1025-00006 · Graystone Forensics LLC · Regulatory Defense/CT Insurance Dept & HHS-OCR

ct-insurance-dept-supplemental-submission.docx DOCUMENT Data Privacy

57 / 88 ← → ✕

CALDERWOOD & HARKNESS LLP Attorneys at Law

1700 K Street NW, Suite 900 Washington, D.C. 20006

Telephone: (202) 555-4800 Facsimile: (202) 555-4801 www.calderwoodharkness.com

October 20, 2023

VIA EMAIL AND CERTIFIED MAIL

Richard Nakamura Examiner, Financial Analysis Division, Cybersecurity Unit Connecticut Insurance Department 153 Market Street Hartford, CT 06103

Re: Quorum Insurance Holdings Corp. — Supplemental Response to Department Inquiry Regarding Cybersecurity Event Reference: Initial Notification Filed August 14, 2023 Pursuant to Conn. Gen. Stat. § 38a-999b; Initial Inquiry Response Submitted September 22, 2023

Dear Mr. Nakamura:

Calderwood & Harkness LLP represents Quorum Insurance Holdings Corp. ("Quorum" or "QIH"), a Delaware corporation publicly traded on the Nasdaq Stock Market (ticker symbol: QIHC) and headquartered at 400 Constitution Plaza, Suite 2200, Hartford, Connecticut 06103. This supplemental submission is made on behalf of Quorum in response to the Department's follow-up information request dated October 6, 2023, which was issued following the Department's review of Quorum's initial inquiry response submitted on September 22, 2023.

We understand that the Department has requested additional information in three specific areas: (1) Quorum's vendor oversight and third-party risk management program; (2) the contractual data security provisions governing the relationship between Quorum and its third-party claims-processing vendor, Palomar Data Solutions, Inc. ("Palomar"); and (3) the post-incident remediation measures undertaken by both Quorum and Palomar in the wake of the cybersecurity event at issue.

As the Department is aware from Quorum's prior filings, the underlying cybersecurity event was a vendor-originated data breach that occurred within Palomar's network environment. The breach affected approximately 318,247 individuals across twenty-nine states and the District of Columbia, including approximately 52,114 Connecticut residents. At no time were Quorum's own information systems or network infrastructure compromised by the threat actor; rather, the unauthorized access and data exfiltration occurred entirely within Palomar's computing environment.

Calderwood & Harkness was engaged by Quorum on May 4, 2023 (Firm Matter No. 1025-00006) to manage all aspects of the incident response, including forensic investigation oversight, regulatory notification, consumer notification, vendor accountability, and litigation readiness. Kevin Ostrowski, Partner, serves as the Responsible Partner for this engagement, and Alan Burke, Associate, serves as Lead Associate. Both Mr. Ostrowski and Mr. Burke are primarily responsible for the preparation and accuracy of this supplemental submission.

Quorum respectfully reserves all applicable attorney-client privileges, work product protections, and any other privileges or protections that may apply to the materials, analyses, and communications referenced herein. This submission is provided voluntarily and in a spirit of full cooperation with the Connecticut Insurance Department. Nothing in this submission is intended to, nor shall it be construed to, waive any privilege or protection otherwise available to Quorum, Calderwood & Harkness, or any other party.

The balance of this submission is organized as follows: Section I addresses Quorum's vendor oversight and third-party risk management program; Section II describes the contractual data security provisions of the Master Services Agreement between Quorum and Palomar; Section III provides an updated incident summary with Connecticut-specific impact data; Section IV details the post-incident remediation measures undertaken by both Quorum and Palomar; Section V summarizes Quorum's cyber-insurance coverage relevant to this event; and Section VI offers concluding observations and reaffirms Quorum's commitment to continued cooperation with the Department.

I. QUORUM'S VENDOR OVERSIGHT AND THIRD-PARTY RISK MANAGEMENT PROGRAM

A. Organizational Structure and Governance

Quorum maintains a dedicated vendor risk management function that is integrated into its broader enterprise risk management framework. The vendor risk management program is led by Priya Deshmukh, Vice President of Vendor Risk Management, who reports directly to Thomas R. Whitfield, Quorum's General Counsel. Ms. Deshmukh oversees a team of twelve full-time professionals responsible for the assessment, onboarding, ongoing monitoring, and periodic reassessment of Quorum's third-party vendor relationships.

The vendor risk management program is subject to cross-functional governance through the Vendor Risk Oversight Committee (the "VROC"), which convenes on a quarterly basis and on an ad hoc basis as circumstances require. The VROC includes representatives from the following functional areas:

• Legal: Thomas R. Whitfield, General Counsel;

• Information Security: David Naranjo, Chief Information Security Officer;

• Privacy: Jennifer Liang, Chief Privacy Officer;

• Claims Operations: Robert Wentworth, Senior Vice President, Claims Operations; and

• Vendor Risk Management: Priya Deshmukh, Vice President, Vendor Risk Management.

The VROC is responsible for reviewing and approving vendor risk classifications, overseeing the results of periodic vendor reassessments, evaluating escalated risk findings, and recommending corrective actions where vendor risk posture is found to be deficient. Meeting minutes and action items are documented and retained in accordance with Quorum's records retention policies.

At the Board of Directors level, the Audit Committee, chaired by independent director Franklin Reeves, receives periodic reports on vendor risk, including cybersecurity risk, as part of its broader oversight function. These reports are typically delivered by Ms. Deshmukh and Mr. Naranjo on a semi-annual basis, with supplemental reports provided when material vendor risk issues are identified. Following the cybersecurity event at issue in this matter, the Audit Committee received a comprehensive briefing on the incident and the company's response on June 15, 2023, and has received monthly updates thereafter.

For context regarding Quorum's scale and operations, the company maintains approximately 11,400 employees across its various divisions and operates in all fifty states and the District of Columbia. For the fiscal year ended December 31, 2022, Quorum reported annual revenue of approximately $4.82 billion. Quorum's personal lines division, which was the business unit served by Palomar's claims processing services, represents approximately 38% of total company revenue.

B. Vendor Due Diligence and Onboarding Process

Quorum's vendor risk management program includes a structured due diligence and onboarding process for all vendors, with enhanced requirements applicable to vendors that access, process, store, or transmit policyholder, claimant, or other sensitive data on behalf of Quorum. The due diligence process is designed to evaluate prospective vendors across multiple risk dimensions, including information security, data privacy, financial stability, business continuity, and regulatory compliance.

Risk Tiering Methodology. As part of its vendor risk management framework, Quorum employs a tiered risk classification system that categorizes vendors based on two principal criteria: (i) the sensitivity of the data to which the vendor will have access, and (ii) the business criticality of the services the vendor will provide. This risk tiering methodology results in the following classifications:

• Tier 1 (Highest Risk): Vendors that access, process, or store highly sensitive data, including personally identifiable information ("PII"), protected health information ("PHI"), and financial data (e.g., bank account numbers, payment card numbers), and/or that provide services critical to Quorum's core insurance operations. Tier 1 vendors are subject to the most rigorous due diligence requirements and the most frequent ongoing monitoring and reassessment cycles.

• Tier 2 (Elevated Risk): Vendors that access limited categories of sensitive data or provide services that, while important, are not critical to core insurance operations. Tier 2 vendors are subject to standard due diligence requirements and annual reassessment cycles.

• Tier 3 (Standard Risk): Vendors that do not access sensitive data and provide non-critical services. Tier 3 vendors are subject to baseline due diligence requirements and biennial reassessment cycles.

Palomar's Risk Classification. Palomar Data Solutions, Inc. was classified as a Tier 1 (highest risk) vendor from the inception of the contractual relationship. This classification was appropriate and warranted given that Palomar processed PII, financial data, and PHI in connection with its claims data processing, document management, and analytics services for Quorum's personal lines claims division. Palomar's Tier 1 classification subjected it to enhanced due diligence at onboarding and the most rigorous ongoing monitoring requirements within Quorum's vendor risk management framework.

Pre-Engagement Security Assessments. For Tier 1 vendors, Quorum's due diligence process includes the following pre-engagement security assessment components:

1. A comprehensive review of the vendor's information security policies and procedures, including its written information security program ("WISP"), acceptable use policies, access control policies, incident response plan, and business continuity and disaster recovery plans;

2. A review of recent penetration test results conducted by a qualified independent third party, with particular attention to the identification and remediation of critical and high-severity findings;

3. A review of the vendor's most recent SOC 2 Type II audit report (where available) or equivalent independent assurance documentation;

4. An evaluation of the vendor's cyber-liability insurance coverage, including policy limits, coverage scope, and named insured entities;

5. A standardized security questionnaire administered by Quorum's Information Security team, covering topics including network security architecture, data encryption practices, patch management procedures, vulnerability management, access control mechanisms, logging and monitoring capabilities, employee security awareness training, and incident response preparedness; and

6. Where circumstances warrant, an on-site or virtual assessment conducted by Quorum's Information Security team or a qualified third-party assessor engaged by Quorum.

In the case of Palomar, the pre-engagement due diligence process was completed in the third and fourth quarters of 2019, prior to the execution of the Master Services Agreement on November 12, 2019. At that time, the pre-engagement assessment did not identify any material deficiencies in Palomar's security posture that would have precluded Quorum from entering into the contractual relationship.

SOC 2 Type II Audit Requirement. It is important to note that the requirement for Palomar to undergo and provide an annual SOC 2 Type II audit was not included in the original MSA executed in November 2019 but was subsequently added pursuant to Amendment 2 to the MSA, executed on September 15, 2022. The SOC 2 Type II audit requirement was added as part of a broader update to the Data Security Exhibit (Exhibit D) of the MSA, reflecting the evolution of industry best practices and Quorum's own enhanced vendor oversight standards. The SOC 2 Type II audit was conducted by the independent accounting firm Kessler, Park & Associates CPA, PLLC, based in Dallas, Texas (Engagement Partner: Vivian Park). The audit covered the twelve-month period ending June 30, 2022, and was delivered to Quorum in October 2022. No material exceptions were noted in the SOC 2 Type II report at that time. A subsequent SOC 2 Type II engagement covering the twelve-month period ending June 30, 2023, was underway at the time of the incident and has since been completed; its findings are not addressed in this submission but are available for the Department's review upon request.

C. Ongoing Monitoring and Oversight

Beyond the initial due diligence and onboarding process, Quorum's vendor risk management program includes several ongoing monitoring and oversight mechanisms designed to ensure that vendors, particularly Tier 1 vendors such as Palomar, continue to maintain adequate security posture throughout the duration of the contractual relationship.

Annual Vendor Security Questionnaires and Reassessments. All Tier 1 vendors are required to complete an annual security questionnaire administered by Quorum's Information Security team. The questionnaire is comprehensive and covers the same subject areas as the pre-engagement security questionnaire. Responses are reviewed by Quorum's Information Security team and Vendor Risk Management function, and any identified deficiencies or areas of concern are flagged for follow-up. Palomar completed annual security questionnaires in October 2020, November 2021, and October 2022. The October 2022 questionnaire did not reveal any material deficiencies related to patch management or vulnerability remediation.

SOC 2 Type II Reports. As noted above, Amendment 2 to the MSA (executed September 15, 2022) formalized the requirement for Palomar to provide Quorum with an annual SOC 2 Type II audit report. Prior to Amendment 2, Quorum relied on Palomar's self-reported security questionnaire responses and its own periodic assessments as the primary means of evaluating Palomar's security posture. The addition of the SOC 2 Type II requirement represented a meaningful enhancement to Quorum's ongoing monitoring capabilities with respect to Palomar.

Cyber-Insurance Coverage Verification. Quorum's vendor risk management procedures include periodic verification of vendor cyber-insurance coverage to confirm compliance with contractual minimums. This verification is typically conducted on an annual basis in connection with the vendor reassessment cycle. As discussed further in Section II.F below, Palomar was required to maintain a minimum of $10,000,000 in cyber-liability insurance coverage, and Quorum verified Palomar's compliance with this requirement through review of certificates of insurance provided by Palomar's broker.

