PRIVILEGED AND CONFIDENTIAL — ATTORNEY-CLIENT PRIVILEGE / ATTORNEY WORK PRODUCT
MEMORANDUM
TO: Alan Burke, Lead Associate, Privacy & Data Security, Calderwood & Harkness LLP Kevin Ostrowski, Responsible Partner, Privacy & Data Security, Calderwood & Harkness LLP
FROM: Sara Hendricks, Working Associate, Privacy & Data Security, Calderwood & Harkness LLP
DATE: July 23, 2023
RE: New York SHIELD Act Compliance Analysis — Quorum Insurance Holdings Corp. Data Breach Incident
MATTER NO.: 1025-00006
CLIENT: Quorum Insurance Holdings Corp.
I. Executive Summary
The purpose of this memorandum is to analyze the obligations of our client, Quorum Insurance Holdings Corp. ("Quorum" or the "Company"), under the New York Stop Hacks and Improve Electronic Data Security Act (the "SHIELD Act"), codified at N.Y. Gen. Bus. Law § 899-aa, in connection with the vendor-originated data breach incident at Palomar Data Solutions, Inc. ("Palomar"). This analysis is prepared at the direction of counsel to facilitate the provision of legal advice and is protected by the attorney-client privilege and the attorney work product doctrine.
Based on the factual record established by the forensic investigation conducted by Graystone Forensics LLC and the data mining completed by the Quorum incident response team, it is my conclusion that Quorum is required to provide notification to 47,831 affected New York residents whose private information was accessed and exfiltrated during the breach. In addition, Quorum is required to concurrently notify the New York Attorney General, the New York Department of State, and the New York Division of State Police of the breach incident, consistent with the requirements of N.Y. Gen. Bus. Law § 899-aa(8).
The breach triggers notification under multiple categories of "private information" as defined by the SHIELD Act, including Social Security numbers, driver's license numbers, and financial account information, each in combination with the names of affected individuals. The data exfiltrated from Palomar's systems was stored in unencrypted structured format, and therefore the encryption safe harbor under the SHIELD Act does not apply.
Quorum's SHIELD Act notification obligations have been triggered, and Quorum should proceed with notification on the planned timeline. Specifically, consumer notification mailings should begin on August 18, 2023, and regulatory filings to the New York Attorney General and other state agencies should be filed on August 16, 2023, which is two days prior to the commencement of consumer mailings. This timeline satisfies the SHIELD Act's requirement that notification be provided "in the most expedient time possible and without unreasonable delay."
In summary, I recommend the following:
• Consumer notification letters addressed to affected New York residents should be finalized to comply with all SHIELD Act content requirements, including a description of the categories of information compromised, contact information for the Company and the major credit reporting agencies, and the toll-free telephone numbers and addresses of the Federal Trade Commission and the New York Attorney General's Office.
• Concurrent notification to the New York Attorney General (Bureau of Internet and Technology), the New York Department of State, and the New York Division of State Police is required and should be filed on August 16, 2023, with copies of the consumer notification letter and the information specified by the statute.
• Quorum should also be prepared to demonstrate compliance with the SHIELD Act's reasonable security safeguards requirement, codified at N.Y. Gen. Bus. Law § 899-bb, to mitigate enforcement risk. Although the breach originated entirely within Palomar's environment, the SHIELD Act's service provider provisions may subject Quorum's vendor oversight practices to scrutiny by the New York Attorney General.
The balance of this memorandum sets forth the factual background, the statutory framework, and the detailed analysis supporting these conclusions and recommendations.
II. Background and Factual Summary
A. The Incident
On or about March 14, 2023, a threat actor exploited CVE-2023-0669, a known remote code execution vulnerability in a Vireo Health IT (Managed File Transfer) file transfer appliance operated by Palomar Data Solutions, Inc. ("Palomar"), Quorum's third-party claims-processing vendor. The CVE-2023-0669 vulnerability had been publicly disclosed by Severin Corporation on February 1, 2023, and a patch was made available on February 7, 2023. Despite the availability of the patch and the public disclosure of the vulnerability — including its active exploitation in the wild by the Cl0p ransomware group — Palomar failed to apply the patch to the affected GoAnywhere MFT appliance within the timeframe required by both industry best practices and Palomar's contractual obligations to Quorum.
Following the initial exploitation, the threat actor maintained unauthorized access to Palomar's GoAnywhere MFT environment and conducted data exfiltration over an approximately 35-day window, from March 14, 2023, through April 18, 2023. During this period, the threat actor accessed and exfiltrated structured data files containing personally identifiable information, financial account information, and protected health information belonging to individuals whose data was processed through Palomar's claims-processing systems on behalf of Quorum and other Palomar clients.
Palomar's security operations center ("SOC") detected anomalous outbound data transfers on April 18, 2023, at approximately 3:47 a.m. Eastern Time. Following the detection, Palomar's internal incident response team confirmed the compromise of the GoAnywhere MFT appliance and initiated containment procedures, including isolation of the affected system from the network, revocation of compromised credentials, and engagement of its own third-party forensic firm.
