1025-00006 · Graystone Forensics LLC · Regulatory Defense/CT Insurance Dept & HHS-OCR

ct-insurance-dept-closure-letter-annotated.docx DOCUMENT Data Privacy

55 / 88 ← → ✕

Contract analysis Extract to table

ATTORNEY-CLIENT PRIVILEGED / ATTORNEY WORK PRODUCT / CONFIDENTIAL

INTERNAL ANNOTATED COPY — DO NOT DISTRIBUTE

CALDERWOOD & HARKNESS LLP 1700 K Street NW, Suite 900 Washington, D.C. 20006

MATTER COVER SHEET

Matter: Quorum Insurance Holdings Corp. — Palomar Data Security Incident

Matter Number: 1025-00006

Document Description: Annotated copy of Connecticut Insurance Department Closure Letter dated November 28, 2023

Annotations by:

Kevin Ostrowski, Partner, Privacy & Cybersecurity Practice Alan Burke, Associate, Privacy & Cybersecurity Practice

Date of Annotations: November 28, 2023

Distribution:

Thomas R. Whitfield — General Counsel, Quorum Insurance Holdings Corp. Jennifer Liang — Chief Privacy Officer, Quorum Insurance Holdings Corp. David Naranjo — Chief Information Security Officer, Quorum Insurance Holdings Corp. Internal Calderwood & Harkness LLP Privileged File (Matter No. 1025-00006)

This document constitutes attorney work product prepared in anticipation of litigation and in the course of rendering legal advice to Quorum Insurance Holdings Corp. This document is protected by the attorney-client privilege and the work product doctrine. It is intended solely for the use of the individuals and entities identified above. Any unauthorized review, use, disclosure, or distribution is strictly prohibited. If you have received this document in error, please contact Calderwood & Harkness LLP immediately at (202) 555-7200.

CALDERWOOD & HARKNESS LLP MEMORANDUM TO FILE

November 28, 2023

TO: Privileged File — Matter No. 1025-00006

FROM: Kevin Ostrowski, Partner; Alan Burke, Associate

RE: Connecticut Insurance Department Closure Letter — Quorum Insurance Holdings Corp. / Palomar Data Security Incident — Summary and Significance

We write to memorialize the receipt and significance of the enclosed closure letter issued by the Connecticut Insurance Department ("Department"), dated November 28, 2023, in connection with the Department's inquiry into the cybersecurity event affecting Quorum Insurance Holdings Corp. ("Quorum") arising from the Palomar Data Solutions, Inc. ("Palomar") data security incident.

This closure letter represents the second of three anticipated regulatory closure communications in the Palomar matter. The first was the multistate attorneys general coalition closure letter, dated November 22, 2023, issued on behalf of a 29-state coalition (led by Assistant Attorney General Diane Marchetti of the Connecticut Attorney General's Office and Assistant Attorney General Mark Petrosian of the New York Attorney General's Office), which closed the multistate inquiry without enforcement action, penalties, or any form of consent agreement. The third and final anticipated regulatory communication is the determination from the U.S. Department of Health and Human Services, Office for Civil Rights ("HHS-OCR"), which we expect to receive on or about November 30, 2023.

The Connecticut Insurance Department inquiry was initiated following Quorum's August 14, 2023 notification to the Department pursuant to the Connecticut Insurance Data Security Law, Conn. Gen. Stat. § 38a-999b. The inquiry was assigned to Examiner Richard Nakamura of the Department's Financial Analysis Division, Cybersecurity Unit. Over the course of the inquiry, Calderwood & Harkness submitted two substantive filings on Quorum's behalf: the initial inquiry response dated September 22, 2023, and a supplemental information submission dated October 20, 2023. Both submissions were prepared in close coordination with Quorum's General Counsel, Chief Privacy Officer, and Chief Information Security Officer.

The Department's closure letter confirms, in pertinent part, the following:

1. The Department has completed its review and is closing the inquiry without enforcement action, penalties, or consent orders.

2. The Department affirmatively finds that Quorum maintained an information security program consistent with the requirements of Conn. Gen. Stat. § 38a-999b.

3. The Department acknowledges that Quorum timely filed its cybersecurity event notification with the Department.

4. The Department credits Quorum's vendor oversight practices, including the contractual data security requirements imposed on Palomar and the enhanced security provisions formalized in MSA Amendment 3.

5. The Department notes with approval the remediation measures Quorum implemented following the incident.

6. No ongoing monitoring, reporting, or compliance verification obligations are imposed.

This outcome is fully consistent with the cooperative engagement strategy that Calderwood & Harkness pursued throughout the matter, in coordination with Quorum's leadership. The closure is favorable and unqualified in all material respects. The standard reservations of general supervisory authority and the "at this time" qualifier are boilerplate language that appears in virtually all Department closure communications and do not indicate any continuing concern or elevated scrutiny.

The enclosed document consists of the verbatim text of the Department's closure letter, with inline annotations prepared by the undersigned for the purpose of highlighting key language, assessing the implications of specific findings, and identifying any caveats or areas requiring continued attention. A summary analysis and set of key takeaways follows the annotated letter.

We recommend that this annotated copy be included in the Board Audit Committee briefing package being prepared for the November 29, 2023 matter resolution memorandum and that the original closure letter be retained in both the Calderwood & Harkness privileged matter file and Quorum's legal department files in accordance with the Document Retention & Privilege Log Protocol.

Kevin Ostrowski Partner, Privacy & Cybersecurity Practice Calderwood & Harkness LLP

Alan Burke Associate, Privacy & Cybersecurity Practice Calderwood & Harkness LLP

CONNECTICUT INSURANCE DEPARTMENT CLOSURE LETTER (VERBATIM TEXT WITH INLINE ANNOTATIONS)

The following is a verbatim reproduction of the closure letter received from the Connecticut Insurance Department on November 28, 2023. Inline annotations by Calderwood & Harkness attorneys appear in bracketed, bolded text and are clearly distinguished from the Department's original language. All annotations constitute privileged attorney work product.

STATE OF CONNECTICUT INSURANCE DEPARTMENT

Office of the Insurance Commissioner 153 Market Street, 7th Floor Hartford, Connecticut 06103 Telephone: (860) 297-3800 www.ct.gov/cid

November 28, 2023

Thomas R. Whitfield, Esq. General Counsel Quorum Insurance Holdings Corp. 400 Constitution Plaza, Suite 2200 Hartford, CT 06103

cc: Kevin Ostrowski, Esq. Calderwood & Harkness LLP 1700 K Street NW, Suite 900 Washington, D.C. 20006

Re: Cybersecurity Event Investigation — Quorum Insurance Holdings Corp. (NAIC No. 73291) / Inquiry Ref. No. CID-CYB-2023-04187

Dear Mr. Whitfield:

I. Opening — Purpose of Letter

The Connecticut Insurance Department ("Department") has completed its review of the cybersecurity event reported by Quorum Insurance Holdings Corp. ("Quorum") on August 14, 2023. Quorum's initial notification was filed with the Department pursuant to Section 38a-999b of the Connecticut General Statutes, commonly referred to as the Connecticut Insurance Data Security Law. The Department also received and reviewed Quorum's detailed inquiry response dated September 22, 2023, prepared and submitted by its outside counsel, Calderwood & Harkness LLP, as well as supplemental information submitted on October 20, 2023, in response to follow-up questions posed by the Department's Cybersecurity Unit.

Based on its review of all information provided, the Department is closing its inquiry into this cybersecurity event without further action at this time. The purpose of this letter is to communicate the Department's findings and the basis for its determination.

[C&H Annotation 1 — Kevin Ostrowski]: The "at this time" qualifier appearing in the closing clause of the opening paragraph is standard Department language. We have reviewed closure letters issued by the Department in comparable cybersecurity event inquiries over the past three years, including the Department's closures in the Meridian Health Underwriters matter (CID-CYB-2022-03841, closed March 2023) and the Atlantic Re matter (CID-CYB-2023-01602, closed September 2023). Both contained identical "at this time" language. This qualifier does not indicate any reservation, ongoing concern, or condition attached to the closure. Notably, no ongoing monitoring or reporting obligation of any kind is imposed anywhere in this letter. This represents a fully favorable outcome.

II. Summary of the Department's Findings

A. Nature of the Cybersecurity Event

Based on the information provided by Quorum and its counsel, the Department understands the relevant facts to be as follows.

