CALDERWOOD & HARKNESS LLP Attorneys at Law
1700 K Street NW, Suite 900 Washington, D.C. 20006
Telephone: (202) 555-8400 Facsimile: (202) 555-8401 www.calderwoodharkness.com
September 22, 2023
Via Electronic Submission and U.S. Mail
Mr. Richard Nakamura Examiner, Financial Analysis Division, Cybersecurity Unit Connecticut Insurance Department 153 Market Street, 7th Floor Hartford, CT 06103
Re: Response to Connecticut Insurance Department Inquiry Regarding Cybersecurity Event Insurer: Quorum Insurance Holdings Corp. (NAIC No. 44281; Nasdaq: QIHC) CID File Reference: CYB-INQ-2023-04187 Date of Initial Notification Filing: August 14, 2023
Dear Mr. Nakamura:
Calderwood & Harkness LLP respectfully submits this response on behalf of its client, Quorum Insurance Holdings Corp. ("Quorum," "QIH," or the "Company"), a Delaware corporation headquartered at 400 Constitution Plaza, Suite 2200, Hartford, CT 06103. This letter is submitted in response to the Department's inquiry letter dated September 5, 2023, in which the Connecticut Insurance Department (the "Department" or "CID") requested additional information regarding the cybersecurity event that Quorum reported to the Department on August 14, 2023, pursuant to the Connecticut Insurance Data Security Law, Conn. Gen. Stat. § 38a-999b (the "CT Insurance Data Security Law").
By way of background, Quorum is a publicly traded insurance holding company listed on the Nasdaq Stock Market under the ticker symbol "QIHC." The Company operates through its licensed insurance subsidiaries in all fifty states, the District of Columbia, and Puerto Rico, offering a diversified portfolio of personal and commercial lines products, specialty insurance, and life and annuity products. Quorum also develops and operates its proprietary digital underwriting platform, QuorumEdge, which integrates advanced data analytics, machine learning models, and automated decision-support tools to enhance the speed and accuracy of the Company's underwriting processes across all business lines. For the fiscal year ended December 31, 2022, Quorum reported annual consolidated revenue of approximately $4.82 billion and employed approximately 11,400 individuals across its domestic operations. As of May 31, 2023, the Company's market capitalization was approximately $6.1 billion.
Quorum takes the security of its policyholders' and claimants' personal information with the utmost seriousness. Since the Company first learned of the cybersecurity event at issue, Quorum has cooperated fully and transparently with the Department, the Connecticut Attorney General, and all other relevant regulatory authorities. The Company is committed to continuing that cooperation throughout the pendency of this inquiry.
Calderwood & Harkness LLP represents Quorum in connection with all aspects of this matter. The responsible partner on the engagement is Kevin Ostrowski, Partner, Privacy & Data Security Practice Group. The lead associate is Alan Burke. This matter is carried under Calderwood & Harkness Matter No. 1025-00006. This submission has been authorized by Quorum's General Counsel, Thomas R. Whitfield, Esq., and the Company's Chief Privacy Officer, Jennifer Liang.
The following sections provide a comprehensive response to each category of information requested in the Department's inquiry letter, organized for the Department's convenience into the following topics: (I) an executive summary of the cybersecurity event; (II) background on the vendor relationship at the origin of the event; (III) a detailed incident timeline; (IV) the scope of compromised data; (V) the Company's compliance with the CT Insurance Data Security Law; (VI) consumer notification and remedial services; (VII) the forensic investigation and root cause analysis; (VIII) vendor accountability measures; (IX) information security program enhancements; (X) insurance coverage; (XI) a summary of total incident costs; and (XII) Quorum's commitment to continued cooperation.
I. Executive Summary
The cybersecurity event that is the subject of this inquiry originated not within Quorum's own information systems, network infrastructure, or digital platforms, but within the network of a third-party claims-processing vendor, Palomar Data Solutions, Inc. ("Palomar"), a Texas corporation headquartered at 7100 Greenville Avenue, Suite 450, Dallas, TX 75231. Palomar provides claims data processing, document management, and analytics services to Quorum and other mid-to-large insurance carriers under a Master Services Agreement dated November 12, 2019 (as subsequently amended, the "MSA"), which carries an annual contract value of approximately $16.3 million.
On or about March 14, 2023, a threat actor exploited a known remote code execution vulnerability — specifically, CVE-2023-0669, a critical-severity vulnerability affecting GoAnywhere MFT file transfer appliances — in Palomar's network environment to gain unauthorized access. The threat actor subsequently engaged in lateral movement within Palomar's infrastructure, ultimately locating, staging, and exfiltrating structured data files that contained Quorum policyholder and claimant information. The unauthorized access and data exfiltration continued for approximately thirty-five (35) days, from on or about March 14, 2023 through April 18, 2023, when Palomar's Security Operations Center ("SOC") detected anomalous outbound data transfers and took steps to contain the incident.
The forensic investigation, conducted by Graystone Forensics LLC under the direction and privilege umbrella of this firm, confirmed that the personally identifiable information ("PII"), protected health information ("PHI"), and financial data of approximately 318,247 individuals across twenty-nine states and the District of Columbia were compromised in the event. Of this total, 52,114 are residents of the State of Connecticut — making Connecticut the single most affected state by resident count. The compromised data elements span three categories: (a) general PII, including full names, dates of birth, Social Security numbers, and driver's license numbers, affecting all 318,247 individuals; (b) financial information, including bank account numbers and payment card numbers, affecting a subset of 84,619 individuals; and (c) PHI, including health conditions, diagnosis codes, and treatment information derived from workers' compensation and health-related insurance claims, affecting a subset of 41,203 individuals.
Quorum engaged Calderwood & Harkness LLP as outside breach response counsel on May 4, 2023, and this firm retained Graystone Forensics LLC on May 5, 2023, under the attorney-client privilege and work product protections, to conduct a comprehensive forensic investigation into the nature, scope, and impact of the incident. The forensic investigation proceeded in two phases: a preliminary findings report was delivered on June 2, 2023, and the final forensic report was delivered on July 14, 2023. Following the completion of the forensic analysis, Quorum undertook a thorough data mining and affected-individual identification process, which was completed on August 4, 2023.