Palomar notified Quorum of the incident on April 21, 2023, via email from Derek Copeland, Palomar's General Counsel, to Thomas R. Whitfield, Quorum's General Counsel, and David Naranjo, Quorum's Chief Information Security Officer ("CISO"). This notification was approximately 24 hours late per the contractual breach notification requirement set forth in Section 9.4 of the Master Services Agreement dated November 12, 2019 (the "MSA"), as amended by MSA Amendment 1 (effective March 1, 2021) and MSA Amendment 2 (effective September 15, 2022). Section 9.4 of the MSA, as amended, requires Palomar to notify Quorum of any actual or reasonably suspected security incident involving Quorum data within 48 hours of discovery. Palomar's SOC detected the anomalous transfers on April 18 at approximately 3:47 a.m. Eastern, and the April 21 notification came approximately 72 hours after detection, exceeding the contractual window by approximately one day. The delayed notification and its implications for the Quorum-Palomar contractual relationship are addressed separately in the Vendor Indemnification Analysis Memo dated July 18, 2023.
Upon receipt of the Palomar notification, Quorum activated its internal incident response plan and established an incident response team under the direction of Thomas R. Whitfield (General Counsel), David Naranjo (CISO), Jennifer Liang (Chief Privacy Officer, "CPO"), and Priya Deshmukh (Vice President, Vendor Risk Management). Calderwood & Harkness LLP was engaged as external breach counsel on May 4, 2023, and on May 5, 2023, retained Graystone Forensics LLC under the direction and at the request of counsel to conduct a privileged forensic investigation of the breach.
B. Forensic Findings Relevant to New York
Graystone Forensics LLC issued its final forensic investigation report on July 14, 2023 (the "Graystone Report"). The Graystone Report confirmed the total scope of the data breach: 318,247 affected individuals across 29 states and the District of Columbia. The exfiltrated data originated from Palomar's claims-processing systems and included data processed on behalf of Quorum's insurance operating subsidiaries in connection with workers' compensation, health, automobile, and homeowners insurance claims.
The Graystone Report identified the affected population by state of residence based on the data mining and analysis process conducted by Quorum's internal data analytics team, with oversight and quality assurance by Graystone Forensics. The New York-specific findings are as follows:
• Total New York affected residents: 47,831 — the second-largest affected state population (after California, with 52,118 affected residents).
• Data types compromised for New York residents:
• Personally Identifiable Information (PII): Names, dates of birth, Social Security numbers, and driver's license numbers were compromised for all 47,831 New York individuals. These data elements were contained in the structured claims data files exfiltrated from the GoAnywhere MFT environment.
• Financial Account Information: Bank account numbers and/or payment card numbers were compromised for a subset of the affected New York residents. Nationwide, the Graystone Report identified 84,619 individuals whose financial account information was included in the exfiltrated files. The specific New York subset figure is to be derived from the ongoing data mining process. For purposes of this analysis, the nationwide financial data subset applies proportionally, resulting in an estimated 12,715 New York residents with compromised financial account information. The final New York-specific financial data count will be confirmed prior to notification.
• Protected Health Information (PHI): Health conditions, diagnosis codes, treatment information, and related clinical data from workers' compensation and health-related insurance claims were compromised for a subset of New York residents. Nationwide, 41,203 individuals had PHI included in the exfiltrated data. The specific New York PHI subset is similarly being derived from data mining and will be finalized prior to notification.
Data mining and affected individual identification for the New York population was completed on August 4, 2023, confirming the 47,831 New York-specific count and providing mailing addresses for all affected New York residents. The data mining process was conducted in accordance with the protocols established by Calderwood & Harkness in coordination with Quorum's data analytics team and Graystone Forensics.
C. Quorum's New York Nexus
Quorum Insurance Holdings Corp. is a Delaware corporation publicly traded on the Nasdaq Global Select Market (ticker: QIHC), with its principal offices located at 400 Constitution Plaza, Suite 2200, Hartford, Connecticut 06103. Quorum is a holding company that operates through a number of insurance subsidiaries licensed in all 50 states and the District of Columbia.
Quorum conducts substantial business in the State of New York through its insurance operating subsidiaries, including Quorum Property and Casualty Insurance Company of New York (a New York-domiciled insurer), Quorum Life Insurance Company (licensed in New York), and Quorum Specialty Insurance Company (authorized surplus lines insurer in New York). In addition, Quorum's proprietary digital underwriting platform, QuorumEdge, is used by New York-based insurance agents and brokers and processes applications and policy data for New York residents.
For purposes of the SHIELD Act, Quorum is a "person or business" that "owns or licenses" "computerized data which includes private information" of New York residents within the meaning of N.Y. Gen. Bus. Law § 899-aa(1). Quorum owns the data processed by Palomar under the MSA and retains all rights to such data under Section 7.2 of the MSA. Accordingly, Quorum falls squarely within the scope of the SHIELD Act's notification and data security requirements, and the analysis below proceeds on that basis.
III. SHIELD Act Statutory Framework
A. Applicability — N.Y. Gen. Bus. Law § 899-aa(1)
The SHIELD Act, enacted in 2019 and effective in stages through March 21, 2020, substantially expanded New York's existing data breach notification law. The statute applies broadly to "any person or business that owns or licenses computerized data which includes private information" of a resident of New York State. N.Y. Gen. Bus. Law § 899-aa(2).