The cybersecurity event originated not within Quorum's own information systems or network environment, but within the systems of Palomar Data Solutions, Inc. ("Palomar"), a third-party claims-processing vendor engaged by Quorum pursuant to a Master Services Agreement originally executed on November 12, 2019, and subsequently amended. Palomar provides claims adjudication, processing, and data management services to Quorum and, in connection with those services, receives, processes, stores, and transmits certain policyholder and claimant data on Quorum's behalf.

On or about March 14, 2023, one or more unauthorized threat actors gained access to Palomar's network through the exploitation of a known vulnerability, identified as CVE-2023-0669, affecting Palomar's GoAnywhere MFT (Managed File Transfer) appliance. This vulnerability, which was publicly disclosed in early February 2023, permitted remote code execution on unpatched systems. The unauthorized access persisted for a period of approximately thirty-five (35) days, from on or about March 14, 2023, through on or about April 18, 2023, during which time data exfiltration activities occurred.

Palomar discovered anomalous outbound data transfer activity on April 18, 2023, and, following an initial internal assessment, notified Quorum of the potential data security event on April 21, 2023. Quorum thereafter engaged outside forensic investigators and counsel to assess the scope and impact of the incident.

The investigation determined that the compromised data included personally identifiable information ("PII"), financial data, and protected health information ("PHI") of approximately 318,247 Quorum policyholders and claimants across twenty-nine (29) states and the District of Columbia. Of these affected individuals, approximately 52,114 were residents of the State of Connecticut.

[C&H Annotation 2 — Alan Burke]: The Department's recitation of the underlying facts is accurate in all material respects and is fully consistent with the factual narrative presented in our September 22, 2023 inquiry response and our October 20, 2023 supplemental submission. No factual discrepancies or inaccuracies are noted. Several points merit emphasis:

(a) The Department correctly identifies the vendor-originated nature of the breach. The letter's factual summary makes clear that the cybersecurity event originated at Palomar — not within Quorum's own network or systems. This is significant because it demonstrates that the Department understood and accepted our framing of the incident as a third-party vendor event, not a direct Quorum security failure.

(b) The Department correctly attributes the root cause of the unauthorized access to Palomar's failure to patch a known vulnerability (CVE-2023-0669) in its GoAnywhere MFT appliance. The Department does not suggest that Quorum bore any responsibility for Palomar's patching failure or that Quorum's own systems were compromised.

(c) The affected individual counts referenced by the Department (318,247 total; 52,114 Connecticut residents) are consistent with the figures reported in our submissions and in Quorum's consumer notification materials.

B. Compliance with the Connecticut Insurance Data Security Law

The Department has assessed Quorum's compliance with the applicable requirements of the Connecticut Insurance Data Security Law, Conn. Gen. Stat. § 38a-999b, and related provisions. Based on its review, the Department makes the following findings.

The Department finds that Quorum maintained an information security program that was consistent with the requirements of Conn. Gen. Stat. § 38a-999b. The Department reviewed documentation provided by Quorum regarding its information security policies, procedures, and governance structure, including its risk assessment practices, access controls, encryption standards, employee training programs, and incident response protocols, and the Department is satisfied that these measures were commensurate with the nature, size, and complexity of Quorum's insurance operations and the sensitivity of the data at issue.

The Department acknowledges that Quorum timely filed its cybersecurity event notification with the Department on August 14, 2023. Under Conn. Gen. Stat. § 38a-999b(d), a licensee is required to notify the Commissioner of Insurance of a cybersecurity event as promptly as possible, but in no event later than three (3) business days from the date the licensee determines that the event has occurred, if the event meets certain specified criteria. The Department is satisfied that Quorum's August 14, 2023 notification was filed within the applicable statutory timeframe.

The Department further notes that Quorum also filed concurrent notification with the Connecticut Attorney General's Office pursuant to Conn. Gen. Stat. § 36a-701b on August 14, 2023, the same date as its notification to this Department. This concurrent filing demonstrates Quorum's commitment to timely and comprehensive regulatory notification.

The Department acknowledges that Quorum commenced consumer notification mailings to affected Connecticut residents beginning August 18, 2023, and that all consumer notifications were completed by September 15, 2023. The notification letters provided to the Department for review were found to contain the substantive information elements expected under applicable Connecticut law, including a description of the incident, the categories of information involved, guidance for affected individuals, and contact information for Quorum's dedicated incident response team.

Additionally, the Department notes that Quorum offered twenty-four (24) months of complimentary credit monitoring and identity theft protection services, provided through Dunmore Services Inc., to all individuals affected by the cybersecurity event, regardless of whether those individuals were Connecticut residents. The Department views this as a meaningful remedial measure for affected consumers.

[C&H Annotation 3 — Kevin Ostrowski]: This is the most significant substantive finding in the closure letter. The Department's explicit determination that Quorum "maintained an information security program that was consistent with the requirements of Conn. Gen. Stat. § 38a-999b" is a strong, affirmative compliance finding. Several observations:

(a) This language should be highlighted for the Board Audit Committee and preserved for potential use in any future litigation or regulatory defense context. In the event that putative class action plaintiffs (or other regulators) allege that Quorum maintained inadequate data security practices, the Department's finding that Quorum's program was "consistent with" statutory requirements provides a powerful counterpoint. While the finding is not dispositive in other proceedings, it carries persuasive weight — particularly because the Connecticut Insurance Data Security Law is modeled on the NAIC Insurance Data Security Model Law and imposes substantive security program requirements that go beyond mere notification obligations.

(b) The Department's review encompassed Quorum's risk assessment practices, access controls, encryption standards, employee training programs, and incident response protocols. This is a comprehensive review, and the Department's satisfaction with these measures — as stated in the letter — reflects favorably on Quorum's overall security posture.

(c) The Department does not suggest, at any point in this letter, that Quorum's own security posture was deficient or that Quorum bore direct culpability for the breach. This is consistent with the factual reality (the breach was Palomar's) and with our advocacy in the inquiry response submissions.

(d) The Department's acknowledgment of Quorum's timely notification, concurrent AG filing, consumer notifications, and credit monitoring offering further reinforces the narrative of a company that responded responsibly and comprehensively to a third-party vendor incident.

C. Vendor Oversight and Accountability

The Department has also reviewed Quorum's vendor risk management practices as they relate to the Palomar engagement. The Department acknowledges that Quorum maintained a vendor risk management program, overseen by Priya Deshmukh, Vice President of Vendor Risk Management, which included processes for evaluating, onboarding, monitoring, and managing third-party service providers with access to policyholder and claimant data.

The Department notes that the Master Services Agreement between Quorum and Palomar, originally executed on November 12, 2019, and subsequently amended, contained a number of data security requirements applicable to Palomar's handling of Quorum's data. As described in the materials provided to the Department, these contractual requirements included, among other things:

(i) An obligation on Palomar to maintain commercially reasonable safeguards appropriate to the nature and sensitivity of the data being processed;

(ii) A requirement to patch critical vulnerabilities within thirty (30) days of the issuance of a patch by the applicable vendor or developer;

(iii) A requirement to undergo annual penetration testing by a qualified third-party assessor;

(iv) A requirement to provide SOC 2 Type II audit reports to Quorum on an annual basis; and

(v) A security incident notification obligation requiring Palomar to notify Quorum of any actual or suspected data security event within forty-eight (48) hours of discovery.

These provisions were incorporated or strengthened through Amendment 2 to the Master Services Agreement, executed on September 15, 2022.

The Department notes Quorum's assertion, supported by documentation provided in the September 22, 2023 inquiry response and October 20, 2023 supplemental submission, that Palomar failed to timely patch the CVE-2023-0669 vulnerability within the contractual thirty-day window, and that Palomar's breach notification to Quorum was delivered on April 21, 2023 — approximately twenty-four (24) hours beyond the forty-eight-hour notification window specified in Section 9.4 of the Master Services Agreement.

The Department further acknowledges the October 27, 2023 indemnification settlement reached between Quorum and Palomar, pursuant to which Palomar agreed to bear certain costs and expenses arising from the cybersecurity event. In connection with that settlement, the parties executed Amendment 3 to the Master Services Agreement, which formalized enhanced data security requirements for Palomar, including:

(i) An accelerated critical vulnerability patching window of fourteen (14) calendar days (reduced from thirty days);

(ii) Mandatory deployment and operation of endpoint detection and response ("EDR") technology across all systems involved in the processing of Quorum data;

(iii) Quarterly vulnerability scanning of all Palomar systems and applications involved in the Quorum engagement;

(iv) An annual independent security assessment conducted by a qualified third-party assessor, the results of which are to be shared with Quorum; and

(v) A reduced security incident notification window of twenty-four (24) hours (reduced from forty-eight hours).

