PRIVILEGED AND CONFIDENTIAL — ATTORNEY-CLIENT PRIVILEGED / ATTORNEY WORK PRODUCT
MEMORANDUM
July 18, 2023
FROM: Kevin Ostrowski, Partner, Privacy & Data Security Alan Burke, Lead Associate, Privacy & Data Security Calderwood & Harkness LLP 1700 K Street NW, Suite 900 Washington, D.C. 20006
TO: Thomas R. Whitfield, General Counsel Jennifer Liang, Chief Privacy Officer David Naranjo, Chief Information Security Officer Quorum Insurance Holdings Corp. 400 Constitution Plaza, Suite 2200 Hartford, CT 06103
RE: Summary and Legal Analysis of Final Forensic Findings — Palomar Data Solutions Security Incident
MATTER NO.: 1025-00006
PRIVILEGE NOTICE: This memorandum is protected by attorney-client privilege and the work product doctrine. It was prepared by Calderwood & Harkness LLP at the request of Quorum Insurance Holdings Corp. ("Quorum") for the purpose of providing legal advice in connection with the data security incident originating from Palomar Data Solutions, Inc. ("Palomar"). This memorandum contains the mental impressions, conclusions, opinions, and legal theories of counsel. It is intended solely for the use of the named recipients and authorized personnel within Quorum's Office of General Counsel. Do not forward, copy, or distribute without prior authorization from outside counsel. Inadvertent disclosure of this memorandum does not constitute a waiver of any applicable privilege.
Right-click to update Table of Contents
I. Executive Summary
The purpose of this memorandum is to summarize and analyze the final forensic investigation report issued by Graystone Forensics LLC ("Graystone") on July 14, 2023 (the "Final Forensic Report" or "Report"), and to provide a comprehensive legal analysis of the implications for Quorum Insurance Holdings Corp. ("Quorum") arising from the data security incident originating at Palomar Data Solutions, Inc. ("Palomar"). This memorandum is intended to guide Quorum's leadership team in making informed decisions regarding notification obligations, vendor accountability, insurance coordination, regulatory engagement, and board-level reporting.
Graystone was retained under the attorney-client privilege umbrella by Calderwood & Harkness LLP on May 5, 2023, pursuant to the Outside Counsel Retention Letter of the same date. The forensic engagement has been led by Dr. Nolan Briggs, Managing Director, Incident Response, and Kendra Faulkner, Senior Forensic Analyst, both of Graystone's Washington, D.C. practice. All communications between Calderwood & Harkness and Graystone have been conducted within the privilege framework, and the Final Forensic Report was prepared at the direction of counsel for the purpose of providing legal advice to Quorum.
The Final Forensic Report confirms that a threat actor gained unauthorized access to Palomar's network environment over an approximately 35-day period, from March 14, 2023, through April 18, 2023. During this period, the threat actor identified, accessed, staged, and exfiltrated structured data files containing personally identifiable information ("PII"), financial information, and protected health information ("PHI") belonging to Quorum policyholders and claimants whose data was processed by Palomar under the parties' Master Services Agreement ("MSA").
The total number of confirmed affected individuals is 318,247, distributed across 29 states and the District of Columbia. The data types compromised include:
• PII — including names, dates of birth, Social Security numbers, and driver's license numbers — for all 318,247 affected individuals;
• Financial Information — including bank account numbers and payment card numbers — for a subset of 84,619 individuals; and
• Protected Health Information — including health conditions, diagnosis codes, and treatment information derived from workers' compensation and health-related claims — for a subset of 41,203 individuals.
The root cause of the incident, as confirmed by Graystone's forensic analysis, is the exploitation of CVE-2023-0669, a known remote code execution vulnerability in the GoAnywhere MFT file transfer appliance operated by Palomar at its Dallas, Texas, data center. A vendor-issued patch for this vulnerability was available prior to March 14, 2023. Palomar failed to apply the patch within the 30-day window required by Exhibit D (Data Security) of the MSA, as amended by Amendment 2 (executed September 15, 2022). This failure constitutes a clear contractual breach by Palomar and is the proximate cause of the unauthorized access and data exfiltration.
This memorandum addresses the following key legal implications arising from the Final Forensic Report:
1. State-by-State Breach Notification Triggers — Analysis of notification obligations across all 29 affected states and the District of Columbia, including statutory deadlines, regulatory notice requirements, and content specifications;
2. HIPAA Breach Notification Obligations — Analysis of the notification requirements under the HIPAA Breach Notification Rule (45 C.F.R. §§ 164.400–414) for the subset of 41,203 individuals whose PHI was compromised;
3. Recommended Notification Timeline — A proposed schedule for both consumer and regulatory notifications designed to satisfy all applicable statutory deadlines;
4. Vendor Indemnification Posture Against Palomar — Analysis of Quorum's contractual rights under the MSA to seek full indemnification from Palomar for all costs arising from the incident, including identification of Palomar's specific contractual breaches;
5. Cyber-Insurance Coverage Considerations — Analysis of coverage under Quorum's cyber-insurance tower, including the Atlas Mutual Insurance Company primary policy and the Pinnacle Surplus Lines Insurance Corp. excess policy, and coordination with vendor recovery efforts.
Based on the findings summarized herein, Calderwood & Harkness recommends that Quorum proceed immediately to finalize consumer notification letters, prepare regulatory notification filings across all applicable jurisdictions, and initiate a formal vendor indemnification demand against Palomar. Time is of the essence. Several jurisdictions impose aggressive notification deadlines, and prompt action will demonstrate good faith compliance and minimize regulatory risk. The sections that follow provide the detailed analysis supporting these recommendations.
II. Summary of Final Forensic Findings
The following section summarizes the key findings of the Graystone Final Forensic Report dated July 14, 2023. This summary is intended to provide sufficient technical context for the legal analysis in Sections III through VI. The full Graystone Report is available for review in the Calderwood & Harkness secure document repository (Matter No. 1025-00006, Document ID GF-FINAL-071423). As noted above, the Report is protected by attorney-client privilege and the work product doctrine and should not be disseminated outside the privilege framework.