Critically, the SHIELD Act does not require that the entity be headquartered, incorporated, or otherwise organized in New York. The statute applies to any entity, regardless of its domicile or principal place of business, that owns or licenses private information of New York residents. This expansive jurisdictional scope reflects the legislative intent to protect New York residents regardless of where their data is held or by whom it is processed. The legislative history of the SHIELD Act, including the sponsor's memorandum in support of the bill (S.B. 5575-B / A.B. 5635-B, 2019-2020 Regular Session), confirms that the statute was intended to extend protections to New York residents whose data is held by out-of-state entities.
Quorum, as a licensed insurer operating in New York through its subsidiaries and processing data of New York policyholders, claimants, and applicants, clearly falls within the statute's scope. Even if Quorum's corporate headquarters are in Hartford, Connecticut, the Company's ownership of private information belonging to 47,831 New York residents is sufficient to trigger the SHIELD Act's obligations.
The SHIELD Act was amended effective March 21, 2020, to expand the definition of "private information" beyond the original data elements (which were limited to Social Security numbers, driver's license numbers, and financial account numbers) to include biometric information and username/password combinations. The 2020 amendments also imposed affirmative data security obligations under the newly enacted N.Y. Gen. Bus. Law § 899-bb, discussed in Section V below. All references in this memorandum are to the statute as currently in effect.
B. Definition of "Private Information" — § 899-aa(1)(b)
The SHIELD Act defines "private information" by reference to two distinct categories, each of which independently triggers notification obligations when compromised in a breach.
Category 1 is defined as "personal information" — meaning any information concerning a natural person which, because of name, number, personal mark, or other identifier, can be used to identify such natural person — in combination with any one or more of the following data elements, when either the data element or the combination of personal information plus data element is not encrypted, or is encrypted with an encryption key that has also been accessed or acquired:
(i) Social Security number;
(ii) Driver's license number or non-driver identification card number;
(iii) Account number, credit or debit card number, in combination with any required security code, access code, password, or other information that would permit access to an individual's financial account;
(iv) Account number, credit or debit card number, if circumstances exist wherein such number could be used to access an individual's financial account without additional identifying information, security code, access code, or password;
(v) Biometric information, meaning data generated by electronic measurements of an individual's unique physical characteristics, such as a fingerprint, voice print, retina or iris image, or other unique physical representation or digital representation of biometric data which is used to authenticate or ascertain the individual's identity.
Category 2 is defined as a username or email address in combination with a password or security question and answer that would permit access to an online account.
Analysis for the Quorum Incident:
The data elements compromised in the Palomar breach fall squarely within Category 1 of the SHIELD Act's definition of private information. Specifically:
• Social Security Numbers: The Graystone Report confirmed that Social Security numbers were included in the exfiltrated claims data files for all 47,831 affected New York residents. These SSNs were stored in combination with the names of the individuals. This combination — name plus Social Security number — constitutes "private information" under § 899-aa(1)(b)(i) and triggers the notification obligation.
• Driver's License Numbers: Driver's license numbers (and, where applicable, non-driver identification card numbers) were similarly compromised in combination with names for the affected New York resident population. This combination constitutes "private information" under § 899-aa(1)(b)(ii).
• Financial Account Information: For the financial data subset (estimated at approximately 12,715 New York residents, pending final confirmation through data mining), bank account numbers and/or payment card numbers were compromised in combination with names. Based on the Graystone Report's findings, certain of the exfiltrated records included account numbers together with routing numbers sufficient to permit access to individuals' financial accounts without additional security codes or passwords. This combination constitutes "private information" under § 899-aa(1)(b)(iii) or (iv), depending on the specific data elements present for each individual.
• Biometric Information: There is no evidence that biometric information (fingerprints, voiceprints, retinal images, or similar data) was included in the exfiltrated data. Quorum does not collect biometric information in connection with its insurance claims processing, and Palomar's systems did not store biometric data.
• Username/Password Combinations: There is no evidence that username or email address combinations with passwords or security questions were included in the exfiltrated data. The compromised data consisted of structured claims processing records, not online account credentials.
Accordingly, the SHIELD Act's notification obligation is triggered under Category 1 based on the compromise of Social Security numbers, driver's license numbers, and financial account information, each in combination with the names of affected New York residents. Category 2 is not implicated by this breach.
C. Definition of "Breach of the Security of the System" — § 899-aa(1)(c)
The SHIELD Act defines a "breach of the security of the system" as "unauthorized access to or acquisition of, or access to or acquisition without valid authorization of, computerized data that compromises the security, confidentiality, or integrity of private information maintained by a business." N.Y. Gen. Bus. Law § 899-aa(1)(c).
The statute includes one limited exception: good-faith access by an employee or agent of the business for a legitimate purpose is not a breach, provided that the private information is not used or subject to unauthorized disclosure. This exception is narrowly construed and is intended to address situations where an authorized employee inadvertently accesses data outside the scope of their specific role but does not misuse or disclose that data.
