EXHIBIT A
Incident Timeline and Remedial Measures Summary
Submitted on behalf of Quorum Insurance Holdings Corp.
Filed in Connection with the Response of Quorum Insurance Holdings Corp. to the Joint Demand Letter of the Multistate Attorney General Coalition Dated September 8, 2023
Date: October 13, 2023
Prepared by:
Calderwood & Harkness LLP 1700 K Street NW, Suite 900 Washington, D.C. 20006
Kevin Ostrowski, Partner, Privacy & Data Security Alan Burke, Associate, Privacy & Data Security
On Behalf of:
Quorum Insurance Holdings Corp. 400 Constitution Plaza, Suite 2200 Hartford, CT 06103
Submitted to:
Assistant Attorney General Diane Marchetti Connecticut Attorney General's Office Consumer Protection Division
Assistant Attorney General Mark Petrosian New York Attorney General's Office Bureau of Internet and Technology
On behalf of the 29-state multistate coalition
Right-click to update Table of Contents
I. Introduction and Purpose
This Exhibit provides a comprehensive chronological account of the data security incident affecting policyholders and claimants of Quorum Insurance Holdings Corp. ("Quorum" or "QIH"), a Delaware corporation publicly traded on the Nasdaq Stock Market under the ticker symbol QIHC and headquartered in Hartford, Connecticut. This Exhibit is submitted in connection with Quorum's response to the Joint Demand Letter issued by the multistate attorney general coalition on September 8, 2023, and is intended to give the coalition a detailed, transparent, and complete account of the relevant facts, circumstances, and remedial actions surrounding the incident.
The incident that is the subject of this Exhibit did not originate within Quorum's own information technology environment. Rather, the unauthorized access and data exfiltration at issue originated at Quorum's third-party claims-processing vendor, Palomar Data Solutions, Inc. ("Palomar"), a Texas corporation headquartered in Dallas, Texas. Palomar provides claims data processing, document management, and analytics services to Quorum pursuant to a Master Services Agreement originally executed on November 12, 2019, and subsequently amended on multiple occasions (as amended, the "MSA"). As further described in Section II below, Palomar is Quorum's second-largest vendor by revenue, with an annual contract value of approximately $16.3 million following Amendment 1 to the MSA, which became effective on April 1, 2021.
This Exhibit is organized into the following three substantive parts, designed to address the informational requests set forth in the Joint Demand Letter:
1. Narrative Chronological Timeline of the Incident. A detailed, phase-by-phase recounting of the events from the initial unauthorized access through the conclusion of all regulatory engagements, including the forensic investigation, notification activities, and vendor accountability process.
2. Summary of Remedial Measures Taken by Quorum. A comprehensive description of the immediate response measures, notification and consumer protection measures, vendor accountability measures, and enhancements to Quorum's information security and vendor risk management program that Quorum has undertaken in connection with the incident.
3. Summary of Vendor Accountability Measures Imposed on Palomar. A detailed account of the contractual analysis, indemnification demand, negotiation, and ultimate settlement with Palomar, including the enhanced security requirements imposed on Palomar through the execution of Amendment 3 to the MSA.
In total, the incident affected 318,247 individuals across 29 states and the District of Columbia. As set forth in detail below, Quorum acted promptly and in good faith at every stage of its response, notified all affected individuals and relevant regulatory authorities within all applicable statutory deadlines, provided affected individuals with 24 months of complimentary credit monitoring and identity theft protection services, pursued vendor accountability to hold Palomar responsible for the breach of its contractual security obligations, and implemented significant remedial and preventative measures to strengthen its information security posture and vendor risk management program.
II. Background — Quorum and the Palomar Vendor Relationship
A. Overview of Quorum Insurance Holdings Corp.
Quorum Insurance Holdings Corp. is a top-25 United States insurance holding company, with operating subsidiaries licensed and conducting business in all 50 states, the District of Columbia, and several U.S. territories. Quorum offers a diversified portfolio of insurance products across its personal lines division, commercial lines division, and specialty insurance division. In addition to its traditional insurance operations, Quorum developed and operates the proprietary digital underwriting platform known as QuorumEdge, which leverages advanced data analytics and machine learning technologies to support risk assessment, pricing, and policy issuance across Quorum's product lines.
For fiscal year 2022, Quorum reported annual revenue of approximately $4.82 billion. The company employs approximately 11,400 individuals across its corporate headquarters in Hartford, Connecticut, and its regional offices throughout the United States. Quorum is publicly traded on the Nasdaq Stock Market under the ticker symbol QIHC.
B. The Palomar Vendor Relationship
Quorum outsources certain claims data processing functions for its personal lines division to Palomar Data Solutions, Inc. Palomar is a specialized data processing and analytics services company that provides claims data processing, document management, and claims analytics services to insurance carriers and other financial services organizations. The vendor relationship between Quorum and Palomar has been governed by the MSA since its original execution.
The key terms and amendments of the MSA are summarized as follows:
Original MSA — Executed November 12, 2019. The MSA was originally executed on November 12, 2019, with a five-year term expiring November 11, 2024. The original agreement established the scope of Palomar's claims data processing services for Quorum's personal lines division, set forth the parties' respective obligations regarding data security and privacy, and included a Data Security Exhibit (Exhibit D) specifying Palomar's minimum security requirements.
