1025-00006 · Graystone Forensics LLC · Notification Obligation Analysis

ct-insurance-data-security-law-memo.docx DOCUMENT Data Privacy

50 / 88 ← → ✕

PRIVILEGED & CONFIDENTIAL ATTORNEY-CLIENT COMMUNICATION ATTORNEY WORK PRODUCT

This memorandum constitutes a privileged and confidential attorney-client communication and attorney work product. It has been prepared at the direction of counsel for the sole purpose of providing legal advice to Quorum Insurance Holdings Corp. in connection with the matters described herein. This memorandum is protected from disclosure by the attorney-client privilege, the work product doctrine, and all other applicable privileges and protections. This memorandum, and the information contained herein, may not be disclosed, disseminated, distributed, or copied, in whole or in part, to any third party without the prior written consent of Calderwood & Harkness LLP. Any inadvertent disclosure of this memorandum does not constitute a waiver of any applicable privilege or protection.

MEMORANDUM

FROM: Alan Burke, Lead Associate, Privacy & Data Security Calderwood & Harkness LLP 1700 K Street NW, Suite 900 Washington, D.C. 20006

TO: Thomas R. Whitfield, General Counsel Quorum Insurance Holdings Corp. 400 Constitution Plaza, Suite 2200 Hartford, CT 06103

DATE: July 22, 2023

RE: Analysis of Quorum Insurance Holdings Corp. Notification Obligations Under the Connecticut Insurance Data Security Law (Conn. Gen. Stat. § 38a-999b) — Palomar Data Solutions Security Incident

MATTER NO.: 1025-00006

I. Executive Summary

This memorandum analyzes the notification obligations of Quorum Insurance Holdings Corp. ("Quorum" or the "Company") to the Connecticut Insurance Department under the Connecticut Insurance Data Security Law, Conn. Gen. Stat. § 38a-999b et seq., in connection with the vendor-originated data breach that occurred at the systems of Palomar Data Solutions, Inc. ("Palomar"), a third-party claims-processing vendor retained by Quorum. This analysis has been prepared at the request of Thomas R. Whitfield, General Counsel of Quorum, in anticipation of Quorum's forthcoming regulatory notification filings.

Based on our review of the applicable statutory provisions, the factual record developed through the forensic investigation conducted by Graystone Forensics LLC under the direction of this firm, and the relevant regulatory guidance issued by the Connecticut Insurance Department, we reach the following principal conclusions:

First, Quorum is required to notify the Connecticut Insurance Department of the security incident as a "cybersecurity event" within the meaning of Conn. Gen. Stat. § 38a-999b. Quorum, as a registered insurance holding company domiciled in Connecticut with operating subsidiaries licensed to conduct the business of insurance in Connecticut, is unambiguously a "licensee" subject to the statute's requirements. The breach at Palomar involved the unauthorized access to and exfiltration of "nonpublic information" — including Social Security numbers, dates of birth, driver's license numbers, financial account numbers, and protected health information — belonging to Quorum's policyholders, claimants, and other consumers. Although the breach occurred on Palomar's systems, the statute places the notification obligation on Quorum as the licensee whose customers' nonpublic information was compromised.

Second, the notification must be made to the Commissioner of Insurance as promptly as possible but no later than seventy-two (72) hours after a "determination" that a cybersecurity event has occurred. As discussed in detail in Section IV.B below, we recommend treating August 4, 2023 — the date on which data mining and affected-individual identification was completed — as the operative "determination" date. Under this analysis, Quorum's planned filing on August 14, 2023, falls well within the 72-hour window. Even under a more conservative interpretation that treats the July 14, 2023 Graystone final forensic report as the outer boundary for when a "determination" could reasonably have been made, the August 14 filing date is supportable on the grounds that "determination" requires the identification of specific affected individuals and the types of data compromised — information that was not available until the data mining process was completed on August 4, 2023.

Third, the incident is significant in scope. The forensic investigation confirmed that a total of 318,247 individuals across 29 states and the District of Columbia were affected by the breach. Of that total, 52,114 are Connecticut residents — the single largest state-level cohort among the affected population. This Connecticut-specific exposure underscores the importance of timely and complete notification to the Connecticut Insurance Department.

Fourth, we recommend that Quorum file its notification with the Connecticut Insurance Department on August 14, 2023, concurrent with the notification to the Connecticut Attorney General under the state's general breach notification statute, Conn. Gen. Stat. § 36a-701b. Filing both notifications on the same date ensures coordinated regulatory engagement and avoids any inference of delay. Calderwood & Harkness will prepare the draft notification filing for review by Thomas R. Whitfield and Chief Privacy Officer Jennifer Liang in advance of the filing date.

This memorandum addresses only the Connecticut Insurance Data Security Law notification obligation. Other notification obligations — including but not limited to the Connecticut Attorney General notification, HIPAA breach notification to HHS-OCR, notifications under the breach notification statutes of the other 28 affected states and the District of Columbia, and SEC disclosure obligations — are addressed in separate analyses referenced herein.

II. Background — The Security Incident

A. Factual Summary

On or about March 14, 2023, a threat actor exploited CVE-2023-0669, a remote code execution vulnerability in the Vireo Health IT (Managed File Transfer) file transfer appliance, to gain unauthorized access to the network environment of Palomar Data Solutions, Inc. ("Palomar"), Quorum's third-party claims-processing vendor. Palomar is headquartered at 7100 Greenville Avenue, Suite 450, Dallas, Texas 75231. CVE-2023-0669 is a pre-authentication deserialization vulnerability that was publicly disclosed and actively exploited in the wild beginning in late January 2023. The Cybersecurity and Infrastructure Security Agency ("CISA") added CVE-2023-0669 to its Known Exploited Vulnerabilities Catalog on February 10, 2023, and Severin Corporation issued a patch on February 7, 2023. The forensic evidence indicates that Palomar had not applied the available patch to its GoAnywhere MFT instance as of the date of the intrusion on March 14, 2023 — a delay of approximately 35 days following the patch release.

Palomar provides claims data processing services for Quorum's personal lines insurance division pursuant to a Master Services Agreement dated November 12, 2019 (the "MSA"), as amended by Amendment 1 dated March 3, 2021 (which expanded the scope of services to include workers' compensation claims processing and increased the annual contract value) and Amendment 2 dated September 15, 2022 (which updated the information security requirements in Exhibit D to the MSA, including the addition of SOC 2 Type II audit requirements). The annual contract value under the MSA, as adjusted by Amendment 1, is approximately $16.3 million. As part of its claims processing services, Palomar receives, processes, and stores structured data files containing personal information, financial information, and health-related information belonging to Quorum's policyholders, claimants, and other consumers.

The forensic evidence indicates that the threat actor maintained unauthorized access to Palomar's network environment and exfiltrated data over an approximately thirty-five (35) day period from March 14, 2023 through April 18, 2023. During this period, the threat actor accessed and exfiltrated structured data files stored on Palomar's file transfer servers, including files containing claims data processed on behalf of Quorum. The exfiltration was accomplished through the creation of unauthorized administrator accounts on the GoAnywhere MFT appliance, which were then used to download data files through the compromised file transfer platform.

On April 18, 2023, Palomar's Security Operations Center ("SOC") detected anomalous outbound data transfers from the GoAnywhere MFT environment during a routine review of network traffic logs. Palomar's SOC initiated its internal incident response procedures and, upon confirming that the anomalous transfers were indicative of unauthorized access, escalated the matter to Palomar's General Counsel, Derek Copeland.

On April 21, 2023, approximately three days after Palomar's SOC discovered the anomalous activity, Derek Copeland notified Quorum's General Counsel, Thomas R. Whitfield, and Quorum's Chief Information Security Officer, David Naranjo, of the incident via email. This notification occurred approximately 24 hours beyond the 48-hour contractual notification requirement set forth in Section 9.4 of the MSA, which requires Palomar to "notify [Quorum] in writing within forty-eight (48) hours of Palomar's discovery of any Security Incident affecting [Quorum] Data." The late notification is a matter being separately addressed in connection with Quorum's contractual remedies and vendor accountability analysis.

Copeland's April 21 notification email described the incident in general terms, indicating that Palomar had "identified unauthorized access to certain file transfer systems" and that "the scope and nature of any data potentially affected is under investigation." The notification did not identify the specific vulnerability exploited, the specific Quorum data files affected, or the number of individuals whose information may have been compromised.

B. Forensic Investigation

Following Palomar's notification, Quorum engaged Calderwood & Harkness LLP to provide legal counsel in connection with the incident. On May 4, 2023, Calderwood & Harkness was formally engaged by Quorum. On May 5, 2023, Calderwood & Harkness retained Graystone Forensics LLC ("Graystone") to conduct a forensic investigation of the incident under the direction and supervision of this firm, pursuant to the attorney-client privilege and work product doctrine. The Graystone engagement is led by Dr. Nolan Briggs, Managing Director, and Kendra Faulkner, Senior Forensic Analyst. The engagement of Graystone through Calderwood & Harkness, rather than directly by Quorum, was structured specifically to maximize the protections afforded by the attorney-client privilege and work product doctrine.

Graystone's investigation proceeded in two phases. In the first phase, Graystone analyzed the technical forensic evidence obtained from Palomar's network environment — including system logs, network traffic captures, endpoint forensic images, and file transfer audit logs — to identify the attack vector, the timeline of the intrusion, and the scope of data exfiltration. On June 2, 2023, Graystone issued its preliminary findings, which confirmed that the threat actor had exploited CVE-2023-0669 to gain initial access and had exfiltrated structured data files from the GoAnywhere MFT platform. The preliminary findings identified the general categories of exfiltrated files but did not yet quantify the number of affected individuals or the specific data elements compromised for each individual.

In the second phase, Graystone conducted a detailed data mining and analysis of the exfiltrated data files to identify the specific individuals affected and the types of personal information compromised for each individual. This data mining process — which involved parsing, de-duplicating, and cross-referencing millions of records across hundreds of data files — was time-intensive and required coordination with Palomar's data management team to obtain the complete file inventories and data dictionaries necessary to interpret the exfiltrated data.

On July 14, 2023, Graystone issued its final forensic report (the "Graystone Report"), which confirmed the full scope of compromised data. The Graystone Report's principal findings are as follows:

• Total Affected Individuals: 318,247 individuals across 29 states and the District of Columbia.

• Personally Identifiable Information (PII): All 318,247 affected individuals had the following categories of PII compromised: full legal names, dates of birth, Social Security numbers, and driver's license numbers.

• Financial Information: A subset of 84,619 individuals had financial information compromised, including bank account numbers and payment card numbers associated with premium payment and claims disbursement records.

• Protected Health Information (PHI): A subset of 41,203 individuals had protected health information compromised, including health conditions, diagnosis codes (ICD-10), and treatment information associated with workers' compensation claims and health-related personal lines claims data.

• Connecticut-Specific Exposure: 52,114 affected individuals are residents of the State of Connecticut, representing the largest single-state cohort among the total affected population. This concentration is consistent with Quorum's Connecticut domicile and the historical composition of its personal lines book of business.

The data mining process to match individual affected persons to their specific data elements and to compile state-by-state mailing lists was completed on August 4, 2023 — approximately three weeks after the issuance of the final Graystone Report. The delay between the July 14 report date and the August 4 data mining completion date reflects the complexity of parsing the exfiltrated data files, validating current mailing addresses through the National Change of Address ("NCOA") database, and compiling the state-specific notification lists required for compliance with the varying breach notification statutes across the 29 affected states and the District of Columbia.