Analysis: The threat actor's exploitation of CVE-2023-0669 to gain unauthorized access to Palomar's GoAnywhere MFT environment, and the subsequent exfiltration of structured data files containing private information of New York residents, constitutes a "breach of the security of the system" within the meaning of the SHIELD Act. The access was unauthorized; the threat actor had no valid authorization to access Palomar's systems or the data stored therein. The exfiltration compromised the security, confidentiality, and integrity of the private information. The good-faith employee exception does not apply, as the access was by an external threat actor, not an employee or agent of Quorum or Palomar acting in good faith for a legitimate purpose.
It bears noting that the SHIELD Act does not require proof that the compromised data was actually misused, sold on the dark web, or used for identity theft or fraud. The statute's definition of "breach" focuses on unauthorized access to or acquisition of the data, not on downstream harm. The Graystone Report confirmed that the threat actor accessed and exfiltrated the data; that finding alone is sufficient to establish a "breach of the security of the system" under the statute. While Quorum and Graystone Forensics have not identified evidence that the exfiltrated data has been publicly disseminated or used for fraudulent purposes as of the date of this memorandum, this fact does not negate the occurrence of a breach or the resulting notification obligations.
D. Encryption / Safe Harbor Analysis
The SHIELD Act provides a limited safe harbor from the notification obligation where the exposed data was encrypted and the encryption key was not also accessed or acquired by the unauthorized person. Specifically, notification is not required if the private information was encrypted with an encryption key that was not also compromised in the breach. N.Y. Gen. Bus. Law § 899-aa(1)(b).
Analysis: The Graystone Report's forensic findings indicate that the exfiltrated data files were stored in unencrypted structured format (specifically, delimited flat files and database exports) on Palomar's GoAnywhere MFT claims processing systems. Palomar did not apply encryption at rest to the files stored on the GoAnywhere MFT appliance, and the files were transmitted in cleartext within Palomar's internal network prior to exfiltration. Although the GoAnywhere MFT appliance supported encryption functionality for file transfers, the specific files at issue were stored locally in an unencrypted state at the time of exfiltration.
Accordingly, the encryption safe harbor does not apply. The SHIELD Act notification obligation is triggered without regard to any encryption-related defense.
IV. Notification Obligations
A. Consumer Notification Requirements — § 899-aa(2)
The SHIELD Act requires that "[a]ny person or business which owns or licenses computerized data which includes private information of a resident of New York shall disclose any breach of the security of the system following discovery or notification of the breach in the security of the system to any resident of New York state whose private information was, or is reasonably believed to have been, accessed or acquired by a person without valid authorization." N.Y. Gen. Bus. Law § 899-aa(2).
Trigger: The notification obligation is triggered upon the entity's "Discovery or notification" of the breach. In this case, Quorum received notification from Palomar on April 21, 2023. From that date forward, the SHIELD Act's timing requirements became operative.
Timing: The statute requires that notification be provided "in the most expedient time possible and without unreasonable delay." N.Y. Gen. Bus. Law § 899-aa(2). The statute further provides that notification may be delayed if consistent with "the legitimate needs of law enforcement" or if delay is necessary to "determine the scope of the breach and restore the reasonable integrity of the data system." Id.
Unlike certain other state breach notification statutes — such as those in Florida (30 days), Colorado (30 days), or Connecticut (60 days) — the SHIELD Act does not prescribe a specific day count for notification. Instead, it employs the flexible "most expedient time possible and without unreasonable delay" standard. This standard has not been the subject of significant judicial interpretation, but the New York Attorney General's enforcement guidance and public statements suggest that the AG's office evaluates the reasonableness of notification timing on a case-by-case basis, considering the totality of the circumstances, including the complexity of the forensic investigation, the data mining process, and the number of affected individuals.
Analysis of Quorum's Timeline: The following timeline is relevant to the reasonableness analysis:
Quorum has planned consumer notification mailings to begin on August 18, 2023. Given that the final forensic report was issued on July 14, 2023, and data mining for the New York population was completed on August 4, 2023, the notification timeline is reasonable under the SHIELD Act's "most expedient time possible" standard. The approximately two-week period between the completion of data mining (August 4) and the commencement of consumer mailings (August 18) is necessary for the drafting, review, and finalization of state-specific notification letters; the printing and preparation of mailing packages; the coordination of credit monitoring enrollment logistics with Clearfield Notification Services LLC; and the filing of regulatory notifications. This interval is consistent with the timeframes accepted by the New York Attorney General's office in prior enforcement matters and multistate investigations of comparable scope and complexity.
Furthermore, the period from Quorum's initial notification by Palomar (April 21, 2023) through the completion of the forensic investigation (July 14, 2023) reflects the legitimate and necessary steps of retaining counsel, engaging a forensic firm, conducting a thorough forensic investigation of a complex vendor-originated breach affecting over 318,000 individuals across 30 jurisdictions, and performing comprehensive data mining to identify affected individuals and the specific data elements compromised for each. This timeline is well within the range of timelines accepted as reasonable in comparable multistate breach incidents.