Quorum filed timely notifications with the Connecticut Insurance Department and the Connecticut Attorney General on August 14, 2023, in compliance with the CT Insurance Data Security Law, Conn. Gen. Stat. § 38a-999b, and the Connecticut breach notification statute, Conn. Gen. Stat. § 36a-701b. The Company also filed notifications with the U.S. Department of Health and Human Services, Office for Civil Rights ("HHS-OCR"), and all other applicable state attorneys general and regulatory bodies within the timeframes required by applicable law. Consumer notification letters were mailed on a rolling basis commencing August 18, 2023, and the mailing was completed on September 15, 2023. All affected individuals were offered twenty-four (24) months of complimentary credit monitoring and identity theft protection services.
In addition to consumer remediation, Quorum has actively pursued vendor accountability. On June 20, 2023, this firm issued a formal breach of contract and indemnification demand to Palomar and its counsel, asserting Palomar's material breach of its data security obligations under the MSA and seeking full indemnification for all incident response costs incurred by Quorum. Those negotiations remain ongoing as of the date of this submission. Quorum has also imposed enhanced security requirements on Palomar and is evaluating all available contractual remedies, including termination of the MSA for cause.
II. Background on the Vendor Relationship
A. Palomar Data Solutions — Overview
Palomar Data Solutions, Inc. ("Palomar") is a Texas corporation, Employer Identification Number 75-3291048, with its principal offices located at 7100 Greenville Avenue, Suite 450, Dallas, TX 75231. Palomar provides claims data processing, document management, and analytics services to mid-to-large insurance carriers across the United States. The company was founded in 2005 and, as of December 31, 2022, employed approximately 2,100 individuals. For the fiscal year ended December 31, 2022, Palomar reported annual revenue of approximately $340 million.
Quorum is Palomar's second-largest client by annual revenue, accounting for approximately 4.8% of Palomar's total annual revenue. Palomar's senior leadership relevant to this matter includes Marcus J. Trevino, Chief Executive Officer; Anita Raghavan, Chief Technology Officer; and Derek Copeland, General Counsel. Palomar is represented in this matter by the law firm of Mercer, Haight & Dunlop LLP, 2100 Ross Avenue, Suite 3600, Dallas, TX 75201, with Catherine Langford, Partner, serving as lead counsel.
B. Master Services Agreement
Quorum and Palomar entered into the Master Services Agreement on November 12, 2019, with an initial five-year term expiring November 11, 2024. The original annual contract value was $14.2 million, representing a five-year total contract value of $71.0 million. The MSA has been amended twice since its execution:
Amendment 1 (executed March 3, 2021): This amendment expanded the scope of services to include data processing for Quorum's QuorumEdge digital underwriting platform, which required Palomar to process additional categories of underwriting-related data. Amendment 1 increased the annual contract value by $2.1 million, from $14.2 million to $16.3 million, effective April 1, 2021.
Amendment 2 (executed September 15, 2022): This amendment updated the Data Security Exhibit (Exhibit D) to reflect evolving industry standards and regulatory requirements. Among other changes, Amendment 2 added an express requirement that Palomar obtain and maintain a SOC 2 Type II audit report, audited annually by Kessler, Park & Associates CPA, PLLC, Dallas, TX, and updated the minimum cyber-insurance coverage requirements applicable to Palomar under the Insurance Requirements Exhibit (Exhibit E).
Under the MSA, Palomar processes claims data for Quorum's personal lines division, which includes policyholder and claimant PII (such as names, Social Security numbers, dates of birth, addresses, and driver's license numbers), financial information (such as bank account numbers and payment card data used for claim disbursements), and health-related claims data (including diagnosis codes, treatment information, and medical records associated with workers' compensation and health-related insurance claims).
C. Contractual Data Security Requirements
The MSA, as amended, imposes detailed data security requirements on Palomar through several interconnected provisions:
Data Security Exhibit (Exhibit D, as amended by Amendment 2): Exhibit D required Palomar to develop, implement, and maintain "commercially reasonable" administrative, technical, and physical safeguards designed to protect the confidentiality, integrity, and availability of all Quorum data in Palomar's possession, custody, or control. Specific requirements under Exhibit D included, among others:
• Patching of critical and high-severity vulnerabilities within thirty (30) days of the date on which a vendor-released patch becomes available;
• Conducting annual penetration testing of all systems and applications that process, store, or transmit Quorum data, with results to be shared with Quorum upon request;
• Maintaining a current SOC 2 Type II audit report, covering the Trust Services Criteria for Security, Availability, and Confidentiality, audited annually by an independent third-party audit firm; and
• Maintaining access controls, encryption standards, logging and monitoring capabilities, and other technical safeguards consistent with industry best practices and applicable legal requirements.
Breach Notification Clause (MSA Section 9.4): Section 9.4 of the MSA required Palomar to notify Quorum in writing within forty-eight (48) hours of Palomar's discovery of any security incident, data breach, or unauthorized access to, or acquisition, disclosure, or use of, Quorum data. The notification was required to include a description of the incident, the categories of data potentially affected, and Palomar's initial assessment of the scope and severity of the incident.
Insurance Requirements (Exhibit E): Exhibit E required Palomar to procure and maintain, at its own cost, a minimum of $10,000,000 in cyber-liability insurance coverage, with Quorum named as an additional insured. Palomar was required to furnish certificates of insurance to Quorum annually and upon request.
