's reconstruction of the incident timeline, based on forensic analysis of system logs, network traffic data, and endpoint artifacts obtained from Palomar's environment, establishes the following sequence of events:
March 14, 2023 (on or about): Initial unauthorized access to Palomar's network infrastructure via exploitation of CVE-2023-0669 on the GoAnywhere MFT appliance. Graystone's analysis of log artifacts indicates that the threat actor established persistent access to the compromised system on or about this date.
March 14, 2023 through April 18, 2023 (~35-day window): Following initial access, the threat actor conducted lateral movement through Palomar's internal network, eventually reaching the claims processing environment containing Quorum data. The threat actor staged structured data files from the claims processing environment for exfiltration and transferred them out of Palomar's network over this approximately thirty-five-day period. Graystone's analysis of network flow data and file transfer logs confirms sustained exfiltration activity during this window.
April 18, 2023: Palomar's Security Operations Center ("SOC") detected anomalous outbound data transfers from the claims processing environment. The detection of this anomalous activity triggered Palomar's internal incident response procedures and effectively terminated the exfiltration window.
April 21, 2023: Palomar notified Quorum of the security incident. The notification was transmitted via email from Derek Copeland, Palomar's General Counsel, to Thomas R. Whitfield and David Naranjo at Quorum. The notification occurred three calendar days after Palomar's internal SOC discovery on April 18, 2023.
The approximately thirty-five-day exfiltration window is a significant finding because it indicates that the threat actor had extended, sustained access to Palomar's claims processing environment and was able to stage and exfiltrate large volumes of data over an extended period without detection by Palomar's security monitoring systems. The length of this dwell time raises additional questions about the adequacy of Palomar's intrusion detection and monitoring capabilities, which may be relevant to the contractual analysis and to any regulatory inquiries that may follow.
C. Nature of Compromised Data
Graystone has confirmed that the data exfiltrated from Palomar's claims processing environment consists of structured data files containing Quorum policyholder and claimant records. Based on its preliminary analysis of the file structures and sample data, Graystone has identified the following categories of compromised data:
Personally Identifiable Information (PII): The exfiltrated files contain names, dates of birth, Social Security numbers, and driver's license numbers for Quorum policyholders and claimants. The presence of Social Security numbers and driver's license numbers in the compromised data is particularly significant from a notification perspective, as these are among the most commonly triggered data elements under state breach notification statutes.
Financial Information: A subset of the exfiltrated records includes bank account numbers and payment card numbers associated with Quorum policyholders and claimants. This financial information was present in records related to claims payments and policyholder billing transactions processed by Palomar on Quorum's behalf.
Protected Health Information (PHI): A subset of the exfiltrated records contains information that is likely to constitute protected health information under HIPAA, including health conditions, diagnosis codes (ICD-10), and treatment information. This PHI was present in records associated with Quorum's workers' compensation claims and certain health-related claims lines processed by Palomar.
The precise number of affected individuals has not yet been determined. As discussed in greater detail in Section III.D below, enumeration of affected individuals requires completion of a data mining process in which Graystone will analyze the exfiltrated data files to identify unique individuals by name, associate each individual with a state of residence, and categorize the specific data elements compromised for each individual. Graystone has estimated that the data mining phase will be completed by mid-to-late July 2023.
Notwithstanding the lack of a final count, Graystone's preliminary estimate — based on the volume of data exfiltrated, the known scope of Quorum's personal lines claims data processed by Palomar, and the structure of the compromised data files — suggests that the scope of the breach is in the range of several hundred thousand individuals across multiple states. This estimate is consistent with the volume and geographic breadth of Quorum's personal lines claims operations and the role that Palomar plays in processing that claims data.
D. Findings Not Yet Concluded
Several critical aspects of the forensic investigation remain outstanding as of the date of Graystone's preliminary report. These include:
•  Final enumeration of affected individuals. The precise number of unique individuals whose data was compromised will not be known until completion of the data mining phase. Graystone has estimated that this work will be completed by mid-to-late July 2023, depending on the volume and complexity of the data sets involved.
•  State-by-state distribution of affected residents. The identification of affected individuals' states of residence — which is essential for determining notification obligations under each state's breach notification statute — is dependent upon completion of data mining.
•  Precise breakdown of individuals by data type category. Graystone has not yet completed its analysis of which individuals fall into each data type category (i.e., PII-only, PII plus financial data, PII plus PHI, or all three categories). This breakdown is necessary for tailoring notification content and determining which individuals require HIPAA-compliant notifications.