B. Content Requirements — § 899-aa(2)(b)
The SHIELD Act specifies the content that must be included in consumer notification letters. N.Y. Gen. Bus. Law § 899-aa(2)(b) requires that the notice include:
(i) Contact information for the person or business making the notification;
(ii) A description of the categories of information that were, or are reasonably believed to have been, accessed or acquired by a person without valid authorization, including a specification of which of the elements of private information and private information were or are reasonably believed to have been accessed or acquired;
(iii) The telephone number, toll-free if available, and the address of the person or business making the notification;
(iv) The toll-free telephone numbers and addresses of the major consumer reporting agencies; and
(v) The toll-free telephone numbers, addresses, and website addresses for the Federal Trade Commission and the New York Attorney General's Office, advising individuals that they may obtain information from these sources about steps to take to protect against identity theft.
These content requirements are mandatory and must be included in the notification letter. The New York Attorney General's office has historically reviewed notification letters for compliance with these content requirements, and deficiencies in content have been a basis for enforcement inquiry and remediation demands.
Recommendations for Quorum's New York Notification Letter:
Based on the foregoing statutory requirements, I recommend that Quorum's New York-specific notification letter include the following elements:
1. Description of Information Categories Compromised. The letter should clearly state the specific categories of information that were accessed and acquired by the unauthorized actor. For each recipient, the letter should identify the data elements applicable to that individual. Because the compromised data elements vary by individual (some individuals had only PII compromised, while others had PII plus financial data and/or PHI compromised), the letter should be tailored for each recipient. The following data elements should be described, as applicable:
• Full name
• Date of birth
• Social Security number
• Driver's license number or state identification card number
• Bank account number and/or payment card number (for the financial data subset)
• Health-related information, including health conditions, diagnosis codes, and treatment information (for the PHI subset)
2. Quorum Contact Information. The letter should include Quorum's contact information, including the toll-free telephone number for the dedicated call center operated by Clearfield Notification Services LLC. The call center should be identified as the point of contact for affected individuals who have questions about the incident or wish to enroll in the complimentary credit monitoring and identity theft protection services.
3. Major Credit Bureau Contact Information. The letter should include the toll-free telephone numbers and mailing addresses of the three major consumer reporting agencies:
• Harborview Enterprises: 1-800-685-1111; P.O. Box 740241, Atlanta, GA 30374; www.Harborview Enterprises.com
• Penrose Group: 1-888-397-3742; P.O. Box 9554, Allen, TX 75013; www.Penrose Group.com
• Penmark Enterprises: 1-800-916-8800; P.O. Box 2000, Chester, PA 19016; www.Penmark Enterprises.com
4. FTC Contact Information. The letter should include the toll-free telephone number, address, and website for the Federal Trade Commission: 1-877-382-4357; 600 Pennsylvania Avenue NW, Washington, D.C. 20580; www.ftc.gov/idtheft.
5. New York Attorney General Contact Information. The letter should include the contact information for the New York Attorney General's Office, Bureau of Internet and Technology: Office of the New York State Attorney General, Bureau of Internet and Technology, 28 Liberty Street, New York, NY 10005; 1-800-771-7755; www.ag.ny.gov.
6. Credit Monitoring Offer. The letter should describe the offer of 24-month complimentary credit monitoring and identity theft protection services provided through Clearfield Notification Services LLC, including instructions for enrollment and the enrollment deadline.
7. Protective Steps. The letter should include guidance on steps individuals can take to protect themselves against identity theft and fraud, including information regarding fraud alerts, credit freezes, monitoring of financial account statements, and review of explanation of benefits statements (for the PHI subset).
I will prepare a draft of the New York-specific notification letter incorporating these elements and circulate it to Alan Burke and Kevin Ostrowski for review by July 28, 2023, to allow sufficient time for revisions prior to the printing deadline.
C. Methods of Notification — § 899-aa(2)(a)
The SHIELD Act authorizes three methods of direct notification and one method of substitute notification:
Direct Notification Methods:
(1) Written notice — provided by mail to the last known home address of the affected individual.
(2) Electronic notice — provided via email, provided that the notice is consistent with the provisions of the federal Electronic Signatures in Global and National Commerce Act (E-SIGN Act), 15 U.S.C. § 7001 et seq., including the requirement that the individual has affirmatively consented to receive electronic communications.
(3) Telephone notice — provided directly to the affected individual by telephone, subject to specific requirements to ensure the individual receives the notification.
Substitute Notification:
Substitute notice is permitted if the entity demonstrates that (a) the cost of providing direct notification would exceed $250,000, or (b) the affected class exceeds 500,000 persons, or (c) the entity does not have sufficient contact information to provide direct notice. If substitute notice is employed, it must consist of all of the following:
(i) Email notice, when an email address is available;
(ii) Conspicuous posting of the notice on the entity's website, if the entity maintains one; and
(iii) Notification to major statewide media.
Analysis: Quorum plans to provide written notification by first-class U.S. mail to all 47,831 affected New York residents. Written notice by mail is the preferred and most legally defensible method of notification under the SHIELD Act and is the method most commonly accepted by the New York Attorney General's office. Quorum has confirmed mailing addresses for all affected New York individuals through the data mining process completed on August 4, 2023, and the cost of mailing does not approach the $250,000 substitute notice threshold for the New York population alone. Accordingly, substitute notice is neither necessary nor appropriate.