[C&H Annotation 4 — Alan Burke]: The Department's treatment of the vendor oversight and accountability topic is favorable in several important respects:

(a) The Department affirmatively acknowledges the existence and substance of Quorum's vendor risk management program, the contractual data security requirements imposed on Palomar, and the specific persons responsible for overseeing the program (Priya Deshmukh, VP Vendor Risk Management). This acknowledgment is significant because vendor oversight adequacy is one of the most common areas of regulatory scrutiny following third-party vendor breaches.

(b) The Department does not criticize Quorum's vendor management practices or suggest that they were inadequate in any respect. The Department's recitation of the contractual provisions — patching requirements, penetration testing, SOC 2 reports, notification obligations — demonstrates that the Department reviewed these provisions and found them to be appropriate. No finding of deficiency is made.

(c) The Department's acknowledgment of the MSA Amendment 3 enhancements and the indemnification settlement reflects positively on Quorum's proactive approach to holding its vendor accountable and strengthening contractual protections following the incident. The Department appears to view these measures favorably.

(d) One area of potential vulnerability that the Department did not address: the Department does not comment on whether Quorum should have independently detected Palomar's failure to patch CVE-2023-0669 prior to the breach. The contractual patching obligation was Palomar's, and Quorum's vendor oversight program relied in part on Palomar's self-reported compliance and SOC 2 reporting. Whether Quorum's monitoring was sufficiently robust to detect a vendor's undisclosed patching failure is a question that could be raised in other contexts — for example, in class action litigation or in an HHS-OCR review — but the Department has not raised it here, and the closure without further action effectively resolves this issue as far as the Connecticut Insurance Department is concerned. We should remain attentive to this issue in the HHS-OCR context.

D. Remediation Measures

The Department notes with approval the remediation measures that Quorum has implemented or is in the process of implementing following the cybersecurity event. These measures include, but are not limited to:

(i) The enhanced vendor security audit requirements formalized in Amendment 3 to the Master Services Agreement, as described above;

(ii) The strengthened contractual notification obligations, including the reduction of Palomar's security event notification window from forty-eight (48) hours to twenty-four (24) hours;

(iii) The engagement of an independent third-party security assessor to conduct a comprehensive security evaluation of Palomar's systems and practices, at Palomar's expense, with results to be shared with Quorum;

(iv) Enhancements to Quorum's own vendor risk management program, including the implementation of additional monitoring and oversight mechanisms for critical third-party service providers;

(v) A comprehensive review and updating of Quorum's incident response plan to incorporate lessons learned from the Palomar event, including revised escalation procedures, communication protocols, and forensic readiness measures.

The Department encourages Quorum to continue to evaluate and enhance its information security program and vendor oversight practices on an ongoing basis, consistent with evolving cybersecurity threats, industry best practices, and the requirements of applicable law.

[C&H Annotation 5 — Kevin Ostrowski]: The Department's use of the word "encourages" in the final sentence of this section is precatory, not mandatory. This language does not create any binding obligation, compliance requirement, or enforceable commitment on Quorum's part. No specific remediation orders, consent agreements, compliance monitoring requirements, periodic reporting obligations, or follow-up assessments are imposed anywhere in this letter. This is standard advisory language that appears routinely in Department closure communications and should not be construed as indicating any deficiency or ongoing concern.

For the avoidance of doubt, Quorum is, of course, already implementing the remediation measures described in the letter and is committed to continuous improvement of its information security and vendor risk management programs. The Department's "encouragement" is entirely consistent with Quorum's existing trajectory and does not require any additional action beyond what is already planned and underway.

III. Formal Closure

Based on its review of all information provided by Quorum and its counsel in connection with this inquiry, the Department is closing its inquiry into this cybersecurity event without further action. The Department considers this matter resolved.

Nothing in this letter shall be construed as a waiver or limitation of the Department's general supervisory and examination authority under Title 38a of the Connecticut General Statutes, including but not limited to the Department's authority under Conn. Gen. Stat. §§ 38a-15, 38a-16, and 38a-999b. This closure does not preclude the Department from taking future action with respect to this matter or any related matter if additional information comes to light or if circumstances change.

The Department thanks Quorum and its counsel at Calderwood & Harkness LLP for their cooperation and responsiveness throughout the inquiry process. The Department appreciates the thoroughness and professionalism with which Quorum addressed the Department's questions and requests for information.

[C&H Annotation 6 — Alan Burke]: The reservation of general supervisory and examination authority and the "future action" language in the second paragraph of this section is entirely standard boilerplate. We have confirmed that substantively identical language appears in every Department closure letter we have reviewed in the cybersecurity context, including the Meridian Health Underwriters and Atlantic Re closures referenced above. The language does not indicate any ongoing concern, elevated scrutiny, or condition precedent to the closure. It is a standard protective reservation that preserves the Department's statutory prerogatives as a matter of law — prerogatives that exist regardless of whether they are expressly reserved in a closure letter.

The Department's expression of appreciation for cooperation is a positive signal and is consistent with the cooperative engagement strategy that we pursued throughout this matter. The Department's characterization of Quorum's engagement as "thorough" and "professional" reflects well on the company and on the inquiry response submissions.

Should you have any questions regarding this letter, please do not hesitate to contact the undersigned.

Sincerely,

Richard Nakamura Examiner, Financial Analysis Division Cybersecurity Unit Connecticut Insurance Department 153 Market Street, 7th Floor Hartford, CT 06103 Tel: (860) 297-3847

Email: richard.nakamura@ct.gov

[C&H Annotation 7 — Kevin Ostrowski]: The letter is signed by Richard Nakamura, the same examiner who was assigned to the inquiry from its inception following Quorum's August 14, 2023 notification. Throughout the course of the inquiry, the matter was not escalated to more senior Department officials — it remained at the examiner level within the Cybersecurity Unit of the Financial Analysis Division. This is a favorable indicator for several reasons: (a) it suggests that the Department did not view the matter as presenting issues of sufficient concern or complexity to warrant involvement by senior leadership or the Commissioner's office; (b) it is consistent with the Department's treatment of the matter as a routine cybersecurity event inquiry rather than an enforcement investigation; and (c) it is consistent with the cooperative engagement approach, which was designed to provide complete and responsive information at the initial and supplemental submission stages so as to resolve the inquiry efficiently at the examiner level without the need for escalation.

CALDERWOOD & HARKNESS LLP SUMMARY ANALYSIS AND KEY TAKEAWAYS (POST-LETTER ANNOTATION SECTION)

The following analysis is prepared by Kevin Ostrowski and Alan Burke of Calderwood & Harkness LLP and constitutes privileged attorney work product. It is intended solely for the use of Quorum Insurance Holdings Corp. and authorized internal C&H personnel in connection with Matter No. 1025-00006.

I. Overall Assessment

The Connecticut Insurance Department's closure letter of November 28, 2023, represents a fully favorable outcome for Quorum Insurance Holdings Corp. The key elements of this assessment are as follows:

No Enforcement Action. The Department closed its inquiry without initiating any enforcement proceeding, issuing any administrative order, or imposing any penalty or fine.

No Consent Order or Agreement. The Department did not require Quorum to enter into any consent order, assurance of voluntary compliance, or similar agreement as a condition of closure.

No Ongoing Monitoring or Reporting. The Department did not impose any ongoing monitoring, periodic reporting, compliance verification, or follow-up assessment requirements.

Affirmative Compliance Finding. The Department affirmatively found that Quorum maintained an information security program consistent with the requirements of Conn. Gen. Stat. § 38a-999b. This is an important positive finding, not merely the absence of a negative finding.

Vendor Oversight Credited. The Department acknowledged Quorum's vendor risk management program and the contractual data security requirements imposed on Palomar, and noted with approval the enhanced security provisions formalized in MSA Amendment 3.

Post-Incident Remediation Credited. The Department recognized Quorum's remediation measures and expressed no concern regarding their adequacy or scope.

Timely Notification Acknowledged. The Department confirmed that Quorum's notification was filed within the applicable statutory timeframe.