•  Attribution of threat actor. Graystone's threat intelligence team continues to analyze the tactics, techniques, and procedures ("TTPs") observed in the incident for the purpose of attributing the attack to a known threat actor group. Attribution is ongoing and may not be definitively concluded during the forensic investigation.
•  Assessment of data dissemination. Graystone has not yet determined whether the exfiltrated data has appeared on dark web marketplaces, data leak sites, or other forums, or whether the data has been further disseminated or offered for sale. Dark web monitoring is ongoing, and Graystone has deployed continuous monitoring through its threat intelligence platform.
Calderwood & Harkness will supplement this analysis as additional findings become available from Graystone's ongoing investigation.
IV. Legal Analysis — Notification Obligations
A. State Breach Notification Laws — High Likelihood of Triggering
The confirmed exfiltration of personally identifiable information — including Social Security numbers, driver's license numbers, bank account numbers, and payment card numbers — will trigger breach notification obligations under virtually every state's data breach notification statute for residents of the affected state whose data was compromised. As of the date of this memorandum, all fifty states, the District of Columbia, and the U.S. territories have enacted breach notification laws, each with its own definitions of "personal information," notification triggers, timing requirements, content mandates, and regulatory notification obligations.
Because Quorum operates in all fifty states and Palomar processes claims data for Quorum's personal lines division on a nationwide basis, the preliminary indications are that affected individuals reside in numerous states. The precise state-by-state distribution awaits completion of data mining, but given the national scope of Quorum's personal lines operations, it is reasonable to expect that affected individuals will be identified in a substantial majority of states.
Key state statutes that are expected to be triggered based on the nature of the compromised data and the anticipated geographic distribution of affected individuals include the following:
Connecticut (Conn. Gen. Stat. § 36a-701b): As Quorum's headquarters state, Connecticut is expected to have a significant affected population. Connecticut's breach notification statute requires notification to affected residents and to the Connecticut Attorney General within sixty days of discovery of the breach. The Connecticut statute also requires that notifications include information regarding identity theft prevention and mitigation, and permits the Attorney General to investigate and bring enforcement actions.
New York (N.Y. Gen. Bus. Law § 899-aa — SHIELD Act): New York's Stop Hacks and Improve Electronic Data Security Act ("SHIELD Act") broadened the definition of "private information" to include biometric data and certain account credentials, and imposed reasonable security safeguard requirements on entities that hold private information of New York residents. The SHIELD Act requires notification to affected residents, the New York Attorney General, the Department of State, and the Division of State Police. Given the size of Quorum's New York policyholder base, a significant number of affected individuals is expected to reside in New York.
California (Cal. Civ. Code § 1798.82): California's breach notification statute is among the most prescriptive in the nation with respect to notification content requirements. If more than five hundred California residents are affected — which is anticipated given the scale of the overall breach — Quorum will also be required to submit a notification to the California Attorney General's office. California's notification requirements also mandate specific content formatting, including a prescribed heading and specific categories of information to be included in the notification letter.
Massachusetts (Mass. Gen. Laws ch. 93H, § 3 and 201 CMR 17.00): Massachusetts imposes specific content and format requirements for breach notification letters and requires notification to the Massachusetts Attorney General and the Office of Consumer Affairs and Business Regulation. Massachusetts also maintains stringent data security regulations (201 CMR 17.00), which may be relevant to any assessment of the adequacy of data security practices.
Texas: As Palomar's headquarters state and a state where Quorum maintains a significant policyholder base, Texas (Tex. Bus. & Com. Code § 521.053) is expected to have a substantial number of affected residents. The Texas statute requires notification to affected residents and, if more than 250 Texas residents are affected in a single breach, notification to the Texas Attorney General.
Florida, Pennsylvania, Illinois, Ohio, and other states with significant policyholder populations: Each of these states has its own breach notification statute with specific triggering criteria, timing requirements, and notification content mandates. Given the national scope of Quorum's personal lines operations, we anticipate that a significant number of affected individuals will reside in each of these jurisdictions.
Calderwood & Harkness has initiated the preparation of a comprehensive 50-state breach notification law survey to map all applicable triggers, timing requirements, content mandates, regulatory notification obligations, and any special provisions that may be applicable (such as substitute notice thresholds, exemptions for entities subject to HIPAA or the Gramm-Leach-Bliley Act, and provisions regarding vendor-sourced breaches). We anticipate completing this survey by June 8, 2023, and will circulate it to Thomas Whitfield and Jennifer Liang at that time.
