1025-00006 · Graystone Forensics LLC · Insurance Coverage

notice-of-claim-pinnacle.docx DOCUMENT Data Privacy

46 / 88 ← → ✕

Contract analysis Extract to table

PRIVILEGED & CONFIDENTIAL

CALDERWOOD & HARKNESS LLP Attorneys at Law

1700 K Street NW, Suite 900 Washington, D.C. 20006

Telephone: (202) 555-7400 Facsimile: (202) 555-7401 www.calderwoodharkness.com

May 8, 2023

Via Email and Certified Mail, Return Receipt Requested

Lisa Garner Claims Contact Pinnacle Surplus Lines Insurance Corp. One Beacon Street, Suite 1100 Boston, MA 02108

Re: Precautionary Notice of Potential Claim Under Excess Cyber-Liability Policy

Policyholder / Named Insured: Quorum Insurance Holdings Corp.

Policy Number: XS-CYB-2023-7812

Policy Period: January 1, 2023 – January 1, 2024

Excess Limit: $25,000,000 excess of $15,000,000 (Atlas Mutual Insurance Company primary layer)

Underlying Primary Policy: Atlas Mutual Insurance Company, Policy No. CYB-2023-041587, per-occurrence limit $15,000,000, aggregate limit $15,000,000, self-insured retention $2,500,000

Total Insurance Tower: $40,000,000

Primary Carrier Claim Number: CYB-CLM-2023-05892

Dear Ms. Garner:

I. Introduction and Purpose of Notice

Calderwood & Harkness LLP serves as outside counsel to Quorum Insurance Holdings Corp. ("Quorum" or the "Policyholder"), a Delaware corporation publicly traded on the Nasdaq Stock Market (ticker symbol: QIHC), with its principal executive offices located at 400 Constitution Plaza, Suite 2200, Hartford, CT 06103 (EIN: 06-4832197). We write on behalf of Quorum in connection with the above-referenced excess cyber-liability insurance policy, Policy No. XS-CYB-2023-7812 (the "Excess Policy"), issued by Pinnacle Surplus Lines Insurance Corp. ("Pinnacle") to Quorum for the policy period of January 1, 2023 through January 1, 2024.

The purpose of this letter is to provide Pinnacle with precautionary notice of a potential claim under the Excess Policy arising from a significant data security incident that has recently come to Quorum's attention. This notice is provided in accordance with the notice provisions set forth in the Excess Policy and is submitted on a precautionary basis given the early stage of the forensic investigation into the incident. As of the date of this letter, Quorum does not yet know whether the losses arising from the incident will exceed the $15,000,000 primary layer of coverage provided by Atlas Mutual Insurance Company ("Atlas Mutual") under Policy No. CYB-2023-041587 (the "Primary Policy"). Nevertheless, out of an abundance of caution and in order to preserve all of Quorum's rights under the Excess Policy, Quorum is providing this notice at the earliest practicable opportunity.

Quorum expressly reserves all rights under the Excess Policy, including without limitation all coverage rights, defenses, and claims for reimbursement, and does not waive any coverage rights by providing this notice at this time or by any statement or characterization contained herein. Nothing in this letter shall be deemed an admission or acknowledgment that any particular loss has occurred, that any particular claim is covered, or that losses will ultimately reach the Excess Policy's attachment point.

Concurrent with the delivery of this letter, a notice of claim has been filed today, May 8, 2023, with Atlas Mutual under the Primary Policy. Atlas Mutual has assigned Claim No. CYB-CLM-2023-05892 to the matter. A copy of the notice of claim letter submitted to Atlas Mutual is enclosed herewith for Pinnacle's reference and records.

II. Identification of the Policyholder

The Named Insured under the Excess Policy is Quorum Insurance Holdings Corp., the relevant details of which are set forth below:

Full Legal Name: Quorum Insurance Holdings Corp.

Entity Type: Corporation organized under the laws of the State of Delaware

Public Listing: Nasdaq Stock Market; ticker symbol: QIHC

Headquarters Address: 400 Constitution Plaza, Suite 2200, Hartford, CT 06103

Employer Identification Number (EIN): 06-4832197

Industry: Insurance (property & casualty, specialty lines, life & annuity) and financial technology (digital underwriting platform and insurtech analytics)

Annual Revenue (FY 2022): Approximately $4.82 billion

Employees: Approximately 11,400 employees across its domestic and international operations

Chief Executive Officer: Margaret D. Calloway

General Counsel: Thomas R. Whitfield

Chief Information Security Officer (CISO): David Naranjo

Chief Privacy Officer (CPO): Jennifer Liang

Quorum is a top-25 U.S. insurance holding company with operating subsidiaries licensed in all 50 states and the District of Columbia. Quorum's business encompasses personal and commercial lines insurance, specialty insurance products, and life and annuity offerings. In addition to its traditional insurance operations, Quorum operates a proprietary digital underwriting platform known as "QuorumEdge," which provides automated risk assessment, policy issuance, and data analytics services to Quorum's underwriting and distribution partners. Quorum's position as a large-scale insurance holding company, coupled with its extensive use of digital infrastructure and data-intensive operations, underscores the potential significance of the data security incident described herein.

III. Description of the Cyber-Security Incident

A. Overview. Quorum has become aware of a significant data security incident (the "Incident") originating from the systems and network environment of its third-party claims-processing vendor, Palomar Data Solutions, Inc. ("Palomar"), a Texas corporation headquartered at 7100 Greenville Avenue, Suite 450, Dallas, TX 75231. Palomar provides claims data processing, document management, and analytics services to Quorum under a Master Services Agreement dated November 12, 2019, as subsequently amended (the "MSA"). The MSA carries an annual contract value of approximately $16.3 million, making Palomar Quorum's second-largest claims processing vendor by revenue. Palomar has provided services to Quorum continuously since the inception of the MSA, and during that period has maintained access to and custody of substantial volumes of Quorum's claims data, including data pertaining to individual policyholders and claimants.