C. Quorum's Regulatory Posture

Quorum Insurance Holdings Corp. is a Delaware corporation, publicly traded on the Nasdaq Stock Market under the ticker symbol "QIHC." The Company is headquartered at 400 Constitution Plaza, Suite 2200, Hartford, Connecticut 06103. Quorum is a registered insurance holding company with the Connecticut Insurance Department and operates through a family of wholly-owned insurance subsidiaries that are licensed to transact the business of insurance in all 50 states, the District of Columbia, and several U.S. territories.

For the fiscal year ended December 31, 2022, Quorum reported consolidated annual revenue of approximately $4.82 billion. The Company employs approximately 11,400 individuals. As of May 2023, Quorum's market capitalization was approximately $6.1 billion.

Quorum's executive leadership relevant to this matter includes the following individuals:

• Margaret D. Calloway, Chief Executive Officer

• Thomas R. Whitfield, General Counsel

• Jennifer Liang, Chief Privacy Officer

• David Naranjo, Chief Information Security Officer

• Priya Deshmukh, Vice President, Vendor Risk Management

Quorum's domiciliary regulator is the Connecticut Insurance Department, which serves as the lead state regulator for purposes of group-wide supervision of the Quorum insurance holding company system. This regulatory relationship is significant in the context of the present analysis, as it means the Connecticut Insurance Department has direct supervisory authority over Quorum and its subsidiaries and may elect to conduct a targeted examination or inquiry in connection with the cybersecurity event notification.

III. Statutory Framework — Connecticut Insurance Data Security Law

A. Overview and Legislative Purpose

The Connecticut Insurance Data Security Law, codified at Conn. Gen. Stat. § 38a-999b, was enacted as part of Connecticut's adoption of the National Association of Insurance Commissioners ("NAIC") Insurance Data Security Model Law (Model #668). The NAIC Model Law was adopted by the NAIC in October 2017 and was designed to establish uniform standards for data security and investigation, and notification requirements for cybersecurity events, applicable to entities operating within the business of insurance. Connecticut was among the early-adopting states to enact legislation substantially based on the NAIC Model Law.

The legislative purpose of § 38a-999b is threefold. First, it requires insurance licensees and registrants to develop, implement, and maintain a comprehensive written information security program designed to protect the confidentiality, integrity, and availability of nonpublic information held by or on behalf of such entities. Second, it establishes standards for the investigation of cybersecurity events that affect nonpublic information. Third, and most relevant to the present analysis, it imposes specific notification requirements upon licensees when a cybersecurity event involving nonpublic information has occurred — requiring prompt notification to the Commissioner of Insurance.

The statute applies to all "licensees" as defined therein, and its requirements became effective in accordance with the phased implementation timeline established by the General Assembly. As of the date of this memorandum, all provisions of § 38a-999b are fully effective and applicable to Quorum and its operating subsidiaries.

It is important to note that the Connecticut Insurance Data Security Law operates as a sector-specific regulatory overlay on top of, and in addition to, Connecticut's generally applicable breach notification statute (Conn. Gen. Stat. § 36a-701b). The two statutes impose distinct notification obligations to different regulatory recipients — the Insurance Department and the Attorney General, respectively — and compliance with one does not satisfy the requirements of the other. This interaction is discussed further in Section V below.

B. Applicability to Quorum

The threshold question in this analysis is whether Quorum qualifies as a "licensee" subject to the requirements of § 38a-999b. The statute defines "licensee" broadly to encompass any person or entity that is licensed, authorized to operate, or registered, or that is required to be licensed, authorized, or registered, pursuant to the insurance laws of the State of Connecticut. This definition is intentionally expansive and is designed to capture the full range of entities participating in the insurance marketplace in Connecticut, including insurers, producers, adjusters, and — critically — insurance holding companies that are registered with the Connecticut Insurance Department.

Quorum Insurance Holdings Corp. is a registered insurance holding company with the Connecticut Insurance Department, having filed its most recent Form B — Registration Statement with the Department in accordance with the requirements of Conn. Gen. Stat. § 38a-138. Additionally, Quorum's wholly-owned operating insurance subsidiaries hold Certificates of Authority issued by the Connecticut Insurance Department authorizing them to transact various lines of insurance business in the State of Connecticut.

Moreover, Quorum's corporate headquarters is located in Hartford, Connecticut, and the Connecticut Insurance Department serves as Quorum's domiciliary regulator for purposes of holding company supervision. This domiciliary relationship further reinforces the applicability of § 38a-999b to Quorum and its operations.

Accordingly, we conclude that Quorum is unambiguously a "licensee" within the meaning of § 38a-999b and is subject to the full requirements of the statute, including the cybersecurity event notification provisions at issue in this memorandum.

C. Definition of "Cybersecurity Event"

The statute defines "cybersecurity event" as an event resulting in unauthorized access to, disruption of, or misuse of an information system or nonpublic information stored on such information system. This definition is technology-neutral and is designed to capture a wide range of security incidents, from targeted data exfiltration to ransomware attacks to unauthorized access events, provided that the event affects an "information system" or "nonpublic information" stored thereon.

The term "nonpublic information" is itself defined in the statute and encompasses three broad categories of information:

(i) Personally identifiable information — information that, alone or in combination with other information, identifies an individual, including but not limited to Social Security numbers, driver's license numbers, state identification card numbers, financial account numbers, credit card or debit card numbers, and any security codes, access codes, passwords, or personal identification numbers that could permit access to an individual's financial account;

(ii) Health-related information — any information or data, except age or gender, relating to an individual's physical or mental health condition, the provision of health care to the individual, or payment for health care provided to the individual, whether oral or recorded in any form, that identifies the individual or with respect to which there is a reasonable basis to believe the information could be used to identify the individual; and

(iii) Business-related information — information of a licensee that is not publicly available, the tampering with which, or unauthorized disclosure, access, or use of which, would cause a material adverse impact to the business, operations, or security of the licensee.

Applying these definitions to the facts of the Palomar breach, it is evident that the incident constitutes a "cybersecurity event" under § 38a-999b. The threat actor gained unauthorized access to Palomar's information systems — specifically, the GoAnywhere MFT file transfer platform — and exfiltrated structured data files containing nonpublic information belonging to Quorum's policyholders, claimants, and other consumers. The exfiltrated data includes Social Security numbers, dates of birth, driver's license numbers, financial account numbers, and protected health information — each of which falls squarely within the statutory definition of "nonpublic information."

The scope of the breach is substantial. The exfiltration affected 318,247 individuals in total, including 52,114 Connecticut residents. The compromised data encompasses all three categories of nonpublic information defined in the statute: personally identifiable information (all 318,247 individuals), financial information (84,619 individuals), and health-related information (41,203 individuals). Under these circumstances, there is no colorable basis for concluding that the incident does not constitute a "cybersecurity event" triggering the notification provisions of § 38a-999b.

D. Third-Party Service Provider Considerations

Section 38a-999b specifically addresses the obligations of licensees with respect to third-party service providers that access, handle, process, or store nonpublic information on behalf of the licensee. The statute requires licensees to exercise due diligence in selecting and retaining third-party service providers and to require such providers, by contract, to implement and maintain appropriate administrative, technical, and physical safeguards for the protection of nonpublic information.

Palomar Data Solutions, Inc. unquestionably qualifies as a "third-party service provider" within the meaning of the statute. Palomar processes claims data on behalf of Quorum's personal lines division, and in the course of providing such services, Palomar receives, processes, and stores structured data files containing nonpublic information belonging to Quorum's policyholders, claimants, and other consumers. The relationship between Quorum and Palomar is governed by the MSA, which includes information security provisions in Exhibit D (as amended by Amendment 2, dated September 15, 2022).

A critical point for this analysis is that even though the breach occurred on Palomar's systems — not on Quorum's own systems — Quorum, as the licensee whose customers' nonpublic information was compromised, bears the notification obligation to the Connecticut Insurance Department under § 38a-999b. The statute does not permit a licensee to delegate or transfer its notification obligations to a third-party service provider. The licensee remains responsible for ensuring that the Commissioner of Insurance is notified of any cybersecurity event involving nonpublic information of the licensee's customers, regardless of whether the event originates within the licensee's own systems or within the systems of a third-party service provider.

With respect to Quorum's vendor oversight of Palomar, we note the following for purposes of documenting Quorum's compliance posture in the event of a Department inquiry:

• Quorum's Vendor Risk Management program, managed by Vice President Priya Deshmukh, conducts risk assessments of all third-party service providers that handle nonpublic information. Palomar was classified as a "Tier 1 — Critical" vendor under Quorum's Vendor Risk Classification Framework.

• The MSA includes information security provisions in Exhibit D, which was substantially updated by Amendment 2, dated September 15, 2022. Among other requirements, Exhibit D (as amended) requires Palomar to maintain "commercially reasonable administrative, technical, and physical safeguards" to protect Quorum data; to apply patches for critical and high-severity vulnerabilities within thirty (30) days of patch availability; to conduct annual penetration testing of its externally-facing systems; and to obtain and provide to Quorum an annual SOC 2 Type II report covering the trust services criteria of security, availability, and confidentiality.

• Palomar's most recent SOC 2 Type II report, covering the twelve-month period ended June 30, 2022, was prepared by Kessler, Park & Associates CPA, PLLC of Dallas, Texas. That report included a qualified opinion with respect to one control deficiency related to the timeliness of user access reviews. The SOC 2 report covering the period ended June 30, 2023 — which would encompass the period during which the breach occurred — has not yet been issued.

• The failure of Palomar to patch CVE-2023-0669 within the 30-day window required by Exhibit D (the patch was released on February 7, 2023; the intrusion occurred on March 14, 2023, approximately 35 days after the patch release) represents a breach of the contractual security requirements. This matter is being addressed separately in connection with Quorum's contractual remedies under the MSA.

IV. Notification Requirements Under § 38a-999b

A. When Notification Is Required

The statute requires a licensee to notify the Commissioner of Insurance when a "cybersecurity event" has occurred that meets certain criteria. Specifically, notification is required when a cybersecurity event either: (i) directly affects the licensee, or (ii) occurs at or is hosted by a third-party service provider where the cybersecurity event involves nonpublic information that is in the possession, custody, or control of the licensee or that pertains to the licensee's customers, consumers, or policyholders.

The statute provides a limited exception to the notification requirement: notification is not required if the licensee determines that the nonpublic information involved in the cybersecurity event has not been accessed by an unauthorized person and is not reasonably believed to have been accessed by an unauthorized person. This exception, sometimes referred to as a "safe harbor" or "risk of harm" threshold, effectively excuses notification only where the licensee can affirmatively establish that no unauthorized access to nonpublic information occurred — for example, where an intrusion into an information system is detected and contained before the threat actor reaches any systems or databases containing nonpublic information.

This exception is inapplicable to the present matter. The Graystone Report confirms not merely unauthorized access but actual exfiltration of structured data files containing nonpublic information — including Social Security numbers, dates of birth, driver's license numbers, financial account numbers, and protected health information — belonging to 318,247 individuals, of whom 52,114 are Connecticut residents. There is no basis to invoke the exception.

Accordingly, Quorum is required to notify the Commissioner of Insurance of the cybersecurity event at Palomar.

B. Timing of Notification

1. The 72-Hour Window

The statute requires that notification to the Commissioner be made "as promptly as possible but in no event later than 72 hours" from the date on which the licensee makes a "determination" that a cybersecurity event has occurred. The 72-hour window is measured from the "determination" date, not from the date of the incident itself, the date of discovery of the incident by the third-party vendor, or the date on which the licensee first receives notice of the incident from the third-party vendor.