Recommendation: Following completion of data mining by Graystone, Calderwood & Harkness will prepare a state-by-state notification trigger analysis identifying each state in which affected residents have been identified, the specific notification requirements applicable in each such state (including timing, content, and regulatory notification obligations), and a recommended notification strategy to ensure timely compliance across all jurisdictions.
B. HIPAA Breach Notification Rule
The confirmed presence of protected health information in the exfiltrated data — specifically health conditions, diagnosis codes, and treatment information from workers' compensation and health-related claims — implicates the HIPAA Breach Notification Rule, codified at 45 C.F.R. Part 164, Subpart D. Quorum, as a covered entity under HIPAA with respect to its health-related claims operations, is subject to the HIPAA Breach Notification Rule when a breach of unsecured PHI occurs.
Under the HIPAA Breach Notification Rule, a "breach" is defined as the acquisition, access, use, or disclosure of PHI in a manner not permitted by the HIPAA Privacy Rule that compromises the security or privacy of the PHI. There is a presumption that an impermissible use or disclosure constitutes a breach unless the covered entity demonstrates, based on a risk assessment considering specified factors, that there is a low probability that the PHI has been compromised. In this case, given that the data was affirmatively exfiltrated by an unauthorized threat actor, it will be exceedingly difficult to demonstrate a "low probability of compromise," and we anticipate that the incident will be determined to constitute a breach for purposes of the HIPAA Breach Notification Rule.
If the subset of individuals whose PHI was compromised exceeds five hundred individuals — which Graystone's preliminary findings suggest is highly likely given the overall scale of the breach and the volume of workers' compensation and health-related claims data processed by Palomar — Quorum will be required to undertake the following notifications:
(i) Individual Notification (45 C.F.R. § 164.404): Quorum must notify each individual whose unsecured PHI has been, or is reasonably believed to have been, accessed, acquired, used, or disclosed as a result of the breach. This notification must be provided without unreasonable delay, and in no case later than sixty (60) calendar days after the date of discovery of the breach. The notification must include a description of the breach, the types of information involved, steps the individual should take to protect themselves, a description of what Quorum is doing to investigate the breach, mitigate harm, and prevent future breaches, and contact procedures for individuals to ask questions.
(ii) HHS Office for Civil Rights Notification (45 C.F.R. § 164.408): Because the breach is anticipated to involve more than 500 individuals, Quorum must notify the Secretary of Health and Human Services through the HHS Office for Civil Rights ("OCR") breach reporting portal within sixty (60) calendar days of discovery. Breaches affecting 500 or more individuals are posted on the OCR "Wall of Shame" public breach portal, which will generate public visibility for this incident.
(iii) Media Notification (45 C.F.R. § 164.406): If the breach involves the PHI of more than 500 residents of any single state or jurisdiction, Quorum must provide notice to prominent media outlets serving that state or jurisdiction. This media notification must be provided without unreasonable delay and in no case later than sixty (60) calendar days after discovery.
The determination of the precise number of individuals whose PHI was compromised, and the state-by-state distribution of those individuals, requires completion of the data mining phase. However, given the volume of workers' compensation and health-related claims processed by Palomar on Quorum's behalf, it is prudent to plan for HIPAA notification obligations.
Recommendation: Upon completion of data mining by Graystone and identification of the PHI subset, Calderwood & Harkness will prepare a detailed HIPAA breach notification analysis addressing the scope of the PHI compromise, the applicable notification requirements, and the recommended notification timeline and content.
C. Connecticut Insurance Data Security Law
As a Connecticut-domiciled insurance holding company, Quorum is subject to the Connecticut Insurance Data Security Law, codified at Conn. Gen. Stat. § 38a-999b. This statute, which implements the National Association of Insurance Commissioners ("NAIC") Insurance Data Security Model Law, imposes separate and distinct cybersecurity requirements and notification obligations on licensees of the Connecticut Insurance Department.
Under the Connecticut Insurance Data Security Law, Quorum is required to notify the Connecticut Insurance Commissioner within seventy-two (72) hours of a determination that a "cybersecurity event" has occurred. A "cybersecurity event" is defined broadly to include an event resulting in unauthorized access to, disruption of, or misuse of an information system or nonpublic information stored on such information system. The exfiltration of policyholder and claimant PII, financial data, and PHI from Palomar's environment clearly satisfies this definition.