Based on information provided by Palomar and preliminary investigative findings, it appears that an unauthorized threat actor compromised Palomar's network environment and exfiltrated data files containing sensitive personal information belonging to Quorum's policyholders and claimants. The details of the Incident, to the extent presently known, are set forth below. Quorum reserves the right to supplement and amend this description as additional information becomes available from the ongoing forensic investigation.

B. Timeline of Key Events

The following timeline reflects Quorum's current understanding of the Incident based on information received from Palomar and from preliminary investigative activities. This timeline is necessarily incomplete, as the forensic investigation remains in its early stages, and Quorum anticipates that additional facts and details will emerge as the investigation progresses.

On or about March 14, 2023: A threat actor exploited a known but unpatched remote code execution vulnerability, identified as CVE-2023-0669, in Palomar's GoAnywhere MFT (Managed File Transfer) file transfer appliance. This vulnerability, which had been publicly disclosed and for which a patch had been made available by the software vendor prior to the date of exploitation, allowed the threat actor to gain initial unauthorized access to Palomar's network environment. It is Quorum's understanding, based on information provided by Palomar, that Palomar had not yet applied the available patch to its GoAnywhere MFT appliance at the time of the initial compromise.

March 14, 2023 through April 18, 2023 (approximately 35 days): During this approximately 35-day window, the threat actor engaged in lateral movement within Palomar's network, escalated privileges, and conducted data exfiltration activities. Based on preliminary information from Palomar, the threat actor is believed to have accessed and exfiltrated structured data files from Palomar's claims processing environment, including data files containing information pertaining to Quorum's policyholders and claimants.

April 18, 2023: Palomar's security operations center ("SOC") detected anomalous outbound data transfers from Palomar's network. This detection marked the identification of the Incident by Palomar and is understood to correspond to the approximate end of the data exfiltration window. Upon detection, Palomar initiated containment measures to terminate the unauthorized access.

April 21, 2023: Palomar's General Counsel, Derek Copeland, notified Quorum's General Counsel, Thomas R. Whitfield, and Quorum's CISO, David Naranjo, of the security incident via email. Mr. Copeland's notification included a preliminary summary of the Incident, an indication that Quorum data may have been affected, and a commitment by Palomar to provide further information as its own investigation progressed.

May 4, 2023: Following an internal assessment and executive briefing, Quorum engaged Calderwood & Harkness LLP to serve as outside counsel for purposes of managing the incident response, including overseeing the forensic investigation, coordinating breach notification compliance, advising on regulatory obligations, and managing insurance claims and vendor accountability matters.

May 5, 2023: At the direction of Calderwood & Harkness LLP, and under the umbrella of the attorney-client privilege and the work product doctrine, Quorum retained Graystone Forensics LLC ("Graystone"), a cybersecurity incident response firm headquartered at 1950 Old Gallows Road, Suite 600, Tysons Corner, VA 22182, to conduct a comprehensive forensic investigation of the Incident. Graystone's engagement encompasses digital forensics, incident response, threat intelligence, and data mining and analysis to determine the nature, scope, and impact of the Incident on Quorum and its data. The Graystone engagement is structured as a privileged investigation conducted at the direction of outside counsel.

May 8, 2023 (today): Notice of claim filed with Atlas Mutual under the Primary Policy and precautionary notice of potential claim filed with Pinnacle under the Excess Policy (this letter).

The forensic investigation by Graystone is ongoing. A preliminary findings report from Graystone is anticipated by early June 2023, at which time Quorum expects to have a materially clearer picture of the scope and impact of the Incident. Quorum will provide Pinnacle with supplemental information as appropriate following receipt of the preliminary findings report and at other points as the investigation progresses.

C. Anticipated Scope of Compromised Data

While the forensic investigation is in its early stages and the full scope of the data compromise has not yet been determined, preliminary information provided by Palomar indicates that the Incident may have resulted in the exfiltration of structured data files from Palomar's claims processing environment. These data files are believed to contain personally identifiable information ("PII"), financial information, and potentially protected health information ("PHI") belonging to Quorum's policyholders and claimants.

The total number of individuals whose data may have been affected has not yet been determined. However, based on the volume and nature of data maintained by Palomar on behalf of Quorum, the scope of the affected population is anticipated to be substantial, potentially spanning policyholders and claimants across multiple states and jurisdictions. A definitive determination of the number of affected individuals and the specific categories of data compromised will be a central objective of the ongoing Graystone forensic investigation.

Based on preliminary information, the categories of data potentially compromised in the Incident include, but may not be limited to, the following:

• Full names of policyholders and claimants

• Dates of birth

• Social Security numbers

• Driver's license numbers and state identification numbers

• Bank account numbers and related financial account information

• Payment card numbers (credit and debit card numbers)

• Health-related information derived from workers' compensation claims and health-related insurance claims, which may constitute protected health information ("PHI") under the Health Insurance Portability and Accountability Act of 1996 ("HIPAA") and applicable state health privacy laws

The potential involvement of PHI is of particular significance, as it may trigger notification obligations under HIPAA and the Health Information Technology for Economic and Clinical Health ("HITECH") Act, in addition to the various state data breach notification statutes that are anticipated to be implicated. Quorum is working with Calderwood & Harkness LLP and Graystone to confirm whether PHI is in fact among the compromised data categories and, if so, the extent of the PHI exposure.

IV. Anticipated Categories of Loss

While it is premature to estimate total losses with precision at this stage of the investigation, Quorum anticipates incurring costs in the following categories in connection with the Incident. Quorum believes that some or all of these cost categories may constitute covered losses under the cyber-liability insurance tower, subject to the terms, conditions, definitions, and exclusions of the applicable policies. The following is provided for informational purposes and to assist Pinnacle in understanding the potential scope and nature of the claim:

1. Forensic Investigation Costs. Fees and expenses of Graystone Forensics LLC for the privileged forensic investigation, including digital forensics analysis, incident response services, threat intelligence services, data mining and review to identify affected individuals and data types, and preparation of forensic reports. These costs are being incurred at the direction of outside counsel and are expected to be substantial given the scale of the Incident and the volume of data potentially at issue.