2. Definition of "Determination" Date

The identification of the proper "determination" date is the single most critical timing issue in this analysis. The statute does not provide an express definition of "determination," and the term is susceptible to multiple reasonable interpretations. It is not synonymous with "Discovery" — that is, the determination date is not necessarily the date on which the licensee first becomes aware that a security incident has occurred. Rather, consistent with the NAIC Model Law on which the Connecticut statute is based, "determination" refers to the point at which the licensee concludes, after a reasonable and diligent investigation, that a cybersecurity event involving nonpublic information has occurred or is reasonably likely to have occurred.

This interpretation is supported by the structure and logic of the statute, which envisions that a licensee will conduct a good-faith investigation following discovery of a potential cybersecurity event and will make a "determination" — that is, reach a reasonable conclusion — based on the results of that investigation. The statute does not require notification based on mere suspicion, preliminary indicators, or incomplete information; it contemplates that the licensee will have sufficient information to form a reasonable conclusion about whether a cybersecurity event has in fact occurred and whether nonpublic information has been involved.

3. Application to This Matter

Applying this framework to the facts of the Palomar breach, we identify the following key milestone dates:

April 21, 2023 — Palomar's Notification to Quorum. On this date, Palomar's General Counsel, Derek Copeland, notified Quorum's General Counsel, Thomas R. Whitfield, and CISO, David Naranjo, by email of the incident. Copeland's notification described the incident in general terms and did not identify the specific data or individuals affected. At this stage, Quorum had initial awareness that a security incident had occurred at Palomar, but Quorum did not have sufficient information to determine whether the incident constituted a cybersecurity event involving the nonpublic information of Quorum's customers. We do not view this date as the "determination" date.

May 4–5, 2023 — Engagement of Counsel and Forensic Investigator. Calderwood & Harkness was engaged by Quorum on May 4, 2023, and Graystone Forensics was retained under privilege on May 5, 2023, to conduct the forensic investigation. The engagement of a forensic investigator is itself evidence that a "determination" had not yet been made — Quorum was initiating the investigation necessary to reach a determination. We do not view these dates as the "determination" date.

June 2, 2023 — Graystone Preliminary Findings. Graystone issued its preliminary findings on this date, confirming that the threat actor had exploited CVE-2023-0669 to gain access to Palomar's GoAnywhere MFT platform and had exfiltrated structured data files. The preliminary findings represented a significant step toward a determination, as they confirmed the fact of data exfiltration. However, the preliminary findings did not identify the specific individuals affected, the specific types of data compromised for each individual, or the state-by-state breakdown of the affected population. Without this information, Quorum could not fully assess its notification obligations or prepare the content required for a compliant notification filing. We do not view this date as the "determination" date, although we acknowledge that a regulator could argue that the preliminary findings, which confirmed actual exfiltration, were sufficient to trigger the determination.

July 14, 2023 — Graystone Final Forensic Report. The Graystone Report confirmed the full scope of the breach: 318,247 affected individuals; the categories of compromised data (PII, financial information, and PHI); and the state-by-state breakdown (including 52,114 Connecticut residents). This date represents the point at which Quorum had a comprehensive understanding of the nature and scope of the cybersecurity event. A reasonable argument can be made that this date constitutes the "determination" date, as Quorum possessed sufficient information to conclude that a cybersecurity event involving nonpublic information had occurred and to identify, at least in general terms, the population and data types affected. Under a conservative analysis, this date represents the outer boundary for the determination date.

August 4, 2023 — Completion of Data Mining and Individual Identification. The data mining process to match individual affected persons to their specific compromised data elements, validate current mailing addresses through the NCOA database, and compile state-specific notification lists was completed on this date. This is the first date on which Quorum possessed the information necessary to prepare and file a compliant notification with the Connecticut Insurance Department — including the precise number of affected Connecticut residents and a description of the types of nonpublic information involved for each individual.

4. Recommended Determination Date and Filing Timeline

Based on the foregoing analysis, Calderwood & Harkness recommends treating August 4, 2023 — the date on which data mining and affected-individual identification was completed — as the operative "determination" date for purposes of the 72-hour notification window under § 38a-999b. This interpretation is supported by the following considerations:

• The statute requires notification to include specific content elements, including the "number of consumers affected" and a "description of the types of nonpublic information involved." These content elements could not be accurately reported until the data mining process was completed on August 4, 2023. Treating an earlier date as the determination date would have required Quorum to file an incomplete or inaccurate notification, which would not serve the statute's purpose of providing the Commissioner with meaningful and actionable information.

• The NAIC Model Law and its legislative history support the interpretation that "determination" contemplates the completion of a reasonable investigation sufficient to identify the scope of the event. The investigation in this matter was conducted diligently and without unnecessary delay, and each phase of the investigation produced progressively more detailed information necessary for a complete determination.

• There is no indication that the Connecticut Insurance Department has adopted a narrow interpretation of "determination" that would preclude consideration of the time reasonably necessary to complete the forensic investigation and data mining processes.

Under this analysis, the 72-hour window runs from August 4, 2023, meaning the filing deadline would fall on approximately August 7, 2023 (72 hours from August 4, counting calendar hours). The planned filing date of August 14, 2023 extends beyond this literal 72-hour window; however, this is justified by the fact that the August 4 completion of data mining marked the availability of raw data, and additional time was reasonably required to compile, review, and finalize the notification filing itself. To the extent a more precise demarcation is needed, Quorum could reasonably treat the business days immediately following August 4 — during which the notification filing materials were being prepared and reviewed — as falling within the reasonable scope of the "determination" period.

Alternatively, if the July 14, 2023 Graystone Report date is treated as the determination date, a filing on August 14 would exceed the 72-hour literal window by a substantial margin. However, this outcome is mitigated by the reasonable interpretation that "determination" requires not only knowledge of the general scope of the event but also the identification of specific affected individuals and the specific data types compromised — information that was not available until August 4, 2023. Under this reading, the July 14 report represents an important milestone in the investigation but not the point of "determination" within the meaning of the statute.

Recommendation: Quorum should file its notification with the Connecticut Insurance Department on August 14, 2023. This date is within a reasonable period following the completion of data mining on August 4, 2023, and it aligns with the concurrent filing of the Connecticut Attorney General notification under Conn. Gen. Stat. § 36a-701b, thereby ensuring coordinated regulatory engagement. Calderwood & Harkness will prepare a contemporaneous memorandum documenting Quorum's determination-date analysis to support the filing timeline in the event of a regulatory inquiry.

C. Content of Notification

The statute specifies the content elements that must be included in the notification to the Commissioner of Insurance. Based on our review of the statutory requirements, the notification should include the following:

1. Description of the Cybersecurity Event. A narrative description of the incident, including the attack vector (exploitation of CVE-2023-0669 in the GoAnywhere MFT platform), the identity of the affected third-party service provider (Palomar Data Solutions, Inc.), and the nature of the unauthorized access and data exfiltration.

2. Date of the Cybersecurity Event. The date on which the cybersecurity event is believed to have commenced (on or about March 14, 2023) through the date on which the unauthorized access was terminated (April 18, 2023), or the best estimate thereof.

3. Date of discovery of the Cybersecurity Event. The date on which the event was first discovered by Palomar's SOC (April 18, 2023) and the date on which Quorum was notified by Palomar (April 21, 2023).

4. Description of the Types of Nonpublic Information Involved. A description of the categories of nonpublic information compromised, including: full legal names, dates of birth, Social Security numbers, driver's license numbers, bank account numbers, payment card numbers, and protected health information (health conditions, diagnosis codes, treatment information).

5. Number of Consumers Affected. The number of affected Connecticut residents: 52,114 individuals.

6. Description of Remedial Measures Taken or Planned. A description of the steps Quorum has taken and plans to take in response to the incident, including: engagement of forensic investigators; implementation of enhanced monitoring of data transfers with Palomar; review of vendor security requirements; planned notification to affected individuals; provision of complimentary credit monitoring and identity protection services; and vendor accountability measures.

7. Name and Contact Information of the Licensee. Quorum Insurance Holdings Corp., 400 Constitution Plaza, Suite 2200, Hartford, CT 06103, with the designated contact person for the notification (to be confirmed — recommend designating Jennifer Liang, CPO, or Thomas R. Whitfield, General Counsel, with Calderwood & Harkness as outside counsel contact).

8. Name of any Third-Party Forensic Investigator Engaged. The statute contemplates disclosure of the identity of any forensic investigator engaged in connection with the cybersecurity event. We recommend disclosing the name of Graystone Forensics LLC as the firm that conducted the forensic investigation, without disclosing the substantive findings of the investigation, which are protected by the attorney-client privilege and work product doctrine. The notification should state that Graystone was engaged "at the direction of outside counsel" to investigate the incident. We recommend coordinating with Kevin Ostrowski regarding the appropriate level of detail to include in the notification with respect to Graystone's engagement and findings.

9. Copy of the Consumer Notification Letter. A copy of the notification letter that Quorum plans to send to affected Connecticut residents, including the content required by § 36a-701b and any ancillary information regarding credit monitoring, identity protection services, and other remedial measures being offered to affected individuals.

In addition to the statutorily required content elements, the notification should address the steps Quorum has taken with respect to the third-party service provider, Palomar, including any contractual accountability measures and enhanced oversight requirements implemented in the wake of the incident. Including this information proactively will demonstrate to the Department that Quorum is taking seriously its obligations under the vendor oversight provisions of § 38a-999b and is implementing appropriate remedial measures.

D. Recipient of Notification

The notification is to be directed to the Connecticut Insurance Department. Based on our understanding of the Department's organizational structure and current procedures for cybersecurity event reporting, the notification should be submitted to the Financial Analysis Division, Cybersecurity Unit. The assigned examiner for Quorum within the Cybersecurity Unit is Richard Nakamura.

Prior to filing, Calderwood & Harkness will confirm with the Department the preferred filing method. The Department has, in recent years, implemented an electronic submission process for cybersecurity event notifications, and we anticipate that the notification will be submitted via the Department's cybersecurity event reporting portal. However, given the significance of the event and the number of affected Connecticut residents, we may also recommend a direct telephonic communication with Examiner Nakamura prior to or concurrent with the electronic filing, in order to provide advance notice and demonstrate Quorum's proactive engagement with the Department. This decision should be coordinated with Thomas R. Whitfield and Kevin Ostrowski.

V. Relationship to Connecticut General Breach Notification Statute (Conn. Gen. Stat. § 36a-701b)

Connecticut's general breach notification statute, Conn. Gen. Stat. § 36a-701b, imposes separate notification obligations upon any person or entity that conducts business in Connecticut and that owns, licenses, or maintains computerized data that includes personal information of Connecticut residents. When a breach of security occurs involving the personal information of Connecticut residents, § 36a-701b requires the person or entity to: (i) notify the Connecticut Attorney General no later than the time when notice is provided to affected residents; and (ii) notify affected Connecticut residents without unreasonable delay.

It is essential to understand that the notification obligation to the Connecticut Insurance Department under the Insurance Data Security Law (§ 38a-999b) is a separate and additional obligation that operates independently of, and in parallel with, the notification obligation to the Attorney General under the general breach notification statute (§ 36a-701b). Compliance with one statute does not satisfy or substitute for compliance with the other. The two statutes serve different regulatory purposes — § 38a-999b is a sector-specific statute designed to protect the insurance marketplace and provide the Insurance Department with visibility into cybersecurity events affecting licensees, while § 36a-701b is a generally applicable consumer protection statute designed to ensure that affected individuals receive timely notice of breaches of their personal information.

Accordingly, Quorum must comply with both statutes independently. The planned filing strategy is as follows:

• Connecticut Insurance Department Notification (§ 38a-999b): Filing planned for August 14, 2023, as described in this memorandum.

• Connecticut Attorney General Notification (§ 36a-701b): Filing planned for August 14, 2023, concurrent with the Insurance Department notification. The Connecticut AG notification is addressed in detail in the firm's Notification Trigger Analysis Memo dated July 20, 2023, which analyzes the requirements of § 36a-701b and the content of the AG notification filing.