Based on our understanding of current examination practices at the Connecticut Insurance Department, Richard Nakamura of the Financial Analysis Division, Cybersecurity Unit, is the anticipated examiner who would be assigned to review Quorum's cybersecurity event notification and any follow-up examination. The seventy-two-hour notification requirement under this statute is among the most stringent timing requirements applicable to this incident, and careful coordination of the timing of this notification with other regulatory filings will be essential.
Additionally, the Connecticut Insurance Data Security Law requires licensees to investigate any cybersecurity event, assess the nature and scope of the event, identify compromised nonpublic information, and take reasonable measures to restore the security of the compromised information systems. Quorum's engagement of Calderwood & Harkness and Graystone, and the ongoing forensic investigation, are consistent with these requirements.
Recommendation: Calderwood & Harkness will prepare a separate, detailed analysis of Quorum's obligations under the Connecticut Insurance Data Security Law, including the content and timing of the required notification to the Connecticut Insurance Commissioner. We will coordinate the timing of this notification with other state and federal regulatory notifications to ensure a coherent and compliant notification strategy.
D. Notification Timing Considerations
A critical threshold question in determining the applicable notification deadlines is the identification of the "Discovery" or "determination" date that triggers the running of notification periods under each applicable statute. The majority of state breach notification statutes begin running the notification clock from the date the entity "Discovers" or "becomes aware of" the breach, or — in some formulations — from the date the entity completes its reasonable investigation and determines that the breach has resulted in the compromise of the requisite categories of personal information.
In this case, while Quorum received initial notification of the security incident from Palomar on April 21, 2023, the investigation as of that date had not progressed to the point at which Quorum could determine the scope and nature of the compromise. Graystone was not retained until May 5, 2023, and its preliminary findings were not delivered until June 2, 2023. Final enumeration of affected individuals, state-by-state distribution, and data type categorization remain dependent on the completion of data mining, which Graystone estimates will conclude in mid-to-late July 2023.
Under most state statutes, the notification clock will begin running from the date Quorum concludes its reasonable investigation and determines, with reasonable specificity, the identity of affected individuals and the nature of the compromise. Conducting a reasonable investigation is a recognized basis for extending the discovery date beyond the initial report of a potential incident. However, Quorum must act diligently and without unreasonable delay in pursuing its investigation, and must not use the investigation as a pretext for delaying notifications beyond what is necessary to identify affected individuals and prepare compliant notification materials.
Graystone's final forensic report is anticipated by mid-July 2023, with the data mining phase expected to conclude shortly thereafter. Once the data mining is complete and affected individuals have been identified, state-specific notification clocks will begin running. Most states require notification within thirty to sixty days of the discovery or determination date, though some states impose shorter timeframes.
Recommendation: To ensure that Quorum is prepared to issue timely notifications once the scope of the breach is finalized, we strongly recommend that Quorum begin preparing notification templates, engage a notification vendor, and establish the logistical infrastructure (mailing, call center, credit monitoring enrollment) in parallel with the ongoing data mining. This parallel workstream approach will significantly reduce the time between the completion of data mining and the issuance of notifications, thereby minimizing the risk of non-compliance with state notification deadlines.
V. Legal Analysis — Palomar Contractual Obligations and Breaches
A. Data Security Exhibit (Exhibit D, as Amended)
The MSA, as amended by Amendment 2 (executed September 15, 2022), contains a comprehensive Data Security Exhibit, designated as Exhibit D, which sets forth the security obligations that Palomar is required to maintain in connection with its processing, storage, and transmission of Quorum data. Exhibit D requires Palomar to maintain "commercially reasonable" administrative, technical, and physical safeguards designed to protect the confidentiality, integrity, and availability of Quorum data against unauthorized access, use, modification, or disclosure.
Among the specific requirements set forth in Exhibit D, the following are most directly relevant to the circumstances of this incident:
(i) Critical Vulnerability Patching (Exhibit D, Section 3.4): Palomar is required to apply security patches for critical vulnerabilities — defined as vulnerabilities rated as "critical" or "high" severity by the vendor or by the Common Vulnerability Scoring System ("CVSS") — within thirty (30) days of the date on which the vendor releases a patch. This requirement reflects industry best practices for vulnerability management and was specifically negotiated by Quorum during the Amendment 2 process to address concerns about Palomar's patch management practices.