A. Attack Vector and Initial Compromise
The Graystone investigation confirmed that the threat actor exploited CVE-2023-0669, a remote code execution vulnerability in the GoAnywhere MFT ("Managed File Transfer") appliance operated by Palomar Data Solutions, Inc. at its primary data center facility located at 7100 Greenville Avenue, Suite 450, Dallas, Texas 75231. The GoAnywhere MFT appliance is a widely used enterprise file transfer solution that enables organizations to manage and automate secure file transfers with trading partners, clients, and internal business units. Palomar utilized this appliance as a central component of its data ingestion and transfer workflow for processing Quorum policyholder and claimant data.
CVE-2023-0669 is a publicly known and well-documented vulnerability. The vulnerability was assigned a CVSS (Common Vulnerability Scoring System) base score indicating a critical severity level. It allows a remote, unauthenticated attacker to execute arbitrary code on the GoAnywhere MFT server by exploiting a deserialization flaw in the appliance's administrative console. The vulnerability was the subject of widespread public reporting in early 2023, and the appliance vendor released a security patch addressing the vulnerability prior to March 14, 2023. The availability of this patch was communicated through standard vendor security advisory channels, and CVE-2023-0669 was cataloged in the National Vulnerability Database (NVD) and the Cybersecurity and Infrastructure Security Agency's (CISA) Known Exploited Vulnerabilities (KEV) catalog.
Graystone's forensic analysis determined that the initial unauthorized access to Palomar's GoAnywhere MFT appliance occurred on or about March 14, 2023. Network traffic analysis, server log reconstruction, and endpoint forensic artifacts collectively establish this date as the earliest evidence of threat actor activity within Palomar's environment. The threat actor leveraged the unpatched CVE-2023-0669 vulnerability to gain an initial foothold on the GoAnywhere MFT server, from which they proceeded to escalate privileges and move laterally within Palomar's internal network.
Palomar's failure to apply the available security patch within a reasonable timeframe directly enabled the exploitation. This failure is not merely a matter of general industry best practice; it constitutes a specific violation of Palomar's contractual obligations to Quorum. Under the Master Services Agreement dated November 12, 2019, between Quorum Insurance Holdings Corp. and Palomar Data Solutions, Inc., as amended by Amendment 2 (executed September 15, 2022), Exhibit D (Data Security) required Palomar to apply patches for critical vulnerabilities within 30 days of the vendor patch release date. The vendor patch for CVE-2023-0669 was available well before March 14, 2023, and Palomar had not applied it as of that date. This constitutes a clear and unambiguous breach of Palomar's obligations under the MSA, and this breach was the direct and proximate cause of the security incident.
B. Lateral Movement and Data Staging
Following the initial compromise of the GoAnywhere MFT appliance on or about March 14, 2023, the threat actor engaged in lateral movement within Palomar's internal network environment over the period of March 14 through April 18, 2023 — an approximately 35-day window. During this period, the threat actor demonstrated a sophisticated understanding of Palomar's network topology and data architecture.
Graystone's forensic analysis identified multiple indicators of lateral movement, including the use of compromised credentials harvested from the GoAnywhere MFT server, deployment of remote access tools on intermediate hosts, and exploitation of internal trust relationships between network segments. The threat actor progressed methodically from the DMZ-facing GoAnywhere appliance into Palomar's internal network, ultimately identifying and accessing Palomar's claims processing environment — the production environment where Quorum policyholder and claimant data was stored and actively processed pursuant to the MSA.
Within the claims processing environment, the threat actor identified and targeted structured data files stored in Palomar's claims processing databases. These databases contained records associated with Quorum's personal lines division, including policyholder identification data, financial account information used for premium payments and claims disbursements, and health-related claims data from Quorum's workers' compensation and health insurance product lines. The threat actor staged these data files for exfiltration by aggregating them into compressed archive files on intermediate staging servers within Palomar's environment. Graystone identified forensic evidence of file compression and staging activity consistent with preparation for bulk data exfiltration.
The lateral movement and staging activity was conducted in a manner designed to evade detection by Palomar's security monitoring tools. The threat actor operated during periods of high network utilization to mask anomalous traffic patterns and utilized encrypted communication channels to avoid content inspection by Palomar's network security appliances.
C. Data Exfiltration
Exfiltration of the staged data files occurred over the course of the approximately 35-day compromise window (March 14 through April 18, 2023). Graystone's analysis of Palomar's network traffic logs, firewall logs, and proxy server records establishes that the threat actor transferred the staged archive files to external infrastructure under the threat actor's control. The exfiltration was conducted incrementally, with data transferred in multiple sessions rather than in a single bulk transfer, further reducing the likelihood of detection by Palomar's security operations team.
The exfiltrated files contained structured data records corresponding to Quorum policyholders and claimants whose data was processed by Palomar under the MSA. The data elements within these records are detailed in Section II.E below and include PII, financial information, and PHI.
On April 18, 2023, Palomar's Security Operations Center ("SOC") detected unusual outbound data transfers originating from the claims processing environment. This detection was triggered by a network anomaly alert that flagged an unusually large volume of encrypted outbound traffic to an external IP address not recognized in Palomar's authorized transfer whitelist. Upon investigation, the SOC confirmed that the traffic was unauthorized, which led to the discovery of the compromise. Palomar's incident response team took immediate steps to contain the threat, including isolating the affected GoAnywhere MFT appliance, revoking compromised credentials, and blocking the external IP addresses used for exfiltration. The cessation of exfiltration activity coincided with these containment measures on April 18, 2023.
D. Discovery and Notification to Quorum
Palomar discovered the anomalous network activity on April 18, 2023, as described above. Following its internal investigation and containment efforts, Palomar notified Quorum of the incident on April 21, 2023, via email from Derek Copeland, Palomar's General Counsel, to Thomas R. Whitfield (Quorum General Counsel) and David Naranjo (Quorum CISO). The notification email identified the incident as a potential security event affecting Quorum data but did not provide detailed information regarding the scope or nature of the compromise.