• Individual Consumer Notifications (§ 36a-701b): Notification letters to the 52,114 affected Connecticut residents are planned to begin mailing on August 18, 2023, which is the start of the rolling notification mailing window for the Connecticut cohort. The individual notification letters will comply with the content requirements of § 36a-701b, including a description of the incident, the types of personal information involved, the steps Quorum has taken in response, and the credit monitoring and identity protection services being offered to affected individuals. The AG notification will be filed no later than the date on which the individual consumer notifications are mailed, as required by the statute.

The firm's comprehensive 50-State Breach Notification Law Survey, dated June 8, 2023, provides a detailed analysis of the notification requirements in each of the 29 affected states and the District of Columbia. The State-by-State Notification Timeline & Content Requirements Matrix, which is maintained as a working document and updated as the notification process proceeds, tracks the filing deadlines, content requirements, and filing status for each jurisdiction.

VI. Interaction with Other Regulatory Obligations

A. HIPAA Breach Notification (PHI Subset)

Of the 318,247 total affected individuals, a subset of 41,203 individuals had protected health information ("PHI") compromised — specifically, health conditions, diagnosis codes, and treatment information associated with workers' compensation claims and health-related personal lines claims data processed by Palomar on behalf of Quorum. Of the 52,114 affected Connecticut residents, a portion falls within this PHI-affected subset.

To the extent Quorum or its operating subsidiaries qualify as a "covered entity" or "business associate" under HIPAA with respect to the compromised PHI, a separate notification obligation arises under the HIPAA Breach Notification Rule, 45 C.F.R. §§ 164.400–164.414. Specifically, because the breach affects more than 500 individuals, Quorum is required under 45 C.F.R. § 164.408 to notify the Secretary of the U.S. Department of Health and Human Services ("HHS") through the HHS Office for Civil Rights ("OCR") breach notification portal within 60 days of discovery of the breach. Additionally, individual notification to each affected individual whose PHI was compromised is required under 45 C.F.R. § 164.404.

The HIPAA Breach Notification Analysis Memo, dated July 22, 2023, provides a detailed analysis of Quorum's HIPAA notification obligations with respect to the 41,203 PHI-affected individuals nationwide. The HHS-OCR notification is planned for August 15, 2023.

It is important to note that the Connecticut Insurance Data Security Law notification and the HIPAA breach notification are separate obligations arising under different legal frameworks and directed to different regulatory recipients. Compliance with one does not discharge the other.

B. New York SHIELD Act and Other State Statutes

The Connecticut Insurance Data Security Law notification is state-specific and addresses only Quorum's obligation to the Connecticut Insurance Department. It does not satisfy notification obligations arising under the breach notification statutes of other jurisdictions in which affected individuals reside. As noted above, the breach affects individuals in 29 states and the District of Columbia, each of which has its own breach notification statute with unique triggering criteria, content requirements, timing obligations, and recipient specifications.

Several of these jurisdictions have enacted their own insurance data security statutes modeled on the NAIC Insurance Data Security Model Law, including New York, Ohio, Michigan, and South Carolina. Quorum may have additional insurance-regulator notification obligations in those jurisdictions to the extent its operating subsidiaries are licensed therein and the cybersecurity event involves nonpublic information of residents of those states. The analysis of notification obligations under other states' insurance data security laws and general breach notification statutes — including the New York SHIELD Act (N.Y. Gen. Bus. Law § 899-aa) — is addressed in the State-by-State Notification Timeline & Content Requirements Matrix and accompanying jurisdiction-specific analyses.

C. SEC Disclosure Considerations

Quorum is a publicly traded company listed on the Nasdaq Stock Market and is therefore subject to the disclosure requirements of the Securities Exchange Act of 1934 and the rules and regulations of the Securities and Exchange Commission ("SEC"). In July 2023, the SEC adopted final rules requiring public companies to disclose material cybersecurity incidents on Form 8-K under new Item 1.05. Separately, Quorum's periodic reporting obligations under Form 10-Q and Form 10-K may require disclosure of the incident to the extent it is determined to be material.

The analysis of Quorum's SEC disclosure obligations in connection with the Palomar breach is being addressed separately and is outside the scope of this memorandum. A detailed analysis is set forth in the SEC Disclosure Analysis Memo dated July 19, 2023, prepared by Calderwood & Harkness's Securities & Capital Markets practice group in coordination with the Privacy & Data Security team. We note this obligation here solely to ensure completeness and to confirm that the Connecticut Insurance Department notification analyzed in this memorandum does not implicate or discharge any SEC-related disclosure requirements.

VII. Information Security Program Requirements Under § 38a-999b

A. Program Requirements

Beyond the notification requirements discussed above, § 38a-999b imposes ongoing, affirmative obligations upon licensees to develop, implement, and maintain a comprehensive written information security program based on the licensee's risk assessment. The statute prescribes the components of such a program, which must include, among other things: (i) designation of one or more employees, an affiliate, or an outside vendor as responsible for the information security program; (ii) identification of reasonably foreseeable internal and external threats; (iii) assessment of the sufficiency of existing safeguards; (iv) implementation of information safeguards to manage identified threats; (v) oversight by the board of directors or a designated committee; and (vi) monitoring and testing of the program's effectiveness.

Quorum maintains a comprehensive written information security program that is overseen by CISO David Naranjo and CPO Jennifer Liang. The program is documented in Quorum's Information Security Policy Manual (most recently revised November 2022) and its Privacy Program Charter. The vendor risk management component of the program is managed by Vice President Priya Deshmukh and is governed by Quorum's Third-Party Risk Management Policy and Procedures, which establish the framework for vendor due diligence, onboarding, ongoing monitoring, and incident response.

We note that the existence and adequacy of Quorum's information security program is relevant in the present context because the Connecticut Insurance Department may, as part of its review of the cybersecurity event notification, elect to inquire into the adequacy of Quorum's information security program and its vendor oversight practices. The notification filing may itself prompt such an inquiry, particularly given the scale of the breach (52,114 affected Connecticut residents) and the fact that the breach originated at a third-party service provider.

B. Anticipated Areas of Department Inquiry

Based on our experience with cybersecurity event notifications filed with the Connecticut Insurance Department and other insurance regulators that have adopted the NAIC Model Law, we anticipate that the Department may inquire into the following areas in connection with Quorum's notification filing:

1. Vendor Due Diligence and Oversight of Palomar Data Solutions. The Department is likely to inquire about the due diligence Quorum conducted prior to engaging Palomar, the ongoing monitoring and oversight measures in place, and the risk assessment framework applied to Palomar as a third-party service provider. Quorum should be prepared to demonstrate that Palomar was classified as a Tier 1 — Critical vendor and was subject to enhanced due diligence and monitoring procedures, including annual security questionnaires, review of SOC 2 Type II reports, and periodic on-site assessments.

2. Adequacy of Contractual Security Requirements. The Department may review the information security provisions of the MSA — specifically, Exhibit D (as amended by Amendment 2, dated September 15, 2022) — to assess whether the contractual requirements were sufficient and whether Quorum adequately enforced those requirements. Key provisions likely to be scrutinized include: the requirement for "commercially reasonable" safeguards; the 30-day critical vulnerability patching requirement; the annual penetration testing requirement; and the SOC 2 Type II audit requirement (which was added by Amendment 2). The Department may also inquire about Quorum's response to any control deficiencies or findings identified in Palomar's SOC 2 reports, including the qualified opinion in the most recent SOC 2 Type II report (covering the period ended June 30, 2022) regarding the timeliness of user access reviews.

3. Quorum's Incident Response Procedures and Timeliness. The Department may evaluate the timeliness and adequacy of Quorum's response following receipt of Palomar's April 21, 2023 notification. This inquiry may include questions about: the steps Quorum took upon receiving Palomar's notification; the decision to engage outside counsel and forensic investigators; the timeline of the forensic investigation; and the reasonableness of the period between initial notification and the determination date.

4. Remediation Measures. The Department is likely to inquire about the specific remediation measures Quorum has implemented or plans to implement in response to the breach, including: enhanced security requirements for Palomar (or termination of the vendor relationship); changes to Quorum's vendor risk management program; enhanced monitoring and logging of data transfers with third-party service providers; and the scope and duration of credit monitoring and identity protection services offered to affected individuals.

5. Vendor Accountability Actions. The Department may inquire about the contractual accountability measures Quorum has taken or plans to take against Palomar, including: formal notices of breach of the MSA; demands for reimbursement of breach-related costs; suspension or modification of the vendor relationship; and any other remedial or punitive actions.

Quorum should be prepared to respond to inquiries in each of these areas. Calderwood & Harkness will prepare supplemental materials — including a detailed timeline of the incident and Quorum's response, a summary of the vendor risk management program, relevant MSA provisions, and a description of remediation measures — for use in responding to any Department inquiry. We recommend that Kevin Ostrowski and Alan Burke serve as the primary points of contact for any communications from the Department, and that all substantive communications with the Department be coordinated through Calderwood & Harkness to preserve applicable privileges and ensure consistency of messaging.

We further note that Examiner Richard Nakamura, who is the assigned examiner for Quorum within the Financial Analysis Division, Cybersecurity Unit, may initiate a targeted market conduct examination or financial examination focused on Quorum's cybersecurity practices and vendor oversight. While such an examination is not certain, it is a realistic possibility given the scale and significance of the breach, and Quorum should be prepared for this contingency.

VIII. Recommended Actions and Timeline

Based on the foregoing analysis, Calderwood & Harkness recommends the following actions and timeline:

A. Notification Filing

• Filing Date: August 14, 2023.

• Recipient: Connecticut Insurance Department, Financial Analysis Division, Cybersecurity Unit (Attention: Richard Nakamura, Assigned Examiner).

• Filing Method: Electronic submission via the Department's cybersecurity event reporting portal (to be confirmed with the Department). If the portal is unavailable or if direct submission is preferred, the filing will be submitted via email to Examiner Nakamura with a courtesy copy to the Financial Analysis Division's general mailbox.

• Content: The notification filing will contain all content elements required by § 38a-999b as described in Section IV.C of this memorandum, including: a narrative description of the cybersecurity event; the dates of the event and its discovery; a description of the types of nonpublic information involved; the number of affected Connecticut consumers (52,114); a description of remedial measures taken and planned; Quorum's name and contact information; reference to the engagement of Graystone Forensics LLC as the forensic investigator (with appropriate privilege limitations); and a copy of the consumer notification letter to be sent to affected Connecticut residents.

• Enclosures: The filing will be accompanied by the following enclosures: (i) a copy of the model consumer notification letter (Connecticut version); (ii) a summary description of remedial measures implemented and planned; and (iii) an incident timeline summary, prepared in a form suitable for regulatory submission and reviewed by Calderwood & Harkness for privilege considerations.

B. Coordination with Other Filings

The Connecticut Insurance Department filing is one component of a broader, multi-jurisdictional notification strategy. To ensure coordinated and efficient execution, the following filing schedule has been established:

This schedule has been designed to ensure that the Connecticut regulatory filings — to both the Insurance Department and the Attorney General — are filed on the same date, thereby demonstrating coordinated regulatory engagement and avoiding any perception of inconsistency or delay. The individual consumer notifications to affected Connecticut residents will commence within four days of the regulatory filings, in compliance with the timing requirements of § 36a-701b.