2. Consumer Notification Costs. Costs associated with the printing, mailing, and delivery of notification letters to potentially affected individuals across multiple states, in compliance with applicable state data breach notification statutes. Given the anticipated scope of the affected population, these costs are expected to be significant and will include the preparation and customization of notification letters to comply with the specific requirements of each applicable state's breach notification law.

3. Call Center Operations. Costs associated with the establishment and operation of a dedicated call center to respond to inquiries from affected individuals following the issuance of breach notification letters. This will include staffing, training, script development, telecommunications infrastructure, and ongoing operational costs for the duration of the call center operation.

4. Credit Monitoring and Identity Theft Protection Services. Costs associated with the enrollment of affected individuals in complimentary credit monitoring and identity theft protection programs for a period to be determined based on legal requirements, regulatory expectations, and the nature of the data compromised. Given the potential compromise of Social Security numbers and financial account information, Quorum anticipates offering robust credit monitoring and identity protection services.

5. Crisis Communications and Public Relations. Fees and expenses for external crisis communications advisors retained to assist Quorum in managing press inquiries, preparing public statements, developing employee communications, and coordinating investor-facing disclosures, including any required filings with the U.S. Securities and Exchange Commission. Quorum is a publicly traded company and anticipates that the Incident may attract media attention and investor scrutiny.

6. Regulatory Notification and Defense Costs. Costs associated with the preparation and filing of regulatory notifications with state attorneys general, state insurance departments and commissioners, and federal regulators, including the U.S. Department of Health and Human Services, Office for Civil Rights ("HHS-OCR"), to the extent PHI is confirmed to be among the compromised data. This category also includes costs associated with responding to and defending any resulting regulatory inquiries, investigations, civil investigative demands, or enforcement actions that may follow the regulatory notifications.

7. Legal Fees. Fees and expenses of outside counsel, Calderwood & Harkness LLP, for incident response coordination, forensic investigation oversight, breach notification compliance analysis and implementation, regulatory defense, vendor accountability assessment, insurance coverage analysis and claims management, and related legal services. These legal fees are anticipated to be ongoing for a considerable period as the investigation, notification, and regulatory response processes unfold.

8. Internal Costs. Quorum's internal costs associated with responding to the Incident, including IT remediation and security hardening measures, employee overtime, executive and management time devoted to incident response, internal audit activities, and related operational costs. While the recoverability of internal costs will depend on the specific policy language, Quorum identifies these costs here to provide a complete picture of the anticipated financial impact.

At this early stage of the investigation and response, Quorum cannot determine with any certainty whether total losses arising from the Incident will exceed the $2,500,000 self-insured retention under the Primary Policy, the $15,000,000 per-occurrence limit of the Atlas Mutual Primary Policy, or whether the Pinnacle Excess Policy will ultimately be implicated. The potential for losses to reach or exceed the primary layer attachment point will depend on a number of factors that are not yet known, including the total number of affected individuals, the specific categories of data compromised, the jurisdictions involved, the regulatory response, and whether class action litigation or other third-party claims are initiated.

This notice is provided on a precautionary basis to preserve all of Quorum's rights under the Excess Policy, and Quorum will keep Pinnacle informed as additional information regarding the anticipated scope and magnitude of losses becomes available.

V. Underlying Primary Insurance Information

For Pinnacle's reference and records, the following is a summary of the underlying primary cyber-liability insurance coverage maintained by Quorum:

Primary Carrier: Atlas Mutual Insurance Company

Address: 120 South LaSalle Street, Suite 3200, Chicago, IL 60603

Primary Policy Number: CYB-2023-041587

Policy Period: January 1, 2023 – January 1, 2024

Per-Occurrence Limit of Liability: $15,000,000

Aggregate Limit of Liability: $15,000,000

Self-Insured Retention (SIR): $2,500,000

Assigned Claims Adjuster: Paul Enriquez

Primary Claim Number: CYB-CLM-2023-05892

A notice of claim was filed with Atlas Mutual on May 8, 2023, concurrent with the delivery of this precautionary notice to Pinnacle. A copy of the notice of claim letter submitted to Atlas Mutual is enclosed with this letter. Atlas Mutual has assigned Claim No. CYB-CLM-2023-05892 to the matter, and Paul Enriquez has been identified as the assigned claims adjuster.

It is Quorum's understanding that the Pinnacle Excess Policy, Policy No. XS-CYB-2023-7812, follows form to the Atlas Mutual Primary Policy terms and conditions, except as otherwise specifically provided in the Excess Policy. To the extent that any provisions of the Excess Policy differ from or are in addition to those of the Primary Policy, Quorum requests that Pinnacle identify any such provisions that may affect the notice, reporting, or claims process so that Quorum may ensure full compliance with the Excess Policy's requirements.

VI. Cyber Insurance Broker Information

Quorum's cyber-liability insurance program, including both the Atlas Mutual Primary Policy and the Pinnacle Excess Policy, was placed by the following broker:

Broker: Whitmore Risk Advisors Inc.

Address: 390 Park Avenue, 18th Floor, New York, NY 10022

Lead Broker: Sandra Whitmore-Kim

Whitmore Risk Advisors Inc. and Ms. Whitmore-Kim have been notified of the Incident and of Quorum's decision to file notices of claim with both Atlas Mutual and Pinnacle. Whitmore Risk Advisors is available to facilitate communications between Quorum's counsel and Pinnacle as needed.

VII. Outside Counsel and Forensic Investigator Information

The following professionals have been engaged by Quorum in connection with the Incident response and are authorized to communicate with Pinnacle on Quorum's behalf regarding this matter:

Outside Counsel:

Calderwood & Harkness LLP 1700 K Street NW, Suite 900 Washington, D.C. 20006

Responsible Partner: Kevin Ostrowski, Privacy & Data Security Practice Group Billing Partner: Rachel Bernstein, Privacy & Data Security Practice Group Lead Associate: Alan Burke, Privacy & Data Security Practice Group Working Associate: Sara Hendricks, Privacy & Data Security Practice Group

Calderwood & Harkness Matter Number: 1025-00006

Forensic Investigator (retained under attorney-client privilege):

Graystone Forensics LLC 1950 Old Gallows Road, Suite 600 Tysons Corner, VA 22182

Engagement Lead: Dr. Nolan Briggs, Managing Director, Incident Response Analyst Lead: Kendra Faulkner, Senior Forensic Analyst

Graystone Forensics LLC has been retained by Calderwood & Harkness LLP at the direction of Quorum for the purpose of providing litigation support and forensic investigation services in connection with the Incident. The engagement is structured under the attorney-client privilege and the work product doctrine. Quorum reserves all applicable privilege protections with respect to the work product generated by Graystone in connection with this engagement.