Contractual Audit Rights. The MSA between Quorum and Palomar includes contractual audit rights (Section 11.3 of the MSA) that permit Quorum to conduct or commission audits of Palomar's security environment. These audit rights entitle Quorum, upon reasonable notice and during normal business hours, to access Palomar's facilities, systems, records, and personnel to the extent necessary to evaluate Palomar's compliance with the data security requirements of the MSA. While Quorum did not exercise its formal contractual audit rights during the period between the execution of the MSA and the date of the incident, Quorum's reliance on SOC 2 Type II reports, annual security questionnaires, and the other monitoring mechanisms described above was consistent with industry practice for the oversight of third-party service providers of Palomar's type and risk profile.

Escalation Procedures. Quorum's vendor risk management procedures include defined escalation procedures for use when vendor risk issues are identified during the ongoing monitoring process. When a Tier 1 vendor reassessment reveals a material deficiency or area of concern, the finding is escalated to the VROC for review and action. The VROC may direct a range of corrective actions, including requiring the vendor to develop and implement a remediation plan within a specified timeframe, engaging a third-party assessor to conduct an independent evaluation, exercising contractual audit rights, or, in extreme cases, recommending termination of the vendor relationship. In the period preceding the incident at issue, no material deficiencies requiring escalation to the VROC were identified with respect to Palomar.

II. PALOMAR MSA DATA SECURITY AND CONTRACTUAL PROVISIONS

A. Master Services Agreement Overview

The relationship between Quorum and Palomar is governed by a Master Services Agreement (the "MSA") executed on November 12, 2019, with an initial term of five years expiring on November 11, 2024. Palomar Data Solutions, Inc. is a Texas corporation (EIN: 75-3291048) headquartered at 7100 Greenville Avenue, Suite 450, Dallas, Texas 75231. Palomar is a provider of claims data processing, document management, and analytics services to the insurance industry.

Under the MSA, Palomar provides claims data processing, document management, and analytics services for Quorum's personal lines division. The original annual contract value ("ACV") was $14,200,000, resulting in a five-year total contract value ("TCV") of approximately $71,000,000. Quorum is understood to be Palomar's second-largest client by revenue, with Palomar's services to Quorum representing a significant portion of Palomar's overall business. The services provided by Palomar are integral to the efficient operation of Quorum's personal lines claims function, involving the receipt, processing, organization, analysis, and storage of claims-related data submitted by policyholders and claimants.

Given the nature and scope of the services provided, Palomar routinely received and processed substantial volumes of sensitive data on behalf of Quorum, including policyholder and claimant PII (names, dates of birth, Social Security numbers, driver's license numbers, mailing addresses, and contact information), financial data (bank account numbers, payment card numbers, and payment transaction details), and, in the context of workers' compensation and health-related claims, PHI (health conditions, diagnosis codes, treatment information, and provider details). The volume and sensitivity of this data were the primary drivers of Palomar's Tier 1 risk classification, as discussed in Section I.B above.

B. Amendment History

Since its execution, the MSA has been amended on three occasions. The first two amendments preceded the cybersecurity event; the third amendment was executed in connection with the post-incident settlement agreement, as described in Section IV below.

Amendment 1 was executed on March 3, 2021. Amendment 1 expanded the scope of Palomar's services to include data processing associated with Quorum's QuorumEdge digital underwriting platform, a proprietary technology platform used by Quorum's personal lines division to streamline underwriting workflows. Amendment 1 increased the ACV by $2,100,000, from $14,200,000 to $16,300,000, effective April 1, 2021. The expanded services required Palomar to process additional categories of applicant and policyholder data in connection with the QuorumEdge platform, further reinforcing Palomar's Tier 1 risk classification.

Amendment 2 was executed on September 15, 2022. Amendment 2 addressed several important enhancements to the data security provisions of the MSA. Specifically, Amendment 2 updated the Data Security Exhibit (Exhibit D) to incorporate more specific and prescriptive security requirements, added the requirement for Palomar to undergo and provide an annual SOC 2 Type II audit, and updated the minimum cyber-insurance coverage requirements applicable to Palomar. Amendment 2 reflected Quorum's ongoing commitment to strengthening the contractual data security framework governing its highest-risk vendor relationships and was consistent with evolving industry standards and regulatory expectations.

Amendment 3 was executed on October 27, 2023, concurrently with the settlement agreement between Quorum and Palomar. Amendment 3 is discussed in detail in Section IV.C below.

C. Data Security Exhibit (Exhibit D, as Amended)

The Data Security Exhibit, designated as Exhibit D to the MSA, sets forth the information security obligations applicable to Palomar in connection with its processing of Quorum data. As amended by Amendment 2 (September 15, 2022), Exhibit D required Palomar to maintain "commercially reasonable" administrative, technical, and physical safeguards consistent with industry standards, including but not limited to standards promulgated by the National Institute of Standards and Technology ("NIST") and the International Organization for Standardization ("ISO"). The key security obligations imposed on Palomar under Exhibit D, as amended, included the following:

(i) Vulnerability and Patch Management. Palomar was required to maintain a documented vulnerability management program, including procedures for identifying, evaluating, and remediating security vulnerabilities in its systems and software. Of critical relevance to this incident, Exhibit D (as amended) required Palomar to apply patches for critical vulnerabilities within thirty (30) days of the date on which the applicable vendor patch or remediation was made publicly available. This thirty-day patching window was the specific contractual obligation that Palomar failed to satisfy in connection with CVE-2023-0669, the GoAnywhere MFT remote code execution vulnerability exploited by the threat actor. As detailed in Section III below, the patch for CVE-2023-0669 was made available by Severin Corporation, the developer of GoAnywhere MFT, on February 7, 2023, but Palomar had not applied the patch as of March 14, 2023, the date of the initial unauthorized access — a period of approximately thirty-five days after the patch was made available and five days beyond the contractual thirty-day patching window.

(ii) Annual Penetration Testing. Palomar was required to engage a qualified independent third party to conduct penetration testing of its network and application environments at least annually. The results of each penetration test, including identified vulnerabilities and remediation plans, were required to be made available to Quorum upon request.

(iii) SOC 2 Type II Audit. As added by Amendment 2, Palomar was required to engage a qualified independent audit firm to conduct an annual SOC 2 Type II audit and to provide the resulting report to Quorum within thirty (30) days of its completion.

(iv) Data Encryption. Palomar was required to encrypt all Quorum data at rest using AES-256 or equivalent encryption and to encrypt all Quorum data in transit using TLS 1.2 or higher.

(v) Access Controls and Logging. Palomar was required to implement and maintain role-based access controls, multi-factor authentication for administrative and remote access, and comprehensive logging and monitoring of access to systems containing Quorum data. Access logs were required to be retained for a minimum of twelve (12) months.

D. Breach Notification Clause (Section 9.4)

Section 9.4 of the MSA imposed a contractual obligation on Palomar to notify Quorum within forty-eight (48) hours of discovering a security incident that affected, or was reasonably believed to affect, the confidentiality, integrity, or availability of Quorum data. The notification was required to be provided in writing to Quorum's General Counsel and Chief Information Security Officer and was required to include, to the extent known at the time of notification, a description of the nature of the incident, the categories of data believed to be affected, the estimated number of affected individuals, the measures being taken by Palomar to investigate and contain the incident, and a designated point of contact for ongoing communications.

The chronology of Palomar's notification to Quorum is as follows:

• April 18, 2023: Palomar's Security Operations Center ("SOC") detected anomalous outbound data transfers from systems within Palomar's network that were used to process Quorum data. This detection constituted the point at which Palomar discovered, or should reasonably have been deemed to have discovered, the security incident for purposes of Section 9.4.

• April 21, 2023: Palomar's General Counsel, Derek Copeland, transmitted written notification of the security incident to Thomas R. Whitfield, Quorum's General Counsel, and David Naranjo, Quorum's Chief Information Security Officer, via email. The notification described the anomalous activity detected by Palomar's SOC, indicated that Palomar was conducting an internal investigation, and identified Mr. Copeland as the primary point of contact for further communications.

The elapsed time between Palomar's discovery of the incident on April 18, 2023, and its notification to Quorum on April 21, 2023, was approximately seventy-two (72) hours. This represented an approximately twenty-four-hour delay beyond the contractual forty-eight-hour notification deadline established by Section 9.4. This delay is one of the two identified contractual breaches by Palomar, as further discussed in Section IV.B below.

E. Indemnification Provisions (Section 12.2)

Section 12.2 of the MSA provides that Palomar shall defend, indemnify, and hold harmless Quorum and its affiliates, officers, directors, employees, and agents from and against any and all losses, damages, liabilities, costs, and expenses (including reasonable attorneys' fees) arising out of or relating to Palomar's breach of its data security obligations under the MSA, including the obligations set forth in Exhibit D. This indemnification obligation encompasses, without limitation, costs incurred in connection with forensic investigation, regulatory notification, consumer notification, credit monitoring services, crisis communications, legal fees, and regulatory penalties or fines.

The indemnification obligation is subject to a liability cap equal to two times (2×) the trailing twelve-month fees paid by Quorum to Palomar under the MSA. Based on the then-current ACV of $16,300,000, the applicable liability cap was $32,600,000 (i.e., $16,300,000 × 2). Quorum's total incident response costs of $8,230,250, as described in Section IV.B below, were well within this contractual liability cap.

Quorum, through Calderwood & Harkness, issued a formal indemnification demand to Palomar on June 20, 2023, asserting Palomar's obligation to indemnify Quorum for the full amount of its incident response costs. The demand was addressed to Derek Copeland, Palomar's General Counsel, with a copy to Catherine Langford of Mercer, Haight & Dunlop LLP (Dallas, Texas), which Palomar had engaged as outside counsel. The subsequent vendor accountability negotiations and settlement are described in Section IV.B below.

F. Insurance Requirements (Exhibit E)

Exhibit E to the MSA sets forth the insurance coverage requirements applicable to Palomar. Among other coverage requirements, Exhibit E required Palomar to obtain and maintain, at its own expense, cyber-liability insurance coverage with a minimum per-occurrence limit of $10,000,000 from an insurer with an A.M. Best rating of A- (Excellent) or better. The cyber-liability coverage was required to provide coverage for, among other things, data breach response costs (including notification costs, credit monitoring, forensic investigation, and crisis management), network security liability, privacy liability, and regulatory defense costs.

As part of Quorum's ongoing vendor oversight procedures, Quorum periodically verified Palomar's compliance with the insurance requirements of Exhibit E through review of certificates of insurance provided by Palomar's insurance broker. Based on the most recent certificate of insurance reviewed by Quorum prior to the incident (dated January 15, 2023), Palomar maintained cyber-liability insurance coverage with a per-occurrence limit of $10,000,000, in compliance with the minimum requirements of Exhibit E. While Palomar's insurance coverage does not relieve Palomar of its contractual indemnification obligations to Quorum, the existence of adequate cyber-liability coverage at Palomar provides an additional source of financial support for the recovery of incident response costs.

G. Termination for Cause (Section 14.2)

Section 14.2 of the MSA provides that either party may terminate the MSA upon the material breach of the agreement by the other party, provided that the non-breaching party provides written notice of the breach and the breaching party fails to cure the breach within thirty (30) calendar days of receiving such notice. Palomar's failure to comply with the critical vulnerability patching requirement and the breach notification timeline, as described herein, constitute material breaches of the MSA that would entitle Quorum to terminate the MSA under Section 14.2.

Quorum has carefully evaluated the termination option and has determined, in the exercise of its business judgment and in consultation with its legal, information security, and claims operations teams, that termination of the MSA is not in Quorum's best interest at this time. This determination reflects several considerations, including the significant operational disruption and transition costs that would be associated with migrating Quorum's claims processing operations to an alternative vendor, the ongoing dependency of Quorum's personal lines claims division on Palomar's services and infrastructure, and the availability of alternative remedies — specifically, the indemnification recovery and enhanced contractual security provisions described in Section IV below — that adequately address the harm caused by Palomar's breaches while preserving the continuity of critical business operations.