Indemnification Provision (MSA Section 12.2): Under Section 12.2, Palomar agreed to indemnify, defend, and hold harmless Quorum and its affiliates, officers, directors, employees, and agents from and against all losses, liabilities, damages, costs, and expenses (including reasonable attorneys' fees) arising from or related to Palomar's breach of its data security obligations under the MSA, including but not limited to Exhibit D. The indemnification obligation is subject to a liability cap equal to two times (2×) the trailing twelve-month fees paid by Quorum to Palomar, which, based on the current annual contract value of $16.3 million, equates to a cap of $32,600,000.
D. Vendor Oversight by Quorum
Quorum maintains a comprehensive vendor risk management program that is designed to assess, monitor, and mitigate risks associated with the Company's use of third-party service providers, with particular emphasis on vendors that process, store, or transmit nonpublic personal information of Quorum policyholders and claimants. The vendor risk management program is overseen by Priya Deshmukh, Vice President, Vendor Risk Management, who reports to the Company's Chief Information Security Officer, David Naranjo, and General Counsel, Thomas R. Whitfield.
As part of this program, Quorum conducts annual reviews of Palomar's SOC 2 Type II audit reports to verify compliance with the Trust Services Criteria for Security, Availability, and Confidentiality. Quorum also administers periodic security questionnaires and conducts risk assessments of Palomar's data security practices. In addition, the MSA grants Quorum contractual audit rights under Section 8.3, which permit Quorum or its designated representatives to conduct on-site or remote audits of Palomar's security controls, data handling practices, and compliance with the MSA upon reasonable notice. Quorum exercised these audit rights most recently in October 2022, at which time no material deficiencies were identified in Palomar's security posture based on the information and access provided during the audit.
III. Detailed Incident Timeline
The following provides a detailed chronological account of the cybersecurity event, from the initial unauthorized access through the completion of consumer notifications.
A. Unauthorized Access and Exfiltration (March 14 – April 18, 2023)
On or about March 14, 2023, a threat actor exploited CVE-2023-0669, a known but unpatched remote code execution vulnerability affecting Palomar's GoAnywhere MFT (Managed File Transfer) file transfer appliance, to gain unauthorized access to Palomar's internal network environment. CVE-2023-0669 is a critical-severity vulnerability that had been publicly disclosed and for which a vendor-issued patch had been made available prior to the date of exploitation. Despite this, Palomar had not applied the available patch to the affected appliance at the time of the intrusion. This failure to patch is discussed in greater detail in Section VII.B, below.
Following the initial intrusion, the threat actor engaged in lateral movement through Palomar's network, progressively escalating privileges and navigating through multiple network segments to reach the systems and file repositories within Palomar's claims processing environment that contained Quorum policyholder and claimant data. Over the course of the following weeks, the threat actor systematically staged and exfiltrated structured data files containing sensitive personal information.
The exfiltration window extended for approximately thirty-five (35) days, from on or about March 14, 2023, through April 18, 2023. Throughout this period, the unauthorized access and data exfiltration were not detected by Palomar's security monitoring tools.
B. Detection and Initial Vendor Notification (April 18 – April 21, 2023)
On April 18, 2023, Palomar's Security Operations Center detected unusual patterns of outbound data transfers from its network. Upon detection of this anomalous activity, Palomar's SOC initiated containment measures, effectively ending the exfiltration window.
On April 21, 2023 — three calendar days after detection — Palomar's General Counsel, Derek Copeland, notified Quorum's General Counsel, Thomas R. Whitfield, and Quorum's Chief Information Security Officer, David Naranjo, via email of the security incident. The notification informed Quorum that Palomar had detected a potential unauthorized intrusion into its network and that Palomar was conducting an internal investigation to determine the scope of the incident.
It is important to note that Palomar's notification was provided three calendar days after discovery, which was approximately twenty-four (24) hours past the contractual forty-eight-hour notification deadline established under MSA Section 9.4. This late notification, while ultimately not significantly affecting the overall timeline of Quorum's response, did delay Quorum's ability to begin its own investigation and response activities. Quorum has raised this contractual breach as an additional basis for its indemnification demand, as discussed in Section VIII.A, below.
C. Quorum's Immediate Response (April 21 – May 8, 2023)
Upon receipt of Palomar's notification on April 21, 2023, Quorum immediately activated its written incident response plan. The incident response plan, which is maintained and regularly updated under the oversight of CISO David Naranjo and CPO Jennifer Liang, establishes protocols for the investigation, containment, notification, and remediation of cybersecurity events affecting the Company or its data.
The following actions were taken in the initial response phase:
May 4, 2023: Quorum formally engaged Calderwood & Harkness LLP as outside counsel to manage and direct all aspects of the breach response, including the forensic investigation, regulatory compliance, consumer notification, vendor accountability, and coordination with law enforcement and regulatory authorities.
May 5, 2023: At the direction of Calderwood & Harkness LLP, Graystone Forensics LLC ("Graystone") was retained to conduct a comprehensive forensic investigation of the cybersecurity event. Graystone's principal office is located at 1950 Old Gallows Road, Suite 600, Tysons Corner, VA 22182. The engagement was structured under the attorney-client privilege and work product doctrine, with Graystone retained by Calderwood & Harkness on behalf of Quorum for the purpose of providing litigation support and expert analysis. The engagement team was led by Dr. Nolan Briggs, Managing Director, Incident Response, and Kendra Faulkner, Senior Forensic Analyst.
May 6, 2023: Legal hold notices were issued to all relevant Quorum personnel and departments, including the Information Technology department (under CISO David Naranjo) and the Claims Operations department (under Robert Wentworth, Senior Vice President, Claims Operations), directing the preservation of all documents, data, and communications related to the Palomar relationship, the cybersecurity event, and the Company's response.
May 8, 2023: Quorum filed a formal claim under its primary cyber-liability insurance policy with Atlas Mutual Insurance Company (Policy No. CYB-2023-041587; Claim No. CYB-CLM-2023-05892). The claim was submitted through Quorum's cyber-insurance broker, Whitmore Risk Advisors Inc. (Sandra Whitmore-Kim, Lead Broker), and included an initial estimate of anticipated incident response costs.