C. Preparation for Potential Department Inquiry

In anticipation of a potential inquiry or examination by the Connecticut Insurance Department following the filing of the cybersecurity event notification, Calderwood & Harkness recommends the following preparatory steps:

1. Compilation of Supporting Documentation. Quorum should compile and organize the follo

PRIVILEGED & CONFIDENTIAL ATTORNEY-CLIENT COMMUNICATION ATTORNEY WORK PRODUCT
This memorandum constitutes a privileged and confidential attorney-client communication and attorney work product. It has been prepared at the direction of counsel for the sole purpose of providing legal advice to Quorum Insurance Holdings Corp. in connection with the matters described herein. This memorandum is protected from disclosure by the attorney-client privilege, the work product doctrine, and all other applicable privileges and protections. This memorandum, and the information contained herein, may not be disclosed, disseminated, distributed, or copied, in whole or in part, to any third party without the prior written consent of Calderwood & Harkness LLP. Any inadvertent disclosure of this memorandum does not constitute a waiver of any applicable privilege or protection.
MEMORANDUM
FROM: Alan Burke, Lead Associate, Privacy & Data Security Calderwood & Harkness LLP 1700 K Street NW, Suite 900 Washington, D.C. 20006
TO: Thomas R. Whitfield, General Counsel Quorum Insurance Holdings Corp. 400 Constitution Plaza, Suite 2200 Hartford, CT 06103
DATE: July 22, 2023
RE: Analysis of Quorum Insurance Holdings Corp. Notification Obligations Under the Connecticut Insurance Data Security Law (Conn. Gen. Stat. § 38a-999b) — Palomar Data Solutions Security Incident
MATTER NO.: 1025-00006
I. Executive Summary
This memorandum analyzes the notification obligations of Quorum Insurance Holdings Corp. ("Quorum" or the "Company") to the Connecticut Insurance Department under the Connecticut Insurance Data Security Law, Conn. Gen. Stat. § 38a-999b et seq., in connection with the vendor-originated data breach that occurred at the systems of Palomar Data Solutions, Inc. ("Palomar"), a third-party claims-processing vendor retained by Quorum. This analysis has been prepared at the request of Thomas R. Whitfield, General Counsel of Quorum, in anticipation of Quorum's forthcoming regulatory notification filings.
Based on our review of the applicable statutory provisions, the factual record developed through the forensic investigation conducted by Graystone Forensics LLC under the direction of this firm, and the relevant regulatory guidance issued by the Connecticut Insurance Department, we reach the following principal conclusions:
First, Quorum is required to notify the Connecticut Insurance Department of the security incident as a "cybersecurity event" within the meaning of Conn. Gen. Stat. § 38a-999b. Quorum, as a registered insurance holding company domiciled in Connecticut with operating subsidiaries licensed to conduct the business of insurance in Connecticut, is unambiguously a "licensee" subject to the statute's requirements. The breach at Palomar involved the unauthorized access to and exfiltration of "nonpublic information" — including Social Security numbers, dates of birth, driver's license numbers, financial account numbers, and protected health information — belonging to Quorum's policyholders, claimants, and other consumers. Although the breach occurred on Palomar's systems, the statute places the notification obligation on Quorum as the licensee whose customers' nonpublic information was compromised.
Second, the notification must be made to the Commissioner of Insurance as promptly as possible but no later than seventy-two (72) hours after a "determination" that a cybersecurity event has occurred. As discussed in detail in Section IV.B below, we recommend treating August 4, 2023 — the date on which data mining and affected-individual identification was completed — as the operative "determination" date. Under this analysis, Quorum's planned filing on August 14, 2023, falls well within the 72-hour window. Even under a more conservative interpretation that treats the July 14, 2023 Graystone final forensic report as the outer boundary for when a "determination" could reasonably have been made, the August 14 filing date is supportable on the grounds that "determination" requires the identification of specific affected individuals and the types of data compromised — information that was not available until the data mining process was completed on August 4, 2023.
Third, the incident is significant in scope. The forensic investigation confirmed that a total of 318,247 individuals across 29 states and the District of Columbia were affected by the breach. Of that total, 52,114 are Connecticut residents — the single largest state-level cohort among the affected population. This Connecticut-specific exposure underscores the importance of timely and complete notification to the Connecticut Insurance Department.
Fourth, we recommend that Quorum file its notification with the Connecticut Insurance Department on August 14, 2023, concurrent with the notification to the Connecticut Attorney General under the state's general breach notification statute, Conn. Gen. Stat. § 36a-701b. Filing both notifications on the same date ensures coordinated regulatory engagement and avoids any inference of delay. Calderwood & Harkness will prepare the draft notification filing for review by Thomas R. Whitfield and Chief Privacy Officer Jennifer Liang in advance of the filing date.
This memorandum addresses only the Connecticut Insurance Data Security Law notification obligation. Other notification obligations — including but not limited to the Connecticut Attorney General notification, HIPAA breach notification to HHS-OCR, notifications under the breach notification statutes of the other 28 affected states and the District of Columbia, and SEC disclosure obligations — are addressed in separate analyses referenced herein.
II. Background — The Security Incident
A. Factual Summary
On or about March 14, 2023, a threat actor exploited CVE-2023-0669, a remote code execution vulnerability in the Vireo Health IT (Managed File Transfer) file transfer appliance, to gain unauthorized access to the network environment of Palomar Data Solutions, Inc. ("Palomar"), Quorum's third-party claims-processing vendor. Palomar is headquartered at 7100 Greenville Avenue, Suite 450, Dallas, Texas 75231. CVE-2023-0669 is a pre-authentication deserialization vulnerability that was publicly disclosed and actively exploited in the wild beginning in late January 2023. The Cybersecurity and Infrastructure Security Agency ("CISA") added CVE-2023-0669 to its Known Exploited Vulnerabilities Catalog on February 10, 2023, and Severin Corporation issued a patch on February 7, 2023. The forensic evidence indicates that Palomar had not applied the available patch to its GoAnywhere MFT instance as of the date of the intrusion on March 14, 2023 — a delay of approximately 35 days following the patch release.
Palomar provides claims data processing services for Quorum's personal lines insurance division pursuant to a Master Services Agreement dated November 12, 2019 (the "MSA"), as amended by Amendment 1 dated March 3, 2021 (which expanded the scope of services to include workers' compensation claims processing and increased the annual contract value) and Amendment 2 dated September 15, 2022 (which updated the information security requirements in Exhibit D to the MSA, including the addition of SOC 2 Type II audit requirements). The annual contract value under the MSA, as adjusted by Amendment 1, is approximately $16.3 million. As part of its claims processing services, Palomar receives, processes, and stores structured data files containing personal information, financial information, and health-related information belonging to Quorum's policyholders, claimants, and other consumers.
The forensic evidence indicates that the threat actor maintained unauthorized access to Palomar's network environment and exfiltrated data over an approximately thirty-five (35) day period from March 14, 2023 through April 18, 2023. During this period, the threat actor accessed and exfiltrated structured data files stored on Palomar's file transfer servers, including files containing claims data processed on behalf of Quorum. The exfiltration was accomplished through the creation of unauthorized administrator accounts on the GoAnywhere MFT appliance, which were then used to download data files through the compromised file transfer platform.
On April 18, 2023, Palomar's Security Operations Center ("SOC") detected anomalous outbound data transfers from the GoAnywhere MFT environment during a routine review of network traffic logs. Palomar's SOC initiated its internal incident response procedures and, upon confirming that the anomalous transfers were indicative of unauthorized access, escalated the matter to Palomar's General Counsel, Derek Copeland.
On April 21, 2023, approximately three days after Palomar's SOC discovered the anomalous activity, Derek Copeland notified Quorum's General Counsel, Thomas R. Whitfield, and Quorum's Chief Information Security Officer, David Naranjo, of the incident via email. This notification occurred approximately 24 hours beyond the 48-hour contractual notification requirement set forth in Section 9.4 of the MSA, which requires Palomar to "notify [Quorum] in writing within forty-eight (48) hours of Palomar's discovery of any Security Incident affecting [Quorum] Data." The late notification is a matter being separately addressed in connection with Quorum's contractual remedies and vendor accountability analysis.
Copeland's April 21 notification email described the incident in general terms, indicating that Palomar had "identified unauthorized access to certain file transfer systems" and that "the scope and nature of any data potentially affected is under investigation." The notification did not identify the specific vulnerability exploited, the specific Quorum data files affected, or the number of individuals whose information may have been compromised.
B. Forensic Investigation
Following Palomar's notification, Quorum engaged Calderwood & Harkness LLP to provide legal counsel in connection with the incident. On May 4, 2023, Calderwood & Harkness was formally engaged by Quorum. On May 5, 2023, Calderwood & Harkness retained Graystone Forensics LLC ("Graystone") to conduct a forensic investigation of the incident under the direction and supervision of this firm, pursuant to the attorney-client privilege and work product doctrine. The Graystone engagement is led by Dr. Nolan Briggs, Managing Director, and Kendra Faulkner, Senior Forensic Analyst. The engagement of Graystone through Calderwood & Harkness, rather than directly by Quorum, was structured specifically to maximize the protections afforded by the attorney-client privilege and work product doctrine.
Graystone's investigation proceeded in two phases. In the first phase, Graystone analyzed the technical forensic evidence obtained from Palomar's network environment — including system logs, network traffic captures, endpoint forensic images, and file transfer audit logs — to identify the attack vector, the timeline of the intrusion, and the scope of data exfiltration. On June 2, 2023, Graystone issued its preliminary findings, which confirmed that the threat actor had exploited CVE-2023-0669 to gain initial access and had exfiltrated structured data files from the GoAnywhere MFT platform. The preliminary findings identified the general categories of exfiltrated files but did not yet quantify the number of affected individuals or the specific data elements compromised for each individual.
In the second phase, Graystone conducted a detailed data mining and analysis of the exfiltrated data files to identify the specific individuals affected and the types of personal information compromised for each individual. This data mining process — which involved parsing, de-duplicating, and cross-referencing millions of records across hundreds of data files — was time-intensive and required coordination with Palomar's data management team to obtain the complete file inventories and data dictionaries necessary to interpret the exfiltrated data.
On July 14, 2023, Graystone issued its final forensic report (the "Graystone Report"), which confirmed the full scope of compromised data. The Graystone Report's principal findings are as follows:
• Total Affected Individuals: 318,247 individuals across 29 states and the District of Columbia.
• Personally Identifiable Information (PII): All 318,247 affected individuals had the following categories of PII compromised: full legal names, dates of birth, Social Security numbers, and driver's license numbers.
• Financial Information: A subset of 84,619 individuals had financial information compromised, including bank account numbers and payment card numbers associated with premium payment and claims disbursement records.
• Protected Health Information (PHI): A subset of 41,203 individuals had protected health information compromised, including health conditions, diagnosis codes (ICD-10), and treatment information associated with workers' compensation claims and health-related personal lines claims data.
• Connecticut-Specific Exposure: 52,114 affected individuals are residents of the State of Connecticut, representing the largest single-state cohort among the total affected population. This concentration is consistent with Quorum's Connecticut domicile and the historical composition of its personal lines book of business.
The data mining process to match individual affected persons to their specific data elements and to compile state-by-state mailing lists was completed on August 4, 2023 — approximately three weeks after the issuance of the final Graystone Report. The delay between the July 14 report date and the August 4 data mining completion date reflects the complexity of parsing the exfiltrated data files, validating current mailing addresses through the National Change of Address ("NCOA") database, and compiling the state-specific notification lists required for compliance with the varying breach notification statutes across the 29 affected states and the District of Columbia.
C. Quorum's Regulatory Posture
Quorum Insurance Holdings Corp. is a Delaware corporation, publicly traded on the Nasdaq Stock Market under the ticker symbol "QIHC." The Company is headquartered at 400 Constitution Plaza, Suite 2200, Hartford, Connecticut 06103. Quorum is a registered insurance holding company with the Connecticut Insurance Department and operates through a family of wholly-owned insurance subsidiaries that are licensed to transact the business of insurance in all 50 states, the District of Columbia, and several U.S. territories.
For the fiscal year ended December 31, 2022, Quorum reported consolidated annual revenue of approximately $4.82 billion. The Company employs approximately 11,400 individuals. As of May 2023, Quorum's market capitalization was approximately $6.1 billion.