VIII. Reservation of Rights

Quorum expressly reserves all rights under the Excess Policy, including but not limited to all coverage rights, defenses, claims for reimbursement, and any other rights, remedies, or entitlements available to Quorum under the Excess Policy, at law, or in equity. Without limiting the generality of the foregoing, Quorum specifically reserves the following:

(a) The right to assert coverage for any and all losses, costs, expenses, damages, judgments, settlements, fines, penalties, and other amounts arising from or related to the Incident that may be covered under the Excess Policy;

(b) The right to supplement, amend, or modify this notice as additional information becomes available from the ongoing forensic investigation, the regulatory response process, or any third-party claims or litigation that may arise;

(c) The right to assert that this precautionary notice satisfies all notice requirements under the Excess Policy, including any requirements relating to notice of circumstances, notice of potential claims, or notice of claims;

(d) The right to assert that any delay in providing notice, to the extent any such delay is alleged, does not prejudice Quorum's coverage rights under the Excess Policy; and

(e) All other rights, remedies, and defenses available to Quorum under the Excess Policy, applicable law, or otherwise.

This notice is provided on a precautionary basis and shall not be construed as an acknowledgment or admission that losses arising from the Incident will reach the Excess Policy's attachment point of $15,000,000, or that any particular loss is covered or not covered under the Excess Policy. Nor shall this notice be construed as a waiver by Quorum of any rights, remedies, or defenses available to Quorum under the Excess Policy, at law, or in equity.

Quorum will keep Pinnacle reasonably informed of material developments in the investigation and the claim as additional information becomes available, consistent with its obligations under the Excess Policy and subject to all applicable privilege protections.

IX. Requested Acknowledgment

Quorum respectfully requests that Pinnacle acknowledge receipt of this precautionary notice of potential claim in writing. Such acknowledgment may be directed to:

Kevin Ostrowski, Partner Calderwood & Harkness LLP 1700 K Street NW, Suite 900 Washington, D.C. 20006

Email: kostrowski@calderwoodharkness.com

Telephone: (202) 555-7418

In addition, Quorum requests that Pinnacle provide the following in connection with its acknowledgment:

(a) Confirmation of the claim number or reference number assigned by Pinnacle to this precautionary notice under the Excess Policy;

(b) Identification of the claims contact and claims adjuster assigned by Pinnacle to handle this matter, including the contact's direct telephone number and email address; and

(c) A summary or identification of any policy-specific requirements for ongoing notice, reporting, or submission of documentation under the Excess Policy that Quorum should be aware of and comply with as the investigation and claim proceed.

Quorum wishes to ensure that it complies fully with all notice and reporting obligations under the Excess Policy and appreciates Pinnacle's cooperation in identifying any specific requirements that may apply.

X. Request for Cooperation and Communication

All communications from Pinnacle regarding this matter should be directed to Kevin Ostrowski, Partner, Calderwood & Harkness LLP, at the address and contact information set forth in Section IX above. Mr. Ostrowski and his team at Calderwood & Harkness are authorized to communicate with Pinnacle on behalf of Quorum with respect to all aspects of this claim.

Quorum will provide periodic updates to Pinnacle as the forensic investigation progresses and the scope of losses and potential liability becomes clearer. In particular, Quorum anticipates providing supplemental information following receipt of the preliminary forensic findings report from Graystone, which is expected in early June 2023, and at other material junctures in the investigation and response process.

In the event that the investigation reveals that total losses arising from the Incident are reasonably likely to approach or exceed the $15,000,000 attachment point of the Excess Policy, Quorum will promptly notify Pinnacle and work cooperatively with Pinnacle to facilitate the orderly transition of claims handling responsibilities to the excess layer. Quorum requests Pinnacle's full cooperation in the event that excess coverage is ultimately implicated, including with respect to the review and approval of reasonable and necessary costs and expenses incurred in connection with the Incident response.

XI. Closing

We appreciate Pinnacle's prompt attention to this precautionary notice of potential claim. Quorum is committed to a thorough, diligent, and timely response to the Incident and to keeping its insurance carriers, including Pinnacle, fully informed throughout the investigation and response process. We are available to discuss this matter at Pinnacle's convenience and to provide any additional information that Pinnacle may require in order to evaluate this notice and prepare for the potential involvement of the Excess Policy.

Should you have any questions, require additional documentation, or wish to schedule a call to discuss this matter further, please do not hesitate to contact the undersigned at the telephone number or email address provided above.

We look forward to receiving Pinnacle's written acknowledgment of this notice at your earliest convenience.

Respectfully submitted,

CALDERWOOD & HARKNESS LLP

By: ________

Kevin Ostrowski, Partner Privacy & Data Security Practice Group Calderwood & Harkness LLP 1700 K Street NW, Suite 900 Washington, D.C. 20006 Telephone: (202) 555-7418

Email: kostrowski@calderwoodharkness.com

On behalf of Quorum Insurance Holdings Corp.