Instead of termination, Quorum has pursued a combination of indemnification recovery, fee concessions, and substantially enhanced contractual security provisions, as detailed in Sections IV.B and IV.C below. Quorum believes that this approach, which holds Palomar financially accountable for its contractual failures while simultaneously strengthening the security framework governing the relationship on a going-forward basis, represents the most prudent and effective course of action.

III. INCIDENT SUMMARY AND CONNECTICUT-SPECIFIC IMPACT

A. Incident Timeline Recap

The following timeline summarizes the key events associated with the cybersecurity incident, drawing upon the findings of the forensic investigation conducted by Graystone Forensics LLC ("Graystone") under the direction and supervision of Calderwood & Harkness:

March 14, 2023: A threat actor exploited CVE-2023-0669, a remote code execution vulnerability affecting Severin Corporation's GoAnywhere MFT (Managed File Transfer) software, to gain unauthorized access to Palomar's network environment. The GoAnywhere MFT platform was used by Palomar in connection with the secure transfer of data files between Palomar and its clients, including Quorum. CVE-2023-0669 had been publicly disclosed and a patch made available by Severin Corporation on February 7, 2023. As noted above, Palomar had not applied the available patch as of the date of the initial unauthorized access, which was approximately thirty-five days after the patch release — five days beyond the thirty-day patching window required by Exhibit D of the MSA.

March 14 – April 18, 2023: During an approximately thirty-five-day window, the threat actor conducted lateral movement within Palomar's network, escalated privileges, identified and accessed databases and file repositories containing Quorum data, and exfiltrated structured data files containing the personal information of Quorum policyholders and claimants. Graystone's forensic analysis determined that the threat actor employed a combination of credential harvesting, privilege escalation, and data staging techniques to identify high-value data stores and prepare data for exfiltration. The exfiltrated data was transferred to external infrastructure controlled by the threat actor using encrypted channels, which contributed to the delay in detection by Palomar's SOC.

April 18, 2023: Palomar's SOC detected unusual outbound data transfers from systems within the Palomar network that contained Quorum data. The SOC initiated an internal investigation and engaged its internal incident response team to assess the nature and scope of the activity.

April 21, 2023: Palomar's General Counsel, Derek Copeland, notified Quorum's General Counsel, Thomas R. Whitfield, and Quorum's CISO, David Naranjo, of the security incident via email. As noted in Section II.D above, this notification was approximately twenty-four hours past the contractual forty-eight-hour notification deadline.

May 4, 2023: Quorum engaged Calderwood & Harkness LLP to serve as outside counsel for all aspects of the incident response, including oversight of the forensic investigation, regulatory and consumer notification compliance, vendor accountability, litigation readiness, and communications strategy.

May 5, 2023: At the direction of Calderwood & Harkness, Quorum retained Graystone Forensics LLC, an incident response and digital forensics firm based in Tysons Corner, Virginia, to conduct a forensic investigation of the incident. The engagement was structured under attorney-client privilege, with Graystone reporting directly to Calderwood & Harkness. The investigation was led by Dr. Nolan Briggs, Managing Director, Incident Response, at Graystone.

June 2, 2023: Graystone delivered preliminary forensic findings to Calderwood & Harkness, confirming the exfiltration of structured data files containing Quorum policyholder and claimant information from Palomar's network. The preliminary findings identified the exploitation of CVE-2023-0669 as the initial attack vector and confirmed that the threat actor had accessed multiple databases within Palomar's environment.

July 14, 2023: Graystone delivered its final forensic report to Calderwood & Harkness. The final report confirmed the full scope of the incident: a total of 318,247 individuals were affected across twenty-nine states and the District of Columbia. The report provided a detailed technical analysis of the threat actor's methods, the specific systems and data stores accessed, the categories and volume of data exfiltrated, and the timeline of the unauthorized access.

August 4, 2023: The data mining and affected individual identification process was completed. This process involved the analysis of the exfiltrated data files to identify the specific individuals whose personal information was compromised and to determine the categories of data affected for each individual. The data mining was conducted by Clearfield Notification Services LLC in coordination with Graystone and under the supervision of Calderwood & Harkness.

August 14, 2023: Quorum filed regulatory notifications with the Connecticut Attorney General's Office and the Connecticut Insurance Department. The Connecticut Attorney General notification was filed pursuant to Conn. Gen. Stat. § 36a-701b, and the Connecticut Insurance Department notification was filed pursuant to Conn. Gen. Stat. § 38a-999b. Concurrent notifications were filed with the attorneys general and insurance regulators of the other affected states in accordance with applicable state breach notification laws.

B. Scope of Compromised Data

Based on Graystone's final forensic report and the completed data mining analysis, the following categories and volumes of personal information were confirmed to have been compromised:

• Total affected individuals: 318,247

• Personally Identifiable Information (PII): All 318,247 affected individuals had the following categories of PII compromised: full names, dates of birth, Social Security numbers, and driver's license or state identification numbers.

• Financial information: A subset of 84,619 affected individuals had financial information compromised, including bank account numbers, bank routing numbers, and/or payment card numbers. This subset included individuals who had provided financial account information in connection with premium payments, claim disbursements, or electronic funds transfers.

• Protected Health Information (PHI): A subset of 41,203 affected individuals had PHI compromised, including health conditions, diagnosis codes (ICD-10), treatment information, and healthcare provider details. This subset consisted of individuals who had submitted workers' compensation claims or health-related insurance claims through Quorum's personal lines division.

C. Connecticut-Specific Impact

Connecticut represents the single largest affected state population, with 52,114 Connecticut residents identified as having been affected by the incident. This reflects the significant concentration of Quorum's personal lines insurance business in Connecticut, where the company is headquartered and maintains a substantial market presence.

The following Connecticut-specific regulatory and consumer notification actions were taken:

• Connecticut Attorney General notification: Filed on August 14, 2023, pursuant to Conn. Gen. Stat. § 36a-701b. The notification included a description of the incident, the categories of personal information compromised, the number of affected Connecticut residents, the steps taken by Quorum in response to the incident, and a copy of the consumer notification letter.

• Connecticut Insurance Department notification: Filed concurrently on August 14, 2023, pursuant to Conn. Gen. Stat. § 38a-999b, the Connecticut Insurance Data Security Law. This notification provided the Department with the information required under the statute, including a description of the cybersecurity event, the estimated number of affected Connecticut residents, and the remedial actions undertaken by Quorum.

• Consumer notification letters: Notification letters were mailed to all 52,114 affected Connecticut residents during the rolling mailing window of August 18 through September 15, 2023. The consumer notification letters described the incident in plain language, identified the specific categories of personal information compromised for each individual recipient, explained the steps being taken by Quorum in response, and provided instructions for enrolling in the complimentary credit monitoring and identity theft protection services offered by Quorum.

• Credit monitoring and identity theft protection services: All Connecticut-affected individuals were offered twenty-four (24) months of complimentary credit monitoring and identity theft protection services through Clearfield Notification Services LLC, based in Independence, Ohio (Account Manager: Jerome Tillman). The credit monitoring services include three-bureau credit monitoring, fraud alerts, identity theft insurance, and access to identity restoration specialists. Enrollment instructions and a unique activation code were included in each consumer notification letter.

IV. POST-INCIDENT REMEDIATION MEASURES

A. Quorum's Internal Remediation

In the wake of the cybersecurity event, Quorum has undertaken a comprehensive review and enhancement of its vendor risk management procedures, internal monitoring capabilities, and incident response preparedness. These remediation measures reflect Quorum's commitment to incorporating the lessons learned from this incident into its ongoing risk management practices.

Enhanced Vendor Risk Management Procedures. Quorum has implemented several enhancements to its vendor risk management procedures, with particular emphasis on Tier 1 vendors. These enhancements include:

• Increasing the frequency of security assessments for Tier 1 vendors from annual to semi-annual, ensuring that vendor security posture is evaluated at least twice per year;

• Requiring Tier 1 vendors to provide evidence of patch management compliance on a quarterly basis, including documentation demonstrating timely application of critical and high-severity patches;

• Expanding the scope of the annual vendor security questionnaire to include more detailed questions regarding vulnerability management practices, endpoint detection and response capabilities, and incident response preparedness;

• Implementing a continuous monitoring capability through the use of third-party security rating services to provide real-time visibility into the external security posture of Tier 1 vendors; and

• Revising the vendor risk tiering methodology to incorporate additional risk factors, including the vendor's incident history, geographic footprint, and subcontractor dependencies.

Enhanced Internal Monitoring. Quorum has implemented enhanced internal monitoring of data flows between Quorum's systems and third-party service providers. These monitoring enhancements include the deployment of additional data loss prevention ("DLP") controls at the perimeter of Quorum's network, the implementation of enhanced logging and alerting for data transfers to and from Tier 1 vendors, and the establishment of baseline data transfer volume metrics against which anomalous activity can be detected and investigated.

Updated Incident Response Plan. Quorum has updated its enterprise incident response plan to incorporate the lessons learned from this incident. The updated plan was developed with the direct involvement and input of CISO David Naranjo, CPO Jennifer Liang, and VP Vendor Risk Management Priya Deshmukh, among other key stakeholders. The revisions include enhanced procedures for responding to vendor-originated security incidents, streamlined escalation pathways, updated communication templates for regulatory and consumer notifications, and refined coordination protocols between Quorum's internal teams and external advisors (including outside counsel, forensic investigators, and notification service providers).

Tabletop Exercises and Training. Quorum has conducted two tabletop exercises since the incident — one in August 2023 and one in October 2023 — specifically designed to test the revised incident response plan in a vendor-originated breach scenario. These exercises involved representatives from Legal, Information Security, Privacy, Claims Operations, Vendor Risk Management, Corporate Communications, and Executive Leadership. The exercises identified several process improvements that have been incorporated into the incident response plan. In addition, Quorum has provided supplemental training to all members of its incident response team on vendor breach response protocols, regulatory notification requirements, and coordination with external stakeholders.

Data Minimization Review. Quorum has initiated a comprehensive review of its data sharing practices with Tier 1 vendors to identify opportunities to reduce the volume and sensitivity of data shared with vendors to the minimum necessary for the performance of the contracted services. This review, led by CPO Jennifer Liang and VP Vendor Risk Management Priya Deshmukh, is ongoing and is expected to result in the implementation of enhanced data minimization practices by the first quarter of 2024.

B. Vendor Accountability — Palomar Data Solutions

Quorum has taken decisive action to hold Palomar accountable for its contractual failures in connection with this incident. Through Calderwood & Harkness, Quorum issued a formal indemnification demand to Palomar on June 20, 2023, seeking recovery of the full $8,230,250 in total incident response costs incurred by Quorum as a result of the breach. The total incident response costs are comprised of the following components:

The indemnification demand was predicated on two identified contractual breaches by Palomar:

(i) Failure to Patch CVE-2023-0669 Within the Contractual Window. As described in Sections II.C and III.A above, Exhibit D of the MSA (as amended) required Palomar to apply patches for critical vulnerabilities within thirty (30) days of the date on which the applicable vendor patch was made publicly available. The patch for CVE-2023-0669 was released by Severin Corporation on February 7, 2023. Palomar had not applied the patch as of March 14, 2023, the date of the initial unauthorized access — thirty-five days after the patch release and five days beyond the contractual deadline. This failure to timely patch a known critical vulnerability was the direct cause of the threat actor's ability to gain unauthorized access to Palomar's network.

(ii) Late Breach Notification. As described in Section II.D above, Section 9.4 of the MSA required Palomar to notify Quorum within forty-eight (48) hours of discovering a security incident affecting Quorum data. Palomar discovered the incident on April 18, 2023, but did not notify Quorum until April 21, 2023 — approximately seventy-two hours after discovery and approximately twenty-four hours past the contractual deadline. While this delay did not materially affect the outcome of the incident (as the data exfiltration had already occurred), it nevertheless constituted a breach of Palomar's contractual obligations and delayed the initiation of Quorum's incident response activities.