In addition to direct written notification, Quorum plans to post a notice regarding the incident on its corporate website (www.quoruminsurance.com). Website posting language has been prepared as of August 15, 2023, and is planned for publication concurrent with the commencement of consumer mailings. While website posting is not required when direct written notice is provided, it is a recommended best practice and may serve as a supplemental means of reaching affected individuals who do not receive or do not open the mailed notification.
D. AG and State Agency Notification — § 899-aa(8)
In addition to consumer notification, the SHIELD Act requires concurrent notification to three New York state agencies. N.Y. Gen. Bus. Law § 899-aa(8)(a) provides that "[w]henever the attorney general shall be notified pursuant to this section, the person or business shall also, at the time, notify the state police, the division of state police, and the department of state." While the statutory language could be read to suggest that AG notification precedes and triggers the obligation to notify the other agencies, the practical effect is that all three agencies must be notified concurrently with or prior to consumer notification.
The specific agencies to be notified are:
• New York Attorney General — Bureau of Internet and Technology. The AG's office has established a dedicated online submission portal for data breach notifications, and also accepts notifications by U.S. mail. The current point of contact for breach notifications is AAG Mark Petrosian, Bureau of Internet and Technology.
• New York Department of State — The Department of State receives breach notifications as part of its consumer protection mandate.
• New York Division of State Police — The State Police receives breach notifications in connection with its law enforcement and cybercrime investigation functions.
The notification to each agency must include:
(a) The approximate date of the breach;
(b) The approximate number of affected New York residents to be notified;
(c) A description of the categories of private information that were, or are reasonably believed to have been, compromised; and
(d) A copy of the consumer notification letter, or a description of its content if the letter has not yet been finalized at the time of the agency notification.
Planned Filing Date: Quorum has targeted August 16, 2023, for filing notifications with all three state agencies. This date is two days prior to the planned commencement of consumer notification mailings on August 18, 2023, and is consistent with the SHIELD Act's requirement that agency notification be concurrent with consumer notification. Filing agency notifications prior to consumer mailing commencement is a best practice that demonstrates proactive regulatory engagement and has been well-received by the New York Attorney General's office in prior matters.
Recommendation: File notifications with the New York Attorney General (via the AG's online data breach notification portal and by U.S. mail), the New York Department of State, and the New York Division of State Police on August 16, 2023. Each notification should include: (a) a cover letter summarizing the incident; (b) a copy of the finalized New York consumer notification letter; (c) a statement that 47,831 New York residents will be notified; (d) a description of the categories of private information compromised (names, dates of birth, Social Security numbers, driver's license numbers, and, for subsets, financial account information and health-related information); and (e) a summary description of the incident, including the vendor-originated nature of the breach at Palomar Data Solutions, the exploitation of CVE-2023-0669, and the exfiltration period from March 14 to April 18, 2023.
I will prepare drafts of the AG and state agency notification submissions for review by August 9, 2023.
E. Notification to Consumer Reporting Agencies — § 899-aa(8)(b)
The SHIELD Act imposes an additional notification obligation where the number of affected New York residents exceeds a specified threshold. Section 899-aa(8)(b) provides that if more than 5,000 New York residents are to be notified at one time, the entity must also notify the consumer reporting agencies of the "timing, content, and distribution of the notices" and provide a copy of the template notification letter sent to consumers.
Analysis: With 47,831 affected New York residents to be notified, Quorum far exceeds the 5,000-resident threshold. Accordingly, Quorum is required to notify the three major consumer reporting agencies — Harborview Enterprises, Penrose Group, and Penmark Enterprises — of the timing, content, and distribution of the consumer notifications. This notification is separate from and in addition to the consumer notification letters sent to individuals.
The consumer reporting agency notification should include:
• The approximate date on which consumer notification mailings will commence (August 18, 2023);
• The approximate number of New York residents to be notified (47,831);
• A copy of the template consumer notification letter; and
• A description of the distribution method (first-class U.S. mail to the last known home address of each affected individual).
Recommendation: Prepare and transmit the consumer reporting agency notifications to Harborview Enterprises, Penrose Group, and Penmark Enterprises concurrent with or prior to the August 18, 2023, consumer mailing commencement date. The notifications should be transmitted no later than August 17, 2023, to ensure compliance with the statutory requirement.
V. Reasonable Security Safeguards — N.Y. Gen. Bus. Law § 899-bb
A. Statutory Requirement
In addition to the breach notification obligations under § 899-aa, the SHIELD Act enacted a separate affirmative data security requirement under N.Y. Gen. Bus. Law § 899-bb, which became effective on March 21, 2020. Section 899-bb requires that "[a]ny person or business that owns or licenses computerized data which includes private information of a resident of New York" must "develop, implement, and maintain reasonable safeguards to protect the security, confidentiality and integrity of the private information including, but not limited to, disposal of data." N.Y. Gen. Bus. Law § 899-bb(2).