This closure letter is the second regulatory closure achieved in the Palomar matter. The first was the multistate attorneys general coalition closure letter dated November 22, 2023, in which a 29-state coalition (led by AAG Diane Marchetti of the Connecticut Attorney General's Office and AAG Mark Petrosian of the New York Attorney General's Office) closed its inquiry without enforcement action, penalties, or any form of consent agreement. The only remaining regulatory proceeding is the HHS-OCR review, for which we anticipate a favorable determination in the near term.

II. Key Favorable Language to Preserve

The following specific findings and statements in the Department's closure letter should be highlighted, preserved, and referenced in future filings, briefings, and — if appropriate — litigation or regulatory defense materials:

1. Information Security Program Compliance. "The Department finds that Quorum maintained an information security program that was consistent with the requirements of Conn. Gen. Stat. § 38a-999b." This is the Department's central compliance finding and the single most valuable statement in the letter from a defensive perspective.

2. Timely Notification. "The Department is satisfied that Quorum's August 14, 2023 notification was filed within the applicable statutory timeframe." This confirms that Quorum met its reporting obligation without deficiency.

3. Vendor Accountability Measures. The Department's detailed acknowledgment of the MSA provisions, the indemnification settlement, and the MSA Amendment 3 enhancements. These passages demonstrate that the Department reviewed and was satisfied with Quorum's approach to vendor accountability.

4. Cooperation and Professionalism. "The Department thanks Quorum and its counsel at Calderwood & Harkness LLP for their cooperation and responsiveness throughout the inquiry process. The Department appreciates the thoroughness and professionalism with which Quorum addressed the Department's questions and requests for information." This language, while procedural in nature, is useful in demonstrating that the regulatory process was constructive and that Quorum engaged in good faith.

III. Caveats and Standard Reservations

The closure letter contains several standard reservations and qualifiers that are common to Department closure communications. None of these raise substantive concern:

"At this time" qualifier. The phrase "without further action at this time" appears in the opening paragraph. As noted in Annotation 1, this is standard Department language. It does not reflect any continuing concern or conditional closure. We have confirmed its presence in comparable closure letters.

Reservation of general supervisory authority. The Department reserves its supervisory and examination authority under Title 38a. This is a standard legal reservation that preserves the Department's statutory prerogatives and appears in all closure letters regardless of the circumstances.

"Future action" reservation. The statement that "this closure does not preclude the Department from taking future action . . . if additional information comes to light or if circumstances change" is standard boilerplate. No specific trigger, condition, or scenario is identified. This language does not indicate any expectation or intent to reopen the inquiry.

"Encourages" language regarding ongoing security enhancements. The Department's statement that it "encourages Quorum to continue to evaluate and enhance its information security program" is precatory and advisory. It does not create any enforceable obligation or compliance requirement.

Bottom line: The standard reservations in this letter are wholly unremarkable and do not qualify, diminish, or condition the favorable closure in any way.

IV. Implications for the Broader Matter

The Department's closure letter has several important implications for the broader Palomar matter:

Litigation Posture. This closure strengthens Quorum's position in any future litigation, including the potential consumer class action(s) that may be filed in connection with the Palomar incident. A finding by the relevant state insurance regulator that Quorum's information security program was "consistent with" statutory requirements is a persuasive (though not dispositive) data point that can be cited in defense of adequacy-of-security claims. The closure should be referenced in any litigation hold memorandum update and preserved in the litigation readiness file. Counsel should assess the applicability of this finding in light of the specific causes of action and standards at issue in any particular litigation matter.

Board Audit Committee Briefing. This closure should be prominently featured in the Board Audit Committee final briefing memorandum that is being prepared for the November 29, 2023 meeting. The briefing memo should report that two of the three anticipated regulatory proceedings have now been closed without adverse action, with the third (HHS-OCR) expected to follow shortly. The overall regulatory outcome to date validates the incident response strategy and the cooperative engagement approach that Quorum and Calderwood & Harkness pursued.

SEC Disclosure. This closure, together with the multistate AG closure of November 22, 2023, should be taken into account in connection with Quorum's ongoing securities disclosure analysis. The materiality assessment prepared on July 19, 2023 (in connection with the 8-K / 10-Q analysis) should be revisited in light of the regulatory closures to determine whether any updated or supplemental disclosure is appropriate. The absence of enforcement action, penalties, or consent orders supports the conclusion that the regulatory dimensions of the Palomar matter are resolving favorably and without material financial impact beyond the costs previously disclosed or reserved.

Multistate AG Closure Complement. The Department's closure letter complements and reinforces the multistate AG closure letter of November 22, 2023. The two regulatory closures, taken together, reflect a consistent regulatory consensus that Quorum acted responsibly and in compliance with applicable law. This consistency is valuable from both a reputational and a legal defense perspective.

HHS-OCR Determination. The HHS-OCR review relates to the approximately 41,203 individuals whose protected health information was compromised in the Palomar incident. Quorum filed its HIPAA breach notification with HHS-OCR on August 15, 2023. We anticipate a favorable determination (no further action letter or closure communication) given the parallel regulatory closures, the absence of any identified deficiency in Quorum's own security practices, and the comprehensive nature of Quorum's breach notification and remediation efforts. We continue to monitor for the HHS-OCR determination, which we expect on or about November 30, 2023.

V. Recommended Next Steps

Based on the foregoing analysis, we recommend the following next steps:

1. Circulate annotated copy. This annotated copy and analysis should be circulated to Thomas R. Whitfield (General Counsel), Jennifer Liang (Chief Privacy Officer), David Naranjo (Chief Information Security Officer), and Margaret D. Calloway (Chief Compliance Officer). Distribution should be made under cover of a privilege notice and with instructions that the annotated copy not be further distributed without prior consultation with Calderwood & Harkness.

2. Board Audit Committee briefing. Include this closure letter and the summary analysis in the Board Audit Committee briefing package being prepared for the November 29, 2023 matter resolution memorandum. The briefing should highlight the two regulatory closures achieved to date and the anticipated HHS-OCR determination.

3. Retain original letter. The original closure letter should be retained in the Calderwood & Harkness privileged matter file (Matter No. 1025-00006) and in Quorum's legal department files. Copies should be indexed and accessible for future reference.

4. Regulatory notification tracker. The closure should be logged in the regulatory notification tracker and confirmation log maintained by Sara Hendricks on the Calderwood & Harkness matter team. The tracker entry should reflect the date of closure (November 28, 2023), the inquiry reference number (CID-CYB-2023-04187), the identity of the examining official (Richard Nakamura), the outcome (closed, no action), and a cross-reference to this annotated copy.

5. Monitor for HHS-OCR determination. Continue to monitor for the HHS-OCR final determination, which is anticipated by November 30, 2023. Upon receipt, a similar annotated analysis should be prepared and circulated.

6. Matter closure memorandum. Upon receipt of all three regulatory closures, proceed with the preparation of the comprehensive matter closure memorandum and post-incident lessons learned deliverables. These documents will serve as the definitive internal record of the Palomar matter's regulatory dimension and will inform Quorum's ongoing information security and vendor risk management practices.

VI. Document Retention Note

The original Connecticut Insurance Department closure letter dated November 28, 2023, is to be retained in the Calderwood & Harkness LLP matter file (Matter No. 1025-00006) and in Quorum Insurance Holdings Corp.'s legal department files. Both copies should be maintained indefinitely, or until such time as a formal document retention determination is made in connection with the overall matter closure.

This annotated copy — including the inline annotations, this summary analysis, and all appended materials — constitutes attorney work product prepared in anticipation of litigation and in the course of rendering legal advice to Quorum Insurance Holdings Corp. It is also protected by the attorney-client privilege to the extent it reflects confidential communications between Calderwood & Harkness and Quorum. This annotated copy should not be produced, disclosed, or made available in any discovery proceeding, regulatory inquiry, or other context without the prior review and approval of Calderwood & Harkness LLP. Any request for production of this document or its contents should be immediately referred to Kevin Ostrowski at Calderwood & Harkness.

This document should be retained in accordance with the Document Retention & Privilege Log Protocol that Calderwood & Harkness will prepare and issue upon formal closure of Matter No. 1025-00006. Until that protocol is issued, this document should be maintained in the privileged and confidential section of the matter file, with access limited to the individuals identified on the distribution list set forth on the cover sheet.