(ii) Annual Penetration Testing (Exhibit D, Section 4.1): Palomar is required to conduct annual penetration testing of its network environment and to provide Quorum with a summary of the results, including any remediation actions taken. The most recent penetration test report provided by Palomar was dated October 2022, and Calderwood & Harkness is reviewing that report to determine whether the GoAnywhere MFT appliance was within scope.
(iii) SOC 2 Type II Report (Exhibit D, Section 5.2, as added by Amendment 2): Amendment 2 added a requirement for Palomar to obtain and provide to Quorum a SOC 2 Type II report covering its claims processing environment, including the systems and infrastructure used to process, store, and transmit Quorum data. This requirement was added to provide Quorum with independent assurance regarding the design and operating effectiveness of Palomar's security controls.
Graystone's preliminary findings confirm that the threat actor exploited CVE-2023-0669, a known remote code execution vulnerability in Palomar's GoAnywhere MFT file transfer appliance, for which the vendor had issued security patches prior to the March 14, 2023 date of exploitation. Based on publicly available information regarding the timeline of the CVE-2023-0669 disclosure and patch release, the vendor patch was made available in early February 2023. This means that Palomar had more than thirty days — the period prescribed by Exhibit D, Section 3.4 — to apply the patch before the threat actor exploited the vulnerability on or about March 14, 2023.
Graystone's preliminary findings confirm that Palomar's GoAnywhere MFT instance had not been patched at the time of the exploitation. This represents a clear and direct failure by Palomar to comply with its obligation under Exhibit D, Section 3.4 to apply critical vulnerability patches within thirty days of vendor patch release.
Conclusion: Palomar's failure to timely apply the vendor-issued patch for CVE-2023-0669 constitutes a breach of its data security obligations under Exhibit D, Section 3.4 of the MSA. This failure was the direct cause of the threat actor's initial unauthorized access to Palomar's network and the subsequent exfiltration of Quorum data from the claims processing environment. The breach is straightforward and well-documented: the contractual requirement is clear, the patch was available, the thirty-day window expired before the exploitation, and Palomar failed to act.
B. Breach Notification Clause (Section 9.4)
Section 9.4 of the MSA requires Palomar to notify Quorum "within forty-eight (48) hours of Palomar's discovery or reasonable suspicion of any Security Incident affecting Customer Data." The term "Security Incident" is defined broadly in Section 1.18 of the MSA to include "any actual or reasonably suspected unauthorized access to, acquisition of, use of, or disclosure of Customer Data, or any actual or reasonably suspected breach of Palomar's security systems that could reasonably result in the unauthorized access to, acquisition of, use of, or disclosure of Customer Data." The term "Customer Data" is defined in Section 1.6 to encompass all data provided by or on behalf of Quorum to Palomar in connection with the services, including policyholder and claimant PII, financial data, and PHI.
The timeline established by Graystone's preliminary findings is unambiguous with respect to the notification question:
•  April 18, 2023: Palomar's SOC detected anomalous outbound data transfers from the claims processing environment. This detection constitutes, at minimum, "reasonable suspicion of any Security Incident affecting Customer Data," and more likely constitutes actual "Discovery" of a Security Incident under the MSA's definition.
•  April 21, 2023: Palomar's General Counsel, Derek Copeland, transmitted the initial security incident notification to Thomas R. Whitfield and David Naranjo at Quorum.
The elapsed time between Palomar's SOC detection on April 18, 2023, and Palomar's notification to Quorum on April 21, 2023, is three calendar days — approximately seventy-two hours. Under Section 9.4, Palomar was required to provide notification within forty-eight hours of discovery. The notification was therefore approximately twenty-four hours late.
The significance of this delay should not be understated. The forty-eight-hour notification clause was specifically negotiated by Quorum to ensure rapid awareness of security incidents affecting its data, so that Quorum could activate its own incident response plan, engage legal counsel, preserve evidence, and begin assessing its own notification obligations. The twenty-four-hour delay impaired Quorum's ability to undertake these critical steps in a timely manner and extended the period during which the threat actor's activities remained unaddressed by Quorum's incident response team.
Conclusion: Palomar's notification to Quorum on April 21, 2023 — approximately seventy-two hours after its SOC detection on April 18, 2023 — was approximately twenty-four hours late and constitutes a breach of Section 9.4 of the MSA.