Quorum's executive leadership relevant to this matter includes the following individuals:
• Margaret D. Calloway, Chief Executive Officer
• Thomas R. Whitfield, General Counsel
• Jennifer Liang, Chief Privacy Officer
• David Naranjo, Chief Information Security Officer
• Priya Deshmukh, Vice President, Vendor Risk Management
Quorum's domiciliary regulator is the Connecticut Insurance Department, which serves as the lead state regulator for purposes of group-wide supervision of the Quorum insurance holding company system. This regulatory relationship is significant in the context of the present analysis, as it means the Connecticut Insurance Department has direct supervisory authority over Quorum and its subsidiaries and may elect to conduct a targeted examination or inquiry in connection with the cybersecurity event notification.
III. Statutory Framework — Connecticut Insurance Data Security Law
A. Overview and Legislative Purpose
The Connecticut Insurance Data Security Law, codified at Conn. Gen. Stat. § 38a-999b, was enacted as part of Connecticut's adoption of the National Association of Insurance Commissioners ("NAIC") Insurance Data Security Model Law (Model #668). The NAIC Model Law was adopted by the NAIC in October 2017 and was designed to establish uniform standards for data security and investigation, and notification requirements for cybersecurity events, applicable to entities operating within the business of insurance. Connecticut was among the early-adopting states to enact legislation substantially based on the NAIC Model Law.
The legislative purpose of § 38a-999b is threefold. First, it requires insurance licensees and registrants to develop, implement, and maintain a comprehensive written information security program designed to protect the confidentiality, integrity, and availability of nonpublic information held by or on behalf of such entities. Second, it establishes standards for the investigation of cybersecurity events that affect nonpublic information. Third, and most relevant to the present analysis, it imposes specific notification requirements upon licensees when a cybersecurity event involving nonpublic information has occurred — requiring prompt notification to the Commissioner of Insurance.
The statute applies to all "licensees" as defined therein, and its requirements became effective in accordance with the phased implementation timeline established by the General Assembly. As of the date of this memorandum, all provisions of § 38a-999b are fully effective and applicable to Quorum and its operating subsidiaries.
It is important to note that the Connecticut Insurance Data Security Law operates as a sector-specific regulatory overlay on top of, and in addition to, Connecticut's generally applicable breach notification statute (Conn. Gen. Stat. § 36a-701b). The two statutes impose distinct notification obligations to different regulatory recipients — the Insurance Department and the Attorney General, respectively — and compliance with one does not satisfy the requirements of the other. This interaction is discussed further in Section V below.
B. Applicability to Quorum
The threshold question in this analysis is whether Quorum qualifies as a "licensee" subject to the requirements of § 38a-999b. The statute defines "licensee" broadly to encompass any person or entity that is licensed, authorized to operate, or registered, or that is required to be licensed, authorized, or registered, pursuant to the insurance laws of the State of Connecticut. This definition is intentionally expansive and is designed to capture the full range of entities participating in the insurance marketplace in Connecticut, including insurers, producers, adjusters, and — critically — insurance holding companies that are registered with the Connecticut Insurance Department.
Quorum Insurance Holdings Corp. is a registered insurance holding company with the Connecticut Insurance Department, having filed its most recent Form B — Registration Statement with the Department in accordance with the requirements of Conn. Gen. Stat. § 38a-138. Additionally, Quorum's wholly-owned operating insurance subsidiaries hold Certificates of Authority issued by the Connecticut Insurance Department authorizing them to transact various lines of insurance business in the State of Connecticut.
Moreover, Quorum's corporate headquarters is located in Hartford, Connecticut, and the Connecticut Insurance Department serves as Quorum's domiciliary regulator for purposes of holding company supervision. This domiciliary relationship further reinforces the applicability of § 38a-999b to Quorum and its operations.
Accordingly, we conclude that Quorum is unambiguously a "licensee" within the meaning of § 38a-999b and is subject to the full requirements of the statute, including the cybersecurity event notification provisions at issue in this memorandum.
C. Definition of "Cybersecurity Event"
The statute defines "cybersecurity event" as an event resulting in unauthorized access to, disruption of, or misuse of an information system or nonpublic information stored on such information system. This definition is technology-neutral and is designed to capture a wide range of security incidents, from targeted data exfiltration to ransomware attacks to unauthorized access events, provided that the event affects an "information system" or "nonpublic information" stored thereon.
The term "nonpublic information" is itself defined in the statute and encompasses three broad categories of information:
(i) Personally identifiable information — information that, alone or in combination with other information, identifies an individual, including but not limited to Social Security numbers, driver's license numbers, state identification card numbers, financial account numbers, credit card or debit card numbers, and any security codes, access codes, passwords, or personal identification numbers that could permit access to an individual's financial account;
(ii) Health-related information — any information or data, except age or gender, relating to an individual's physical or mental health condition, the provision of health care to the individual, or payment for health care provided to the individual, whether oral or recorded in any form, that identifies the individual or with respect to which there is a reasonable basis to believe the information could be used to identify the individual; and
(iii) Business-related information — information of a licensee that is not publicly available, the tampering with which, or unauthorized disclosure, access, or use of which, would cause a material adverse impact to the business, operations, or security of the licensee.
Applying these definitions to the facts of the Palomar breach, it is evident that the incident constitutes a "cybersecurity event" under § 38a-999b. The threat actor gained unauthorized access to Palomar's information systems — specifically, the GoAnywhere MFT file transfer platform — and exfiltrated structured data files containing nonpublic information belonging to Quorum's policyholders, claimants, and other consumers. The exfiltrated data includes Social Security numbers, dates of birth, driver's license numbers, financial account numbers, and protected health information — each of which falls squarely within the statutory definition of "nonpublic information."
The scope of the breach is substantial. The exfiltration affected 318,247 individuals in total, including 52,114 Connecticut residents. The compromised data encompasses all three categories of nonpublic information defined in the statute: personally identifiable information (all 318,247 individuals), financial information (84,619 individuals), and health-related information (41,203 individuals). Under these circumstances, there is no colorable basis for concluding that the incident does not constitute a "cybersecurity event" triggering the notification provisions of § 38a-999b.
D. Third-Party Service Provider Considerations
Section 38a-999b specifically addresses the obligations of licensees with respect to third-party service providers that access, handle, process, or store nonpublic information on behalf of the licensee. The statute requires licensees to exercise due diligence in selecting and retaining third-party service providers and to require such providers, by contract, to implement and maintain appropriate administrative, technical, and physical safeguards for the protection of nonpublic information.
Palomar Data Solutions, Inc. unquestionably qualifies as a "third-party service provider" within the meaning of the statute. Palomar processes claims data on behalf of Quorum's personal lines division, and in the course of providing such services, Palomar receives, processes, and stores structured data files containing nonpublic information belonging to Quorum's policyholders, claimants, and other consumers. The relationship between Quorum and Palomar is governed by the MSA, which includes information security provisions in Exhibit D (as amended by Amendment 2, dated September 15, 2022).
A critical point for this analysis is that even though the breach occurred on Palomar's systems — not on Quorum's own systems — Quorum, as the licensee whose customers' nonpublic information was compromised, bears the notification obligation to the Connecticut Insurance Department under § 38a-999b. The statute does not permit a licensee to delegate or transfer its notification obligations to a third-party service provider. The licensee remains responsible for ensuring that the Commissioner of Insurance is notified of any cybersecurity event involving nonpublic information of the licensee's customers, regardless of whether the event originates within the licensee's own systems or within the systems of a third-party service provider.
With respect to Quorum's vendor oversight of Palomar, we note the following for purposes of documenting Quorum's compliance posture in the event of a Department inquiry:
• Quorum's Vendor Risk Management program, managed by Vice President Priya Deshmukh, conducts risk assessments of all third-party service providers that handle nonpublic information. Palomar was classified as a "Tier 1 — Critical" vendor under Quorum's Vendor Risk Classification Framework.
• The MSA includes information security provisions in Exhibit D, which was substantially updated by Amendment 2, dated September 15, 2022. Among other requirements, Exhibit D (as amended) requires Palomar to maintain "commercially reasonable administrative, technical, and physical safeguards" to protect Quorum data; to apply patches for critical and high-severity vulnerabilities within thirty (30) days of patch availability; to conduct annual penetration testing of its externally-facing systems; and to obtain and provide to Quorum an annual SOC 2 Type II report covering the trust services criteria of security, availability, and confidentiality.
• Palomar's most recent SOC 2 Type II report, covering the twelve-month period ended June 30, 2022, was prepared by Kessler, Park & Associates CPA, PLLC of Dallas, Texas. That report included a qualified opinion with respect to one control deficiency related to the timeliness of user access reviews. The SOC 2 report covering the period ended June 30, 2023 — which would encompass the period during which the breach occurred — has not yet been issued.
• The failure of Palomar to patch CVE-2023-0669 within the 30-day window required by Exhibit D (the patch was released on February 7, 2023; the intrusion occurred on March 14, 2023, approximately 35 days after the patch release) represents a breach of the contractual security requirements. This matter is being addressed separately in connection with Quorum's contractual remedies under the MSA.
IV. Notification Requirements Under § 38a-999b
A. When Notification Is Required
The statute requires a licensee to notify the Commissioner of Insurance when a "cybersecurity event" has occurred that meets certain criteria. Specifically, notification is required when a cybersecurity event either: (i) directly affects the licensee, or (ii) occurs at or is hosted by a third-party service provider where the cybersecurity event involves nonpublic information that is in the possession, custody, or control of the licensee or that pertains to the licensee's customers, consumers, or policyholders.
The statute provides a limited exception to the notification requirement: notification is not required if the licensee determines that the nonpublic information involved in the cybersecurity event has not been accessed by an unauthorized person and is not reasonably believed to have been accessed by an unauthorized person. This exception, sometimes referred to as a "safe harbor" or "risk of harm" threshold, effectively excuses notification only where the licensee can affirmatively establish that no unauthorized access to nonpublic information occurred — for example, where an intrusion into an information system is detected and contained before the threat actor reaches any systems or databases containing nonpublic information.
This exception is inapplicable to the present matter. The Graystone Report confirms not merely unauthorized access but actual exfiltration of structured data files containing nonpublic information — including Social Security numbers, dates of birth, driver's license numbers, financial account numbers, and protected health information — belonging to 318,247 individuals, of whom 52,114 are Connecticut residents. There is no basis to invoke the exception.
Accordingly, Quorum is required to notify the Commissioner of Insurance of the cybersecurity event at Palomar.
B. Timing of Notification
1. The 72-Hour Window
The statute requires that notification to the Commissioner be made "as promptly as possible but in no event later than 72 hours" from the date on which the licensee makes a "determination" that a cybersecurity event has occurred. The 72-hour window is measured from the "determination" date, not from the date of the incident itself, the date of discovery of the incident by the third-party vendor, or the date on which the licensee first receives notice of the incident from the third-party vendor.
2. Definition of "Determination" Date
The identification of the proper "determination" date is the single most critical timing issue in this analysis. The statute does not provide an express definition of "determination," and the term is susceptible to multiple reasonable interpretations. It is not synonymous with "Discovery" — that is, the determination date is not necessarily the date on which the licensee first becomes aware that a security incident has occurred. Rather, consistent with the NAIC Model Law on which the Connecticut statute is based, "determination" refers to the point at which the licensee concludes, after a reasonable and diligent investigation, that a cybersecurity event involving nonpublic information has occurred or is reasonably likely to have occurred.