Enclosures:

1. Copy of Notice of Claim Letter to Atlas Mutual Insurance Company dated May 8, 2023 (Primary Policy No. CYB-2023-041587; Primary Claim No. CYB-CLM-2023-05892)

cc:

Thomas R. Whitfield, General Counsel, Quorum Insurance Holdings Corp. David Naranjo, Chief Information Security Officer, Quorum Insurance Holdings Corp. Jennifer Liang, Chief Privacy Officer, Quorum Insurance Holdings Corp. Sandra Whitmore-Kim, Lead Broker, Whitmore Risk Advisors Inc. Rachel Bernstein, Partner, Calderwood & Harkness LLP Paul Enriquez, Claims Adjuster, Atlas Mutual Insurance Company

PRIVILEGED & CONFIDENTIAL
CALDERWOOD & HARKNESS LLP Attorneys at Law
1700 K Street NW, Suite 900 Washington, D.C. 20006
Telephone: (202) 555-7400 Facsimile: (202) 555-7401 www.calderwoodharkness.com
May 8, 2023
Via Email and Certified Mail, Return Receipt Requested
Lisa Garner Claims Contact Pinnacle Surplus Lines Insurance Corp. One Beacon Street, Suite 1100 Boston, MA 02108
Re: Precautionary Notice of Potential Claim Under Excess Cyber-Liability Policy
Policyholder / Named Insured: Quorum Insurance Holdings Corp.
Policy Number: XS-CYB-2023-7812
Policy Period: January 1, 2023 – January 1, 2024
Excess Limit: $25,000,000 excess of $15,000,000 (Atlas Mutual Insurance Company primary layer)
Underlying Primary Policy: Atlas Mutual Insurance Company, Policy No. CYB-2023-041587, per-occurrence limit $15,000,000, aggregate limit $15,000,000, self-insured retention $2,500,000
Total Insurance Tower: $40,000,000
Primary Carrier Claim Number: CYB-CLM-2023-05892
Dear Ms. Garner:
I. Introduction and Purpose of Notice
Calderwood & Harkness LLP serves as outside counsel to Quorum Insurance Holdings Corp. ("Quorum" or the "Policyholder"), a Delaware corporation publicly traded on the Nasdaq Stock Market (ticker symbol: QIHC), with its principal executive offices located at 400 Constitution Plaza, Suite 2200, Hartford, CT 06103 (EIN: 06-4832197). We write on behalf of Quorum in connection with the above-referenced excess cyber-liability insurance policy, Policy No. XS-CYB-2023-7812 (the "Excess Policy"), issued by Pinnacle Surplus Lines Insurance Corp. ("Pinnacle") to Quorum for the policy period of January 1, 2023 through January 1, 2024.
The purpose of this letter is to provide Pinnacle with precautionary notice of a potential claim under the Excess Policy arising from a significant data security incident that has recently come to Quorum's attention. This notice is provided in accordance with the notice provisions set forth in the Excess Policy and is submitted on a precautionary basis given the early stage of the forensic investigation into the incident. As of the date of this letter, Quorum does not yet know whether the losses arising from the incident will exceed the $15,000,000 primary layer of coverage provided by Atlas Mutual Insurance Company ("Atlas Mutual") under Policy No. CYB-2023-041587 (the "Primary Policy"). Nevertheless, out of an abundance of caution and in order to preserve all of Quorum's rights under the Excess Policy, Quorum is providing this notice at the earliest practicable opportunity.
Quorum expressly reserves all rights under the Excess Policy, including without limitation all coverage rights, defenses, and claims for reimbursement, and does not waive any coverage rights by providing this notice at this time or by any statement or characterization contained herein. Nothing in this letter shall be deemed an admission or acknowledgment that any particular loss has occurred, that any particular claim is covered, or that losses will ultimately reach the Excess Policy's attachment point.
Concurrent with the delivery of this letter, a notice of claim has been filed today, May 8, 2023, with Atlas Mutual under the Primary Policy. Atlas Mutual has assigned Claim No. CYB-CLM-2023-05892 to the matter. A copy of the notice of claim letter submitted to Atlas Mutual is enclosed herewith for Pinnacle's reference and records.
II. Identification of the Policyholder
The Named Insured under the Excess Policy is Quorum Insurance Holdings Corp., the relevant details of which are set forth below:
Full Legal Name: Quorum Insurance Holdings Corp.
Entity Type: Corporation organized under the laws of the State of Delaware
Public Listing: Nasdaq Stock Market; ticker symbol: QIHC
Headquarters Address: 400 Constitution Plaza, Suite 2200, Hartford, CT 06103
Employer Identification Number (EIN): 06-4832197
Industry: Insurance (property & casualty, specialty lines, life & annuity) and financial technology (digital underwriting platform and insurtech analytics)
Annual Revenue (FY 2022): Approximately $4.82 billion
Employees: Approximately 11,400 employees across its domestic and international operations
Chief Executive Officer: Margaret D. Calloway
General Counsel: Thomas R. Whitfield
Chief Information Security Officer (CISO): David Naranjo
Chief Privacy Officer (CPO): Jennifer Liang
Quorum is a top-25 U.S. insurance holding company with operating subsidiaries licensed in all 50 states and the District of Columbia. Quorum's business encompasses personal and commercial lines insurance, specialty insurance products, and life and annuity offerings. In addition to its traditional insurance operations, Quorum operates a proprietary digital underwriting platform known as "QuorumEdge," which provides automated risk assessment, policy issuance, and data analytics services to Quorum's underwriting and distribution partners. Quorum's position as a large-scale insurance holding company, coupled with its extensive use of digital infrastructure and data-intensive operations, underscores the potential significance of the data security incident described herein.
III. Description of the Cyber-Security Incident
A. Overview. Quorum has become aware of a significant data security incident (the "Incident") originating from the systems and network environment of its third-party claims-processing vendor, Palomar Data Solutions, Inc. ("Palomar"), a Texas corporation headquartered at 7100 Greenville Avenue, Suite 450, Dallas, TX 75231. Palomar provides claims data processing, document management, and analytics services to Quorum under a Master Services Agreement dated November 12, 2019, as subsequently amended (the "MSA"). The MSA carries an annual contract value of approximately $16.3 million, making Palomar Quorum's second-largest claims processing vendor by revenue. Palomar has provided services to Quorum continuously since the inception of the MSA, and during that period has maintained access to and custody of substantial volumes of Quorum's claims data, including data pertaining to individual policyholders and claimants.
Based on information provided by Palomar and preliminary investigative findings, it appears that an unauthorized threat actor compromised Palomar's network environment and exfiltrated data files containing sensitive personal information belonging to Quorum's policyholders and claimants. The details of the Incident, to the extent presently known, are set forth below. Quorum reserves the right to supplement and amend this description as additional information becomes available from the ongoing forensic investigation.
B. Timeline of Key Events