D. Forensic Investigation (May 5 – July 14, 2023)
Graystone Forensics conducted a thorough and methodical forensic investigation over a period of approximately ten weeks. The investigation included an analysis of log data, network traffic records, file access records, and other forensic artifacts obtained from Palomar's environment, as well as an independent review of Quorum's own systems and network to confirm that the Company's internal infrastructure had not been compromised.
June 2, 2023: Graystone delivered its preliminary forensic findings to Calderwood & Harkness. The preliminary report confirmed the exfiltration of structured data files from Palomar's claims processing environment containing Quorum policyholder and claimant data. The preliminary findings identified CVE-2023-0669 as the initial attack vector and documented the lateral movement and staging activities of the threat actor within Palomar's network.
July 14, 2023: Graystone delivered its final forensic report, which confirmed the full scope of the compromise, including the identification of the specific data files exfiltrated, the categories of personal information contained in those files, and the total number of potentially affected individuals. The final report also confirmed that no unauthorized access to Quorum's own systems or network — including the QuorumEdge digital underwriting platform — had occurred.
E. Data Mining and Notification Preparation (July 14 – August 14, 2023)
Following delivery of the final forensic report on July 14, 2023, Quorum, in coordination with Calderwood & Harkness and Graystone, undertook a comprehensive data mining and affected-individual identification process. This process involved the programmatic review of the exfiltrated data files to identify each unique individual whose personal information was contained in the compromised files, to determine the specific data elements associated with each individual, and to match each individual to their current state of residence for purposes of determining applicable notification requirements.
August 4, 2023: The data mining and affected-individual identification process was completed, confirming a total of 318,247 unique affected individuals across twenty-nine states and the District of Columbia, including 52,114 Connecticut residents. Following completion of the data mining, Calderwood & Harkness conducted a comprehensive analysis of applicable notification obligations under federal and state law. The preparation of notification filings and consumer notification letters commenced promptly thereafter.
During this period, Quorum also engaged the following additional service providers:
Clearfield Notification Services LLC (4500 Rockside Road, Suite 210, Independence, OH 44131; Account Manager: Jerome Tillman) was engaged to manage all aspects of consumer notification, including notification letter printing and mailing, dedicated toll-free call center operations, and credit monitoring enrollment and administration.
BrightPath Consulting Group Inc. (Managing Director: Meredith Ashford) was engaged to provide crisis communications advisory services, including media response strategy, internal communications planning, and public-facing messaging.
Consumer notification letters were drafted in multiple versions to address the different combinations of compromised data elements and state-specific legal requirements. The versions included: (i) a general PII version; (ii) a financial data version; (iii) a PHI version compliant with the HIPAA Breach Notification Rule; (iv) a California-specific version addressing the requirements of the California Consumer Privacy Act and the California data breach notification statute; and (v) a Massachusetts-specific version addressing the requirements of Massachusetts General Laws ch. 93H, § 3 and 201 CMR 17.00.
F. Regulatory and Consumer Notifications (August 14 – September 15, 2023)
Quorum filed all required regulatory notifications within the timeframes prescribed by applicable federal and state law. The following is a summary of the notification filings:
August 14, 2023: Notifications were filed with the Connecticut Insurance Department (to Mr. Richard Nakamura, Examiner, Financial Analysis Division, Cybersecurity Unit) pursuant to Conn. Gen. Stat. § 38a-999b, and with the Connecticut Attorney General (to Assistant Attorney General Diane Marchetti, Consumer Protection Division) pursuant to Conn. Gen. Stat. § 36a-701b.
August 15, 2023: A HIPAA breach notification was filed with the U.S. Department of Health and Human Services, Office for Civil Rights, Region I (Boston), reporting the compromise of the protected health information of 41,203 individuals. A media notice was simultaneously issued, as required by 45 C.F.R. § 164.406 for breaches affecting 500 or more individuals. A substitute notice was posted on Quorum's corporate website on the same date.
August 16, 2023: Notifications were filed with the New York Attorney General (to Assistant Attorney General Mark Petrosian, Bureau of Internet and Technology) and the California Attorney General.
August 17, 2023: Notifications were filed with the Massachusetts Attorney General and the Massachusetts Department of Consumer Affairs, as required under Massachusetts General Laws ch. 93H, § 3.
August 17–25, 2023: Notifications were filed with the attorneys general and/or other applicable regulatory agencies in the remaining twenty-four affected states and the District of Columbia. All of these notifications were filed within the timeframes required by each applicable state's breach notification statute.
August 18, 2023: Consumer notification letter mailing commenced via first-class U.S. Mail.
September 15, 2023: Consumer notification mailing was completed, within a rolling twenty-eight-day mailing window. All 318,247 notification letters were mailed within this period.
IV. Scope of Compromised Data
A. Total Affected Population
The forensic investigation and data mining process confirmed that the personal information of a total of 318,247 individuals across twenty-nine (29) states and the District of Columbia was compromised in the cybersecurity event.
B. Data Types Compromised
The compromised data falls into three categories, affecting overlapping subsets of the total affected population:
Personally Identifiable Information (PII): The PII of all 318,247 affected individuals was compromised. The specific PII data elements included full names, dates of birth, Social Security numbers, and driver's license numbers.
Financial Information: The financial information of a subset of 84,619 individuals was compromised. The specific financial data elements included bank account numbers and payment card numbers associated with claim disbursement and payment processing records.
Protected Health Information (PHI): The PHI of a subset of 41,203 individuals was compromised. The specific PHI data elements included health conditions, medical diagnosis codes, and treatment information derived from workers' compensation claims and other health-related insurance claims processed through the Palomar platform on behalf of Quorum.
C. Connecticut-Specific Impact
A total of 52,114 Connecticut residents were affected by the cybersecurity event, making Connecticut the single state with the largest number of affected residents. Connecticut residents were represented across all three categories of compromised data — PII, financial information, and PHI — in proportions generally consistent with the overall affected population. The disproportionate concentration of affected individuals in Connecticut reflects the fact that Quorum is headquartered in Hartford, Connecticut, and a significant proportion of its personal lines policyholders and claimants reside in the state.