Following the issuance of the indemnification demand, Palomar engaged the law firm of Mercer, Haight & Dunlop LLP, based in Dallas, Texas (Partner: Catherine Langford), as outside counsel to respond to the demand and represent Palomar in the ensuing negotiations. The parties engaged in extensive arm's-length negotiations over the course of approximately four months, resulting in a settlement agreement executed on October 27, 2023.

The key terms of the settlement agreement are as follows:

• Cash Payment: Palomar agreed to pay Quorum $4,200,000 in cash, payable within sixty (60) calendar days of the execution of the settlement agreement.

• Fee Reduction: Palomar agreed to an eighteen-month fee reduction of eight percent (8%) applied to the current ACV, resulting in savings of approximately $1,956,000 over the eighteen-month period (calculated as $16,300,000 × 8% × 1.5 years).

• Total Effective Recovery: The combined value of the cash payment and the fee reduction is $6,156,000, representing approximately 74.8% of Quorum's total incident response costs of $8,230,250.

• Independent Security Assessment: Palomar agreed to engage, at Palomar's sole expense, an independent third-party security assessor to conduct enhanced annual security audits of Palomar's information security program. The assessor must be a nationally recognized cybersecurity firm approved by Quorum, and the audit reports must be provided to Quorum within thirty (30) days of completion.

• Enhanced Security Measures: Palomar agreed to implement enhanced patch management procedures and to deploy enterprise-grade endpoint detection and response ("EDR") capabilities across its network environment within ninety (90) calendar days of the execution of the settlement agreement. Palomar is required to provide Quorum with written confirmation of the implementation of these measures upon completion.

Quorum believes that the settlement represents a reasonable and commercially appropriate resolution that holds Palomar financially accountable for its contractual failures, recovers a substantial majority of Quorum's incident response costs, and — most importantly — establishes a significantly strengthened security framework for the ongoing vendor relationship.

C. MSA Amendment 3 — Enhanced Data Security and Audit Provisions

Concurrently with the execution of the settlement agreement, the parties executed a Third Amendment to the MSA on October 27, 2023 ("Amendment 3"). Amendment 3 incorporates substantially enhanced data security and audit provisions into the MSA, reflecting the lessons learned from the incident and Quorum's determination that the pre-existing contractual security requirements, while consistent with industry practice at the time of their adoption, were insufficient in light of the evolving threat landscape. The key provisions of Amendment 3 include:

• Reduced Patching Window: The critical vulnerability patching window has been reduced from thirty (30) days to fourteen (14) days from the date on which the applicable vendor patch or remediation is made publicly available. This more aggressive patching requirement is designed to substantially reduce the window of exposure to known critical vulnerabilities.

• Mandatory Endpoint Detection and Response: Palomar is required to deploy and maintain enterprise-grade endpoint detection and response ("EDR") solutions across all systems, servers, and endpoints within its network that access, process, or store Quorum data. The EDR solution must provide real-time monitoring, threat detection, automated response capabilities, and forensic data collection.

• Quarterly Vulnerability Scanning: Palomar is required to conduct comprehensive vulnerability scans of its network and application environments on a quarterly basis (minimum four times per year) and to provide the resulting reports to Quorum within fifteen (15) days of completion. The reports must include a listing of all identified vulnerabilities, their severity classifications, and the status of remediation efforts.

• Annual Independent Security Assessment: Palomar is required to engage, at its sole expense, an independent third-party security assessor approved by Quorum to conduct an annual comprehensive security assessment of Palomar's information security program. The scope of the assessment must include, at a minimum, penetration testing, vulnerability assessment, security architecture review, access control review, patch management review, incident response readiness evaluation, and employee security awareness assessment. The assessment report must be provided to Quorum within thirty (30) days of completion.

• Reduced Incident Notification Window: The incident notification window has been reduced from forty-eight (48) hours to twenty-four (24) hours from the time of discovery of a security incident that affects, or is reasonably believed to affect, the confidentiality, integrity, or availability of Quorum data.

• Fee Reduction: The eighteen-month fee reduction of eight percent (8%), as agreed in the settlement, has been formally incorporated into the MSA as an amendment to the fee schedule.

A copy of the executed Amendment 3 is included as Enclosure D to this submission.

D. Consumer Remediation

Quorum has implemented a comprehensive consumer remediation program designed to provide meaningful assistance and protection to the individuals affected by the breach. The key components of the consumer remediation program are as follows:

Consumer Notification. A total of 318,247 consumer notification letters were mailed to affected individuals during the rolling mailing window of August 18 through September 15, 2023. The notification letters were individualized to identify the specific categories of personal information compromised for each recipient. Of the total notification volume, 52,114 letters were mailed to Connecticut residents. The notification letters were drafted in compliance with the notification requirements of all applicable state breach notification statutes, including Conn. Gen. Stat. § 36a-701b, and were reviewed and approved by Calderwood & Harkness prior to mailing.

Credit Monitoring and Identity Theft Protection. All affected individuals were offered twenty-four (24) months of complimentary credit monitoring and identity theft protection services through Clearfield Notification Services LLC, based in Independence, Ohio (Account Manager: Jerome Tillman). The credit monitoring services include three-bureau credit monitoring with real-time alerts, a $1,000,000 identity theft insurance policy, and access to dedicated identity restoration specialists. As of the date of this submission, the estimated take-rate for the credit monitoring services is approximately 40%, representing approximately 127,299 enrollees nationally.

Dedicated Call Center. Clearfield Notification Services operated a dedicated call center staffed by trained representatives to assist affected individuals with questions regarding the incident, the consumer notification letters, and the enrollment process for the credit monitoring services. The dedicated call center operated for a twelve-week window coinciding with the notification mailing period and initial enrollment period. The call center handled an average of approximately 2,800 calls per day during the peak weeks of operation.

Substitute Notice. In addition to the direct mail notifications, Quorum posted a substitute notice on its corporate website (www.quoruminsurance.com/securitynotice) providing information about the incident and instructions for accessing the credit monitoring services. The substitute notice remains posted as of the date of this submission.

V. CYBER-INSURANCE COVERAGE

Quorum maintains a robust cyber-liability insurance program that was in full force and effect at the time of the incident. The program was placed by Whitmore Risk Advisors Inc., a specialty insurance brokerage based in New York, New York (Lead Broker: Sandra Whitmore-Kim), and consists of primary and excess layers of coverage as follows:

Primary Layer:

• Insurer: Atlas Mutual Insurance Company (Chicago, Illinois)

• Policy Number: CYB-2023-041587

• Per-Occurrence Limit: $15,000,000

• Self-Insured Retention ("SIR"): $2,500,000

• Policy Period: January 1, 2023 – December 31, 2023

Excess Layer:

• Insurer: Pinnacle Surplus Lines Insurance Corp. (Boston, Massachusetts)

• Policy Number: XS-CYB-2023-7812

• Coverage: $25,000,000 excess of $15,000,000

• Total Insurance Tower: $40,000,000

Quorum submitted a claim to Atlas Mutual Insurance Company on May 8, 2023 (Claim No. CYB-CLM-2023-05892; Claims Adjuster: Paul Enriquez). Atlas Mutual has acknowledged receipt of the claim and has been engaged in the claims adjustment process in cooperation with Quorum and Calderwood & Harkness.

Of Quorum's total incident response costs of $8,230,250, the first $2,500,000 falls within the self-insured retention and is borne by Quorum. The remaining $5,730,250 is covered under the Atlas Mutual primary policy, which provides a $15,000,000 per-occurrence limit. The covered amount is well within the primary policy limit, and the excess layer provided by Pinnacle Surplus Lines Insurance Corp. is not expected to be implicated by this event.

It should be noted that the $4,200,000 cash payment and $1,956,000 fee reduction obtained through the settlement with Palomar may be subject to subrogation or offset provisions under the Atlas Mutual policy. Quorum is working with Whitmore Risk Advisors and Atlas Mutual to coordinate the application of the settlement proceeds in a manner consistent with the terms of the insurance policy.

VI. CONCLUSION AND COOPERATION

Quorum Insurance Holdings Corp. respectfully submits that this supplemental response, together with the initial notification filed on August 14, 2023, and the initial inquiry response submitted on September 22, 2023, provides the Connecticut Insurance Department with a comprehensive and transparent account of the cybersecurity event, Quorum's vendor oversight framework, the contractual provisions governing the Palomar relationship, and the extensive remediation measures that have been undertaken.

Quorum reaffirms its commitment to full compliance with Connecticut insurance regulatory requirements and the Connecticut Insurance Data Security Law, Conn. Gen. Stat. § 38a-999b. As a Hartford-headquartered company and a significant participant in the Connecticut insurance market, Quorum takes its obligations to its policyholders, claimants, and regulators with the utmost seriousness.

Throughout this incident, Quorum has acted promptly and responsibly. Upon receiving notification from Palomar, Quorum moved swiftly to engage experienced outside counsel and a nationally recognized forensic investigation firm. Quorum conducted a thorough forensic investigation, identified all affected individuals, and provided timely regulatory and consumer notifications in compliance with all applicable state and federal requirements. Quorum held its vendor accountable through the assertion of contractual indemnification rights and the negotiation of a settlement that recovered a substantial majority of Quorum's incident response costs. Quorum implemented enhanced vendor oversight procedures and contractual protections designed to materially reduce the risk of recurrence. And Quorum provided affected individuals, including more than 52,000 Connecticut residents, with twenty-four months of complimentary credit monitoring and identity theft protection services.

It bears emphasis that this was a vendor-originated breach. At no time were Quorum's own information systems, networks, or infrastructure compromised. The unauthorized access and data exfiltration occurred entirely within Palomar Data Solutions' computing environment, as a direct result of Palomar's failure to timely patch a known critical vulnerability. Quorum has taken substantial and meaningful steps to reduce the risk of a similar event occurring in the future, both through enhanced internal vendor oversight measures and through significantly strengthened contractual data security provisions governing the Palomar relationship.

Quorum remains fully available to provide any additional information or documentation that the Department may require in connection with its review of this matter. We welcome continued dialogue with Mr. Nakamura and the Cybersecurity Unit and stand ready to respond to any further inquiries the Department may have. We respectfully request that the Department consider this supplemental submission, together with Quorum's prior filings, in concluding its review of this matter.

Respectfully submitted,

CALDERWOOD & HARKNESS LLP

By: ________

Kevin Ostrowski, Partner Calderwood & Harkness LLP 1700 K Street NW, Suite 900 Washington, D.C. 20006 Telephone: (202) 555-4800

Email: kostrowski@calderwoodharkness.com

On behalf of Quorum Insurance Holdings Corp.

Date: October 20, 2023

cc:

Thomas R. Whitfield, General Counsel, Quorum Insurance Holdings Corp.

Jennifer Liang, Chief Privacy Officer, Quorum Insurance Holdings Corp.

David Naranjo, Chief Information Security Officer, Quorum Insurance Holdings Corp.