Under MSA Section 9.4 (Security Incident Notification), Palomar was required to notify Quorum within 48 hours of discovering a security incident affecting Quorum data. Palomar discovered the incident on April 18, 2023. The contractual 48-hour notification deadline therefore expired on or about April 20, 2023. Palomar's notification on April 21, 2023, was delivered approximately 72 hours after discovery — approximately 24 hours past the contractual 48-hour deadline. While this delay is relatively modest in absolute terms, it constitutes a breach of the notification obligation under Section 9.4 and potentially impacted Quorum's ability to commence its own incident response activities sooner. This late notification is a separate and independent contractual breach by Palomar, in addition to the patching failure described above.
E. Scope of Compromised Data — Confirmed Totals
The Graystone Final Forensic Report confirms the following regarding the scope and nature of the compromised data:
Total Affected Individuals: 318,247
The data types compromised, and the number of individuals affected by each data type, are as follows:
It is important to note that these categories are not mutually exclusive. All 318,247 affected individuals had PII compromised. The 84,619 individuals with financial information compromised and the 41,203 individuals with PHI compromised are subsets of the total affected population. Certain individuals may fall within both the financial information and PHI subsets simultaneously. The data mining process currently underway will identify the precise overlap, if any, between these subsets to ensure that affected individuals receive notification letters appropriate to the specific data types compromised for each individual.
F. State-by-State Breakdown of Affected Individuals
The 318,247 affected individuals reside across 29 states and the District of Columbia. The following table presents the complete state-by-state breakdown as confirmed by Graystone's data analysis:
As reflected in the table above, ten states each have more than 10,000 affected residents. Connecticut, where Quorum is headquartered, has the largest affected population at 52,114 individuals. The remaining 19 states and the District of Columbia account for a combined 56,216 individuals. A detailed breakout of the 19 remaining states and the District of Columbia is included in Appendix A to the Graystone Final Forensic Report and will be incorporated into the State-by-State Notification Timeline & Content Requirements Matrix that Calderwood & Harkness is preparing separately.
The concentration of affected individuals in ten primary states — particularly Connecticut, New York, California, Texas, and Florida — will drive the prioritization of regulatory notification filings and consumer notification mailing logistics. The geographic distribution also has implications for the HIPAA media notice obligation discussed in Section IV.
G. Forensic Report Provenance and Privilege
The Graystone Final Forensic Report dated July 14, 2023, was prepared at the direction of Calderwood & Harkness LLP in connection with the provision of legal advice to Quorum Insurance Holdings Corp. regarding the Palomar Data Solutions security incident. Graystone was retained by Calderwood & Harkness — not by Quorum directly — pursuant to the Outside Counsel Retention Letter dated May 5, 2023, which established the terms of the engagement and confirmed that all work product generated by Graystone in connection with the engagement would be protected under the attorney-client privilege and work product doctrine.
All communications between Calderwood & Harkness and Graystone, including engagement letters, interim reports, draft findings, data analysis results, and the Final Forensic Report itself, are privileged and were conducted within the privilege umbrella. The retention of Graystone through outside counsel was specifically structured to preserve the privilege protections that would not attach if Graystone had been retained directly by Quorum in a non-litigation context.
The Final Forensic Report should not be shared outside the privilege framework — including with regulators, business partners, or Palomar Data Solutions — without prior consultation with Calderwood & Harkness. In the event that Quorum determines it is necessary or advisable to share any forensic findings with regulators or other third parties, Calderwood & Harkness will prepare a separate, non-privileged summary of relevant factual findings suitable for external dissemination, while preserving the privileged status of the underlying Report and related communications.
III. Legal Analysis — State Breach Notification Obligations
A. Overview of Notification Trigger Analysis
The confirmed data types compromised in the Palomar incident — Social Security numbers, driver's license numbers, financial account numbers, and protected health information — trigger breach notification obligations in all 29 states where affected residents reside, as well as the District of Columbia. Calderwood & Harkness has conducted a comprehensive analysis of the breach notification statutes and implementing regulations of each affected jurisdiction and has confirmed that notification obligations are triggered in every case.
Every affected state's breach notification statute defines "personal information" to include, at a minimum, an individual's name in combination with one or more of the following: Social Security number, driver's license number or state identification card number, or financial account number (with or without access codes, depending on the jurisdiction). Because the compromised data includes names combined with Social Security numbers and driver's license numbers for all 318,247 affected individuals, the notification trigger is satisfied universally across all affected jurisdictions.
The presence of financial account information (bank account numbers and payment card numbers) for the subset of 84,619 individuals triggers additional or enhanced notification requirements in certain jurisdictions. For example, several states include financial account numbers as an independent trigger category and may require specific content in the notification letter addressing steps individuals should take to protect their financial accounts, including fraud alerts and account monitoring. Similarly, the presence of protected health information for the subset of 41,203 individuals triggers parallel obligations under HIPAA (discussed in Section IV) and may trigger enhanced notification requirements under state laws that specifically incorporate medical information or health insurance information within their definitions of "personal information."
Calderwood & Harkness prepared a comprehensive 50-State Breach Notification Law Survey dated June 8, 2023, which surveys the notification requirements of all 50 states, the District of Columbia, and U.S. territories. This survey is available in the Calderwood & Harkness secure document repository under Matter No. 1025-00006. In addition to this memorandum, Calderwood & Harkness will prepare and deliver to Quorum the following supplemental work products:
• A Detailed Notification Trigger Analysis Memorandum, mapping each compromised data element to the specific statutory definition of "personal information" in each affected jurisdiction; and
• A State-by-State Notification Timeline & Content Requirements Matrix, setting forth the specific notification deadlines, required content elements, regulatory filing requirements, and format specifications for each of the 29 affected states and the District of Columbia.
These supplemental work products will be finalized in the coming weeks as the notification preparation process advances. The sections below address the key state-specific requirements for the jurisdictions with the largest affected populations.