— END OF ANNOTATED DOCUMENT —

Calderwood & Harkness LLP — Confidential Attorney Work Product — Matter No. 1025-00006

ATTORNEY-CLIENT PRIVILEGED / ATTORNEY WORK PRODUCT / CONFIDENTIAL
INTERNAL ANNOTATED COPY — DO NOT DISTRIBUTE
CALDERWOOD & HARKNESS LLP 1700 K Street NW, Suite 900 Washington, D.C. 20006
MATTER COVER SHEET
Matter: Quorum Insurance Holdings Corp. — Palomar Data Security Incident
Matter Number: 1025-00006
Document Description: Annotated copy of Connecticut Insurance Department Closure Letter dated November 28, 2023
Annotations by:
Kevin Ostrowski, Partner, Privacy & Cybersecurity Practice Alan Burke, Associate, Privacy & Cybersecurity Practice
Date of Annotations: November 28, 2023
Distribution:
Thomas R. Whitfield — General Counsel, Quorum Insurance Holdings Corp. Jennifer Liang — Chief Privacy Officer, Quorum Insurance Holdings Corp. David Naranjo — Chief Information Security Officer, Quorum Insurance Holdings Corp. Internal Calderwood & Harkness LLP Privileged File (Matter No. 1025-00006)
This document constitutes attorney work product prepared in anticipation of litigation and in the course of rendering legal advice to Quorum Insurance Holdings Corp. This document is protected by the attorney-client privilege and the work product doctrine. It is intended solely for the use of the individuals and entities identified above. Any unauthorized review, use, disclosure, or distribution is strictly prohibited. If you have received this document in error, please contact Calderwood & Harkness LLP immediately at (202) 555-7200.
CALDERWOOD & HARKNESS LLP MEMORANDUM TO FILE
November 28, 2023
TO: Privileged File — Matter No. 1025-00006
FROM: Kevin Ostrowski, Partner; Alan Burke, Associate
RE: Connecticut Insurance Department Closure Letter — Quorum Insurance Holdings Corp. / Palomar Data Security Incident — Summary and Significance
We write to memorialize the receipt and significance of the enclosed closure letter issued by the Connecticut Insurance Department ("Department"), dated November 28, 2023, in connection with the Department's inquiry into the cybersecurity event affecting Quorum Insurance Holdings Corp. ("Quorum") arising from the Palomar Data Solutions, Inc. ("Palomar") data security incident.
This closure letter represents the second of three anticipated regulatory closure communications in the Palomar matter. The first was the multistate attorneys general coalition closure letter, dated November 22, 2023, issued on behalf of a 29-state coalition (led by Assistant Attorney General Diane Marchetti of the Connecticut Attorney General's Office and Assistant Attorney General Mark Petrosian of the New York Attorney General's Office), which closed the multistate inquiry without enforcement action, penalties, or any form of consent agreement. The third and final anticipated regulatory communication is the determination from the U.S. Department of Health and Human Services, Office for Civil Rights ("HHS-OCR"), which we expect to receive on or about November 30, 2023.
The Connecticut Insurance Department inquiry was initiated following Quorum's August 14, 2023 notification to the Department pursuant to the Connecticut Insurance Data Security Law, Conn. Gen. Stat. § 38a-999b. The inquiry was assigned to Examiner Richard Nakamura of the Department's Financial Analysis Division, Cybersecurity Unit. Over the course of the inquiry, Calderwood & Harkness submitted two substantive filings on Quorum's behalf: the initial inquiry response dated September 22, 2023, and a supplemental information submission dated October 20, 2023. Both submissions were prepared in close coordination with Quorum's General Counsel, Chief Privacy Officer, and Chief Information Security Officer.
The Department's closure letter confirms, in pertinent part, the following:
1. The Department has completed its review and is closing the inquiry without enforcement action, penalties, or consent orders.
2. The Department affirmatively finds that Quorum maintained an information security program consistent with the requirements of Conn. Gen. Stat. § 38a-999b.
3. The Department acknowledges that Quorum timely filed its cybersecurity event notification with the Department.
4. The Department credits Quorum's vendor oversight practices, including the contractual data security requirements imposed on Palomar and the enhanced security provisions formalized in MSA Amendment 3.
5. The Department notes with approval the remediation measures Quorum implemented following the incident.
6. No ongoing monitoring, reporting, or compliance verification obligations are imposed.
This outcome is fully consistent with the cooperative engagement strategy that Calderwood & Harkness pursued throughout the matter, in coordination with Quorum's leadership. The closure is favorable and unqualified in all material respects. The standard reservations of general supervisory authority and the "at this time" qualifier are boilerplate language that appears in virtually all Department closure communications and do not indicate any continuing concern or elevated scrutiny.
The enclosed document consists of the verbatim text of the Department's closure letter, with inline annotations prepared by the undersigned for the purpose of highlighting key language, assessing the implications of specific findings, and identifying any caveats or areas requiring continued attention. A summary analysis and set of key takeaways follows the annotated letter.
We recommend that this annotated copy be included in the Board Audit Committee briefing package being prepared for the November 29, 2023 matter resolution memorandum and that the original closure letter be retained in both the Calderwood & Harkness privileged matter file and Quorum's legal department files in accordance with the Document Retention & Privilege Log Protocol.
Kevin Ostrowski Partner, Privacy & Cybersecurity Practice Calderwood & Harkness LLP
Alan Burke Associate, Privacy & Cybersecurity Practice Calderwood & Harkness LLP
CONNECTICUT INSURANCE DEPARTMENT CLOSURE LETTER (VERBATIM TEXT WITH INLINE ANNOTATIONS)
The following is a verbatim reproduction of the closure letter received from the Connecticut Insurance Department on November 28, 2023. Inline annotations by Calderwood & Harkness attorneys appear in bracketed, bolded text and are clearly distinguished from the Department's original language. All annotations constitute privileged attorney work product.
STATE OF CONNECTICUT INSURANCE DEPARTMENT
Office of the Insurance Commissioner 153 Market Street, 7th Floor Hartford, Connecticut 06103 Telephone: (860) 297-3800 www.ct.gov/cid
November 28, 2023
Thomas R. Whitfield, Esq. General Counsel Quorum Insurance Holdings Corp. 400 Constitution Plaza, Suite 2200 Hartford, CT 06103
cc: Kevin Ostrowski, Esq. Calderwood & Harkness LLP 1700 K Street NW, Suite 900 Washington, D.C. 20006
Re: Cybersecurity Event Investigation — Quorum Insurance Holdings Corp. (NAIC No. 73291) / Inquiry Ref. No. CID-CYB-2023-04187
Dear Mr. Whitfield:
I. Opening — Purpose of Letter
The Connecticut Insurance Department ("Department") has completed its review of the cybersecurity event reported by Quorum Insurance Holdings Corp. ("Quorum") on August 14, 2023. Quorum's initial notification was filed with the Department pursuant to Section 38a-999b of the Connecticut General Statutes, commonly referred to as the Connecticut Insurance Data Security Law. The Department also received and reviewed Quorum's detailed inquiry response dated September 22, 2023, prepared and submitted by its outside counsel, Calderwood & Harkness LLP, as well as supplemental information submitted on October 20, 2023, in response to follow-up questions posed by the Department's Cybersecurity Unit.
Based on its review of all information provided, the Department is closing its inquiry into this cybersecurity event without further action at this time. The purpose of this letter is to communicate the Department's findings and the basis for its determination.
[C&H Annotation 1 — Kevin Ostrowski]: The "at this time" qualifier appearing in the closing clause of the opening paragraph is standard Department language. We have reviewed closure letters issued by the Department in comparable cybersecurity event inquiries over the past three years, including the Department's closures in the Meridian Health Underwriters matter (CID-CYB-2022-03841, closed March 2023) and the Atlantic Re matter (CID-CYB-2023-01602, closed September 2023). Both contained identical "at this time" language. This qualifier does not indicate any reservation, ongoing concern, or condition attached to the closure. Notably, no ongoing monitoring or reporting obligation of any kind is imposed anywhere in this letter. This represents a fully favorable outcome.
II. Summary of the Department's Findings
A. Nature of the Cybersecurity Event
Based on the information provided by Quorum and its counsel, the Department understands the relevant facts to be as follows.
The cybersecurity event originated not within Quorum's own information systems or network environment, but within the systems of Palomar Data Solutions, Inc. ("Palomar"), a third-party claims-processing vendor engaged by Quorum pursuant to a Master Services Agreement originally executed on November 12, 2019, and subsequently amended. Palomar provides claims adjudication, processing, and data management services to Quorum and, in connection with those services, receives, processes, stores, and transmits certain policyholder and claimant data on Quorum's behalf.
On or about March 14, 2023, one or more unauthorized threat actors gained access to Palomar's network through the exploitation of a known vulnerability, identified as CVE-2023-0669, affecting Palomar's GoAnywhere MFT (Managed File Transfer) appliance. This vulnerability, which was publicly disclosed in early February 2023, permitted remote code execution on unpatched systems. The unauthorized access persisted for a period of approximately thirty-five (35) days, from on or about March 14, 2023, through on or about April 18, 2023, during which time data exfiltration activities occurred.
Palomar discovered anomalous outbound data transfer activity on April 18, 2023, and, following an initial internal assessment, notified Quorum of the potential data security event on April 21, 2023. Quorum thereafter engaged outside forensic investigators and counsel to assess the scope and impact of the incident.