Rachel Bernstein, Partner, Calderwood & Harkness LLP

Enclosures:

Enclosure A: Summary of Palomar MSA Data Security Exhibit (Exhibit D, as Amended) and Key Contractual Provisions

Enclosure B: Quorum Vendor Risk Management Program Overview

Enclosure C: Summary of Post-Incident Remediation Measures (Quorum and Palomar)

Enclosure D: Executed MSA Amendment 3 — Enhanced Data Security and Audit Provisions (October 27, 2023)

Enclosure E: Palomar Settlement Agreement Summary of Key Terms (October 27, 2023)

Cost Category	Vendor/Description	Amount
Forensic Investigation	Graystone Forensics LLC	$1,847,000
Consumer Notification & Credit Monitoring	Clearfield Notification Services LLC	$3,214,500
Crisis Communications	BrightPath Consulting Group	$385,000
Legal Fees	Calderwood & Harkness LLP	$2,163,750
Internal Costs	Quorum internal personnel time and resources	$620,000
Total	$8,230,250

CALDERWOOD & HARKNESS LLP Attorneys at Law
1700 K Street NW, Suite 900 Washington, D.C. 20006
Telephone: (202) 555-4800 Facsimile: (202) 555-4801 www.calderwoodharkness.com
October 20, 2023
VIA EMAIL AND CERTIFIED MAIL
Richard Nakamura Examiner, Financial Analysis Division, Cybersecurity Unit Connecticut Insurance Department 153 Market Street Hartford, CT 06103
Re: Quorum Insurance Holdings Corp. — Supplemental Response to Department Inquiry Regarding Cybersecurity Event Reference: Initial Notification Filed August 14, 2023 Pursuant to Conn. Gen. Stat. § 38a-999b; Initial Inquiry Response Submitted September 22, 2023
Dear Mr. Nakamura:
Calderwood & Harkness LLP represents Quorum Insurance Holdings Corp. ("Quorum" or "QIH"), a Delaware corporation publicly traded on the Nasdaq Stock Market (ticker symbol: QIHC) and headquartered at 400 Constitution Plaza, Suite 2200, Hartford, Connecticut 06103. This supplemental submission is made on behalf of Quorum in response to the Department's follow-up information request dated October 6, 2023, which was issued following the Department's review of Quorum's initial inquiry response submitted on September 22, 2023.
We understand that the Department has requested additional information in three specific areas: (1) Quorum's vendor oversight and third-party risk management program; (2) the contractual data security provisions governing the relationship between Quorum and its third-party claims-processing vendor, Palomar Data Solutions, Inc. ("Palomar"); and (3) the post-incident remediation measures undertaken by both Quorum and Palomar in the wake of the cybersecurity event at issue.
As the Department is aware from Quorum's prior filings, the underlying cybersecurity event was a vendor-originated data breach that occurred within Palomar's network environment. The breach affected approximately 318,247 individuals across twenty-nine states and the District of Columbia, including approximately 52,114 Connecticut residents. At no time were Quorum's own information systems or network infrastructure compromised by the threat actor; rather, the unauthorized access and data exfiltration occurred entirely within Palomar's computing environment.
Calderwood & Harkness was engaged by Quorum on May 4, 2023 (Firm Matter No. 1025-00006) to manage all aspects of the incident response, including forensic investigation oversight, regulatory notification, consumer notification, vendor accountability, and litigation readiness. Kevin Ostrowski, Partner, serves as the Responsible Partner for this engagement, and Alan Burke, Associate, serves as Lead Associate. Both Mr. Ostrowski and Mr. Burke are primarily responsible for the preparation and accuracy of this supplemental submission.
Quorum respectfully reserves all applicable attorney-client privileges, work product protections, and any other privileges or protections that may apply to the materials, analyses, and communications referenced herein. This submission is provided voluntarily and in a spirit of full cooperation with the Connecticut Insurance Department. Nothing in this submission is intended to, nor shall it be construed to, waive any privilege or protection otherwise available to Quorum, Calderwood & Harkness, or any other party.
The balance of this submission is organized as follows: Section I addresses Quorum's vendor oversight and third-party risk management program; Section II describes the contractual data security provisions of the Master Services Agreement between Quorum and Palomar; Section III provides an updated incident summary with Connecticut-specific impact data; Section IV details the post-incident remediation measures undertaken by both Quorum and Palomar; Section V summarizes Quorum's cyber-insurance coverage relevant to this event; and Section VI offers concluding observations and reaffirms Quorum's commitment to continued cooperation with the Department.
I. QUORUM'S VENDOR OVERSIGHT AND THIRD-PARTY RISK MANAGEMENT PROGRAM
A. Organizational Structure and Governance
Quorum maintains a dedicated vendor risk management function that is integrated into its broader enterprise risk management framework. The vendor risk management program is led by Priya Deshmukh, Vice President of Vendor Risk Management, who reports directly to Thomas R. Whitfield, Quorum's General Counsel. Ms. Deshmukh oversees a team of twelve full-time professionals responsible for the assessment, onboarding, ongoing monitoring, and periodic reassessment of Quorum's third-party vendor relationships.
The vendor risk management program is subject to cross-functional governance through the Vendor Risk Oversight Committee (the "VROC"), which convenes on a quarterly basis and on an ad hoc basis as circumstances require. The VROC includes representatives from the following functional areas:
•  Legal: Thomas R. Whitfield, General Counsel;
•  Information Security: David Naranjo, Chief Information Security Officer;
•  Privacy: Jennifer Liang, Chief Privacy Officer;
•  Claims Operations: Robert Wentworth, Senior Vice President, Claims Operations; and
•  Vendor Risk Management: Priya Deshmukh, Vice President, Vendor Risk Management.
The VROC is responsible for reviewing and approving vendor risk classifications, overseeing the results of periodic vendor reassessments, evaluating escalated risk findings, and recommending corrective actions where vendor risk posture is found to be deficient. Meeting minutes and action items are documented and retained in accordance with Quorum's records retention policies.
At the Board of Directors level, the Audit Committee, chaired by independent director Franklin Reeves, receives periodic reports on vendor risk, including cybersecurity risk, as part of its broader oversight function. These reports are typically delivered by Ms. Deshmukh and Mr. Naranjo on a semi-annual basis, with supplemental reports provided when material vendor risk issues are identified. Following the cybersecurity event at issue in this matter, the Audit Committee received a comprehensive briefing on the incident and the company's response on June 15, 2023, and has received monthly updates thereafter.
For context regarding Quorum's scale and operations, the company maintains approximately 11,400 employees across its various divisions and operates in all fifty states and the District of Columbia. For the fiscal year ended December 31, 2022, Quorum reported annual revenue of approximately $4.82 billion. Quorum's personal lines division, which was the business unit served by Palomar's claims processing services, represents approximately 38% of total company revenue.
B. Vendor Due Diligence and Onboarding Process
Quorum's vendor risk management program includes a structured due diligence and onboarding process for all vendors, with enhanced requirements applicable to vendors that access, process, store, or transmit policyholder, claimant, or other sensitive data on behalf of Quorum. The due diligence process is designed to evaluate prospective vendors across multiple risk dimensions, including information security, data privacy, financial stability, business continuity, and regulatory compliance.
Risk Tiering Methodology. As part of its vendor risk management framework, Quorum employs a tiered risk classification system that categorizes vendors based on two principal criteria: (i) the sensitivity of the data to which the vendor will have access, and (ii) the business criticality of the services the vendor will provide. This risk tiering methodology results in the following classifications:
•  Tier 1 (Highest Risk): Vendors that access, process, or store highly sensitive data, including personally identifiable information ("PII"), protected health information ("PHI"), and financial data (e.g., bank account numbers, payment card numbers), and/or that provide services critical to Quorum's core insurance operations. Tier 1 vendors are subject to the most rigorous due diligence requirements and the most frequent ongoing monitoring and reassessment cycles.
•  Tier 2 (Elevated Risk): Vendors that access limited categories of sensitive data or provide services that, while important, are not critical to core insurance operations. Tier 2 vendors are subject to standard due diligence requirements and annual reassessment cycles.
•  Tier 3 (Standard Risk): Vendors that do not access sensitive data and provide non-critical services. Tier 3 vendors are subject to baseline due diligence requirements and biennial reassessment cycles.
Palomar's Risk Classification. Palomar Data Solutions, Inc. was classified as a Tier 1 (highest risk) vendor from the inception of the contractual relationship. This classification was appropriate and warranted given that Palomar processed PII, financial data, and PHI in connection with its claims data processing, document management, and analytics services for Quorum's personal lines claims division. Palomar's Tier 1 classification subjected it to enhanced due diligence at onboarding and the most rigorous ongoing monitoring requirements within Quorum's vendor risk management framework.
Pre-Engagement Security Assessments. For Tier 1 vendors, Quorum's due diligence process includes the following pre-engagement security assessment components:
1.  A comprehensive review of the vendor's information security policies and procedures, including its written information security program ("WISP"), acceptable use policies, access control policies, incident response plan, and business continuity and disaster recovery plans;
2.  A review of recent penetration test results conducted by a qualified independent third party, with particular attention to the identification and remediation of critical and high-severity findings;
3.  A review of the vendor's most recent SOC 2 Type II audit report (where available) or equivalent independent assurance documentation;
4.  An evaluation of the vendor's cyber-liability insurance coverage, including policy limits, coverage scope, and named insured entities;
5.  A standardized security questionnaire administered by Quorum's Information Security team, covering topics including network security architecture, data encryption practices, patch management procedures, vulnerability management, access control mechanisms, logging and monitoring capabilities, employee security awareness training, and incident response preparedness; and
6.  Where circumstances warrant, an on-site or virtual assessment conducted by Quorum's Information Security team or a qualified third-party assessor engaged by Quorum.
In the case of Palomar, the pre-engagement due diligence process was completed in the third and fourth quarters of 2019, prior to the execution of the Master Services Agreement on November 12, 2019. At that time, the pre-engagement assessment did not identify any material deficiencies in Palomar's security posture that would have precluded Quorum from entering into the contractual relationship.
SOC 2 Type II Audit Requirement. It is important to note that the requirement for Palomar to undergo and provide an annual SOC 2 Type II audit was not included in the original MSA executed in November 2019 but was subsequently added pursuant to Amendment 2 to the MSA, executed on September 15, 2022. The SOC 2 Type II audit requirement was added as part of a broader update to the Data Security Exhibit (Exhibit D) of the MSA, reflecting the evolution of industry best practices and Quorum's own enhanced vendor oversight standards. The SOC 2 Type II audit was conducted by the independent accounting firm Kessler, Park & Associates CPA, PLLC, based in Dallas, Texas (Engagement Partner: Vivian Park). The audit covered the twelve-month period ending June 30, 2022, and was delivered to Quorum in October 2022. No material exceptions were noted in the SOC 2 Type II report at that time. A subsequent SOC 2 Type II engagement covering the twelve-month period ending June 30, 2023, was underway at the time of the incident and has since been completed; its findings are not addressed in this submission but are available for the Department's review upon request.
C. Ongoing Monitoring and Oversight
Beyond the initial due diligence and onboarding process, Quorum's vendor risk management program includes several ongoing monitoring and oversight mechanisms designed to ensure that vendors, particularly Tier 1 vendors such as Palomar, continue to maintain adequate security posture throughout the duration of the contractual relationship.
Annual Vendor Security Questionnaires and Reassessments. All Tier 1 vendors are required to complete an annual security questionnaire administered by Quorum's Information Security team. The questionnaire is comprehensive and covers the same subject areas as the pre-engagement security questionnaire. Responses are reviewed by Quorum's Information Security team and Vendor Risk Management function, and any identified deficiencies or areas of concern are flagged for follow-up. Palomar completed annual security questionnaires in October 2020, November 2021, and October 2022. The October 2022 questionnaire did not reveal any material deficiencies related to patch management or vulnerability remediation.
SOC 2 Type II Reports. As noted above, Amendment 2 to the MSA (executed September 15, 2022) formalized the requirement for Palomar to provide Quorum with an annual SOC 2 Type II audit report. Prior to Amendment 2, Quorum relied on Palomar's self-reported security questionnaire responses and its own periodic assessments as the primary means of evaluating Palomar's security posture. The addition of the SOC 2 Type II requirement represented a meaningful enhancement to Quorum's ongoing monitoring capabilities with respect to Palomar.
Cyber-Insurance Coverage Verification. Quorum's vendor risk management procedures include periodic verification of vendor cyber-insurance coverage to confirm compliance with contractual minimums. This verification is typically conducted on an annual basis in connection with the vendor reassessment cycle. As discussed further in Section II.F below, Palomar was required to maintain a minimum of $10,000,000 in cyber-liability insurance coverage, and Quorum verified Palomar's compliance with this requirement through review of certificates of insurance provided by Palomar's broker.