C. Indemnification Rights (Section 12.2)
Section 12.2 of the MSA provides that Palomar shall indemnify, defend, and hold harmless Quorum and its affiliates, officers, directors, employees, and agents from and against all losses, damages, costs, expenses (including reasonable attorneys' fees), liabilities, claims, actions, suits, proceedings, and judgments arising from or related to Palomar's breach of its data security obligations under the MSA, including the obligations set forth in Exhibit D and Section 9.4.
The categories of "losses" covered by the indemnification provision are defined broadly in Section 12.1 and encompass, without limitation:
•  Costs of forensic investigation and incident response;
•  Costs of notifying affected individuals, including mailing, printing, and postage;
•  Costs of credit monitoring and identity theft protection services for affected individuals;
•  Costs of call center services;
•  Costs of regulatory defense, including responses to regulatory inquiries and investigations;
•  Crisis communications costs;
•  Legal fees and expenses incurred in connection with the breach;
•  Internal remediation costs, including the cost of implementing enhanced security measures necessitated by the breach; and
•  Damages, fines, penalties, or settlements arising from third-party claims or regulatory actions related to the breach.
The indemnification obligation under Section 12.2 is subject to the general liability limitation set forth in Section 13.1 of the MSA, which caps each party's aggregate liability under the MSA at an amount equal to two times (2×) the trailing twelve-month fees paid under the MSA. Based on the current ACV of $16.3 million (as increased by Amendment 1), the liability cap applicable to Palomar's indemnification obligation is $32,600,000 (i.e., $16.3 million × 2). It is important to note that certain categories of liability — including liability arising from breaches of confidentiality obligations and indemnification obligations related to data security breaches — are frequently carved out from or subject to elevated liability caps in vendor agreements. Calderwood & Harkness will undertake a detailed review of Sections 12.2 and 13.1 in the comprehensive contractual analysis memorandum to confirm the precise scope and application of the liability cap to the indemnification claim.
The identified contractual breaches — Palomar's failure to timely patch CVE-2023-0669 in violation of Exhibit D, Section 3.4, and Palomar's late notification in violation of Section 9.4 — provide a strong contractual basis for Quorum to pursue indemnification from Palomar for all qualifying losses arising from the security incident. The causal nexus between the contractual breaches and the resulting harm is clear: Palomar's failure to patch the known vulnerability was the direct cause of the threat actor's initial access, and the subsequent exfiltration of Quorum data was the proximate result of that access.
Recommendation: Quorum should preserve all indemnification rights under the MSA. Calderwood & Harkness will prepare a comprehensive contractual analysis memorandum detailing the bases for Quorum's indemnification claims, quantifying the categories of recoverable losses, and assessing the enforceability of the liability cap. At the appropriate time — which we recommend be following the completion of Graystone's final forensic report and after initial quantification of incident response costs — Calderwood & Harkness will issue a formal breach of contract and indemnification demand to Palomar's outside counsel, Catherine Langford at Mercer, Haight & Dunlop LLP. In the interim, Quorum should ensure that all incident response costs are thoroughly documented and categorized to support the eventual indemnification claim.
D. Termination Rights (Section 14.2)
Section 14.2 of the MSA permits either party to terminate the MSA upon the other party's material breach that remains uncured for a period of thirty (30) calendar days following written notice specifying the nature of the breach. The question of whether Palomar's identified contractual breaches — the failure to patch CVE-2023-0669 and the late notification — constitute "material" breaches for purposes of Section 14.2 requires assessment of the magnitude, significance, and impact of the breaches in the context of the overall MSA relationship.
In our preliminary view, both breaches are strong candidates for characterization as material breaches. The patching failure resulted in the compromise of hundreds of thousands of Quorum customer records and will give rise to millions of dollars in incident response costs, regulatory exposure, and reputational harm. The late notification, while a narrower breach, compounded the harm by delaying Quorum's response. Together, these breaches go to the core of Palomar's data security obligations under the MSA — obligations that are fundamental to the purpose and value of the outsourcing arrangement.
However, the exercise of termination rights raises significant strategic considerations that weigh in favor of a measured approach:
•  Operational Disruption: Termination of the MSA would disrupt Quorum's claims processing operations, as Palomar handles the full claims data processing lifecycle for Quorum's personal lines division. Transitioning these services to an alternative vendor or bringing them in-house would require significant time, resources, and planning.