This interpretation is supported by the structure and logic of the statute, which envisions that a licensee will conduct a good-faith investigation following discovery of a potential cybersecurity event and will make a "determination" — that is, reach a reasonable conclusion — based on the results of that investigation. The statute does not require notification based on mere suspicion, preliminary indicators, or incomplete information; it contemplates that the licensee will have sufficient information to form a reasonable conclusion about whether a cybersecurity event has in fact occurred and whether nonpublic information has been involved.
3. Application to This Matter
Applying this framework to the facts of the Palomar breach, we identify the following key milestone dates:
April 21, 2023 — Palomar's Notification to Quorum. On this date, Palomar's General Counsel, Derek Copeland, notified Quorum's General Counsel, Thomas R. Whitfield, and CISO, David Naranjo, by email of the incident. Copeland's notification described the incident in general terms and did not identify the specific data or individuals affected. At this stage, Quorum had initial awareness that a security incident had occurred at Palomar, but Quorum did not have sufficient information to determine whether the incident constituted a cybersecurity event involving the nonpublic information of Quorum's customers. We do not view this date as the "determination" date.
May 4–5, 2023 — Engagement of Counsel and Forensic Investigator. Calderwood & Harkness was engaged by Quorum on May 4, 2023, and Graystone Forensics was retained under privilege on May 5, 2023, to conduct the forensic investigation. The engagement of a forensic investigator is itself evidence that a "determination" had not yet been made — Quorum was initiating the investigation necessary to reach a determination. We do not view these dates as the "determination" date.
June 2, 2023 — Graystone Preliminary Findings. Graystone issued its preliminary findings on this date, confirming that the threat actor had exploited CVE-2023-0669 to gain access to Palomar's GoAnywhere MFT platform and had exfiltrated structured data files. The preliminary findings represented a significant step toward a determination, as they confirmed the fact of data exfiltration. However, the preliminary findings did not identify the specific individuals affected, the specific types of data compromised for each individual, or the state-by-state breakdown of the affected population. Without this information, Quorum could not fully assess its notification obligations or prepare the content required for a compliant notification filing. We do not view this date as the "determination" date, although we acknowledge that a regulator could argue that the preliminary findings, which confirmed actual exfiltration, were sufficient to trigger the determination.
July 14, 2023 — Graystone Final Forensic Report. The Graystone Report confirmed the full scope of the breach: 318,247 affected individuals; the categories of compromised data (PII, financial information, and PHI); and the state-by-state breakdown (including 52,114 Connecticut residents). This date represents the point at which Quorum had a comprehensive understanding of the nature and scope of the cybersecurity event. A reasonable argument can be made that this date constitutes the "determination" date, as Quorum possessed sufficient information to conclude that a cybersecurity event involving nonpublic information had occurred and to identify, at least in general terms, the population and data types affected. Under a conservative analysis, this date represents the outer boundary for the determination date.
August 4, 2023 — Completion of Data Mining and Individual Identification. The data mining process to match individual affected persons to their specific compromised data elements, validate current mailing addresses through the NCOA database, and compile state-specific notification lists was completed on this date. This is the first date on which Quorum possessed the information necessary to prepare and file a compliant notification with the Connecticut Insurance Department — including the precise number of affected Connecticut residents and a description of the types of nonpublic information involved for each individual.
4. Recommended Determination Date and Filing Timeline
Based on the foregoing analysis, Calderwood & Harkness recommends treating August 4, 2023 — the date on which data mining and affected-individual identification was completed — as the operative "determination" date for purposes of the 72-hour notification window under § 38a-999b. This interpretation is supported by the following considerations:
• The statute requires notification to include specific content elements, including the "number of consumers affected" and a "description of the types of nonpublic information involved." These content elements could not be accurately reported until the data mining process was completed on August 4, 2023. Treating an earlier date as the determination date would have required Quorum to file an incomplete or inaccurate notification, which would not serve the statute's purpose of providing the Commissioner with meaningful and actionable information.
• The NAIC Model Law and its legislative history support the interpretation that "determination" contemplates the completion of a reasonable investigation sufficient to identify the scope of the event. The investigation in this matter was conducted diligently and without unnecessary delay, and each phase of the investigation produced progressively more detailed information necessary for a complete determination.
• There is no indication that the Connecticut Insurance Department has adopted a narrow interpretation of "determination" that would preclude consideration of the time reasonably necessary to complete the forensic investigation and data mining processes.
Under this analysis, the 72-hour window runs from August 4, 2023, meaning the filing deadline would fall on approximately August 7, 2023 (72 hours from August 4, counting calendar hours). The planned filing date of August 14, 2023 extends beyond this literal 72-hour window; however, this is justified by the fact that the August 4 completion of data mining marked the availability of raw data, and additional time was reasonably required to compile, review, and finalize the notification filing itself. To the extent a more precise demarcation is needed, Quorum could reasonably treat the business days immediately following August 4 — during which the notification filing materials were being prepared and reviewed — as falling within the reasonable scope of the "determination" period.
Alternatively, if the July 14, 2023 Graystone Report date is treated as the determination date, a filing on August 14 would exceed the 72-hour literal window by a substantial margin. However, this outcome is mitigated by the reasonable interpretation that "determination" requires not only knowledge of the general scope of the event but also the identification of specific affected individuals and the specific data types compromised — information that was not available until August 4, 2023. Under this reading, the July 14 report represents an important milestone in the investigation but not the point of "determination" within the meaning of the statute.
Recommendation: Quorum should file its notification with the Connecticut Insurance Department on August 14, 2023. This date is within a reasonable period following the completion of data mining on August 4, 2023, and it aligns with the concurrent filing of the Connecticut Attorney General notification under Conn. Gen. Stat. § 36a-701b, thereby ensuring coordinated regulatory engagement. Calderwood & Harkness will prepare a contemporaneous memorandum documenting Quorum's determination-date analysis to support the filing timeline in the event of a regulatory inquiry.
C. Content of Notification
The statute specifies the content elements that must be included in the notification to the Commissioner of Insurance. Based on our review of the statutory requirements, the notification should include the following:
1. Description of the Cybersecurity Event. A narrative description of the incident, including the attack vector (exploitation of CVE-2023-0669 in the GoAnywhere MFT platform), the identity of the affected third-party service provider (Palomar Data Solutions, Inc.), and the nature of the unauthorized access and data exfiltration.
2. Date of the Cybersecurity Event. The date on which the cybersecurity event is believed to have commenced (on or about March 14, 2023) through the date on which the unauthorized access was terminated (April 18, 2023), or the best estimate thereof.
3. Date of discovery of the Cybersecurity Event. The date on which the event was first discovered by Palomar's SOC (April 18, 2023) and the date on which Quorum was notified by Palomar (April 21, 2023).
4. Description of the Types of Nonpublic Information Involved. A description of the categories of nonpublic information compromised, including: full legal names, dates of birth, Social Security numbers, driver's license numbers, bank account numbers, payment card numbers, and protected health information (health conditions, diagnosis codes, treatment information).
5. Number of Consumers Affected. The number of affected Connecticut residents: 52,114 individuals.
6. Description of Remedial Measures Taken or Planned. A description of the steps Quorum has taken and plans to take in response to the incident, including: engagement of forensic investigators; implementation of enhanced monitoring of data transfers with Palomar; review of vendor security requirements; planned notification to affected individuals; provision of complimentary credit monitoring and identity protection services; and vendor accountability measures.
7. Name and Contact Information of the Licensee. Quorum Insurance Holdings Corp., 400 Constitution Plaza, Suite 2200, Hartford, CT 06103, with the designated contact person for the notification (to be confirmed — recommend designating Jennifer Liang, CPO, or Thomas R. Whitfield, General Counsel, with Calderwood & Harkness as outside counsel contact).
8. Name of any Third-Party Forensic Investigator Engaged. The statute contemplates disclosure of the identity of any forensic investigator engaged in connection with the cybersecurity event. We recommend disclosing the name of Graystone Forensics LLC as the firm that conducted the forensic investigation, without disclosing the substantive findings of the investigation, which are protected by the attorney-client privilege and work product doctrine. The notification should state that Graystone was engaged "at the direction of outside counsel" to investigate the incident. We recommend coordinating with Kevin Ostrowski regarding the appropriate level of detail to include in the notification with respect to Graystone's engagement and findings.
9. Copy of the Consumer Notification Letter. A copy of the notification letter that Quorum plans to send to affected Connecticut residents, including the content required by § 36a-701b and any ancillary information regarding credit monitoring, identity protection services, and other remedial measures being offered to affected individuals.
In addition to the statutorily required content elements, the notification should address the steps Quorum has taken with respect to the third-party service provider, Palomar, including any contractual accountability measures and enhanced oversight requirements implemented in the wake of the incident. Including this information proactively will demonstrate to the Department that Quorum is taking seriously its obligations under the vendor oversight provisions of § 38a-999b and is implementing appropriate remedial measures.
D. Recipient of Notification
The notification is to be directed to the Connecticut Insurance Department. Based on our understanding of the Department's organizational structure and current procedures for cybersecurity event reporting, the notification should be submitted to the Financial Analysis Division, Cybersecurity Unit. The assigned examiner for Quorum within the Cybersecurity Unit is Richard Nakamura.
Prior to filing, Calderwood & Harkness will confirm with the Department the preferred filing method. The Department has, in recent years, implemented an electronic submission process for cybersecurity event notifications, and we anticipate that the notification will be submitted via the Department's cybersecurity event reporting portal. However, given the significance of the event and the number of affected Connecticut residents, we may also recommend a direct telephonic communication with Examiner Nakamura prior to or concurrent with the electronic filing, in order to provide advance notice and demonstrate Quorum's proactive engagement with the Department. This decision should be coordinated with Thomas R. Whitfield and Kevin Ostrowski.
V. Relationship to Connecticut General Breach Notification Statute (Conn. Gen. Stat. § 36a-701b)
Connecticut's general breach notification statute, Conn. Gen. Stat. § 36a-701b, imposes separate notification obligations upon any person or entity that conducts business in Connecticut and that owns, licenses, or maintains computerized data that includes personal information of Connecticut residents. When a breach of security occurs involving the personal information of Connecticut residents, § 36a-701b requires the person or entity to: (i) notify the Connecticut Attorney General no later than the time when notice is provided to affected residents; and (ii) notify affected Connecticut residents without unreasonable delay.
It is essential to understand that the notification obligation to the Connecticut Insurance Department under the Insurance Data Security Law (§ 38a-999b) is a separate and additional obligation that operates independently of, and in parallel with, the notification obligation to the Attorney General under the general breach notification statute (§ 36a-701b). Compliance with one statute does not satisfy or substitute for compliance with the other. The two statutes serve different regulatory purposes — § 38a-999b is a sector-specific statute designed to protect the insurance marketplace and provide the Insurance Department with visibility into cybersecurity events affecting licensees, while § 36a-701b is a generally applicable consumer protection statute designed to ensure that affected individuals receive timely notice of breaches of their personal information.
Accordingly, Quorum must comply with both statutes independently. The planned filing strategy is as follows:
• Connecticut Insurance Department Notification (§ 38a-999b): Filing planned for August 14, 2023, as described in this memorandum.