The investigation determined that the compromised data included personally identifiable information ("PII"), financial data, and protected health information ("PHI") of approximately 318,247 Quorum policyholders and claimants across twenty-nine (29) states and the District of Columbia. Of these affected individuals, approximately 52,114 were residents of the State of Connecticut.
[C&H Annotation 2 — Alan Burke]: The Department's recitation of the underlying facts is accurate in all material respects and is fully consistent with the factual narrative presented in our September 22, 2023 inquiry response and our October 20, 2023 supplemental submission. No factual discrepancies or inaccuracies are noted. Several points merit emphasis:
(a) The Department correctly identifies the vendor-originated nature of the breach. The letter's factual summary makes clear that the cybersecurity event originated at Palomar — not within Quorum's own network or systems. This is significant because it demonstrates that the Department understood and accepted our framing of the incident as a third-party vendor event, not a direct Quorum security failure.
(b) The Department correctly attributes the root cause of the unauthorized access to Palomar's failure to patch a known vulnerability (CVE-2023-0669) in its GoAnywhere MFT appliance. The Department does not suggest that Quorum bore any responsibility for Palomar's patching failure or that Quorum's own systems were compromised.
(c) The affected individual counts referenced by the Department (318,247 total; 52,114 Connecticut residents) are consistent with the figures reported in our submissions and in Quorum's consumer notification materials.
B. Compliance with the Connecticut Insurance Data Security Law
The Department has assessed Quorum's compliance with the applicable requirements of the Connecticut Insurance Data Security Law, Conn. Gen. Stat. § 38a-999b, and related provisions. Based on its review, the Department makes the following findings.
The Department finds that Quorum maintained an information security program that was consistent with the requirements of Conn. Gen. Stat. § 38a-999b. The Department reviewed documentation provided by Quorum regarding its information security policies, procedures, and governance structure, including its risk assessment practices, access controls, encryption standards, employee training programs, and incident response protocols, and the Department is satisfied that these measures were commensurate with the nature, size, and complexity of Quorum's insurance operations and the sensitivity of the data at issue.
The Department acknowledges that Quorum timely filed its cybersecurity event notification with the Department on August 14, 2023. Under Conn. Gen. Stat. § 38a-999b(d), a licensee is required to notify the Commissioner of Insurance of a cybersecurity event as promptly as possible, but in no event later than three (3) business days from the date the licensee determines that the event has occurred, if the event meets certain specified criteria. The Department is satisfied that Quorum's August 14, 2023 notification was filed within the applicable statutory timeframe.
The Department further notes that Quorum also filed concurrent notification with the Connecticut Attorney General's Office pursuant to Conn. Gen. Stat. § 36a-701b on August 14, 2023, the same date as its notification to this Department. This concurrent filing demonstrates Quorum's commitment to timely and comprehensive regulatory notification.
The Department acknowledges that Quorum commenced consumer notification mailings to affected Connecticut residents beginning August 18, 2023, and that all consumer notifications were completed by September 15, 2023. The notification letters provided to the Department for review were found to contain the substantive information elements expected under applicable Connecticut law, including a description of the incident, the categories of information involved, guidance for affected individuals, and contact information for Quorum's dedicated incident response team.
Additionally, the Department notes that Quorum offered twenty-four (24) months of complimentary credit monitoring and identity theft protection services, provided through Dunmore Services Inc., to all individuals affected by the cybersecurity event, regardless of whether those individuals were Connecticut residents. The Department views this as a meaningful remedial measure for affected consumers.
[C&H Annotation 3 — Kevin Ostrowski]: This is the most significant substantive finding in the closure letter. The Department's explicit determination that Quorum "maintained an information security program that was consistent with the requirements of Conn. Gen. Stat. § 38a-999b" is a strong, affirmative compliance finding. Several observations:
(a) This language should be highlighted for the Board Audit Committee and preserved for potential use in any future litigation or regulatory defense context. In the event that putative class action plaintiffs (or other regulators) allege that Quorum maintained inadequate data security practices, the Department's finding that Quorum's program was "consistent with" statutory requirements provides a powerful counterpoint. While the finding is not dispositive in other proceedings, it carries persuasive weight — particularly because the Connecticut Insurance Data Security Law is modeled on the NAIC Insurance Data Security Model Law and imposes substantive security program requirements that go beyond mere notification obligations.
(b) The Department's review encompassed Quorum's risk assessment practices, access controls, encryption standards, employee training programs, and incident response protocols. This is a comprehensive review, and the Department's satisfaction with these measures — as stated in the letter — reflects favorably on Quorum's overall security posture.
(c) The Department does not suggest, at any point in this letter, that Quorum's own security posture was deficient or that Quorum bore direct culpability for the breach. This is consistent with the factual reality (the breach was Palomar's) and with our advocacy in the inquiry response submissions.
(d) The Department's acknowledgment of Quorum's timely notification, concurrent AG filing, consumer notifications, and credit monitoring offering further reinforces the narrative of a company that responded responsibly and comprehensively to a third-party vendor incident.
C. Vendor Oversight and Accountability
The Department has also reviewed Quorum's vendor risk management practices as they relate to the Palomar engagement. The Department acknowledges that Quorum maintained a vendor risk management program, overseen by Priya Deshmukh, Vice President of Vendor Risk Management, which included processes for evaluating, onboarding, monitoring, and managing third-party service providers with access to policyholder and claimant data.
The Department notes that the Master Services Agreement between Quorum and Palomar, originally executed on November 12, 2019, and subsequently amended, contained a number of data security requirements applicable to Palomar's handling of Quorum's data. As described in the materials provided to the Department, these contractual requirements included, among other things:
(i) An obligation on Palomar to maintain commercially reasonable safeguards appropriate to the nature and sensitivity of the data being processed;
(ii) A requirement to patch critical vulnerabilities within thirty (30) days of the issuance of a patch by the applicable vendor or developer;
(iii) A requirement to undergo annual penetration testing by a qualified third-party assessor;
(iv) A requirement to provide SOC 2 Type II audit reports to Quorum on an annual basis; and
(v) A security incident notification obligation requiring Palomar to notify Quorum of any actual or suspected data security event within forty-eight (48) hours of discovery.
These provisions were incorporated or strengthened through Amendment 2 to the Master Services Agreement, executed on September 15, 2022.
The Department notes Quorum's assertion, supported by documentation provided in the September 22, 2023 inquiry response and October 20, 2023 supplemental submission, that Palomar failed to timely patch the CVE-2023-0669 vulnerability within the contractual thirty-day window, and that Palomar's breach notification to Quorum was delivered on April 21, 2023 — approximately twenty-four (24) hours beyond the forty-eight-hour notification window specified in Section 9.4 of the Master Services Agreement.
The Department further acknowledges the October 27, 2023 indemnification settlement reached between Quorum and Palomar, pursuant to which Palomar agreed to bear certain costs and expenses arising from the cybersecurity event. In connection with that settlement, the parties executed Amendment 3 to the Master Services Agreement, which formalized enhanced data security requirements for Palomar, including:
(i) An accelerated critical vulnerability patching window of fourteen (14) calendar days (reduced from thirty days);
(ii) Mandatory deployment and operation of endpoint detection and response ("EDR") technology across all systems involved in the processing of Quorum data;
(iii) Quarterly vulnerability scanning of all Palomar systems and applications involved in the Quorum engagement;
(iv) An annual independent security assessment conducted by a qualified third-party assessor, the results of which are to be shared with Quorum; and
(v) A reduced security incident notification window of twenty-four (24) hours (reduced from forty-eight hours).
[C&H Annotation 4 — Alan Burke]: The Department's treatment of the vendor oversight and accountability topic is favorable in several important respects:
(a) The Department affirmatively acknowledges the existence and substance of Quorum's vendor risk management program, the contractual data security requirements imposed on Palomar, and the specific persons responsible for overseeing the program (Priya Deshmukh, VP Vendor Risk Management). This acknowledgment is significant because vendor oversight adequacy is one of the most common areas of regulatory scrutiny following third-party vendor breaches.