B. Key State-Specific Requirements
1. Connecticut. Connecticut is Quorum's headquarters state and has the largest affected population at 52,114 individuals. Connecticut's breach notification framework imposes obligations through two separate statutory frameworks, both of which apply to Quorum.
General Breach Notification Statute: Conn. Gen. Stat. § 36a-701b. This statute requires any person who conducts business in Connecticut and who, in the ordinary course of business, owns, licenses, or maintains computerized data that includes personal information, to notify affected Connecticut residents of a breach of security "without unreasonable delay" but no later than 60 days after discovery of the breach. The statute was amended effective October 1, 2021, to shorten the notification deadline from 90 days to 60 days and to expand the definition of personal information. Notification to the Connecticut Attorney General is required not later than the time notification is provided to Connecticut residents. The notification must include, among other things, a description of the breach, the approximate date of the breach, the type of personal information compromised, and contact information for the entity providing notice.
Connecticut Insurance Data Security Law: Conn. Gen. Stat. § 38a-999b. As a regulated insurance holding company domiciled in Connecticut, Quorum is subject to the additional requirements of Connecticut's Insurance Data Security Law, which is modeled on the NAIC Insurance Data Security Model Law. This statute requires a licensee to notify the Connecticut Insurance Department of a "cybersecurity event" within 72 hours of a determination that a cybersecurity event has occurred. The 72-hour clock begins upon the licensee's determination that a cybersecurity event involving nonpublic information has occurred — not upon discovery of suspicious activity. Quorum's determination that a cybersecurity event occurred was made following receipt of Palomar's notification and Calderwood & Harkness's preliminary assessment, and the 72-hour notification to the Connecticut Insurance Department is a parallel obligation that must be tracked separately from the general breach notification timeline.
Calderwood & Harkness has identified Richard Nakamura, Financial Analysis Division, Cybersecurity Unit, at the Connecticut Insurance Department as the assigned examiner for purposes of this notification. We recommend direct engagement with Mr. Nakamura's office in advance of the formal filing to provide preliminary notice that a cybersecurity event filing will be submitted. Such advance engagement is consistent with best practices and may facilitate a cooperative regulatory posture.
2. New York
New York has the second-largest affected population at 47,831 individuals. New York's breach notification obligations are governed by the New York SHIELD Act (Stop Hacks and Improve Electronic Data Security Act), codified at N.Y. Gen. Bus. Law § 899-aa.
The SHIELD Act requires notification to affected individuals "in the most expedient time possible and without unreasonable delay." The statute does not impose a specific numeric deadline (e.g., 30 or 60 days) but applies a reasonableness standard, consistent with other states that use an expedient/reasonable delay formulation. However, given the volume of affected New York residents and the heightened scrutiny that the New York Attorney General's office applies to data breach notifications, prompt notification is strongly advised.
Regulatory notifications under the SHIELD Act must be made to three state agencies: (1) the New York Attorney General; (2) the New York Department of State; and (3) the New York Division of State Police. These notifications must be made at the time notification is provided to affected individuals. The notification to the AG's office must include a copy of the template notification letter sent to affected New York residents, a description of the timing, content, and distribution of the notification, and the approximate number of affected individuals.
The SHIELD Act also imposes enhanced reasonable security safeguards requirements on any person or business that owns or licenses computerized data that includes private information of New York residents. While these requirements are primarily relevant to Quorum's own security posture (which is not at issue in this incident), they may inform the AG's assessment of whether Quorum exercised reasonable oversight of its vendor, Palomar.
Calderwood & Harkness has identified AAG Mark Petrosian of the Bureau of Internet and Technology within the New York Attorney General's office as the appropriate contact for the notification filing. We recommend that the New York AG notification be filed on or about August 16, 2023, concurrent with the California AG notification.
3. California. California has the third-largest affected population at 38,206 individuals. California's breach notification statute is codified at Cal. Civ. Code § 1798.82.
Because more than 500 California residents are affected by this breach, Quorum is required to notify the California Attorney General in addition to affected individuals. The AG notification must include a sample copy of the notification letter sent to affected California residents. The California AG's office maintains an online submission portal for breach notifications, and the filing must be made electronically through this portal.
California's statute imposes specific format requirements for the consumer notification letter. The notification must be titled "Notice of Data Breach" and must include the following content in a prescribed order: (1) the name and contact information of the notifying entity; (2) a list of the types of personal information that were or are reasonably believed to have been subject to the breach; (3) the date, estimated date, or date range of the breach, if known; (4) a description of the breach in general terms; (5) the toll-free telephone numbers and addresses of the major credit reporting agencies, if the breach involved a Social Security number or driver's license number; (6) whether notification was delayed due to a law enforcement investigation, if applicable; and (7) a description of what the entity has done to protect individuals whose information was breached.
Additionally, the California Confidentiality of Medical Information Act ("CMIA") (Cal. Civ. Code § 56 et seq.) may impose additional requirements for the subset of California residents whose protected health information was compromised. The CMIA applies to providers of health care, health care service plans, pharmaceutical companies, and contractors (including their subcontractors and agents) that maintain medical information. Calderwood & Harkness is analyzing the applicability of the CMIA to Quorum's relationship with Palomar with respect to the PHI subset and will address this issue in the supplemental Notification Trigger Analysis Memorandum.
4. Texas. Texas has the fourth-largest affected population at 29,477 individuals. Texas's breach notification statute requires notification to affected individuals "as quickly as possible" and also requires notification to the Texas Attorney General if more than 250 Texas residents are affected by a single breach. Given that 29,477 Texas residents are affected, the AG notification obligation is clearly triggered. The Texas AG notification must be made no later than 60 days after the date the breach was discovered and must include a detailed description of the nature and circumstances of the breach. The Texas AG's office maintains an online filing portal for breach notifications, and Calderwood & Harkness will prepare the filing for submission during the August 17–25 filing window.