The following timeline reflects Quorum's current understanding of the Incident based on information received from Palomar and from preliminary investigative activities. This timeline is necessarily incomplete, as the forensic investigation remains in its early stages, and Quorum anticipates that additional facts and details will emerge as the investigation progresses.
On or about March 14, 2023: A threat actor exploited a known but unpatched remote code execution vulnerability, identified as CVE-2023-0669, in Palomar's GoAnywhere MFT (Managed File Transfer) file transfer appliance. This vulnerability, which had been publicly disclosed and for which a patch had been made available by the software vendor prior to the date of exploitation, allowed the threat actor to gain initial unauthorized access to Palomar's network environment. It is Quorum's understanding, based on information provided by Palomar, that Palomar had not yet applied the available patch to its GoAnywhere MFT appliance at the time of the initial compromise.
March 14, 2023 through April 18, 2023 (approximately 35 days): During this approximately 35-day window, the threat actor engaged in lateral movement within Palomar's network, escalated privileges, and conducted data exfiltration activities. Based on preliminary information from Palomar, the threat actor is believed to have accessed and exfiltrated structured data files from Palomar's claims processing environment, including data files containing information pertaining to Quorum's policyholders and claimants.
April 18, 2023: Palomar's security operations center ("SOC") detected anomalous outbound data transfers from Palomar's network. This detection marked the identification of the Incident by Palomar and is understood to correspond to the approximate end of the data exfiltration window. Upon detection, Palomar initiated containment measures to terminate the unauthorized access.
April 21, 2023: Palomar's General Counsel, Derek Copeland, notified Quorum's General Counsel, Thomas R. Whitfield, and Quorum's CISO, David Naranjo, of the security incident via email. Mr. Copeland's notification included a preliminary summary of the Incident, an indication that Quorum data may have been affected, and a commitment by Palomar to provide further information as its own investigation progressed.
May 4, 2023: Following an internal assessment and executive briefing, Quorum engaged Calderwood & Harkness LLP to serve as outside counsel for purposes of managing the incident response, including overseeing the forensic investigation, coordinating breach notification compliance, advising on regulatory obligations, and managing insurance claims and vendor accountability matters.
May 5, 2023: At the direction of Calderwood & Harkness LLP, and under the umbrella of the attorney-client privilege and the work product doctrine, Quorum retained Graystone Forensics LLC ("Graystone"), a cybersecurity incident response firm headquartered at 1950 Old Gallows Road, Suite 600, Tysons Corner, VA 22182, to conduct a comprehensive forensic investigation of the Incident. Graystone's engagement encompasses digital forensics, incident response, threat intelligence, and data mining and analysis to determine the nature, scope, and impact of the Incident on Quorum and its data. The Graystone engagement is structured as a privileged investigation conducted at the direction of outside counsel.
May 8, 2023 (today): Notice of claim filed with Atlas Mutual under the Primary Policy and precautionary notice of potential claim filed with Pinnacle under the Excess Policy (this letter).
The forensic investigation by Graystone is ongoing. A preliminary findings report from Graystone is anticipated by early June 2023, at which time Quorum expects to have a materially clearer picture of the scope and impact of the Incident. Quorum will provide Pinnacle with supplemental information as appropriate following receipt of the preliminary findings report and at other points as the investigation progresses.
C. Anticipated Scope of Compromised Data
While the forensic investigation is in its early stages and the full scope of the data compromise has not yet been determined, preliminary information provided by Palomar indicates that the Incident may have resulted in the exfiltration of structured data files from Palomar's claims processing environment. These data files are believed to contain personally identifiable information ("PII"), financial information, and potentially protected health information ("PHI") belonging to Quorum's policyholders and claimants.
The total number of individuals whose data may have been affected has not yet been determined. However, based on the volume and nature of data maintained by Palomar on behalf of Quorum, the scope of the affected population is anticipated to be substantial, potentially spanning policyholders and claimants across multiple states and jurisdictions. A definitive determination of the number of affected individuals and the specific categories of data compromised will be a central objective of the ongoing Graystone forensic investigation.
Based on preliminary information, the categories of data potentially compromised in the Incident include, but may not be limited to, the following:
• Full names of policyholders and claimants
• Dates of birth
• Social Security numbers
• Driver's license numbers and state identification numbers
• Bank account numbers and related financial account information
• Payment card numbers (credit and debit card numbers)
• Health-related information derived from workers' compensation claims and health-related insurance claims, which may constitute protected health information ("PHI") under the Health Insurance Portability and Accountability Act of 1996 ("HIPAA") and applicable state health privacy laws
The potential involvement of PHI is of particular significance, as it may trigger notification obligations under HIPAA and the Health Information Technology for Economic and Clinical Health ("HITECH") Act, in addition to the various state data breach notification statutes that are anticipated to be implicated. Quorum is working with Calderwood & Harkness LLP and Graystone to confirm whether PHI is in fact among the compromised data categories and, if so, the extent of the PHI exposure.
IV. Anticipated Categories of Loss
While it is premature to estimate total losses with precision at this stage of the investigation, Quorum anticipates incurring costs in the following categories in connection with the Incident. Quorum believes that some or all of these cost categories may constitute covered losses under the cyber-liability insurance tower, subject to the terms, conditions, definitions, and exclusions of the applicable policies. The following is provided for informational purposes and to assist Pinnacle in understanding the potential scope and nature of the claim:
1. Forensic Investigation Costs. Fees and expenses of Graystone Forensics LLC for the privileged forensic investigation, including digital forensics analysis, incident response services, threat intelligence services, data mining and review to identify affected individuals and data types, and preparation of forensic reports. These costs are being incurred at the direction of outside counsel and are expected to be substantial given the scale of the Incident and the volume of data potentially at issue.