D. State-by-State Breakdown (Top 10 States)
The following table summarizes the number of affected individuals by state of residence for the ten most affected states:
V. Compliance with Connecticut Insurance Data Security Law (Conn. Gen. Stat. § 38a-999b)
A. Overview of Statutory Requirements
The Connecticut Insurance Data Security Law, Conn. Gen. Stat. § 38a-999b, requires each licensee domiciled in Connecticut to develop, implement, and maintain a comprehensive written information security program that contains administrative, technical, and physical safeguards for the protection of nonpublic information. The statute further requires licensees to investigate and respond to cybersecurity events, to notify the Insurance Commissioner of cybersecurity events within specified timeframes, and to exercise due diligence in overseeing the data security practices of third-party service providers.
B. Quorum's Information Security Program
Quorum maintains a comprehensive written information security program ("ISP") that is designed to be consistent with and responsive to the requirements of Conn. Gen. Stat. § 38a-999b, as well as the NAIC Insurance Data Security Model Law, the New York Department of Financial Services Cybersecurity Regulation (23 NYCRR 500), and other applicable state and federal cybersecurity and data protection requirements.
The ISP is overseen by David Naranjo, Chief Information Security Officer, who has more than twenty years of experience in information security and holds CISSP, CISM, and CISA certifications. The ISP is administered in coordination with Jennifer Liang, Chief Privacy Officer. The governance structure includes regular reporting by the CISO and CPO to the Board of Directors' Audit Committee, which is chaired by Franklin Reeves, an independent director with extensive experience in financial services regulation and corporate governance.
Quorum's ISP incorporates the following key elements, among others:
• Technical Safeguards: The Company maintains robust technical controls, including role-based access controls, multi-factor authentication for privileged and remote access, encryption of data at rest and in transit using AES-256 and TLS 1.2/1.3 protocols, intrusion detection and prevention systems, security information and event management ("SIEM") capabilities, and endpoint detection and response tools deployed across all enterprise endpoints.
• Employee Training and Awareness: Quorum conducts mandatory annual cybersecurity awareness training for all employees, supplemented by quarterly phishing simulation exercises and targeted training for employees in high-risk roles such as claims processing, underwriting, and IT administration.
• Vendor Risk Management: The Company's vendor risk management program, supervised by Priya Deshmukh, Vice President, Vendor Risk Management, incorporates a comprehensive framework for assessing and monitoring the cybersecurity posture of third-party service providers. This framework includes pre-engagement due diligence, contractual data security requirements, ongoing risk assessments, annual SOC 2 Type II report reviews, periodic security questionnaires, and contractual audit rights.
• Vulnerability Management and Penetration Testing: Quorum conducts annual penetration testing and ongoing vulnerability assessments of its own systems and applications. The Company maintains a formal patch management program for its internal infrastructure with defined remediation timelines based on vulnerability severity.
• Incident Response Planning: Quorum maintains a written incident response plan that is reviewed and updated at least annually, and the Company conducts tabletop exercises to test the plan's effectiveness.
A non-privileged summary overview of Quorum's Information Security Program is enclosed as Enclosure E.
C. Timeliness of Notification to the Department
Quorum filed its notification with the Connecticut Insurance Department on August 14, 2023. The notification was filed promptly following the completion of the Company's determination of the scope of affected individuals, which involved a complex data mining and affected-individual identification process that was completed on August 4, 2023. In the days immediately following the completion of data mining, Calderwood & Harkness LLP conducted a comprehensive analysis of applicable notification obligations under the CT Insurance Data Security Law, the Connecticut breach notification statute, and the laws of all other affected jurisdictions. The regulatory notification filing was prepared and submitted as promptly as practicable upon the completion of this analysis.
The notification to the Connecticut Insurance Department was filed concurrently with the notification to the Connecticut Attorney General under Conn. Gen. Stat. § 36a-701b. Quorum's notification was timely under all applicable statutory deadlines, including the notification requirements of Conn. Gen. Stat. § 38a-999b.
D. Vendor-Originated Nature of the Incident
Quorum respectfully emphasizes to the Department that the cybersecurity event at issue did not originate within Quorum's own information systems, network infrastructure, or any platform or application owned or operated by Quorum. The compromise occurred entirely within the infrastructure of Palomar Data Solutions, as a direct result of Palomar's failure to timely apply a vendor-released patch for a known critical vulnerability (CVE-2023-0669) in its GoAnywhere MFT file transfer appliance.
Quorum's own systems — including its corporate network, all enterprise applications, and the QuorumEdge digital underwriting platform — were not accessed, compromised, or otherwise affected by the threat actor. The forensic investigation conducted by Graystone Forensics confirmed this finding.
Quorum's vendor risk management program had incorporated appropriate contractual safeguards to mitigate the risk of vendor-related security events, including the express requirement under Exhibit D of the MSA that Palomar patch critical vulnerabilities within thirty (30) days of the availability of a vendor-released patch, the requirement that Palomar maintain a current SOC 2 Type II audit report, and the establishment of contractual audit rights. Palomar's failure to comply with the patching requirement constituted a breach of Exhibit D of the MSA and was the direct and proximate cause of the cybersecurity event.
VI. Consumer Notification and Remedial Services
A. Consumer Notification Process
Quorum undertook a comprehensive consumer notification program to ensure that all affected individuals received timely and informative notice of the cybersecurity event. A total of 318,247 notification letters were mailed on a rolling basis via first-class U.S. Mail from August 18, 2023, through September 15, 2023, a rolling twenty-eight-day mailing window. Of this total, 52,114 letters were mailed to residents of the State of Connecticut.