Contractual Audit Rights. The MSA between Quorum and Palomar includes contractual audit rights (Section 11.3 of the MSA) that permit Quorum to conduct or commission audits of Palomar's security environment. These audit rights entitle Quorum, upon reasonable notice and during normal business hours, to access Palomar's facilities, systems, records, and personnel to the extent necessary to evaluate Palomar's compliance with the data security requirements of the MSA. While Quorum did not exercise its formal contractual audit rights during the period between the execution of the MSA and the date of the incident, Quorum's reliance on SOC 2 Type II reports, annual security questionnaires, and the other monitoring mechanisms described above was consistent with industry practice for the oversight of third-party service providers of Palomar's type and risk profile.
Escalation Procedures. Quorum's vendor risk management procedures include defined escalation procedures for use when vendor risk issues are identified during the ongoing monitoring process. When a Tier 1 vendor reassessment reveals a material deficiency or area of concern, the finding is escalated to the VROC for review and action. The VROC may direct a range of corrective actions, including requiring the vendor to develop and implement a remediation plan within a specified timeframe, engaging a third-party assessor to conduct an independent evaluation, exercising contractual audit rights, or, in extreme cases, recommending termination of the vendor relationship. In the period preceding the incident at issue, no material deficiencies requiring escalation to the VROC were identified with respect to Palomar.
II. PALOMAR MSA DATA SECURITY AND CONTRACTUAL PROVISIONS
A. Master Services Agreement Overview
The relationship between Quorum and Palomar is governed by a Master Services Agreement (the "MSA") executed on November 12, 2019, with an initial term of five years expiring on November 11, 2024. Palomar Data Solutions, Inc. is a Texas corporation (EIN: 75-3291048) headquartered at 7100 Greenville Avenue, Suite 450, Dallas, Texas 75231. Palomar is a provider of claims data processing, document management, and analytics services to the insurance industry.
Under the MSA, Palomar provides claims data processing, document management, and analytics services for Quorum's personal lines division. The original annual contract value ("ACV") was $14,200,000, resulting in a five-year total contract value ("TCV") of approximately $71,000,000. Quorum is understood to be Palomar's second-largest client by revenue, with Palomar's services to Quorum representing a significant portion of Palomar's overall business. The services provided by Palomar are integral to the efficient operation of Quorum's personal lines claims function, involving the receipt, processing, organization, analysis, and storage of claims-related data submitted by policyholders and claimants.
Given the nature and scope of the services provided, Palomar routinely received and processed substantial volumes of sensitive data on behalf of Quorum, including policyholder and claimant PII (names, dates of birth, Social Security numbers, driver's license numbers, mailing addresses, and contact information), financial data (bank account numbers, payment card numbers, and payment transaction details), and, in the context of workers' compensation and health-related claims, PHI (health conditions, diagnosis codes, treatment information, and provider details). The volume and sensitivity of this data were the primary drivers of Palomar's Tier 1 risk classification, as discussed in Section I.B above.
B. Amendment History
Since its execution, the MSA has been amended on three occasions. The first two amendments preceded the cybersecurity event; the third amendment was executed in connection with the post-incident settlement agreement, as described in Section IV below.
Amendment 1 was executed on March 3, 2021. Amendment 1 expanded the scope of Palomar's services to include data processing associated with Quorum's QuorumEdge digital underwriting platform, a proprietary technology platform used by Quorum's personal lines division to streamline underwriting workflows. Amendment 1 increased the ACV by $2,100,000, from $14,200,000 to $16,300,000, effective April 1, 2021. The expanded services required Palomar to process additional categories of applicant and policyholder data in connection with the QuorumEdge platform, further reinforcing Palomar's Tier 1 risk classification.
Amendment 2 was executed on September 15, 2022. Amendment 2 addressed several important enhancements to the data security provisions of the MSA. Specifically, Amendment 2 updated the Data Security Exhibit (Exhibit D) to incorporate more specific and prescriptive security requirements, added the requirement for Palomar to undergo and provide an annual SOC 2 Type II audit, and updated the minimum cyber-insurance coverage requirements applicable to Palomar. Amendment 2 reflected Quorum's ongoing commitment to strengthening the contractual data security framework governing its highest-risk vendor relationships and was consistent with evolving industry standards and regulatory expectations.
Amendment 3 was executed on October 27, 2023, concurrently with the settlement agreement between Quorum and Palomar. Amendment 3 is discussed in detail in Section IV.C below.
C. Data Security Exhibit (Exhibit D, as Amended)
The Data Security Exhibit, designated as Exhibit D to the MSA, sets forth the information security obligations applicable to Palomar in connection with its processing of Quorum data. As amended by Amendment 2 (September 15, 2022), Exhibit D required Palomar to maintain "commercially reasonable" administrative, technical, and physical safeguards consistent with industry standards, including but not limited to standards promulgated by the National Institute of Standards and Technology ("NIST") and the International Organization for Standardization ("ISO"). The key security obligations imposed on Palomar under Exhibit D, as amended, included the following:
(i) Vulnerability and Patch Management. Palomar was required to maintain a documented vulnerability management program, including procedures for identifying, evaluating, and remediating security vulnerabilities in its systems and software. Of critical relevance to this incident, Exhibit D (as amended) required Palomar to apply patches for critical vulnerabilities within thirty (30) days of the date on which the applicable vendor patch or remediation was made publicly available. This thirty-day patching window was the specific contractual obligation that Palomar failed to satisfy in connection with CVE-2023-0669, the GoAnywhere MFT remote code execution vulnerability exploited by the threat actor. As detailed in Section III below, the patch for CVE-2023-0669 was made available by Severin Corporation, the developer of GoAnywhere MFT, on February 7, 2023, but Palomar had not applied the patch as of March 14, 2023, the date of the initial unauthorized access — a period of approximately thirty-five days after the patch was made available and five days beyond the contractual thirty-day patching window.
(ii) Annual Penetration Testing. Palomar was required to engage a qualified independent third party to conduct penetration testing of its network and application environments at least annually. The results of each penetration test, including identified vulnerabilities and remediation plans, were required to be made available to Quorum upon request.
(iii) SOC 2 Type II Audit. As added by Amendment 2, Palomar was required to engage a qualified independent audit firm to conduct an annual SOC 2 Type II audit and to provide the resulting report to Quorum within thirty (30) days of its completion.
(iv) Data Encryption. Palomar was required to encrypt all Quorum data at rest using AES-256 or equivalent encryption and to encrypt all Quorum data in transit using TLS 1.2 or higher.
(v) Access Controls and Logging. Palomar was required to implement and maintain role-based access controls, multi-factor authentication for administrative and remote access, and comprehensive logging and monitoring of access to systems containing Quorum data. Access logs were required to be retained for a minimum of twelve (12) months.
D. Breach Notification Clause (Section 9.4)
Section 9.4 of the MSA imposed a contractual obligation on Palomar to notify Quorum within forty-eight (48) hours of discovering a security incident that affected, or was reasonably believed to affect, the confidentiality, integrity, or availability of Quorum data. The notification was required to be provided in writing to Quorum's General Counsel and Chief Information Security Officer and was required to include, to the extent known at the time of notification, a description of the nature of the incident, the categories of data believed to be affected, the estimated number of affected individuals, the measures being taken by Palomar to investigate and contain the incident, and a designated point of contact for ongoing communications.
The chronology of Palomar's notification to Quorum is as follows:
•  April 18, 2023: Palomar's Security Operations Center ("SOC") detected anomalous outbound data transfers from systems within Palomar's network that were used to process Quorum data. This detection constituted the point at which Palomar discovered, or should reasonably have been deemed to have discovered, the security incident for purposes of Section 9.4.
•  April 21, 2023: Palomar's General Counsel, Derek Copeland, transmitted written notification of the security incident to Thomas R. Whitfield, Quorum's General Counsel, and David Naranjo, Quorum's Chief Information Security Officer, via email. The notification described the anomalous activity detected by Palomar's SOC, indicated that Palomar was conducting an internal investigation, and identified Mr. Copeland as the primary point of contact for further communications.
The elapsed time between Palomar's discovery of the incident on April 18, 2023, and its notification to Quorum on April 21, 2023, was approximately seventy-two (72) hours. This represented an approximately twenty-four-hour delay beyond the contractual forty-eight-hour notification deadline established by Section 9.4. This delay is one of the two identified contractual breaches by Palomar, as further discussed in Section IV.B below.
E. Indemnification Provisions (Section 12.2)
Section 12.2 of the MSA provides that Palomar shall defend, indemnify, and hold harmless Quorum and its affiliates, officers, directors, employees, and agents from and against any and all losses, damages, liabilities, costs, and expenses (including reasonable attorneys' fees) arising out of or relating to Palomar's breach of its data security obligations under the MSA, including the obligations set forth in Exhibit D. This indemnification obligation encompasses, without limitation, costs incurred in connection with forensic investigation, regulatory notification, consumer notification, credit monitoring services, crisis communications, legal fees, and regulatory penalties or fines.
The indemnification obligation is subject to a liability cap equal to two times (2×) the trailing twelve-month fees paid by Quorum to Palomar under the MSA. Based on the then-current ACV of $16,300,000, the applicable liability cap was $32,600,000 (i.e., $16,300,000 × 2). Quorum's total incident response costs of $8,230,250, as described in Section IV.B below, were well within this contractual liability cap.
Quorum, through Calderwood & Harkness, issued a formal indemnification demand to Palomar on June 20, 2023, asserting Palomar's obligation to indemnify Quorum for the full amount of its incident response costs. The demand was addressed to Derek Copeland, Palomar's General Counsel, with a copy to Catherine Langford of Mercer, Haight & Dunlop LLP (Dallas, Texas), which Palomar had engaged as outside counsel. The subsequent vendor accountability negotiations and settlement are described in Section IV.B below.
F. Insurance Requirements (Exhibit E)
Exhibit E to the MSA sets forth the insurance coverage requirements applicable to Palomar. Among other coverage requirements, Exhibit E required Palomar to obtain and maintain, at its own expense, cyber-liability insurance coverage with a minimum per-occurrence limit of $10,000,000 from an insurer with an A.M. Best rating of A- (Excellent) or better. The cyber-liability coverage was required to provide coverage for, among other things, data breach response costs (including notification costs, credit monitoring, forensic investigation, and crisis management), network security liability, privacy liability, and regulatory defense costs.
As part of Quorum's ongoing vendor oversight procedures, Quorum periodically verified Palomar's compliance with the insurance requirements of Exhibit E through review of certificates of insurance provided by Palomar's insurance broker. Based on the most recent certificate of insurance reviewed by Quorum prior to the incident (dated January 15, 2023), Palomar maintained cyber-liability insurance coverage with a per-occurrence limit of $10,000,000, in compliance with the minimum requirements of Exhibit E. While Palomar's insurance coverage does not relieve Palomar of its contractual indemnification obligations to Quorum, the existence of adequate cyber-liability coverage at Palomar provides an additional source of financial support for the recovery of incident response costs.
G. Termination for Cause (Section 14.2)
Section 14.2 of the MSA provides that either party may terminate the MSA upon the material breach of the agreement by the other party, provided that the non-breaching party provides written notice of the breach and the breaching party fails to cure the breach within thirty (30) calendar days of receiving such notice. Palomar's failure to comply with the critical vulnerability patching requirement and the breach notification timeline, as described herein, constitute material breaches of the MSA that would entitle Quorum to terminate the MSA under Section 14.2.
Quorum has carefully evaluated the termination option and has determined, in the exercise of its business judgment and in consultation with its legal, information security, and claims operations teams, that termination of the MSA is not in Quorum's best interest at this time. This determination reflects several considerations, including the significant operational disruption and transition costs that would be associated with migrating Quorum's claims processing operations to an alternative vendor, the ongoing dependency of Quorum's personal lines claims division on Palomar's services and infrastructure, and the availability of alternative remedies — specifically, the indemnification recovery and enhanced contractual security provisions described in Section IV below — that adequately address the harm caused by Palomar's breaches while preserving the continuity of critical business operations.