5. Florida. Florida has the fifth-largest affected population at 22,913 individuals. Florida's Information Protection Act of 2014 (Fla. Stat. § 501.171) imposes one of the more aggressive notification deadlines in the country, requiring notification to affected individuals within 30 days of the determination that a breach has occurred, or within 30 days of the date the entity reasonably should have known of the breach, whichever is earlier. Notification to the Florida Department of Legal Affairs is required if more than 500 Florida residents are affected, and the notification must be made "as expeditiously as practicable" but no later than 30 days. Given the 30-day deadline, Florida's timeline is among the strictest that Quorum will face. However, based on the proposed notification timeline set forth in Section III.C below, Quorum expects to satisfy the Florida deadline. Calderwood & Harkness will monitor the timeline closely to ensure compliance.
6. Additional States with Large Affected Populations
The following states also have significant affected populations and warrant particular attention in the notification planning process:
Pennsylvania (18,640 affected residents). Pennsylvania's breach notification statute (73 Pa. Stat. § 2303) requires notification to affected individuals "without unreasonable delay." The statute also requires notification to the Pennsylvania Attorney General if more than 1,000 Pennsylvania residents are affected, and notification to the applicable credit reporting agencies. The AG notification must include a description of the breach, the number of affected Pennsylvania residents, and a copy of the notification letter.
Illinois (16,502 affected residents). Illinois's Personal Information Protection Act (815 ILCS 530/10) requires notification to affected individuals "in the most expedient time possible and without unreasonable delay," but no later than in accordance with the legitimate needs of law enforcement, consistent with any measures necessary to determine the scope of the breach and restore the integrity of the data system. Notification to the Illinois Attorney General is required if more than 500 Illinois residents are affected. The notification must include a description of the breach, the number of affected residents, remedial actions taken, and contact information for the entity.
New Jersey (14,388 affected residents). New Jersey's breach notification statute (N.J. Stat. § 56:8-163) requires notification to affected individuals "in the most expedient time possible and without unreasonable delay." Notification to the New Jersey Division of State Police is required before notification is given to affected individuals, and notification to the New Jersey Division of Consumer Affairs is also required.
Ohio (11,743 affected residents). Ohio's breach notification statute (Ohio Rev. Code § 1349.19) requires notification to affected individuals "in the most expedient time possible" but no later than 45 days after discovery or notification of the breach. Notification to the Ohio Attorney General is required if more than 1,000 Ohio residents are affected.
Massachusetts (10,217 affected residents). Massachusetts has among the most prescriptive breach notification requirements in the country, governed by Mass. Gen. Laws ch. 93H, § 3, and implementing regulations at 201 CMR 17.00. The statute requires notification to affected individuals, the Massachusetts Attorney General, and the Massachusetts Office of Consumer Affairs and Business Regulation. The notification letter must comply with specific content and format requirements set forth in the regulations, including a statement of the right to obtain a police report, a statement describing the individual's right to request a security freeze, and specified contact information for the Federal Trade Commission and the Massachusetts AG's office. Massachusetts does not impose a specific numeric deadline but requires notification "as soon as practicable and without unreasonable delay."
Remaining 19 States and the District of Columbia (56,216 combined affected residents). The remaining jurisdictions have smaller affected populations, but each has its own notification requirements that must be individually analyzed and satisfied. Calderwood & Harkness will address each of these jurisdictions in the State-by-State Notification Timeline & Content Requirements Matrix. Most of these jurisdictions follow the general pattern of requiring notification to affected individuals within a reasonable timeframe and notification to the state attorney general when the number of affected residents exceeds a specified threshold.
C. Recommended Notification Timeline
Based on the analysis of applicable state statutes and HIPAA requirements, Calderwood & Harkness recommends the following notification timeline:
All filings and mailings must be completed within the applicable statutory deadlines. The strictest applicable deadline is Florida's 30-day requirement under Fla. Stat. § 501.171. Based on the proposed timeline, with regulatory filings commencing August 14 and consumer mailings commencing no later than August 18, all deadlines are expected to be met. However, Calderwood & Harkness will monitor the timeline closely and will alert Quorum immediately if any slippage threatens compliance with a statutory deadline.
IV. Legal Analysis — HIPAA Breach Notification Obligations
A. Applicability
As confirmed by the Graystone Final Forensic Report, 41,203 individuals had protected health information ("PHI") compromised in the Palomar security incident. The compromised PHI includes health conditions, diagnosis codes, and treatment information derived from workers' compensation and health-related claims processed by Palomar on behalf of Quorum. This information constitutes "individually identifiable health information" as defined under 45 C.F.R. § 160.103, and its unauthorized acquisition or disclosure triggers the HIPAA Breach Notification Rule.
Quorum, in its capacity as a health plan and/or as a covered entity or business associate under HIPAA (or, in the alternative, as the entity that controlled and was responsible for the PHI through its vendor relationship with Palomar), has obligations under the HIPAA Breach Notification Rule (45 C.F.R. §§ 164.400–414). Palomar, as a business associate of Quorum, is also subject to HIPAA obligations, and the MSA's Business Associate Addendum (incorporated as Exhibit F) governs the allocation of breach notification responsibilities between Quorum and Palomar. Under the BAA, Palomar was obligated to notify Quorum of a breach of PHI, and Quorum retains the obligation to provide notification to affected individuals, HHS-OCR, and the media.
The PHI at issue was unsecured at the time of exfiltration — that is, it was not encrypted, destroyed, or otherwise rendered unusable, unreadable, or indecipherable to unauthorized persons, as those terms are defined in the HHS Guidance Specifying the Technologies and Methodologies that Render PHI Unusable, Unreadable, or Indecipherable to Unauthorized Individuals (74 Fed. Reg. 42,740 (Aug. 24, 2009)). Graystone's forensic analysis confirmed that the data files containing PHI were stored in unencrypted, structured database format within Palomar's claims processing environment. Because the PHI was unsecured at the time of the breach, the safe harbor exception to the HIPAA Breach Notification Rule does not apply, and full notification under 45 C.F.R. §§ 164.404–408 is required.