The notification letters were prepared in multiple versions to address the different combinations of compromised data elements applicable to each individual and to satisfy state-specific notification content requirements. The versions included:
• A general PII version for individuals whose names, dates of birth, Social Security numbers, and/or driver's license numbers were compromised;
• A financial data version for individuals whose bank account numbers and/or payment card numbers were compromised;
• A PHI version prepared in compliance with the HIPAA Breach Notification Rule (45 C.F.R. §§ 164.400–164.414) for individuals whose protected health information was compromised;
• A California-specific version addressing the requirements of the California data breach notification statute (Cal. Civ. Code § 1798.82) and the California Consumer Privacy Act; and
• A Massachusetts-specific version addressing the requirements of Massachusetts General Laws ch. 93H, § 3 and the Massachusetts data security regulation (201 CMR 17.00).
In addition, a substitute notice was posted on Quorum's corporate website as of August 15, 2023, as an additional measure to ensure broad public awareness of the event and the availability of remedial services.
Sample copies of the consumer notification letters (general PII, financial data, and PHI versions) are enclosed as Enclosure C.
B. Credit Monitoring and Identity Theft Protection
All 318,247 affected individuals were offered twenty-four (24) months of complimentary credit monitoring and identity theft protection services. These services include three-bureau credit monitoring, dark web monitoring, identity theft insurance, and access to identity restoration specialists. The services are administered by Clearfield Notification Services LLC under a service agreement with Quorum. Based on industry benchmarks and prior experience, Quorum estimates an enrollment take-rate of approximately 40%, which would result in approximately 127,299 enrollees over the enrollment period.
C. Call Center Operations
Quorum, through Clearfield Notification Services, established a dedicated toll-free call center to assist affected individuals with questions regarding the cybersecurity event, the data types compromised, the credit monitoring enrollment process, and related concerns. The call center was staffed with trained agents who were provided with a comprehensive script and frequently asked questions document covering all material aspects of the incident and remedial services. The call center operates during a twelve-week window commencing on August 18, 2023. Escalation protocols were established to direct complex inquiries to designated Quorum representatives and, where appropriate, to Calderwood & Harkness LLP.
D. Costs of Consumer Remediation
The total costs of consumer notification and remediation services, as contracted with Clearfield Notification Services LLC, are as follows:
VII. Forensic Investigation and Root Cause
A. Forensic Investigation
Graystone Forensics LLC was retained on May 5, 2023, under the direction and privilege umbrella of Calderwood & Harkness LLP, to conduct a comprehensive forensic investigation of the cybersecurity event. The engagement was structured to preserve the attorney-client privilege and work product protections applicable to the investigation and its findings.
The Graystone engagement team was led by Dr. Nolan Briggs, Managing Director, Incident Response, and Kendra Faulkner, Senior Forensic Analyst. The investigation involved the forensic collection and analysis of log data, network traffic records, file system metadata, access control records, and other artifacts from Palomar's environment, as well as a parallel review of Quorum's own systems and network to independently confirm that the Company's internal infrastructure was not compromised.
Graystone delivered its preliminary forensic findings on June 2, 2023, confirming the exfiltration of structured data files from Palomar's claims processing environment and identifying CVE-2023-0669 as the initial attack vector. Graystone delivered its final forensic report on July 14, 2023, confirming the full scope of the compromise, including the total number of affected individuals, the specific data elements compromised, and the absence of any unauthorized access to Quorum's own systems.
The total cost of the Graystone Forensics engagement was $1,847,000, reflecting the complexity and scope of the investigation, which encompassed analysis of two separate IT environments and the review of a substantial volume of forensic artifacts.
B. Root Cause — Palomar's Failure to Patch
The forensic investigation established the following root cause of the cybersecurity event:
The threat actor exploited CVE-2023-0669, a critical-severity remote code execution vulnerability affecting Palomar's GoAnywhere MFT (Managed File Transfer) file transfer appliance, to gain initial unauthorized access to Palomar's network. GoAnywhere MFT is an enterprise file transfer solution widely used in the financial services, insurance, and healthcare industries for the secure transfer of sensitive data files.
CVE-2023-0669 was publicly disclosed as a critical vulnerability, and the software vendor released a patch to remediate the vulnerability prior to the March 14, 2023 exploitation date. Under Exhibit D (Data Security Exhibit) of the MSA, as amended by Amendment 2 dated September 15, 2022, Palomar was contractually obligated to apply patches for critical and high-severity vulnerabilities within thirty (30) days of the date on which a vendor-released patch becomes available. Despite this contractual obligation, Palomar failed to timely apply the available patch to the affected GoAnywhere MFT appliance, leaving it vulnerable to exploitation.
This failure to patch constituted a material breach of Palomar's data security obligations under Exhibit D of the MSA and was the direct and proximate cause of the threat actor's ability to gain unauthorized access to Palomar's network, conduct lateral movement, and exfiltrate data files containing Quorum policyholder and claimant information over the thirty-five-day exfiltration window.
C. Late Vendor Notification
As noted in the incident timeline, Palomar's Security Operations Center detected the anomalous outbound data transfers on April 18, 2023. However, Palomar did not notify Quorum of the security incident until April 21, 2023 — three calendar days after discovery. Under MSA Section 9.4, Palomar was required to notify Quorum in writing within forty-eight (48) hours of Palomar's discovery of any security incident affecting Quorum data.
Palomar's notification was therefore provided approximately twenty-four (24) hours past the contractual deadline. While the delay did not materially alter the ultimate scope of the compromise — as the exfiltration had already been contained by the time of Palomar's detection on April 18 — the late notification delayed Quorum's ability to commence its own investigation, activate its incident response plan, and engage outside counsel and forensic investigators. Quorum views this late notification as an additional breach of the MSA and has incorporated it into its indemnification demand against Palomar.