2. Consumer Notification Costs. Costs associated with the printing, mailing, and delivery of notification letters to potentially affected individuals across multiple states, in compliance with applicable state data breach notification statutes. Given the anticipated scope of the affected population, these costs are expected to be significant and will include the preparation and customization of notification letters to comply with the specific requirements of each applicable state's breach notification law.
3. Call Center Operations. Costs associated with the establishment and operation of a dedicated call center to respond to inquiries from affected individuals following the issuance of breach notification letters. This will include staffing, training, script development, telecommunications infrastructure, and ongoing operational costs for the duration of the call center operation.
4. Credit Monitoring and Identity Theft Protection Services. Costs associated with the enrollment of affected individuals in complimentary credit monitoring and identity theft protection programs for a period to be determined based on legal requirements, regulatory expectations, and the nature of the data compromised. Given the potential compromise of Social Security numbers and financial account information, Quorum anticipates offering robust credit monitoring and identity protection services.
5. Crisis Communications and Public Relations. Fees and expenses for external crisis communications advisors retained to assist Quorum in managing press inquiries, preparing public statements, developing employee communications, and coordinating investor-facing disclosures, including any required filings with the U.S. Securities and Exchange Commission. Quorum is a publicly traded company and anticipates that the Incident may attract media attention and investor scrutiny.
6. Regulatory Notification and Defense Costs. Costs associated with the preparation and filing of regulatory notifications with state attorneys general, state insurance departments and commissioners, and federal regulators, including the U.S. Department of Health and Human Services, Office for Civil Rights ("HHS-OCR"), to the extent PHI is confirmed to be among the compromised data. This category also includes costs associated with responding to and defending any resulting regulatory inquiries, investigations, civil investigative demands, or enforcement actions that may follow the regulatory notifications.
7. Legal Fees. Fees and expenses of outside counsel, Calderwood & Harkness LLP, for incident response coordination, forensic investigation oversight, breach notification compliance analysis and implementation, regulatory defense, vendor accountability assessment, insurance coverage analysis and claims management, and related legal services. These legal fees are anticipated to be ongoing for a considerable period as the investigation, notification, and regulatory response processes unfold.
8. Internal Costs. Quorum's internal costs associated with responding to the Incident, including IT remediation and security hardening measures, employee overtime, executive and management time devoted to incident response, internal audit activities, and related operational costs. While the recoverability of internal costs will depend on the specific policy language, Quorum identifies these costs here to provide a complete picture of the anticipated financial impact.
At this early stage of the investigation and response, Quorum cannot determine with any certainty whether total losses arising from the Incident will exceed the $2,500,000 self-insured retention under the Primary Policy, the $15,000,000 per-occurrence limit of the Atlas Mutual Primary Policy, or whether the Pinnacle Excess Policy will ultimately be implicated. The potential for losses to reach or exceed the primary layer attachment point will depend on a number of factors that are not yet known, including the total number of affected individuals, the specific categories of data compromised, the jurisdictions involved, the regulatory response, and whether class action litigation or other third-party claims are initiated.
This notice is provided on a precautionary basis to preserve all of Quorum's rights under the Excess Policy, and Quorum will keep Pinnacle informed as additional information regarding the anticipated scope and magnitude of losses becomes available.
V. Underlying Primary Insurance Information
For Pinnacle's reference and records, the following is a summary of the underlying primary cyber-liability insurance coverage maintained by Quorum:
Primary Carrier: Atlas Mutual Insurance Company
Address: 120 South LaSalle Street, Suite 3200, Chicago, IL 60603
Primary Policy Number: CYB-2023-041587
Policy Period: January 1, 2023 – January 1, 2024
Per-Occurrence Limit of Liability: $15,000,000
Aggregate Limit of Liability: $15,000,000
Self-Insured Retention (SIR): $2,500,000
Assigned Claims Adjuster: Paul Enriquez
Primary Claim Number: CYB-CLM-2023-05892
A notice of claim was filed with Atlas Mutual on May 8, 2023, concurrent with the delivery of this precautionary notice to Pinnacle. A copy of the notice of claim letter submitted to Atlas Mutual is enclosed with this letter. Atlas Mutual has assigned Claim No. CYB-CLM-2023-05892 to the matter, and Paul Enriquez has been identified as the assigned claims adjuster.
It is Quorum's understanding that the Pinnacle Excess Policy, Policy No. XS-CYB-2023-7812, follows form to the Atlas Mutual Primary Policy terms and conditions, except as otherwise specifically provided in the Excess Policy. To the extent that any provisions of the Excess Policy differ from or are in addition to those of the Primary Policy, Quorum requests that Pinnacle identify any such provisions that may affect the notice, reporting, or claims process so that Quorum may ensure full compliance with the Excess Policy's requirements.
VI. Cyber Insurance Broker Information
Quorum's cyber-liability insurance program, including both the Atlas Mutual Primary Policy and the Pinnacle Excess Policy, was placed by the following broker:
Broker: Whitmore Risk Advisors Inc.
Address: 390 Park Avenue, 18th Floor, New York, NY 10022
Lead Broker: Sandra Whitmore-Kim
Whitmore Risk Advisors Inc. and Ms. Whitmore-Kim have been notified of the Incident and of Quorum's decision to file notices of claim with both Atlas Mutual and Pinnacle. Whitmore Risk Advisors is available to facilitate communications between Quorum's counsel and Pinnacle as needed.
VII. Outside Counsel and Forensic Investigator Information
The following professionals have been engaged by Quorum in connection with the Incident response and are authorized to communicate with Pinnacle on Quorum's behalf regarding this matter:
Outside Counsel:
Calderwood & Harkness LLP 1700 K Street NW, Suite 900 Washington, D.C. 20006
Responsible Partner: Kevin Ostrowski, Privacy & Data Security Practice Group Billing Partner: Rachel Bernstein, Privacy & Data Security Practice Group Lead Associate: Alan Burke, Privacy & Data Security Practice Group Working Associate: Sara Hendricks, Privacy & Data Security Practice Group
Calderwood & Harkness Matter Number: 1025-00006