(b) The Department does not criticize Quorum's vendor management practices or suggest that they were inadequate in any respect. The Department's recitation of the contractual provisions — patching requirements, penetration testing, SOC 2 reports, notification obligations — demonstrates that the Department reviewed these provisions and found them to be appropriate. No finding of deficiency is made.
(c) The Department's acknowledgment of the MSA Amendment 3 enhancements and the indemnification settlement reflects positively on Quorum's proactive approach to holding its vendor accountable and strengthening contractual protections following the incident. The Department appears to view these measures favorably.
(d) One area of potential vulnerability that the Department did not address: the Department does not comment on whether Quorum should have independently detected Palomar's failure to patch CVE-2023-0669 prior to the breach. The contractual patching obligation was Palomar's, and Quorum's vendor oversight program relied in part on Palomar's self-reported compliance and SOC 2 reporting. Whether Quorum's monitoring was sufficiently robust to detect a vendor's undisclosed patching failure is a question that could be raised in other contexts — for example, in class action litigation or in an HHS-OCR review — but the Department has not raised it here, and the closure without further action effectively resolves this issue as far as the Connecticut Insurance Department is concerned. We should remain attentive to this issue in the HHS-OCR context.
D. Remediation Measures
The Department notes with approval the remediation measures that Quorum has implemented or is in the process of implementing following the cybersecurity event. These measures include, but are not limited to:
(i) The enhanced vendor security audit requirements formalized in Amendment 3 to the Master Services Agreement, as described above;
(ii) The strengthened contractual notification obligations, including the reduction of Palomar's security event notification window from forty-eight (48) hours to twenty-four (24) hours;
(iii) The engagement of an independent third-party security assessor to conduct a comprehensive security evaluation of Palomar's systems and practices, at Palomar's expense, with results to be shared with Quorum;
(iv) Enhancements to Quorum's own vendor risk management program, including the implementation of additional monitoring and oversight mechanisms for critical third-party service providers;
(v) A comprehensive review and updating of Quorum's incident response plan to incorporate lessons learned from the Palomar event, including revised escalation procedures, communication protocols, and forensic readiness measures.
The Department encourages Quorum to continue to evaluate and enhance its information security program and vendor oversight practices on an ongoing basis, consistent with evolving cybersecurity threats, industry best practices, and the requirements of applicable law.
[C&H Annotation 5 — Kevin Ostrowski]: The Department's use of the word "encourages" in the final sentence of this section is precatory, not mandatory. This language does not create any binding obligation, compliance requirement, or enforceable commitment on Quorum's part. No specific remediation orders, consent agreements, compliance monitoring requirements, periodic reporting obligations, or follow-up assessments are imposed anywhere in this letter. This is standard advisory language that appears routinely in Department closure communications and should not be construed as indicating any deficiency or ongoing concern.
For the avoidance of doubt, Quorum is, of course, already implementing the remediation measures described in the letter and is committed to continuous improvement of its information security and vendor risk management programs. The Department's "encouragement" is entirely consistent with Quorum's existing trajectory and does not require any additional action beyond what is already planned and underway.
III. Formal Closure
Based on its review of all information provided by Quorum and its counsel in connection with this inquiry, the Department is closing its inquiry into this cybersecurity event without further action. The Department considers this matter resolved.
Nothing in this letter shall be construed as a waiver or limitation of the Department's general supervisory and examination authority under Title 38a of the Connecticut General Statutes, including but not limited to the Department's authority under Conn. Gen. Stat. §§ 38a-15, 38a-16, and 38a-999b. This closure does not preclude the Department from taking future action with respect to this matter or any related matter if additional information comes to light or if circumstances change.
The Department thanks Quorum and its counsel at Calderwood & Harkness LLP for their cooperation and responsiveness throughout the inquiry process. The Department appreciates the thoroughness and professionalism with which Quorum addressed the Department's questions and requests for information.
[C&H Annotation 6 — Alan Burke]: The reservation of general supervisory and examination authority and the "future action" language in the second paragraph of this section is entirely standard boilerplate. We have confirmed that substantively identical language appears in every Department closure letter we have reviewed in the cybersecurity context, including the Meridian Health Underwriters and Atlantic Re closures referenced above. The language does not indicate any ongoing concern, elevated scrutiny, or condition precedent to the closure. It is a standard protective reservation that preserves the Department's statutory prerogatives as a matter of law — prerogatives that exist regardless of whether they are expressly reserved in a closure letter.
The Department's expression of appreciation for cooperation is a positive signal and is consistent with the cooperative engagement strategy that we pursued throughout this matter. The Department's characterization of Quorum's engagement as "thorough" and "professional" reflects well on the company and on the inquiry response submissions.
Should you have any questions regarding this letter, please do not hesitate to contact the undersigned.
Sincerely,
Richard Nakamura Examiner, Financial Analysis Division Cybersecurity Unit Connecticut Insurance Department 153 Market Street, 7th Floor Hartford, CT 06103 Tel: (860) 297-3847
Email: richard.nakamura@ct.gov
[C&H Annotation 7 — Kevin Ostrowski]: The letter is signed by Richard Nakamura, the same examiner who was assigned to the inquiry from its inception following Quorum's August 14, 2023 notification. Throughout the course of the inquiry, the matter was not escalated to more senior Department officials — it remained at the examiner level within the Cybersecurity Unit of the Financial Analysis Division. This is a favorable indicator for several reasons: (a) it suggests that the Department did not view the matter as presenting issues of sufficient concern or complexity to warrant involvement by senior leadership or the Commissioner's office; (b) it is consistent with the Department's treatment of the matter as a routine cybersecurity event inquiry rather than an enforcement investigation; and (c) it is consistent with the cooperative engagement approach, which was designed to provide complete and responsive information at the initial and supplemental submission stages so as to resolve the inquiry efficiently at the examiner level without the need for escalation.
CALDERWOOD & HARKNESS LLP SUMMARY ANALYSIS AND KEY TAKEAWAYS (POST-LETTER ANNOTATION SECTION)
The following analysis is prepared by Kevin Ostrowski and Alan Burke of Calderwood & Harkness LLP and constitutes privileged attorney work product. It is intended solely for the use of Quorum Insurance Holdings Corp. and authorized internal C&H personnel in connection with Matter No. 1025-00006.
I. Overall Assessment
The Connecticut Insurance Department's closure letter of November 28, 2023, represents a fully favorable outcome for Quorum Insurance Holdings Corp. The key elements of this assessment are as follows:
No Enforcement Action. The Department closed its inquiry without initiating any enforcement proceeding, issuing any administrative order, or imposing any penalty or fine.
No Consent Order or Agreement. The Department did not require Quorum to enter into any consent order, assurance of voluntary compliance, or similar agreement as a condition of closure.
No Ongoing Monitoring or Reporting. The Department did not impose any ongoing monitoring, periodic reporting, compliance verification, or follow-up assessment requirements.
Affirmative Compliance Finding. The Department affirmatively found that Quorum maintained an information security program consistent with the requirements of Conn. Gen. Stat. § 38a-999b. This is an important positive finding, not merely the absence of a negative finding.
Vendor Oversight Credited. The Department acknowledged Quorum's vendor risk management program and the contractual data security requirements imposed on Palomar, and noted with approval the enhanced security provisions formalized in MSA Amendment 3.
Post-Incident Remediation Credited. The Department recognized Quorum's remediation measures and expressed no concern regarding their adequacy or scope.
Timely Notification Acknowledged. The Department confirmed that Quorum's notification was filed within the applicable statutory timeframe.
This closure letter is the second regulatory closure achieved in the Palomar matter. The first was the multistate attorneys general coalition closure letter dated November 22, 2023, in which a 29-state coalition (led by AAG Diane Marchetti of the Connecticut Attorney General's Office and AAG Mark Petrosian of the New York Attorney General's Office) closed its inquiry without enforcement action, penalties, or any form of consent agreement. The only remaining regulatory proceeding is the HHS-OCR review, for which we anticipate a favorable determination in the near term.
II. Key Favorable Language to Preserve