•  MSA Expiration: The MSA has a remaining term expiring on November 11, 2024 — approximately seventeen months from the date of this memorandum. Quorum may prefer to allow the MSA to expire by its terms rather than terminating early, particularly if an orderly transition can be planned during the remaining contract period.
•  Indemnification Leverage: The threat of termination — and the preservation of Quorum's right to terminate — may serve as a powerful lever in indemnification negotiations with Palomar. Palomar's potential loss of its second-largest client by revenue ($16.3 million ACV) provides Palomar with a strong incentive to cooperate on indemnification and remediation.
•  Enhanced Security Requirements: Rather than terminating the MSA, Quorum may be better served by negotiating enhanced security requirements, accelerated audit rights, and other protective measures as conditions for continued performance under the MSA.
Recommendation: Quorum should preserve its termination rights under Section 14.2 but defer the exercise of those rights pending a full assessment of the indemnification posture, operational transition planning, and strategic considerations. We recommend that Quorum consult with Priya Deshmukh, Vice President of Vendor Risk Management, and Robert Wentworth, Senior Vice President of Claims Operations, to assess the operational impact of termination and to develop a contingency plan for transitioning claims processing services in the event that termination becomes the preferred course of action. Calderwood & Harkness will advise on the legal and strategic dimensions of this decision as the situation evolves.
VI. Insurance Coverage Considerations
The costs incurred and anticipated to be incurred in connection with the Palomar security incident are expected to fall within the categories of covered losses under Quorum's primary cyber-liability policy issued by Atlas Mutual Insurance Company (Policy No. CYB-2023-041587, Claim No. CYB-CLM-2023-05892). The Atlas policy covers a broad range of first-party incident response costs, including:
•  Forensic investigation costs (including the Graystone engagement);
•  Legal fees and expenses (including Calderwood & Harkness fees incurred in connection with the incident response, notification compliance, and contractual analysis);
•  Breach notification costs, including printing, mailing, and postage for notification letters to affected individuals;
•  Credit monitoring and identity theft protection services for affected individuals;
•  Call center services for handling inquiries from affected individuals;
•  Crisis communications costs; and
•  Regulatory defense costs, including the costs of responding to regulatory inquiries and investigations arising from the breach.
The $2,500,000 self-insured retention ("SIR") must be satisfied before Atlas's coverage obligations attach. Based on the costs incurred to date — including the Graystone forensic engagement, Calderwood & Harkness fees, and Quorum's internal incident response costs — the SIR has not yet been fully exhausted. However, as the investigation and notification phases progress, we anticipate that the SIR will be satisfied and that Atlas's coverage will be triggered in the near term.
Based on the anticipated scale of the breach — potentially hundreds of thousands of affected individuals across multiple states — total incident response costs are expected to be significant. By way of illustration, notification mailing costs (printing, postage, and handling) for several hundred thousand notification letters, combined with the costs of operating a call center and providing credit monitoring and identity theft protection services for twelve to twenty-four months, could alone reach several million dollars. When forensic investigation costs, legal fees, crisis communications costs, and regulatory defense costs are factored in, the total cost of the incident response is likely to be substantial, though we anticipate that total costs will remain within the $15 million primary policy layer.
In the event that total incident response costs exceed the $15 million primary layer — which we presently consider unlikely but cannot exclude at this stage — the excess coverage provided by Pinnacle Surplus Lines Insurance Corp. (Policy No. XS-CYB-2023-7812; $25 million excess of $15 million primary) would apply, providing total insurance tower protection of $40 million above the $2.5 million SIR.
It is important to note that any amounts recovered from Palomar through contractual indemnification may be subject to coordination with the insurance recovery. Atlas's subrogation rights may entitle Atlas to pursue recovery from Palomar for amounts paid under the policy, and Quorum's indemnification claims against Palomar should be coordinated with Atlas to avoid any conflict with the policy's subrogation provisions or cooperation requirements. Calderwood & Harkness will analyze the interaction between Quorum's contractual indemnification rights and the insurance recovery in greater detail in the comprehensive contractual analysis memorandum.
Recommendation: Quorum should continue its coordination with Atlas Mutual through Paul Enriquez, the assigned claims adjuster, and with Whitmore Risk Advisors Inc. (Sandra Whitmore-Kim, broker) regarding all aspects of the insurance claim. All costs incurred in connection with the incident response should be thoroughly documented, categorized, and retained for purposes of proof of loss submission to Atlas. Quorum should ensure strict compliance with the Atlas policy's consent, cooperation, and reporting requirements, including obtaining Atlas's prior consent for any costs or engagements that exceed designated thresholds under the policy. Calderwood & Harkness will continue to advise on coverage-related matters and will assist in preparing the proof of loss submission at the appropriate time.