Forensic Investigator (retained under attorney-client privilege):
Graystone Forensics LLC 1950 Old Gallows Road, Suite 600 Tysons Corner, VA 22182
Engagement Lead: Dr. Nolan Briggs, Managing Director, Incident Response Analyst Lead: Kendra Faulkner, Senior Forensic Analyst
Graystone Forensics LLC has been retained by Calderwood & Harkness LLP at the direction of Quorum for the purpose of providing litigation support and forensic investigation services in connection with the Incident. The engagement is structured under the attorney-client privilege and the work product doctrine. Quorum reserves all applicable privilege protections with respect to the work product generated by Graystone in connection with this engagement.
VIII. Reservation of Rights
Quorum expressly reserves all rights under the Excess Policy, including but not limited to all coverage rights, defenses, claims for reimbursement, and any other rights, remedies, or entitlements available to Quorum under the Excess Policy, at law, or in equity. Without limiting the generality of the foregoing, Quorum specifically reserves the following:
(a) The right to assert coverage for any and all losses, costs, expenses, damages, judgments, settlements, fines, penalties, and other amounts arising from or related to the Incident that may be covered under the Excess Policy;
(b) The right to supplement, amend, or modify this notice as additional information becomes available from the ongoing forensic investigation, the regulatory response process, or any third-party claims or litigation that may arise;
(c) The right to assert that this precautionary notice satisfies all notice requirements under the Excess Policy, including any requirements relating to notice of circumstances, notice of potential claims, or notice of claims;
(d) The right to assert that any delay in providing notice, to the extent any such delay is alleged, does not prejudice Quorum's coverage rights under the Excess Policy; and
(e) All other rights, remedies, and defenses available to Quorum under the Excess Policy, applicable law, or otherwise.
This notice is provided on a precautionary basis and shall not be construed as an acknowledgment or admission that losses arising from the Incident will reach the Excess Policy's attachment point of $15,000,000, or that any particular loss is covered or not covered under the Excess Policy. Nor shall this notice be construed as a waiver by Quorum of any rights, remedies, or defenses available to Quorum under the Excess Policy, at law, or in equity.
Quorum will keep Pinnacle reasonably informed of material developments in the investigation and the claim as additional information becomes available, consistent with its obligations under the Excess Policy and subject to all applicable privilege protections.
IX. Requested Acknowledgment
Quorum respectfully requests that Pinnacle acknowledge receipt of this precautionary notice of potential claim in writing. Such acknowledgment may be directed to:
Kevin Ostrowski, Partner Calderwood & Harkness LLP 1700 K Street NW, Suite 900 Washington, D.C. 20006
Email: kostrowski@calderwoodharkness.com
Telephone: (202) 555-7418
In addition, Quorum requests that Pinnacle provide the following in connection with its acknowledgment:
(a) Confirmation of the claim number or reference number assigned by Pinnacle to this precautionary notice under the Excess Policy;
(b) Identification of the claims contact and claims adjuster assigned by Pinnacle to handle this matter, including the contact's direct telephone number and email address; and
(c) A summary or identification of any policy-specific requirements for ongoing notice, reporting, or submission of documentation under the Excess Policy that Quorum should be aware of and comply with as the investigation and claim proceed.
Quorum wishes to ensure that it complies fully with all notice and reporting obligations under the Excess Policy and appreciates Pinnacle's cooperation in identifying any specific requirements that may apply.
X. Request for Cooperation and Communication
All communications from Pinnacle regarding this matter should be directed to Kevin Ostrowski, Partner, Calderwood & Harkness LLP, at the address and contact information set forth in Section IX above. Mr. Ostrowski and his team at Calderwood & Harkness are authorized to communicate with Pinnacle on behalf of Quorum with respect to all aspects of this claim.
Quorum will provide periodic updates to Pinnacle as the forensic investigation progresses and the scope of losses and potential liability becomes clearer. In particular, Quorum anticipates providing supplemental information following receipt of the preliminary forensic findings report from Graystone, which is expected in early June 2023, and at other material junctures in the investigation and response process.
In the event that the investigation reveals that total losses arising from the Incident are reasonably likely to approach or exceed the $15,000,000 attachment point of the Excess Policy, Quorum will promptly notify Pinnacle and work cooperatively with Pinnacle to facilitate the orderly transition of claims handling responsibilities to the excess layer. Quorum requests Pinnacle's full cooperation in the event that excess coverage is ultimately implicated, including with respect to the review and approval of reasonable and necessary costs and expenses incurred in connection with the Incident response.
XI. Closing
We appreciate Pinnacle's prompt attention to this precautionary notice of potential claim. Quorum is committed to a thorough, diligent, and timely response to the Incident and to keeping its insurance carriers, including Pinnacle, fully informed throughout the investigation and response process. We are available to discuss this matter at Pinnacle's convenience and to provide any additional information that Pinnacle may require in order to evaluate this notice and prepare for the potential involvement of the Excess Policy.
Should you have any questions, require additional documentation, or wish to schedule a call to discuss this matter further, please do not hesitate to contact the undersigned at the telephone number or email address provided above.
We look forward to receiving Pinnacle's written acknowledgment of this notice at your earliest convenience.
Respectfully submitted,
CALDERWOOD & HARKNESS LLP
By: ________
Kevin Ostrowski, Partner Privacy & Data Security Practice Group Calderwood & Harkness LLP 1700 K Street NW, Suite 900 Washington, D.C. 20006 Telephone: (202) 555-7418
Email: kostrowski@calderwoodharkness.com
On behalf of Quorum Insurance Holdings Corp.
Enclosures:
1. Copy of Notice of Claim Letter to Atlas Mutual Insurance Company dated May 8, 2023 (Primary Policy No. CYB-2023-041587; Primary Claim No. CYB-CLM-2023-05892)
cc:
Thomas R. Whitfield, General Counsel, Quorum Insurance Holdings Corp. David Naranjo, Chief Information Security Officer, Quorum Insurance Holdings Corp. Jennifer Liang, Chief Privacy Officer, Quorum Insurance Holdings Corp. Sandra Whitmore-Kim, Lead Broker, Whitmore Risk Advisors Inc. Rachel Bernstein, Partner, Calderwood & Harkness LLP Paul Enriquez, Claims Adjuster, Atlas Mutual Insurance Company

PRIVILEGED & CONFIDENTIAL

CALDERWOOD & HARKNESS LLP

Record

Parties

Dates

Amounts