Instead of termination, Quorum has pursued a combination of indemnification recovery, fee concessions, and substantially enhanced contractual security provisions, as detailed in Sections IV.B and IV.C below. Quorum believes that this approach, which holds Palomar financially accountable for its contractual failures while simultaneously strengthening the security framework governing the relationship on a going-forward basis, represents the most prudent and effective course of action.
III. INCIDENT SUMMARY AND CONNECTICUT-SPECIFIC IMPACT
A. Incident Timeline Recap
The following timeline summarizes the key events associated with the cybersecurity incident, drawing upon the findings of the forensic investigation conducted by Graystone Forensics LLC ("Graystone") under the direction and supervision of Calderwood & Harkness:
March 14, 2023: A threat actor exploited CVE-2023-0669, a remote code execution vulnerability affecting Severin Corporation's GoAnywhere MFT (Managed File Transfer) software, to gain unauthorized access to Palomar's network environment. The GoAnywhere MFT platform was used by Palomar in connection with the secure transfer of data files between Palomar and its clients, including Quorum. CVE-2023-0669 had been publicly disclosed and a patch made available by Severin Corporation on February 7, 2023. As noted above, Palomar had not applied the available patch as of the date of the initial unauthorized access, which was approximately thirty-five days after the patch release — five days beyond the thirty-day patching window required by Exhibit D of the MSA.
March 14 – April 18, 2023: During an approximately thirty-five-day window, the threat actor conducted lateral movement within Palomar's network, escalated privileges, identified and accessed databases and file repositories containing Quorum data, and exfiltrated structured data files containing the personal information of Quorum policyholders and claimants. Graystone's forensic analysis determined that the threat actor employed a combination of credential harvesting, privilege escalation, and data staging techniques to identify high-value data stores and prepare data for exfiltration. The exfiltrated data was transferred to external infrastructure controlled by the threat actor using encrypted channels, which contributed to the delay in detection by Palomar's SOC.
April 18, 2023: Palomar's SOC detected unusual outbound data transfers from systems within the Palomar network that contained Quorum data. The SOC initiated an internal investigation and engaged its internal incident response team to assess the nature and scope of the activity.
April 21, 2023: Palomar's General Counsel, Derek Copeland, notified Quorum's General Counsel, Thomas R. Whitfield, and Quorum's CISO, David Naranjo, of the security incident via email. As noted in Section II.D above, this notification was approximately twenty-four hours past the contractual forty-eight-hour notification deadline.
May 4, 2023: Quorum engaged Calderwood & Harkness LLP to serve as outside counsel for all aspects of the incident response, including oversight of the forensic investigation, regulatory and consumer notification compliance, vendor accountability, litigation readiness, and communications strategy.
May 5, 2023: At the direction of Calderwood & Harkness, Quorum retained Graystone Forensics LLC, an incident response and digital forensics firm based in Tysons Corner, Virginia, to conduct a forensic investigation of the incident. The engagement was structured under attorney-client privilege, with Graystone reporting directly to Calderwood & Harkness. The investigation was led by Dr. Nolan Briggs, Managing Director, Incident Response, at Graystone.
June 2, 2023: Graystone delivered preliminary forensic findings to Calderwood & Harkness, confirming the exfiltration of structured data files containing Quorum policyholder and claimant information from Palomar's network. The preliminary findings identified the exploitation of CVE-2023-0669 as the initial attack vector and confirmed that the threat actor had accessed multiple databases within Palomar's environment.
July 14, 2023: Graystone delivered its final forensic report to Calderwood & Harkness. The final report confirmed the full scope of the incident: a total of 318,247 individuals were affected across twenty-nine states and the District of Columbia. The report provided a detailed technical analysis of the threat actor's methods, the specific systems and data stores accessed, the categories and volume of data exfiltrated, and the timeline of the unauthorized access.
August 4, 2023: The data mining and affected individual identification process was completed. This process involved the analysis of the exfiltrated data files to identify the specific individuals whose personal information was compromised and to determine the categories of data affected for each individual. The data mining was conducted by Clearfield Notification Services LLC in coordination with Graystone and under the supervision of Calderwood & Harkness.
August 14, 2023: Quorum filed regulatory notifications with the Connecticut Attorney General's Office and the Connecticut Insurance Department. The Connecticut Attorney General notification was filed pursuant to Conn. Gen. Stat. § 36a-701b, and the Connecticut Insurance Department notification was filed pursuant to Conn. Gen. Stat. § 38a-999b. Concurrent notifications were filed with the attorneys general and insurance regulators of the other affected states in accordance with applicable state breach notification laws.
B. Scope of Compromised Data
Based on Graystone's final forensic report and the completed data mining analysis, the following categories and volumes of personal information were confirmed to have been compromised:
•  Total affected individuals: 318,247
•  Personally Identifiable Information (PII): All 318,247 affected individuals had the following categories of PII compromised: full names, dates of birth, Social Security numbers, and driver's license or state identification numbers.
•  Financial information: A subset of 84,619 affected individuals had financial information compromised, including bank account numbers, bank routing numbers, and/or payment card numbers. This subset included individuals who had provided financial account information in connection with premium payments, claim disbursements, or electronic funds transfers.
•  Protected Health Information (PHI): A subset of 41,203 affected individuals had PHI compromised, including health conditions, diagnosis codes (ICD-10), treatment information, and healthcare provider details. This subset consisted of individuals who had submitted workers' compensation claims or health-related insurance claims through Quorum's personal lines division.
C. Connecticut-Specific Impact
Connecticut represents the single largest affected state population, with 52,114 Connecticut residents identified as having been affected by the incident. This reflects the significant concentration of Quorum's personal lines insurance business in Connecticut, where the company is headquartered and maintains a substantial market presence.
The following Connecticut-specific regulatory and consumer notification actions were taken:
•  Connecticut Attorney General notification: Filed on August 14, 2023, pursuant to Conn. Gen. Stat. § 36a-701b. The notification included a description of the incident, the categories of personal information compromised, the number of affected Connecticut residents, the steps taken by Quorum in response to the incident, and a copy of the consumer notification letter.
•  Connecticut Insurance Department notification: Filed concurrently on August 14, 2023, pursuant to Conn. Gen. Stat. § 38a-999b, the Connecticut Insurance Data Security Law. This notification provided the Department with the information required under the statute, including a description of the cybersecurity event, the estimated number of affected Connecticut residents, and the remedial actions undertaken by Quorum.
•  Consumer notification letters: Notification letters were mailed to all 52,114 affected Connecticut residents during the rolling mailing window of August 18 through September 15, 2023. The consumer notification letters described the incident in plain language, identified the specific categories of personal information compromised for each individual recipient, explained the steps being taken by Quorum in response, and provided instructions for enrolling in the complimentary credit monitoring and identity theft protection services offered by Quorum.
•  Credit monitoring and identity theft protection services: All Connecticut-affected individuals were offered twenty-four (24) months of complimentary credit monitoring and identity theft protection services through Clearfield Notification Services LLC, based in Independence, Ohio (Account Manager: Jerome Tillman). The credit monitoring services include three-bureau credit monitoring, fraud alerts, identity theft insurance, and access to identity restoration specialists. Enrollment instructions and a unique activation code were included in each consumer notification letter.
IV. POST-INCIDENT REMEDIATION MEASURES
A. Quorum's Internal Remediation
In the wake of the cybersecurity event, Quorum has undertaken a comprehensive review and enhancement of its vendor risk management procedures, internal monitoring capabilities, and incident response preparedness. These remediation measures reflect Quorum's commitment to incorporating the lessons learned from this incident into its ongoing risk management practices.
Enhanced Vendor Risk Management Procedures. Quorum has implemented several enhancements to its vendor risk management procedures, with particular emphasis on Tier 1 vendors. These enhancements include:
•  Increasing the frequency of security assessments for Tier 1 vendors from annual to semi-annual, ensuring that vendor security posture is evaluated at least twice per year;
•  Requiring Tier 1 vendors to provide evidence of patch management compliance on a quarterly basis, including documentation demonstrating timely application of critical and high-severity patches;
•  Expanding the scope of the annual vendor security questionnaire to include more detailed questions regarding vulnerability management practices, endpoint detection and response capabilities, and incident response preparedness;
•  Implementing a continuous monitoring capability through the use of third-party security rating services to provide real-time visibility into the external security posture of Tier 1 vendors; and
•  Revising the vendor risk tiering methodology to incorporate additional risk factors, including the vendor's incident history, geographic footprint, and subcontractor dependencies.
Enhanced Internal Monitoring. Quorum has implemented enhanced internal monitoring of data flows between Quorum's systems and third-party service providers. These monitoring enhancements include the deployment of additional data loss prevention ("DLP") controls at the perimeter of Quorum's network, the implementation of enhanced logging and alerting for data transfers to and from Tier 1 vendors, and the establishment of baseline data transfer volume metrics against which anomalous activity can be detected and investigated.
Updated Incident Response Plan. Quorum has updated its enterprise incident response plan to incorporate the lessons learned from this incident. The updated plan was developed with the direct involvement and input of CISO David Naranjo, CPO Jennifer Liang, and VP Vendor Risk Management Priya Deshmukh, among other key stakeholders. The revisions include enhanced procedures for responding to vendor-originated security incidents, streamlined escalation pathways, updated communication templates for regulatory and consumer notifications, and refined coordination protocols between Quorum's internal teams and external advisors (including outside counsel, forensic investigators, and notification service providers).
Tabletop Exercises and Training. Quorum has conducted two tabletop exercises since the incident — one in August 2023 and one in October 2023 — specifically designed to test the revised incident response plan in a vendor-originated breach scenario. These exercises involved representatives from Legal, Information Security, Privacy, Claims Operations, Vendor Risk Management, Corporate Communications, and Executive Leadership. The exercises identified several process improvements that have been incorporated into the incident response plan. In addition, Quorum has provided supplemental training to all members of its incident response team on vendor breach response protocols, regulatory notification requirements, and coordination with external stakeholders.
Data Minimization Review. Quorum has initiated a comprehensive review of its data sharing practices with Tier 1 vendors to identify opportunities to reduce the volume and sensitivity of data shared with vendors to the minimum necessary for the performance of the contracted services. This review, led by CPO Jennifer Liang and VP Vendor Risk Management Priya Deshmukh, is ongoing and is expected to result in the implementation of enhanced data minimization practices by the first quarter of 2024.
B. Vendor Accountability — Palomar Data Solutions
Quorum has taken decisive action to hold Palomar accountable for its contractual failures in connection with this incident. Through Calderwood & Harkness, Quorum issued a formal indemnification demand to Palomar on June 20, 2023, seeking recovery of the full $8,230,250 in total incident response costs incurred by Quorum as a result of the breach. The total incident response costs are comprised of the following components:
The indemnification demand was predicated on two identified contractual breaches by Palomar:
(i) Failure to Patch CVE-2023-0669 Within the Contractual Window. As described in Sections II.C and III.A above, Exhibit D of the MSA (as amended) required Palomar to apply patches for critical vulnerabilities within thirty (30) days of the date on which the applicable vendor patch was made publicly available. The patch for CVE-2023-0669 was released by Severin Corporation on February 7, 2023. Palomar had not applied the patch as of March 14, 2023, the date of the initial unauthorized access — thirty-five days after the patch release and five days beyond the contractual deadline. This failure to timely patch a known critical vulnerability was the direct cause of the threat actor's ability to gain unauthorized access to Palomar's network.