VII. Recommended Next Steps
Based on the analysis set forth in this memorandum, Calderwood & Harkness recommends the following actions, organized by timeframe:
A. Immediate Actions (June 2023)
1.  Completion of 50-State Breach Notification Law Survey. Calderwood & Harkness is preparing a comprehensive survey of the breach notification laws of all fifty states, the District of Columbia, and applicable territories. The target completion date is June 8, 2023. This survey will serve as the foundation for the state-by-state notification trigger analysis that will be prepared upon completion of data mining.
2.  Continuation of Graystone Forensics Investigation. Graystone should continue its forensic investigation through to the issuance of the final forensic report, which is estimated to be completed by mid-July 2023. Calderwood & Harkness will continue to coordinate with Dr. Briggs and Ms. Faulkner on the scope and progress of the investigation.
3.  Engagement of Data Mining Analysts. Authorize Graystone (or, if capacity or cost considerations warrant, a separate data mining vendor engaged under the Calderwood & Harkness privilege umbrella) to proceed with the data mining phase. The objective of this phase is to analyze the exfiltrated data files and identify all affected individuals by name, associate each individual with a state of residence, and identify the specific data elements compromised for each individual. This work is essential for determining notification obligations and preparing compliant notifications.
4.  Preparation of Consumer Notification Letter Templates. Calderwood & Harkness will begin drafting consumer notification letter templates for the principal notification categories: (a) individuals whose PII only was compromised; (b) individuals whose PII and financial data were compromised; and (c) individuals whose PHI was compromised, requiring HIPAA-compliant notification content. These templates will be prepared in compliance with the content requirements of the most prescriptive applicable state statutes and will be finalized upon completion of the state-by-state notification trigger analysis.
5.  Evaluation and Engagement of Notification Vendor. Quorum should evaluate and engage a notification vendor to handle the logistics of notification mailing, call center operations, and credit monitoring enrollment services. Clearfield Notification Services LLC has been identified as a strong candidate based on its experience with large-scale, multi-state insurance sector breach notifications. Calderwood & Harkness can facilitate introductions and contract negotiations.
6.  Engagement of Crisis Communications Consultant. Quorum should engage BrightPath Consulting Group Inc. (Meredith Ashford, Managing Director) to develop a crisis communications plan in anticipation of the public-facing notification phase. The plan should address media inquiries, policyholder communications, regulator and analyst relations, and internal employee communications. Early engagement of BrightPath will allow adequate time to develop and refine messaging before notifications are issued.
B. Near-Term Actions (July–August 2023)
7.  State-by-State Notification Trigger Analysis. Upon receipt of the Graystone final forensic report and completion of data mining, Calderwood & Harkness will prepare a comprehensive state-by-state notification trigger analysis identifying each jurisdiction with affected residents and the specific notification requirements (timing, content, regulatory filings) applicable in each.
8.  HIPAA Breach Notification Analysis. Calderwood & Harkness will prepare a detailed HIPAA breach notification analysis for the subset of affected individuals whose PHI was compromised, addressing the scope of the PHI compromise, the applicable notification requirements under 45 C.F.R. Part 164, Subpart D, the notification timeline, and the required content of individual, HHS, and media notifications.
9.  Connecticut Insurance Data Security Law Analysis. Calderwood & Harkness will prepare a separate analysis of Quorum's notification obligations under the Connecticut Insurance Data Security Law (Conn. Gen. Stat. § 38a-999b), including the content and timing of the required notification to the Connecticut Insurance Commissioner and coordination with Richard Nakamura at the Financial Analysis Division, Cybersecurity Unit.
10.  Comprehensive Contractual Analysis Memorandum. Calderwood & Harkness will prepare a detailed memorandum analyzing Palomar's contractual breaches under the MSA, Quorum's indemnification rights under Section 12.2, the scope and applicability of the liability cap under Section 13.1, and the recommended strategy for pursuing indemnification from Palomar. This memorandum will serve as the basis for a formal breach of contract and indemnification demand to be issued to Palomar's counsel, Catherine Langford at Mercer, Haight & Dunlop LLP.
11.  Notification Timing Strategy. Calderwood & Harkness wi