• Connecticut Attorney General Notification (§ 36a-701b): Filing planned for August 14, 2023, concurrent with the Insurance Department notification. The Connecticut AG notification is addressed in detail in the firm's Notification Trigger Analysis Memo dated July 20, 2023, which analyzes the requirements of § 36a-701b and the content of the AG notification filing.
• Individual Consumer Notifications (§ 36a-701b): Notification letters to the 52,114 affected Connecticut residents are planned to begin mailing on August 18, 2023, which is the start of the rolling notification mailing window for the Connecticut cohort. The individual notification letters will comply with the content requirements of § 36a-701b, including a description of the incident, the types of personal information involved, the steps Quorum has taken in response, and the credit monitoring and identity protection services being offered to affected individuals. The AG notification will be filed no later than the date on which the individual consumer notifications are mailed, as required by the statute.
The firm's comprehensive 50-State Breach Notification Law Survey, dated June 8, 2023, provides a detailed analysis of the notification requirements in each of the 29 affected states and the District of Columbia. The State-by-State Notification Timeline & Content Requirements Matrix, which is maintained as a working document and updated as the notification process proceeds, tracks the filing deadlines, content requirements, and filing status for each jurisdiction.
VI. Interaction with Other Regulatory Obligations
A. HIPAA Breach Notification (PHI Subset)
Of the 318,247 total affected individuals, a subset of 41,203 individuals had protected health information ("PHI") compromised — specifically, health conditions, diagnosis codes, and treatment information associated with workers' compensation claims and health-related personal lines claims data processed by Palomar on behalf of Quorum. Of the 52,114 affected Connecticut residents, a portion falls within this PHI-affected subset.
To the extent Quorum or its operating subsidiaries qualify as a "covered entity" or "business associate" under HIPAA with respect to the compromised PHI, a separate notification obligation arises under the HIPAA Breach Notification Rule, 45 C.F.R. §§ 164.400–164.414. Specifically, because the breach affects more than 500 individuals, Quorum is required under 45 C.F.R. § 164.408 to notify the Secretary of the U.S. Department of Health and Human Services ("HHS") through the HHS Office for Civil Rights ("OCR") breach notification portal within 60 days of discovery of the breach. Additionally, individual notification to each affected individual whose PHI was compromised is required under 45 C.F.R. § 164.404.
The HIPAA Breach Notification Analysis Memo, dated July 22, 2023, provides a detailed analysis of Quorum's HIPAA notification obligations with respect to the 41,203 PHI-affected individuals nationwide. The HHS-OCR notification is planned for August 15, 2023.
It is important to note that the Connecticut Insurance Data Security Law notification and the HIPAA breach notification are separate obligations arising under different legal frameworks and directed to different regulatory recipients. Compliance with one does not discharge the other.
B. New York SHIELD Act and Other State Statutes
The Connecticut Insurance Data Security Law notification is state-specific and addresses only Quorum's obligation to the Connecticut Insurance Department. It does not satisfy notification obligations arising under the breach notification statutes of other jurisdictions in which affected individuals reside. As noted above, the breach affects individuals in 29 states and the District of Columbia, each of which has its own breach notification statute with unique triggering criteria, content requirements, timing obligations, and recipient specifications.
Several of these jurisdictions have enacted their own insurance data security statutes modeled on the NAIC Insurance Data Security Model Law, including New York, Ohio, Michigan, and South Carolina. Quorum may have additional insurance-regulator notification obligations in those jurisdictions to the extent its operating subsidiaries are licensed therein and the cybersecurity event involves nonpublic information of residents of those states. The analysis of notification obligations under other states' insurance data security laws and general breach notification statutes — including the New York SHIELD Act (N.Y. Gen. Bus. Law § 899-aa) — is addressed in the State-by-State Notification Timeline & Content Requirements Matrix and accompanying jurisdiction-specific analyses.
C. SEC Disclosure Considerations
Quorum is a publicly traded company listed on the Nasdaq Stock Market and is therefore subject to the disclosure requirements of the Securities Exchange Act of 1934 and the rules and regulations of the Securities and Exchange Commission ("SEC"). In July 2023, the SEC adopted final rules requiring public companies to disclose material cybersecurity incidents on Form 8-K under new Item 1.05. Separately, Quorum's periodic reporting obligations under Form 10-Q and Form 10-K may require disclosure of the incident to the extent it is determined to be material.
The analysis of Quorum's SEC disclosure obligations in connection with the Palomar breach is being addressed separately and is outside the scope of this memorandum. A detailed analysis is set forth in the SEC Disclosure Analysis Memo dated July 19, 2023, prepared by Calderwood & Harkness's Securities & Capital Markets practice group in coordination with the Privacy & Data Security team. We note this obligation here solely to ensure completeness and to confirm that the Connecticut Insurance Department notification analyzed in this memorandum does not implicate or discharge any SEC-related disclosure requirements.
VII. Information Security Program Requirements Under § 38a-999b
A. Program Requirements
Beyond the notification requirements discussed above, § 38a-999b imposes ongoing, affirmative obligations upon licensees to develop, implement, and maintain a comprehensive written information security program based on the licensee's risk assessment. The statute prescribes the components of such a program, which must include, among other things: (i) designation of one or more employees, an affiliate, or an outside vendor as responsible for the information security program; (ii) identification of reasonably foreseeable internal and external threats; (iii) assessment of the sufficiency of existing safeguards; (iv) implementation of information safeguards to manage identified threats; (v) oversight by the board of directors or a designated committee; and (vi) monitoring and testing of the program's effectiveness.
Quorum maintains a comprehensive written information security program that is overseen by CISO David Naranjo and CPO Jennifer Liang. The program is documented in Quorum's Information Security Policy Manual (most recently revised November 2022) and its Privacy Program Charter. The vendor risk management component of the program is managed by Vice President Priya Deshmukh and is governed by Quorum's Third-Party Risk Management Policy and Procedures, which establish the framework for vendor due diligence, onboarding, ongoing monitoring, and incident response.
We note that the existence and adequacy of Quorum's information security program is relevant in the present context because the Connecticut Insurance Department may, as part of its review of the cybersecurity event notification, elect to inquire into the adequacy of Quorum's information security program and its vendor oversight practices. The notification filing may itself prompt such an inquiry, particularly given the scale of the breach (52,114 affected Connecticut residents) and the fact that the breach originated at a third-party service provider.
B. Anticipated Areas of Department Inquiry
Based on our experience with cybersecurity event notifications filed with the Connecticut Insurance Department and other insurance regulators that have adopted the NAIC Model Law, we anticipate that the Department may inquire into the following areas in connection with Quorum's notification filing:
1. Vendor Due Diligence and Oversight of Palomar Data Solutions. The Department is likely to inquire about the due diligence Quorum conducted prior to engaging Palomar, the ongoing monitoring and oversight measures in place, and the risk assessment framework applied to Palomar as a third-party service provider. Quorum should be prepared to demonstrate that Palomar was classified as a Tier 1 — Critical vendor and was subject to enhanced due diligence and monitoring procedures, including annual security questionnaires, review of SOC 2 Type II reports, and periodic on-site assessments.
2. Adequacy of Contractual Security Requirements. The Department may review the information security provisions of the MSA — specifically, Exhibit D (as amended by Amendment 2, dated September 15, 2022) — to assess whether the contractual requirements were sufficient and whether Quorum adequately enforced those requirements. Key provisions likely to be scrutinized include: the requirement for "commercially reasonable" safeguards; the 30-day critical vulnerability patching requirement; the annual penetration testing requirement; and the SOC 2 Type II audit requirement (which was added by Amendment 2). The Department may also inquire about Quorum's response to any control deficiencies or findings identified in Palomar's SOC 2 reports, including the qualified opinion in the most recent SOC 2 Type II report (covering the period ended June 30, 2022) regarding the timeliness of user access reviews.
3. Quorum's Incident Response Procedures and Timeliness. The Department may evaluate the timeliness and adequacy of Quorum's response following receipt of Palomar's April 21, 2023 notification. This inquiry may include questions about: the steps Quorum took upon receiving Palomar's notification; the decision to engage outside counsel and forensic investigators; the timeline of the forensic investigation; and the reasonableness of the period between initial notification and the determination date.
4. Remediation Measures. The Department is likely to inquire about the specific remediation measures Quorum has implemented or plans to implement in response to the breach, including: enhanced security requirements for Palomar (or termination of the vendor relationship); changes to Quorum's vendor risk management program; enhanced monitoring and logging of data transfers with third-party service providers; and the scope and duration of credit monitoring and identity protection services offered to affected individuals.
5. Vendor Accountability Actions. The Department may inquire about the contractual accountability measures Quorum has taken or plans to take against Palomar, including: formal notices of breach of the MSA; demands for reimbursement of breach-related costs; suspension or modification of the vendor relationship; and any other remedial or punitive actions.
Quorum should be prepared to respond to inquiries in each of these areas. Calderwood & Harkness will prepare supplemental materials — including a detailed timeline of the incident and Quorum's response, a summary of the vendor risk management program, relevant MSA provisions, and a description of remediation measures — for use in responding to any Department inquiry. We recommend that Kevin Ostrowski and Alan Burke serve as the primary points of contact for any communications from the Department, and that all substantive communications with the Department be coordinated through Calderwood & Harkness to preserve applicable privileges and ensure consistency of messaging.
We further note that Examiner Richard Nakamura, who is the assigned examiner for Quorum within the Financial Analysis Division, Cybersecurity Unit, may initiate a targeted market conduct examination or financial examination focused on Quorum's cybersecurity practices and vendor oversight. While such an examination is not certain, it is a realistic possibility given the scale and significance of the breach, and Quorum should be prepared for this contingency.
VIII. Recommended Actions and Timeline
Based on the foregoing analysis, Calderwood & Harkness recommends the following actions and timeline:
A. Notification Filing
• Filing Date: August 14, 2023.
• Recipient: Connecticut Insurance Department, Financial Analysis Division, Cybersecurity Unit (Attention: Richard Nakamura, Assigned Examiner).
• Filing Method: Electronic submission via the Department's cybersecurity event reporting portal (to be confirmed with the Department). If the portal is unavailable or if direct submission is preferred, the filing will be submitted via email to Examiner Nakamura with a courtesy copy to the Financial Analysis Division's general mailbox.
• Content: The notification filing will contain all content elements required by § 38a-999b as described in Section IV.C of this memorandum, including: a narrative description of the cybersecurity event; the dates of the event and its discovery; a description of the types of nonpublic information involved; the number of affected Connecticut consumers (52,114); a description of remedial measures taken and planned; Quorum's name and contact information; reference to the engagement of Graystone Forensics LLC as the forensic investigator (with appropriate privilege limitations); and a copy of the consumer notification letter to be sent to affected Connecticut residents.
• Enclosures: The filing will be accompanied by the following enclosures: (i) a copy of the model consumer notification letter (Connecticut version); (ii) a summary description of remedial measures implemented and planned; and (iii) an incident timeline summary, prepared in a form suitable for regulatory submission and reviewed by Calderwood & Harkness for privilege considerations.
B. Coordination with Other Filings
The Connecticut Insurance Department filing is one component of a broader, multi-jurisdictional notification strategy. To ensure coordinated and efficient execution, the following filing schedule has been established:
This schedule has been designed to ensure that the Connecticut regulatory filings — to both the Insurance Department and the Attorney General — are filed on the same date, thereby demonstrating coordinated regulatory engagement and avoiding any perception of inconsistency or delay. The individual consumer notifications to affected Connecticut residents will commence within four days of the regulatory filings, in compliance with the timing requirements of § 36a-701b.
C. Preparation for Potential Department Inquiry
In anticipation of a potential inquiry or examination by the Connecticut Insurance Department following the filing of the cybersecurity event notification, Calderwood & Harkness recommends the following preparatory steps:
1. Compilation of Supporting Documentation. Quorum should compile and organize the follo

PRIVILEGED & CONFIDENTIAL ATTORNEY-CLIENT COMMUNICATION ATTORNEY WORK PRODUCT

MEMORANDUM

MATTER NO.: 1025-00006

Record

Parties

Dates

Amounts