The statute specifies that a "reasonable" data security program is one that includes the following categories of safeguards:
Administrative Safeguards:
(i) Designating one or more employees to coordinate the security program;
(ii) Identifying reasonably foreseeable internal and external risks;
(iii) Assessing the sufficiency of safeguards in place to control the identified risks;
(iv) Training and managing employees in the security program practices and procedures;
(v) Selecting service providers capable of maintaining appropriate safeguards, and requiring those safeguards by contract; and
(vi) Adjusting the security program in light of business changes or new circumstances.
Technical Safeguards:
(i) Assessing risks in network and software design;
(ii) Assessing risks in information processing, transmission, and storage;
(iii) Detecting, preventing, and responding to attacks or system failures; and
(iv) Regularly testing and monitoring the effectiveness of key controls, systems, and procedures.
Physical Safeguards:
(i) Assessing risks of information storage and disposal;
(ii) Detecting, preventing, and responding to intrusions;
(iii) Protecting against unauthorized access to or use of private information during or after the collection, transportation, and destruction or disposal of the information; and
(iv) Disposing of private information within a reasonable amount of time after it is no longer needed for business purposes by erasing electronic media so that the information cannot be read or reconstructed.
The statute does not prescribe specific technical measures (such as particular encryption standards, patch management timelines, or access control technologies) but instead adopts a reasonableness standard that takes into account the nature and size of the business, the amount of data it maintains, and the complexity and scope of its operations. This principles-based approach is consistent with the data security frameworks employed by other regulators, including the FTC and the New York Department of Financial Services.
B. Small Business Qualifier
Section 899-bb(2)(c) provides that a "small business" is deemed to be in compliance with the reasonable safeguards requirement if its security program "contains reasonable administrative, technical, and physical safeguards that are appropriate for the size and complexity of the small business, the nature and scope of the small business's activities, and the sensitivity of the personal information the small business collects from or about consumers." The statute does not define "small business" with specificity but references factors including the number of employees, annual revenue, and year-end assets.
Analysis: Quorum Insurance Holdings Corp. is a large, publicly traded insurance holding company with approximately 11,400 employees across its operating subsidiaries and corporate functions, and reported annual revenue of $4.82 billion for fiscal year 2022. Quorum does not qualify as a small business under any reasonable interpretation of the statute. Accordingly, Quorum is subject to the full requirements of § 899-bb and must demonstrate a comprehensive data security program that includes administrative, technical, and physical safeguards.
C. Assessment of Quorum's Compliance Posture
This section provides a preliminary assessment of Quorum's compliance with the § 899-bb reasonable safeguards requirement, with a focus on the elements most likely to be scrutinized by the New York Attorney General in connection with the Palomar breach.
Key Positive Factors for Quorum:
• Designated Security Personnel. Quorum maintains a dedicated Chief Information Security Officer (David Naranjo), a Chief Privacy Officer (Jennifer Liang), and a Vice President of Vendor Risk Management (Priya Deshmukh), each of whom reports to Quorum's General Counsel and participates in the Company's enterprise risk management governance structure. This organizational structure satisfies the SHIELD Act's administrative safeguard requirement to designate one or more employees to coordinate the security program.
• Vendor Risk Management Program. Quorum operates a formal vendor risk management program under the direction of Priya Deshmukh. The program includes pre-engagement due diligence, risk tiering, and ongoing oversight of third-party service providers. The Palomar MSA includes Exhibit D (Data Security), which imposes specific security obligations on Palomar, including requirements for vulnerability management and patching (within 30 days of patch availability for critical and high-severity vulnerabilities), annual penetration testing by a qualified third party, maintenance of a SOC 2 Type II report, and annual attestation of compliance with Exhibit D requirements. These contractual provisions are consistent with the SHIELD Act's requirement to select service providers capable of maintaining appropriate safeguards and to require those safeguards by contract.
• Contractual Updates. MSA Amendment 2, effective September 15, 2022, updated the security requirements in Exhibit D to add the SOC 2 Type II audit requirement, to strengthen the incident response notification obligations (including the 48-hour notification window), and to add enhanced data handling and encryption requirements. This amendment demonstrates ongoing program adjustment in light of new circumstances, consistent with the SHIELD Act's administrative safeguard provisions.
• Quorum's Own Systems Were Not Compromised. The forensic investigation confirmed that the breach originated entirely within Palomar's environment. Quorum's own networks, systems, and applications were not accessed by the threat actor. There is no evidence that Quorum's own technical safeguards were deficient or that a vulnerability in Quorum's infrastructure contributed to the breach.
• Prompt Response. Upon receiving notification from Palomar on April 21, 2023, Quorum promptly activated its incident response plan, engaged external counsel, and retained a forensic investigator under privilege. Quorum's response was consistent with the incident response procedures documented in the Company's Information Security Incident Response Plan (Version 4.2, last updated January 15, 2023).
Key Risk Factors and Potential Vulnerabilities:
• Adequacy of Vendor Oversight. While the SHIELD Act's service provider provision requires entities to select service providers capable of maintaining appropriate safeguards and to require those safeguards by contract, a question may arise as to whether Quorum's oversight of Palomar's actual compliance with the contractual security obligations was sufficient. The SHIELD Act does not expressly address the degree of ongoing monitoring required, but the New York Attorney General's office may take the position that contractual requirements alone are insufficient if the entity did not exercise reasonable diligence to verify the vendor's compliance.