B. Notification Requirements
The HIPAA Breach Notification Rule imposes three distinct notification obligations in connection with this incident:
Notification to the HHS Office for Civil Rights. Under 45 C.F.R. § 164.408, a covered entity must notify the Secretary of HHS of a breach of unsecured PHI. Because the breach affects more than 500 individuals, this is classified as a "large breach" under HIPAA, and notification to HHS-OCR must be made within 60 days of the date the breach was discovered. For large breaches, the notification must be submitted contemporaneously with the notification to affected individuals, and HHS will post the breach on the publicly accessible HHS Breach Portal (commonly referred to as the "Wall of Shame"). The notification to HHS-OCR must include, at a minimum: a description of the breach, including the types of unsecured PHI involved; a description of the types of individuals affected; the number of individuals affected; a description of what the entity is doing in response; and contact procedures for affected individuals. HHS-OCR Region I (Boston) has jurisdiction over Connecticut-based covered entities. Calderwood & Harkness recommends filing the HHS-OCR notification on or about August 15, 2023.
Notification to Affected Individuals. Under 45 C.F.R. § 164.404, a covered entity must notify each individual whose unsecured PHI has been, or is reasonably believed to have been, accessed, acquired, used, or disclosed as a result of a breach, within 60 days of the date the breach was discovered. The notification must be provided in writing by first-class mail (or, if the individual has agreed, by email). The notification letters must include all elements specified in 45 C.F.R. § 164.404(c), which are:
(1) A brief description of what happened, including the date of the breach and the date of discovery, if known;
(2) A description of the types of unsecured PHI that were involved in the breach (e.g., health conditions, diagnosis codes, treatment information);
(3) Any steps individuals should take to protect themselves from potential harm resulting from the breach;
(4) A brief description of what the covered entity is doing to investigate the breach, mitigate harm to individuals, and protect against further breaches; and
(5) Contact procedures for individuals to ask questions or learn additional information, which must include a toll-free telephone number, an email address, a website, or a postal address.
The PHI-specific notification letters must be drafted in compliance with these requirements and must be written in plain language. Calderwood & Harkness, in coordination with Clearfield Notification Services LLC, will prepare the HIPAA-compliant notification letter version as described in Section IV.C below.
Media Notice. Under 45 C.F.R. § 164.406, if a breach of unsecured PHI affects more than 500 residents of a state or jurisdiction, the covered entity must provide notice to prominent media outlets serving that state or jurisdiction. Because the PHI subset of 41,203 individuals is distributed across multiple states, and because it is likely that more than 500 PHI-affected individuals reside in one or more individual states (particularly Connecticut, New York, and California, given the overall population distribution), Calderwood & Harkness will analyze the state-by-state distribution of the PHI-affected individuals to determine the specific states in which the media notice obligation is triggered. The media notice must be provided within 60 days of discovery, contemporaneous with individual notification. Calderwood & Harkness will coordinate with BrightPath Consulting Group (Meredith Ashford, engagement lead) on the preparation and distribution of the media notice, including identification of appropriate media outlets in each applicable state.
C. PHI-Specific Notification Letter
Calderwood & Harkness will prepare a separate, HIPAA-compliant consumer notification letter version specifically for the 41,203 individuals whose PHI was compromised. This PHI-specific letter will incorporate all elements required by 45 C.F.R. § 164.404(c), as outlined above, and will be tailored to address the specific nature of the PHI involved (health conditions, diagnosis codes, and treatment information from workers' compensation and health-related claims). The PHI letter will be in addition to the general PII notification letter and will be sent to the PHI-affected subset in lieu of (not in addition to) the general PII letter, to avoid duplicative notifications to the same individuals.
The PHI-specific letter will include enhanced guidance regarding steps individuals can take to protect themselves in light of the compromise of health information, including guidance on monitoring explanation of benefits statements, contacting health plans and providers to review records for unauthorized activity, and filing complaints with HHS-OCR if individuals believe their privacy rights have been violated.
V. Legal Analysis — Vendor Indemnification Posture Against Palomar Data Solutions
A. Contractual Framework
The relationship between Quorum Insurance Holdings Corp. and Palomar Data Solutions, Inc. is governed by a Master Services Agreement ("MSA") executed November 12, 2019, with a five-year term expiring November 11, 2024. Under the MSA, Palomar provides claims processing, data management, and related services to Quorum, including the intake, processing, and storage of Quorum policyholder and claimant data. The MSA has been amended twice:
Amendment 1 (executed March 3, 2021): Added processing of data associated with the QuorumEdge digital platform, Quorum's direct-to-consumer personal lines offering. Amendment 1 increased the annual contract value ("ACV") by $2.1 million, from $14.2 million to $16.3 million, effective April 1, 2021. This amendment expanded the scope and volume of Quorum data processed by Palomar, which is directly relevant to the scope of the current incident.
Amendment 2 (executed September 15, 2022): Updated the Data Security Exhibit (Exhibit D) to incorporate enhanced security requirements, including a specific obligation to patch critical vulnerabilities within 30 days of vendor patch release. Amendment 2 also added a requirement for Palomar to undergo an annual SOC 2 Type II audit by an independent auditor (the current auditor is Kessler, Park & Associates CPA, PLLC) and updated the minimum cyber liability insurance coverage requirements in Exhibit E.
The current annual contract value under the MSA, as amended, is $16,300,000. Quorum is Palomar's second-largest client by revenue, accounting for approximately $14.2 million at the original ACV (prior to Amendment 1) and $16.3 million at the current ACV. The significance of the commercial relationship and the volume of Quorum data entrusted to Palomar underscore the severity of Palomar's security failures and the reasonableness of Quorum's indemnification expectations.
B. Palomar's Contractual Breaches
1. Failure to Patch Critical Vulnerabilities (Exhibit D Violation)
Exhibit D (Data Security), as amended by Amendment 2 (September 15, 2022), sets forth Palomar's obligations regarding the maintenance of its information security program. Among the requirements in Exhibit D is the following provision:
"Service Provider shall apply security patches and updates for critical and high-severity vulnerabilities to all systems used to process, store, or transmit Client Data within thirty (30) calendar days of the patch or update being made available by the applicable software or hardware vendor."