VIII. Vendor Accountability Measures
A. Indemnification Demand
On June 20, 2023, Calderwood & Harkness LLP, on behalf of Quorum, issued a formal breach of contract demand letter to Palomar through Palomar's outside counsel, Mercer, Haight & Dunlop LLP (Catherine Langford, Partner). The demand letter asserted that Palomar's failure to timely patch CVE-2023-0669, in violation of the patching requirements under Exhibit D of the MSA, constituted a material breach of Palomar's data security obligations. The demand further asserted that Palomar's failure to notify Quorum within the contractual forty-eight-hour window, in violation of MSA Section 9.4, constituted an additional breach of the MSA. Calderwood & Harkness demanded full indemnification under MSA Section 12.2 for all losses, liabilities, costs, and expenses arising from or related to Palomar's breaches.
The full demand amount totals $8,230,250 in total incident response costs incurred by Quorum as a result of the cybersecurity event. This amount is well within the contractual liability cap of $32,600,000 (2× trailing twelve-month fees of $16.3 million) under MSA Section 12.2.
B. Ongoing Negotiations
Palomar, through its counsel at Mercer, Haight & Dunlop, initially disputed certain aspects of causation and liability. Palomar offered a goodwill credit of $1,500,000, which Quorum rejected as wholly inadequate in light of the clear contractual breaches that directly caused the cybersecurity event and the full scope of costs incurred by Quorum in its response.
Negotiations between the parties remain ongoing as of the date of this submission, September 22, 2023. Quorum is pursuing maximum recovery from Palomar and is prepared to pursue all available legal remedies, including formal litigation if necessary, to ensure that Palomar is held accountable for its contractual failures and the resulting harm to Quorum and its policyholders.
C. Enhanced Security Requirements
In parallel with the indemnification negotiations, Quorum has communicated to Palomar that the continuation of the vendor relationship is contingent upon Palomar's implementation of enhanced security measures. The specific enhancements required by Quorum include:
• Enhanced Patch Management Protocols: Palomar must reduce the remediation timeline for critical and high-severity vulnerabilities from thirty (30) days to fourteen (14) days from the date of vendor patch release, with emergency patching within forty-eight (48) hours for actively exploited vulnerabilities.
• Endpoint Detection and Response ("EDR") Capabilities: Palomar must implement EDR tools across all systems that process, store, or transmit Quorum data, with continuous monitoring and automated alerting capabilities.
• Independent Third-Party Security Assessment: Palomar must engage an independent third-party security assessor, acceptable to Quorum, to conduct a comprehensive security assessment of Palomar's infrastructure and to provide ongoing audit oversight on at least a semi-annual basis.
• Shortened Incident Notification Timelines: The contractual notification window for security incidents must be reduced from forty-eight (48) hours to twenty-four (24) hours.
In addition to these specific requirements, Quorum is evaluating all available contractual options under the MSA, including termination of the agreement for cause under MSA Section 14.2. Section 14.2 permits termination for material breach subject to a thirty-day cure period. Quorum has not yet exercised its termination rights, as the Company is carefully evaluating the operational implications of transitioning claims processing services to an alternative vendor while ensuring continuity of service to policyholders.
IX. Quorum's Information Security Program Enhancements
A. Post-Incident Internal Improvements
In addition to the vendor-facing accountability measures described above, Quorum has undertaken and continues to pursue a number of internal enhancements to its information security program in response to the cybersecurity event. These enhancements are designed to strengthen the Company's ability to detect, prevent, and respond to vendor-related cybersecurity events in the future:
• Enhanced Monitoring of Vendor Data Processing Environments: Quorum is implementing enhanced technical monitoring capabilities designed to provide the Company with greater visibility into the data processing activities of its critical third-party service providers. This includes the deployment of additional logging and alerting tools at the points of data transfer between Quorum and Palomar, as well as other high-risk vendors.
• Expanded Tabletop Exercises: Quorum is expanding the scope and frequency of its incident response tabletop exercises to specifically incorporate vendor-originated breach scenarios, with participation by cross-functional teams including IT, Claims Operations, Legal, Compliance, and Vendor Risk Management.
• Strengthened Vendor Onboarding and Risk Assessment Procedures: Under the leadership of Priya Deshmukh, Vice President, Vendor Risk Management, Quorum is undertaking a comprehensive review and strengthening of its vendor onboarding procedures and ongoing risk assessment protocols. This includes the implementation of enhanced due diligence questionnaires, the incorporation of continuous monitoring tools for vendor security posture, and more frequent reassessment cycles for vendors classified as critical or high-risk.
• Data Minimization Practices Review: Quorum is conducting a thorough review of its data sharing practices with all third-party vendors to assess whether the volume, types, and retention periods of data shared with vendors can be reduced without impairing business operations. The objective of this initiative is to minimize the potential impact of any future vendor-related security event by reducing the quantity of sensitive personal information residing in vendor environments.
B. Governance Enhancements
Quorum has also implemented enhanced governance measures to ensure that cybersecurity risk, and vendor-related cybersecurity risk in particular, receives appropriate attention at the highest levels of the organization:
• Board Audit Committee Briefings: The Board Audit Committee, chaired by Franklin Reeves, now receives regular briefings on the Company's cybersecurity posture, vendor risk management activities, and the status of any open cybersecurity events or regulatory inquiries. These briefings are provided by CISO David Naranjo and CPO Jennifer Liang on at least a quarterly basis, with ad hoc briefings as circumstances warrant.
• Post-Incident Review Process: Quorum has instituted a formal post-incident review process for all significant cybersecurity events, involving CISO David Naranjo, CPO Jennifer Liang, and SVP Claims Operations Robert Wentworth, as well as representatives from the Legal, Compliance, and Vendor Risk Management functions. The purpose of this review is to identify lessons learned, assess the effectiveness of the Company's response, and develop actionable recommendations for program enhancements.
• Evaluation of Additional Vendor Cybersecurity Insurance Requirements: Quorum is evaluating whether to increase the minimum cyber-liability insurance coverage required of its critical vendors beyond the current $10,000,000 threshold, and whether to require vendors to obtain separate cyber-event coverage endorsements specifically addressing third-party data breach liability.