• Palomar's Failure to Patch. CVE-2023-0669 was publicly disclosed on February 1, 2023, and a patch was available as of February 7, 2023. Exhibit D of the MSA required Palomar to patch critical and high-severity vulnerabilities within 30 days of patch availability. Palomar failed to apply the patch within this window, and the vulnerability was exploited on March 14, 2023 — approximately 35 days after the patch became available. This suggests a potential gap in Quorum's monitoring of Palomar's compliance with the patching requirements in Exhibit D. Although Quorum required Palomar to provide annual attestations of compliance, there is no evidence that Quorum conducted independent verification of Palomar's patching cadence between the last attestation (December 2022) and the date of the breach (March 14, 2023).
• Frequency of Vendor Assessments. Quorum's vendor risk management program calls for annual risk assessments of critical vendors, including review of SOC 2 Type II reports. The most recent SOC 2 Type II report provided by Palomar covered the period from April 1, 2021, through March 31, 2022. The next report, covering the period from April 1, 2022, through March 31, 2023, was due to Quorum by June 30, 2023, but was not received prior to the breach. The absence of a current SOC 2 report may be a point of inquiry in any AG investigation.
Recommendation: In any communication to the New York Attorney General or in response to any AG inquiry, Quorum should emphasize the following points: (a) Quorum maintained a robust contractual framework with Palomar that included specific and detailed data security requirements; (b) the breach was vendor-originated, and Quorum's own systems were not compromised; (c) Quorum responded promptly and appropriately upon receiving notification of the incident; and (d) Quorum has implemented post-incident vendor accountability measures, including the formal indemnification demand letter issued to Palomar on June 29, 2023, and enhanced security requirements imposed on Palomar through the ongoing MSA remediation process. Additionally, Quorum should prepare a comprehensive summary of its information security program and vendor risk management program for potential use in responding to any AG inquiry, as discussed further in Section VII below.
D. Enforcement Considerations
The SHIELD Act vests exclusive enforcement authority in the New York Attorney General. There is no private right of action under the statute. Affected individuals may not bring claims directly under the SHIELD Act, although they may pursue common law claims (e.g., negligence, breach of implied contract) or claims under other statutes (e.g., N.Y. Gen. Bus. Law §§ 349-350) in connection with a data breach.
The Attorney General may bring enforcement actions under several authorities:
• Under N.Y. Gen. Bus. Law § 899-aa(6), the AG may bring an action against any person or business that violates the notification requirements of the SHIELD Act. The court may impose civil penalties of the greater of $5,000 per violation or $20 per instance of failed notification, not to exceed $250,000 for knowing and reckless violations of the notification requirement.
• Under N.Y. Gen. Bus. Law § 899-aa(5), a violation of the notification requirements may be deemed a deceptive act or practice actionable under N.Y. Gen. Bus. Law § 349 (deceptive acts and practices) or § 350 (false advertising), providing an additional basis for AG enforcement and the imposition of civil penalties.
• Under N.Y. Executive Law § 63(12), the AG has broad authority to bring actions for repeated or persistent fraud or illegality in the conduct of business. The AG has invoked this authority in prior data security enforcement actions, including actions based on alleged failures to maintain reasonable safeguards under § 899-bb.
• Separate penalties may be imposed for violations of the reasonable safeguards requirement under § 899-bb, although the statute does not specify a separate penalty schedule. The AG has treated reasonable safeguards violations as actionable under the deceptive practices and fraud provisions cited above.
Risk Assessment: Given that the breach was vendor-originated, Quorum responded promptly upon notification, and all planned notifications are being provided in a timely manner, the enforcement risk under the SHIELD Act is assessed as moderate to low. This assessment is based on the following considerations:
• Quorum's notification timeline is reasonable and well-documented.
• The notification letters will comply with all statutory content requirements.
• Quorum can demonstrate the existence of a comprehensive information security program and vendor risk management program that includes the administrative, technical, and physical safeguards specified by § 899-bb.
• The breach was caused by Palomar's failure to patch a known vulnerability, not by any deficiency in Quorum's own systems or security practices.
However, the following factors may elevate enforcement risk:
• The large number of affected New York residents (47,831) is likely to attract AG attention.
• The AG may focus on whether Quorum's vendor oversight was adequate — in particular, whether Quorum took reasonable steps to verify Palomar's compliance with the contractual security requirements in Exhibit D.
• The anticipated multistate AG inquiry, which may include the New York AG, could result in a coordinated investigation and potential demand for remedial measures and/or a monetary resolution.
Cooperative and proactive engagement with the New York Attorney General is recommended, consistent with the overall multistate strategy being developed in coordination with Alan Burke and the multistate response team.
VI. Interaction with Other Applicable New York Laws
A. New York Department of Financial Services Cybersecurity Regulation (23 NYCRR Part 500)
To the extent that Quorum operates licensed insurance entities in the State of New York — which it does through Quorum Property and Casualty Insurance Company of New York (a New York-domiciled insurer) — Quorum and its New York-licensed subsidiaries may be subject to the New York Department of Financial Services ("DFS") Cybersecurity Regulation, codified at 23 NYCRR Part 500.