The security patch for CVE-2023-0669, the remote code execution vulnerability in the GoAnywhere MFT appliance, was made available by the appliance vendor prior to March 14, 2023. Graystone's forensic analysis confirmed that Palomar had not applied the patch as of March 14, 2023, when the threat actor exploited the vulnerability to gain initial access to Palomar's environment. The GoAnywhere MFT appliance was a system used by Palomar to process and transmit Quorum data, and CVE-2023-0669 was classified as a critical vulnerability. Accordingly, Palomar was required to apply the patch within 30 days of its release, which it failed to do.
This failure constitutes a clear and material breach of Palomar's obligations under Exhibit D. The breach is not a matter of dispute or interpretation — the patch was available, Palomar was contractually obligated to apply it within 30 days, and Palomar failed to do so. Moreover, this failure was the direct and proximate cause of the entire security incident. Had Palomar applied the patch as required, the threat actor would not have been able to exploit CVE-2023-0669, and the unauthorized access, lateral movement, data staging, and data exfiltration that followed would not have occurred.
2. Late Breach Notification (Section 9.4 Violation)
Section 9.4 (Security Incident Notification) of the MSA provides:
"Service Provider shall notify Client in writing within forty-eight (48) hours of discovering any Security Incident that affects or is reasonably likely to affect Client Data. Such notification shall include all known details regarding the nature and scope of the Security Incident, the data affected, and the remedial measures taken or planned."
As established by the timeline set forth in the Graystone Report, Palomar discovered the anomalous network activity constituting the security incident on April 18, 2023. The 48-hour notification deadline under Section 9.4 therefore expired on or about April 20, 2023. Palomar's notification to Quorum was sent on April 21, 2023 — approximately 72 hours after discovery, which is approximately 24 hours past the contractual 48-hour deadline.
While the delay is relatively short in absolute terms, it constitutes a breach of the notification obligation under Section 9.4. This breach is significant for several reasons. First, the 48-hour notification provision was specifically negotiated as part of the MSA to ensure that Quorum would have the earliest possible opportunity to begin its own incident response activities, including engaging outside counsel and forensic investigators, assessing legal obligations, and activating its cyber-insurance coverage. Second, the 24-hour delay, while modest, potentially impacted Quorum's ability to commence certain response activities sooner. Third, Palomar's initial notification email on April 21 was notably sparse in detail, describing the event merely as a "potential security event" without providing the detailed information regarding nature, scope, affected data, and remedial measures that Section 9.4 requires. This compounded the impact of the delay by limiting Quorum's ability to make informed response decisions upon receipt of the notification.
C. Indemnification Provisions
The MSA contains robust indemnification provisions in favor of Quorum. Section 12.2 (Service Provider Indemnification) provides:
"Service Provider shall indemnify, defend, and hold harmless Client and its affiliates, officers, directors, employees, agents, successors, and assigns from and against any and all losses, damages, liabilities, costs, and expenses (including reasonable attorneys' fees and costs of investigation) arising out of or relating to (i) any breach by Service Provider of its obligations under this Agreement, including without limitation the Data Security obligations set forth in Exhibit D; (ii) any unauthorized access to, use of, or disclosure of Client Data in the possession or control of Service Provider or its subcontractors; or (iii) any violation of applicable law by Service Provider in connection with its processing of Client Data."
The indemnification obligation is subject to a liability cap set forth in Section 13.1 of the MSA, which limits Palomar's aggregate liability under the Agreement (excluding indemnification for intellectual property infringement, willful misconduct, and confidentiality breaches) to two times (2×) the trailing twelve-month fees paid by Quorum to Palomar. Based on the current ACV of $16,300,000, the applicable liability cap is:
$16,300,000 × 2 = $32,600,000
Given the clear breach of Exhibit D (patching obligation) and Section 9.4 (notification timing), Quorum has a strong basis for an indemnification demand against Palomar under Section 12.2. The causal nexus between Palomar's Exhibit D breach (failure to patch) and the entirety of the security incident is direct and well-supported by the forensic evidence. The incident response costs for which Quorum will seek indemnification include forensic investigation costs, legal fees, consumer notification costs, credit monitoring costs, crisis communications costs, regulatory compliance costs, and related expenses.
Calderwood & Harkness's current estimate of total incident response costs is in the range of $7–9 million (subsequently confirmed at $8,230,250 based on actual and projected costs through completion). The following table summarizes the major cost categories:
The total estimated cost of $8,230,250 is well within the $32.6 million indemnification cap under Section 13.1. Even if actual costs ultimately exceed current estimates, significant headroom remains within the cap. Calderwood & Harkness is confident that Quorum's indemnification demand is well-supported both factually and contractually.
D. Recommended Next Steps — Vendor Accountability
Calderwood & Harkness recommends the following actions to preserve and advance Quorum's indemnification rights against Palomar:
Formal Demand Letter. Calderwood & Harkness recommends issuing a formal breach of contract and indemnification demand letter to Palomar's outside counsel, Catherine Langford at Mercer, Haight & Dunlop LLP (2100 Ross Avenue, Suite 3600, Dallas, TX 75201). Ms. Langford has been representing Palomar in connection with the incident since mid-May 2023 and has been Calderwood & Harkness's primary point of contact for Palomar-related communications. The demand letter should:
(a) Assert both the Exhibit D patching breach and the Section 9.4 notification breach as independent bases for liability;
(b) Seek full indemnification for all incident response costs incurred and to be incurred by Quorum under MSA Section 12.2;
(c) Reserve all additional rights and remedies available to Quorum under the MSA and applicable law, including termination for cause; and
(d) Request a response within 30 days.
Termination for Cause Evaluation. In addition to the indemnification demand, Quorum should consider whether to exercise its termination for cause rights under Section 14.2 of the MSA, which permits either party to terminate the Agreement upon 30 days' written notice if the other party has committed a material breach that remains uncured after the 30-day cure period. Palomar's failure to patch CVE-2023-0669 in violation of Exhibit D constitutes a material breach, and the resulting security incident is, by its nature, incurable (the data has already been exfiltrated and the harm has occurred). However, the decision to terminate must be weighed against the business implications of transitioning Quorum's claims processing operations from Palomar to an alternative provider during the remaining approximately 16 months of the MSA term (through November 11, 2024). Quorum should evaluate the availability of alternative vendors, the cost and timeline of a transition, and the operational risks associated with a mid-contract migration.