The following specific findings and statements in the Department's closure letter should be highlighted, preserved, and referenced in future filings, briefings, and — if appropriate — litigation or regulatory defense materials:
1. Information Security Program Compliance. "The Department finds that Quorum maintained an information security program that was consistent with the requirements of Conn. Gen. Stat. § 38a-999b." This is the Department's central compliance finding and the single most valuable statement in the letter from a defensive perspective.
2. Timely Notification. "The Department is satisfied that Quorum's August 14, 2023 notification was filed within the applicable statutory timeframe." This confirms that Quorum met its reporting obligation without deficiency.
3. Vendor Accountability Measures. The Department's detailed acknowledgment of the MSA provisions, the indemnification settlement, and the MSA Amendment 3 enhancements. These passages demonstrate that the Department reviewed and was satisfied with Quorum's approach to vendor accountability.
4. Cooperation and Professionalism. "The Department thanks Quorum and its counsel at Calderwood & Harkness LLP for their cooperation and responsiveness throughout the inquiry process. The Department appreciates the thoroughness and professionalism with which Quorum addressed the Department's questions and requests for information." This language, while procedural in nature, is useful in demonstrating that the regulatory process was constructive and that Quorum engaged in good faith.
III. Caveats and Standard Reservations
The closure letter contains several standard reservations and qualifiers that are common to Department closure communications. None of these raise substantive concern:
"At this time" qualifier. The phrase "without further action at this time" appears in the opening paragraph. As noted in Annotation 1, this is standard Department language. It does not reflect any continuing concern or conditional closure. We have confirmed its presence in comparable closure letters.
Reservation of general supervisory authority. The Department reserves its supervisory and examination authority under Title 38a. This is a standard legal reservation that preserves the Department's statutory prerogatives and appears in all closure letters regardless of the circumstances.
"Future action" reservation. The statement that "this closure does not preclude the Department from taking future action . . . if additional information comes to light or if circumstances change" is standard boilerplate. No specific trigger, condition, or scenario is identified. This language does not indicate any expectation or intent to reopen the inquiry.
"Encourages" language regarding ongoing security enhancements. The Department's statement that it "encourages Quorum to continue to evaluate and enhance its information security program" is precatory and advisory. It does not create any enforceable obligation or compliance requirement.
Bottom line: The standard reservations in this letter are wholly unremarkable and do not qualify, diminish, or condition the favorable closure in any way.
IV. Implications for the Broader Matter
The Department's closure letter has several important implications for the broader Palomar matter:
Litigation Posture. This closure strengthens Quorum's position in any future litigation, including the potential consumer class action(s) that may be filed in connection with the Palomar incident. A finding by the relevant state insurance regulator that Quorum's information security program was "consistent with" statutory requirements is a persuasive (though not dispositive) data point that can be cited in defense of adequacy-of-security claims. The closure should be referenced in any litigation hold memorandum update and preserved in the litigation readiness file. Counsel should assess the applicability of this finding in light of the specific causes of action and standards at issue in any particular litigation matter.
Board Audit Committee Briefing. This closure should be prominently featured in the Board Audit Committee final briefing memorandum that is being prepared for the November 29, 2023 meeting. The briefing memo should report that two of the three anticipated regulatory proceedings have now been closed without adverse action, with the third (HHS-OCR) expected to follow shortly. The overall regulatory outcome to date validates the incident response strategy and the cooperative engagement approach that Quorum and Calderwood & Harkness pursued.
SEC Disclosure. This closure, together with the multistate AG closure of November 22, 2023, should be taken into account in connection with Quorum's ongoing securities disclosure analysis. The materiality assessment prepared on July 19, 2023 (in connection with the 8-K / 10-Q analysis) should be revisited in light of the regulatory closures to determine whether any updated or supplemental disclosure is appropriate. The absence of enforcement action, penalties, or consent orders supports the conclusion that the regulatory dimensions of the Palomar matter are resolving favorably and without material financial impact beyond the costs previously disclosed or reserved.
Multistate AG Closure Complement. The Department's closure letter complements and reinforces the multistate AG closure letter of November 22, 2023. The two regulatory closures, taken together, reflect a consistent regulatory consensus that Quorum acted responsibly and in compliance with applicable law. This consistency is valuable from both a reputational and a legal defense perspective.
HHS-OCR Determination. The HHS-OCR review relates to the approximately 41,203 individuals whose protected health information was compromised in the Palomar incident. Quorum filed its HIPAA breach notification with HHS-OCR on August 15, 2023. We anticipate a favorable determination (no further action letter or closure communication) given the parallel regulatory closures, the absence of any identified deficiency in Quorum's own security practices, and the comprehensive nature of Quorum's breach notification and remediation efforts. We continue to monitor for the HHS-OCR determination, which we expect on or about November 30, 2023.
V. Recommended Next Steps
Based on the foregoing analysis, we recommend the following next steps:
1. Circulate annotated copy. This annotated copy and analysis should be circulated to Thomas R. Whitfield (General Counsel), Jennifer Liang (Chief Privacy Officer), David Naranjo (Chief Information Security Officer), and Margaret D. Calloway (Chief Compliance Officer). Distribution should be made under cover of a privilege notice and with instructions that the annotated copy not be further distributed without prior consultation with Calderwood & Harkness.
2. Board Audit Committee briefing. Include this closure letter and the summary analysis in the Board Audit Committee briefing package being prepared for the November 29, 2023 matter resolution memorandum. The briefing should highlight the two regulatory closures achieved to date and the anticipated HHS-OCR determination.
3. Retain original letter. The original closure letter should be retained in the Calderwood & Harkness privileged matter file (Matter No. 1025-00006) and in Quorum's legal department files. Copies should be indexed and accessible for future reference.
4. Regulatory notification tracker. The closure should be logged in the regulatory notification tracker and confirmation log maintained by Sara Hendricks on the Calderwood & Harkness matter team. The tracker entry should reflect the date of closure (November 28, 2023), the inquiry reference number (CID-CYB-2023-04187), the identity of the examining official (Richard Nakamura), the outcome (closed, no action), and a cross-reference to this annotated copy.
5. Monitor for HHS-OCR determination. Continue to monitor for the HHS-OCR final determination, which is anticipated by November 30, 2023. Upon receipt, a similar annotated analysis should be prepared and circulated.
6. Matter closure memorandum. Upon receipt of all three regulatory closures, proceed with the preparation of the comprehensive matter closure memorandum and post-incident lessons learned deliverables. These documents will serve as the definitive internal record of the Palomar matter's regulatory dimension and will inform Quorum's ongoing information security and vendor risk management practices.
VI. Document Retention Note
The original Connecticut Insurance Department closure letter dated November 28, 2023, is to be retained in the Calderwood & Harkness LLP matter file (Matter No. 1025-00006) and in Quorum Insurance Holdings Corp.'s legal department files. Both copies should be maintained indefinitely, or until such time as a formal document retention determination is made in connection with the overall matter closure.
This annotated copy — including the inline annotations, this summary analysis, and all appended materials — constitutes attorney work product prepared in anticipation of litigation and in the course of rendering legal advice to Quorum Insurance Holdings Corp. It is also protected by the attorney-client privilege to the extent it reflects confidential communications between Calderwood & Harkness and Quorum. This annotated copy should not be produced, disclosed, or made available in any discovery proceeding, regulatory inquiry, or other context without the prior review and approval of Calderwood & Harkness LLP. Any request for production of this document or its contents should be immediately referred to Kevin Ostrowski at Calderwood & Harkness.
This document should be retained in accordance with the Document Retention & Privilege Log Protocol that Calderwood & Harkness will prepare and issue upon formal closure of Matter No. 1025-00006. Until that protocol is issued, this document should be maintained in the privileged and confidential section of the matter file, with access limited to the individuals identified on the distribution list set forth on the cover sheet.
— END OF ANNOTATED DOCUMENT —
Calderwood & Harkness LLP — Confidential Attorney Work Product — Matter No. 1025-00006

ATTORNEY-CLIENT PRIVILEGED / ATTORNEY WORK PRODUCT / CONFIDENTIAL

MATTER COVER SHEET

CALDERWOOD & HARKNESS LLP MEMORANDUM TO FILE

STATE OF CONNECTICUT INSURANCE DEPARTMENT

Record

Parties

Dates

Amounts