(ii) Late Breach Notification. As described in Section II.D above, Section 9.4 of the MSA required Palomar to notify Quorum within forty-eight (48) hours of discovering a security incident affecting Quorum data. Palomar discovered the incident on April 18, 2023, but did not notify Quorum until April 21, 2023 — approximately seventy-two hours after discovery and approximately twenty-four hours past the contractual deadline. While this delay did not materially affect the outcome of the incident (as the data exfiltration had already occurred), it nevertheless constituted a breach of Palomar's contractual obligations and delayed the initiation of Quorum's incident response activities.
Following the issuance of the indemnification demand, Palomar engaged the law firm of Mercer, Haight & Dunlop LLP, based in Dallas, Texas (Partner: Catherine Langford), as outside counsel to respond to the demand and represent Palomar in the ensuing negotiations. The parties engaged in extensive arm's-length negotiations over the course of approximately four months, resulting in a settlement agreement executed on October 27, 2023.
The key terms of the settlement agreement are as follows:
•  Cash Payment: Palomar agreed to pay Quorum $4,200,000 in cash, payable within sixty (60) calendar days of the execution of the settlement agreement.
•  Fee Reduction: Palomar agreed to an eighteen-month fee reduction of eight percent (8%) applied to the current ACV, resulting in savings of approximately $1,956,000 over the eighteen-month period (calculated as $16,300,000 × 8% × 1.5 years).
•  Total Effective Recovery: The combined value of the cash payment and the fee reduction is $6,156,000, representing approximately 74.8% of Quorum's total incident response costs of $8,230,250.
•  Independent Security Assessment: Palomar agreed to engage, at Palomar's sole expense, an independent third-party security assessor to conduct enhanced annual security audits of Palomar's information security program. The assessor must be a nationally recognized cybersecurity firm approved by Quorum, and the audit reports must be provided to Quorum within thirty (30) days of completion.
•  Enhanced Security Measures: Palomar agreed to implement enhanced patch management procedures and to deploy enterprise-grade endpoint detection and response ("EDR") capabilities across its network environment within ninety (90) calendar days of the execution of the settlement agreement. Palomar is required to provide Quorum with written confirmation of the implementation of these measures upon completion.
Quorum believes that the settlement represents a reasonable and commercially appropriate resolution that holds Palomar financially accountable for its contractual failures, recovers a substantial majority of Quorum's incident response costs, and — most importantly — establishes a significantly strengthened security framework for the ongoing vendor relationship.
C. MSA Amendment 3 — Enhanced Data Security and Audit Provisions
Concurrently with the execution of the settlement agreement, the parties executed a Third Amendment to the MSA on October 27, 2023 ("Amendment 3"). Amendment 3 incorporates substantially enhanced data security and audit provisions into the MSA, reflecting the lessons learned from the incident and Quorum's determination that the pre-existing contractual security requirements, while consistent with industry practice at the time of their adoption, were insufficient in light of the evolving threat landscape. The key provisions of Amendment 3 include:
•  Reduced Patching Window: The critical vulnerability patching window has been reduced from thirty (30) days to fourteen (14) days from the date on which the applicable vendor patch or remediation is made publicly available. This more aggressive patching requirement is designed to substantially reduce the window of exposure to known critical vulnerabilities.
•  Mandatory Endpoint Detection and Response: Palomar is required to deploy and maintain enterprise-grade endpoint detection and response ("EDR") solutions across all systems, servers, and endpoints within its network that access, process, or store Quorum data. The EDR solution must provide real-time monitoring, threat detection, automated response capabilities, and forensic data collection.
•  Quarterly Vulnerability Scanning: Palomar is required to conduct comprehensive vulnerability scans of its network and application environments on a quarterly basis (minimum four times per year) and to provide the resulting reports to Quorum within fifteen (15) days of completion. The reports must include a listing of all identified vulnerabilities, their severity classifications, and the status of remediation efforts.
•  Annual Independent Security Assessment: Palomar is required to engage, at its sole expense, an independent third-party security assessor approved by Quorum to conduct an annual comprehensive security assessment of Palomar's information security program. The scope of the assessment must include, at a minimum, penetration testing, vulnerability assessment, security architecture review, access control review, patch management review, incident response readiness evaluation, and employee security awareness assessment. The assessment report must be provided to Quorum within thirty (30) days of completion.
•  Reduced Incident Notification Window: The incident notification window has been reduced from forty-eight (48) hours to twenty-four (24) hours from the time of discovery of a security incident that affects, or is reasonably believed to affect, the confidentiality, integrity, or availability of Quorum data.
•  Fee Reduction: The eighteen-month fee reduction of eight percent (8%), as agreed in the settlement, has been formally incorporated into the MSA as an amendment to the fee schedule.
A copy of the executed Amendment 3 is included as Enclosure D to this submission.
D. Consumer Remediation
Quorum has implemented a comprehensive consumer remediation program designed to provide meaningful assistance and protection to the individuals affected by the breach. The key components of the consumer remediation program are as follows:
Consumer Notification. A total of 318,247 consumer notification letters were mailed to affected individuals during the rolling mailing window of August 18 through September 15, 2023. The notification letters were individualized to identify the specific categories of personal information compromised for each recipient. Of the total notification volume, 52,114 letters were mailed to Connecticut residents. The notification letters were drafted in compliance with the notification requirements of all applicable state breach notification statutes, including Conn. Gen. Stat. § 36a-701b, and were reviewed and approved by Calderwood & Harkness prior to mailing.
Credit Monitoring and Identity Theft Protection. All affected individuals were offered twenty-four (24) months of complimentary credit monitoring and identity theft protection services through Clearfield Notification Services LLC, based in Independence, Ohio (Account Manager: Jerome Tillman). The credit monitoring services include three-bureau credit monitoring with real-time alerts, a $1,000,000 identity theft insurance policy, and access to dedicated identity restoration specialists. As of the date of this submission, the estimated take-rate for the credit monitoring services is approximately 40%, representing approximately 127,299 enrollees nationally.
Dedicated Call Center. Clearfield Notification Services operated a dedicated call center staffed by trained representatives to assist affected individuals with questions regarding the incident, the consumer notification letters, and the enrollment process for the credit monitoring services. The dedicated call center operated for a twelve-week window coinciding with the notification mailing period and initial enrollment period. The call center handled an average of approximately 2,800 calls per day during the peak weeks of operation.
Substitute Notice. In addition to the direct mail notifications, Quorum posted a substitute notice on its corporate website (www.quoruminsurance.com/securitynotice) providing information about the incident and instructions for accessing the credit monitoring services. The substitute notice remains posted as of the date of this submission.
V. CYBER-INSURANCE COVERAGE
Quorum maintains a robust cyber-liability insurance program that was in full force and effect at the time of the incident. The program was placed by Whitmore Risk Advisors Inc., a specialty insurance brokerage based in New York, New York (Lead Broker: Sandra Whitmore-Kim), and consists of primary and excess layers of coverage as follows:
Primary Layer:
•  Insurer: Atlas Mutual Insurance Company (Chicago, Illinois)
•  Policy Number: CYB-2023-041587
•  Per-Occurrence Limit: $15,000,000
•  Self-Insured Retention ("SIR"): $2,500,000
•  Policy Period: January 1, 2023 – December 31, 2023
Excess Layer:
•  Insurer: Pinnacle Surplus Lines Insurance Corp. (Boston, Massachusetts)
•  Policy Number: XS-CYB-2023-7812
•  Coverage: $25,000,000 excess of $15,000,000
•  Total Insurance Tower: $40,000,000
Quorum submitted a claim to Atlas Mutual Insurance Company on May 8, 2023 (Claim No. CYB-CLM-2023-05892; Claims Adjuster: Paul Enriquez). Atlas Mutual has acknowledged receipt of the claim and has been engaged in the claims adjustment process in cooperation with Quorum and Calderwood & Harkness.
Of Quorum's total incident response costs of $8,230,250, the first $2,500,000 falls within the self-insured retention and is borne by Quorum. The remaining $5,730,250 is covered under the Atlas Mutual primary policy, which provides a $15,000,000 per-occurrence limit. The covered amount is well within the primary policy limit, and the excess layer provided by Pinnacle Surplus Lines Insurance Corp. is not expected to be implicated by this event.
It should be noted that the $4,200,000 cash payment and $1,956,000 fee reduction obtained through the settlement with Palomar may be subject to subrogation or offset provisions under the Atlas Mutual policy. Quorum is working with Whitmore Risk Advisors and Atlas Mutual to coordinate the application of the settlement proceeds in a manner consistent with the terms of the insurance policy.
VI. CONCLUSION AND COOPERATION
Quorum Insurance Holdings Corp. respectfully submits that this supplemental response, together with the initial notification filed on August 14, 2023, and the initial inquiry response submitted on September 22, 2023, provides the Connecticut Insurance Department with a comprehensive and transparent account of the cybersecurity event, Quorum's vendor oversight framework, the contractual provisions governing the Palomar relationship, and the extensive remediation measures that have been undertaken.
Quorum reaffirms its commitment to full compliance with Connecticut insurance regulatory requirements and the Connecticut Insurance Data Security Law, Conn. Gen. Stat. § 38a-999b. As a Hartford-headquartered company and a significant participant in the Connecticut insurance market, Quorum takes its obligations to its policyholders, claimants, and regulators with the utmost seriousness.
Throughout this incident, Quorum has acted promptly and responsibly. Upon receiving notification from Palomar, Quorum moved swiftly to engage experienced outside counsel and a nationally recognized forensic investigation firm. Quorum conducted a thorough forensic investigation, identified all affected individuals, and provided timely regulatory and consumer notifications in compliance with all applicable state and federal requirements. Quorum held its vendor accountable through the assertion of contractual indemnification rights and the negotiation of a settlement that recovered a substantial majority of Quorum's incident response costs. Quorum implemented enhanced vendor oversight procedures and contractual protections designed to materially reduce the risk of recurrence. And Quorum provided affected individuals, including more than 52,000 Connecticut residents, with twenty-four months of complimentary credit monitoring and identity theft protection services.
It bears emphasis that this was a vendor-originated breach. At no time were Quorum's own information systems, networks, or infrastructure compromised. The unauthorized access and data exfiltration occurred entirely within Palomar Data Solutions' computing environment, as a direct result of Palomar's failure to timely patch a known critical vulnerability. Quorum has taken substantial and meaningful steps to reduce the risk of a similar event occurring in the future, both through enhanced internal vendor oversight measures and through significantly strengthened contractual data security provisions governing the Palomar relationship.
Quorum remains fully available to provide any additional information or documentation that the Department may require in connection with its review of this matter. We welcome continued dialogue with Mr. Nakamura and the Cybersecurity Unit and stand ready to respond to any further inquiries the Department may have. We respectfully request that the Department consider this supplemental submission, together with Quorum's prior filings, in concluding its review of this matter.
Respectfully submitted,
CALDERWOOD & HARKNESS LLP
By: ________
Kevin Ostrowski, Partner Calderwood & Harkness LLP 1700 K Street NW, Suite 900 Washington, D.C. 20006 Telephone: (202) 555-4800
Email: kostrowski@calderwoodharkness.com
On behalf of Quorum Insurance Holdings Corp.
Date: October 20, 2023
cc:
Thomas R. Whitfield, General Counsel, Quorum Insurance Holdings Corp.
Jennifer Liang, Chief Privacy Officer, Quorum Insurance Holdings Corp.
David Naranjo, Chief Information Security Officer, Quorum Insurance Holdings Corp.
Rachel Bernstein, Partner, Calderwood & Harkness LLP
Enclosures:
Enclosure A: Summary of Palomar MSA Data Security Exhibit (Exhibit D, as Amended) and Key Contractual Provisions
Enclosure B: Quorum Vendor Risk Management Program Overview
Enclosure C: Summary of Post-Incident Remediation Measures (Quorum and Palomar)
Enclosure D: Executed MSA Amendment 3 — Enhanced Data Security and Audit Provisions (October 27, 2023)
Enclosure E: Palomar Settlement Agreement Summary of Key Terms (October 27, 2023)
Cost Category | Vendor/Description | Amount
Forensic Investigation | Graystone Forensics LLC | $1,847,000
Consumer Notification & Credit Monitoring | Clearfield Notification Services LLC | $3,214,500
Crisis Communications | BrightPath Consulting Group | $385,000
Legal Fees | Calderwood & Harkness LLP | $2,163,750
Internal Costs | Quorum internal personnel time and resources | $620,000
Total | $8,230,250

CALDERWOOD & HARKNESS LLP Attorneys at Law

VIA EMAIL AND CERTIFIED MAIL

I. QUORUM'S VENDOR OVERSIGHT AND THIRD-PARTY RISK MANAGEMENT PROGRAM

II. PALOMAR MSA DATA SECURITY AND CONTRACTUAL PROVISIONS

III. INCIDENT SUMMARY AND CONNECTICUT-SPECIFIC IMPACT

IV. POST-INCIDENT REMEDIATION MEASURES

V. CYBER-INSURANCE COVERAGE

VI. CONCLUSION AND COOPERATION

CALDERWOOD & HARKNESS LLP

Record

Parties

Dates

Amounts