Calderwood & Harkness recommends that Quorum preserve its termination rights by providing the requisite notice of material breach, while simultaneously evaluating the business case for termination versus renegotiation of the existing relationship. In the alternative, Quorum may choose to negotiate enhanced security provisions with Palomar — including more frequent vulnerability scanning, accelerated patching timelines, additional audit rights, and increased insurance minimums — as a condition of continuing the relationship through the remaining MSA term.
E. Insurance Requirements Compliance (Exhibit E)
Exhibit E (Insurance Requirements) of the MSA, as updated by Amendment 2, requires Palomar to maintain minimum $10 million in cyber liability insurance coverage for the duration of the MSA term. This insurance is intended to backstop Palomar's indemnification obligations and to provide an additional source of recovery for Quorum in the event of a security incident caused by Palomar's acts or omissions.
Calderwood & Harkness recommends that Quorum request confirmation of Palomar's current cyber liability insurance coverage and obtain current certificates of insurance from Palomar, as permitted under Exhibit E. Palomar's insurance may be a source of recovery for Quorum's indemnification claim, either through a direct claim by Palomar's insurer in response to Palomar's tender of the indemnification demand, or through assignment or subrogation. Understanding the status and limits of Palomar's coverage will be important for evaluating the likelihood and timeline of recovery.
VI. Legal Analysis — Cyber-Insurance Coverage Considerations
A. Coverage Tower Summary
Quorum maintains a cyber-insurance program consisting of a primary layer and an excess layer, structured as follows:
The claim arising from the Palomar security incident was filed with Atlas Mutual Insurance Company on May 8, 2023, and assigned Claim No. CYB-CLM-2023-05892. The claim was filed through Quorum's insurance broker, Sandra Whitmore-Kim of Whitmore Risk Advisors Inc. The assigned claims adjuster at Atlas Mutual is Paul Enriquez, and the designated claims contact at Pinnacle Surplus Lines is Lisa Garner.
The Pinnacle excess policy is written on a follow-form basis, meaning it incorporates the terms, conditions, definitions, and exclusions of the Atlas primary policy, subject to any specific modifications set forth in the Pinnacle policy endorsements.
B. Covered Cost Categories
Based on a preliminary review of the Atlas primary policy terms, the following cost categories are expected to be covered under Quorum's cyber-insurance program, subject to the $2,500,000 self-insured retention and the applicable policy limits:
• First-party forensic investigation costs — Fees incurred in connection with the Graystone Forensics LLC engagement, including all investigation, analysis, and reporting costs. Calderwood & Harkness retained Graystone with Atlas's prior knowledge and consent, which is a precondition to coverage in most cyber-insurance policies. Atlas acknowledged the Graystone engagement in its May 12, 2023, coverage acknowledgment letter.
• Consumer notification costs — Costs associated with the notification process administered by Clearfield Notification Services LLC, including printing and mailing of notification letters, operation of a dedicated toll-free call center (12-week operating window), and enrollment of affected individuals in a 24-month credit monitoring and identity theft protection program.
• Crisis communications costs — Fees incurred in connection with the engagement of BrightPath Consulting Group for external communications strategy, preparation of press statements, development of website posting language, and media relations support.
• Regulatory defense costs — Calderwood & Harkness's legal fees for regulatory notification compliance, preparation and filing of regulatory notifications across all applicable jurisdictions, and defense and response to any regulatory inquiries or investigations that may arise from the incident.
• Regulatory fines and penalties — Where insurable by law, fines or penalties imposed by regulators as a result of the breach may be covered under the Atlas policy. Insurability of fines and penalties varies by jurisdiction; Calderwood & Harkness will advise Quorum on this issue if regulatory enforcement action materializes.
• Internal costs — Quorum has estimated approximately $620,000 in internal costs associated with the incident response, including IT staff time, compliance team resources, and management time dedicated to the response. Coverage of internal costs under cyber-insurance policies is typically limited and may depend on whether the policy provides coverage for "extra expense" or "business interruption" costs, and whether internal labor costs fall within those categories. Calderwood & Harkness recommends that Quorum discuss the recoverability of internal costs with Atlas (Paul Enriquez) to determine the extent to which these costs may be submitted as part of the proof of loss.
C. Current Cost Estimates and Coverage Analysis
Based on the estimated total incident response costs of approximately $8,230,250 (as detailed in the table in Section V.C above), the coverage analysis is as follows:
The $2,500,000 self-insured retention ("SIR") will be Quorum's initial financial responsibility. Quorum must satisfy the SIR before Atlas's coverage obligation attaches. The SIR is expected to be satisfied through a combination of early-stage forensic investigation costs, initial legal fees, and a portion of the notification preparation costs.
Costs exceeding the SIR and within the $15,000,000 primary limit will be covered by Atlas Mutual. Based on the current cost projection of $8,230,250, Atlas's coverage obligation is expected to be approximately $5,730,250 (i.e., $8,230,250 total costs minus $2,500,000 SIR). This amount is well within the $15,000,000 per-occurrence and aggregate limits of the Atlas primary policy.
Based on current projections, the total incident response costs are expected to remain well within the $15 million primary layer. The excess coverage from Pinnacle Surplus Lines Insurance Corp. (which attaches at $15 million and provides an additional $25 million of coverage) is unlikely to be implicated absent a significant and unanticipated escalation in costs, such as could result from regulatory enforcement action, class action litigation, or other developments not currently anticipated.
Quorum should continue to document all costs meticulously for eventual proof of loss submission to Atlas. Calderwood & Harkness recommends that Quorum maintain a dedicated cost tracking log, with supporting documentation for all invoices, payments, and internal cost allocations r