X. Insurance Coverage
Quorum maintains a comprehensive cyber-liability insurance program designed to mitigate the financial impact of cybersecurity events. The program is placed through Whitmore Risk Advisors Inc. (Sandra Whitmore-Kim, Lead Broker) and consists of the following policies:
Primary Cyber-Liability Policy: Atlas Mutual Insurance Company, Policy No. CYB-2023-041587. The policy provides a per-occurrence limit of $15,000,000, subject to a self-insured retention ("SIR") of $2,500,000. The policy covers, among other things, costs associated with forensic investigation, legal counsel, regulatory defense, consumer notification, credit monitoring, crisis communications, and regulatory fines and penalties (where insurable).
Excess Cyber-Liability Policy: Pinnacle Surplus Lines Insurance Corp., Policy No. XS-CYB-2023-7812. The excess policy provides $25,000,000 in coverage excess of the $15,000,000 primary layer, for a total insurance tower of $40,000,000.
A claim was filed with Atlas Mutual on May 8, 2023 (Claim No. CYB-CLM-2023-05892). Atlas has acknowledged coverage for the incident and has confirmed that the policy responds to the categories of costs incurred by Quorum in connection with the event, including forensic investigation fees, notification and credit monitoring costs, crisis communications expenses, and regulatory defense costs, in each case in excess of the $2,500,000 SIR.
As set forth in the cost summary in Section XI, below, total incident response costs of $8,230,250 fall within the primary policy limit. Of this amount, the first $2,500,000 constitutes Quorum's self-insured retention and is borne by the Company. The remaining $5,730,250 is covered by the Atlas primary policy. To the extent Quorum recovers indemnification payments from Palomar, such recoveries may offset the amounts paid by the insurer in accordance with standard subrogation principles.
XI. Summary of Total Incident Costs
The following table summarizes the total incident response costs incurred by Quorum in connection with the cybersecurity event through the date of this submission:
The allocation of these costs across Quorum's insurance program and vendor indemnification recovery is as follows:
• Self-insured retention (Quorum's responsibility): $2,500,000
• Amount covered by Atlas Mutual primary cyber-liability policy: $5,730,250
• Vendor indemnification recovery from Palomar: Under negotiation as of the date of this submission
Quorum notes that these cost figures are current as of September 22, 2023, and may increase as the Company incurs additional costs related to ongoing regulatory inquiries, the multistate attorney general investigation, vendor indemnification litigation (if necessary), and other matters arising from the event.
XII. Quorum's Commitment to Continued Cooperation
Quorum remains fully committed to cooperating with the Connecticut Insurance Department throughout the duration of this inquiry. The Company recognizes the critical importance of maintaining public trust in the insurance industry and in the security of the personal information entrusted to insurance carriers and their service providers.
Quorum will promptly provide any additional information, documentation, or clarification requested by Mr. Nakamura or the Cybersecurity Unit of the Financial Analysis Division. The Company authorizes Calderwood & Harkness LLP to serve as the primary point of contact for all communications related to this inquiry, and the Department is welcome to contact Kevin Ostrowski, Partner, or Alan Burke, Associate, at the contact information set forth below.
Quorum will proactively keep the Department informed of all material developments related to the cybersecurity event and its aftermath, including the outcome of vendor indemnification negotiations with Palomar, the implementation of enhanced security measures by Palomar, any decision regarding the continuation or termination of the Palomar vendor relationship, and any additional remediation measures adopted by Quorum.
Quorum also wishes to advise the Department that it is cooperating with a twenty-nine-state multistate attorney general coalition, jointly led by the Connecticut Attorney General and the New York Attorney General, which initiated a formal joint inquiry on September 8, 2023. The Company is also cooperating with the U.S. Department of Health and Human Services, Office for Civil Rights, regarding the PHI component of the data breach. Quorum is committed to full transparency and cooperation with all regulatory bodies exercising jurisdiction over this matter.
XIII. Conclusion
In summary, the cybersecurity event that is the subject of this inquiry was vendor-originated and resulted from the failure of Quorum's third-party claims-processing vendor, Palomar Data Solutions, Inc., to timely patch a known critical vulnerability in its file transfer infrastructure. The event did not reflect a failure of Quorum's own information security program, which was designed and maintained in compliance with the requirements of Conn. Gen. Stat. § 38a-999b and other applicable laws and regulatory standards.
Upon learning of the event, Quorum responded promptly and comprehensively, engaging experienced outside counsel and forensic investigators, conducting a thorough forensic investigation, issuing timely regulatory and consumer notifications in compliance with all applicable statutory deadlines, and offering robust consumer remediation services — including twenty-four months of complimentary credit monitoring and identity theft protection to all 318,247 affected individuals.
Quorum is actively pursuing vendor accountability through indemnification demands and enhanced contractual security requirements, and has implemented meaningful internal enhancements to its information security program and vendor risk management practices to reduce the likelihood and potential impact of similar events in the future.
All applicable statutory notification deadlines — including the requirements of the Connecticut Insurance Data Security Law, the Connecticut breach notification statute, HIPAA, and the notification laws of all other affected jurisdictions — were met.
Quorum respectfully requests that the Department conclude its inquiry with no further action. The Company remains available to address any additional questions the Department may have and to provide any further information or documentation that may be requested.
We appreciate the Department's attention to this matter and its dedication to the protection of Connecticut consumers. Please do not hesitate to contact the undersigned with any questions.
Respectfully submitted,
CALDERWOOD & HARKNESS LLP
By: ________
Kevin Ostrowski, Partner Privacy & Data Security Practice Group Calderwood & Harkness LLP 1700 K Street NW, Suite 900 Washington, D.C. 20006 Telephone: (202) 555-8417
Email: kostrowski@calderwoodharkness.com
________________________________________
Alan Burke, Associate Privacy & Data Security Practice Group Calderwood & Harkness LLP 1700 K Street NW, Suite 900 Washington, D.C. 20006 Telephone: (202) 555-8423