Amendment 1 — Executed March 3, 2021. Amendment 1 to the MSA expanded the scope of services to include data processing in connection with Quorum's QuorumEdge digital underwriting platform. This expansion resulted in an increase in the annual contract value by approximately $2.1 million, bringing the total annual contract value to approximately $16.3 million, effective April 1, 2021. Following the execution of Amendment 1, Palomar became Quorum's second-largest vendor by revenue.
Amendment 2 — Executed September 15, 2022. Amendment 2 to the MSA was executed on September 15, 2022, and focused on updating and strengthening the data security provisions of the agreement. Specifically, Amendment 2 updated the Data Security Exhibit (Exhibit D) to reflect evolving industry standards and best practices, added a requirement that Palomar obtain and maintain a SOC 2 Type II audit report, and updated the minimum cyber insurance coverage requirements applicable to Palomar.
C. Palomar's Data Security Obligations Under the MSA
Under Exhibit D to the MSA, as amended by Amendment 2, Palomar was subject to the following key data security obligations relevant to this incident:
(a) Commercially Reasonable Safeguards. Palomar was required to maintain commercially reasonable administrative, technical, and physical safeguards designed to protect the confidentiality, integrity, and availability of Quorum data processed by Palomar, consistent with applicable laws, regulations, and industry standards.
(b) Patch Management. Palomar was required to apply patches for critical vulnerabilities within thirty (30) days of the vendor's release of such patches. This requirement was a core component of Palomar's obligation to maintain the security of its information systems.
(c) Annual Penetration Testing. Palomar was required to conduct annual penetration testing of its systems and to provide Quorum with a summary of findings and remediation plans.
(d) SOC 2 Type II Audit. Palomar was required to obtain and maintain a SOC 2 Type II audit report, covering the Trust Services Criteria relevant to the services provided under the MSA. Palomar's SOC 2 Type II audit was performed by Kessler, Park & Associates CPA, PLLC, an independent auditing firm based in Dallas, Texas.
(e) Incident Notification. Under Section 9.4 of the MSA, Palomar was required to notify Quorum within forty-eight (48) hours of discovering any security incident affecting Quorum data.
D. Quorum's Vendor Risk Management Oversight
Quorum's vendor risk management program, overseen by Priya Deshmukh, Vice President, Vendor Risk Management, conducted periodic assessments of Palomar's security posture throughout the term of the vendor relationship. These assessments included review of Palomar's SOC 2 Type II audit reports, evaluation of Palomar's responses to Quorum's vendor security questionnaires, and monitoring of Palomar's compliance with the security requirements set forth in Exhibit D to the MSA. The vendor risk management program is a component of Quorum's broader enterprise risk management framework and reports to Quorum's Chief Information Security Officer, David Naranjo.
III. Detailed Chronological Timeline of the Incident
The following narrative timeline sets forth, in chronological order, the key events associated with the data security incident, from the initial unauthorized access through the conclusion of all regulatory engagements. The timeline is organized into eleven phases for clarity of presentation.
Phase 1: Unauthorized Access and Data Exfiltration (March 14 – April 18, 2023)
On or about March 14, 2023, a threat actor exploited a known remote code execution vulnerability — identified as CVE-2023-0669 — in Palomar's GoAnywhere MFT (Managed File Transfer) appliance, thereby gaining initial unauthorized access to Palomar's network environment. GoAnywhere MFT is a widely used enterprise-grade file transfer solution, and CVE-2023-0669 was a publicly disclosed vulnerability that had been the subject of a security advisory issued by the vendor. A patch addressing CVE-2023-0669 was made available by the vendor prior to the date of exploitation.
Significantly, Palomar's obligations under Exhibit D to the MSA, as amended by Amendment 2, required Palomar to apply patches for critical vulnerabilities within thirty (30) days of the vendor's release of such patches. Despite the availability of the patch and the contractual obligation to apply it within the specified timeframe, Palomar had not applied the patch to its GoAnywhere MFT appliance as of the date of exploitation. This failure to timely patch the known critical vulnerability was the direct cause of the threat actor's ability to gain initial unauthorized access to Palomar's network environment.
From approximately March 14, 2023 through approximately April 18, 2023 — a period of approximately thirty-five (35) days — the threat actor conducted lateral movement within Palomar's network, identified and staged structured data files within Palomar's claims processing environment that contained Quorum policyholder and claimant data, and exfiltrated these data files over the approximately 35-day exfiltration window. The forensic investigation subsequently confirmed that the threat actor's activity within Palomar's environment was deliberate and methodical, involving the identification, staging, and transfer of specific data sets associated with Quorum's personal lines claims processing operations.
The exfiltrated data included files containing personally identifiable information ("PII"), financial information, and protected health information ("PHI") of Quorum policyholders and claimants, as further detailed in Phase 5 below in connection with the forensic investigation findings.
Phase 2: Discovery by Palomar (April 18, 2023)
On April 18, 2023, Palomar's Security Operations Center ("SOC") detected unusual outbound data transfers from its network. Upon identifying the anomalous activity, Palomar's SOC initiated an internal investigation to determine the nature, scope, and source of the unauthorized data transfers. This date — April 18, 2023 — marks both the end of the exfiltration window and Palomar's discovery of the security incident.
It bears noting that the approximately 35-day period between the initial unauthorized access on or about March 14, 2023 and Palomar's detection on April 18, 2023 represents a significant gap in Palomar's security monitoring capabilities. During this period, the threat actor was able to operate within Palomar's network without detection, underscoring deficiencies in Palomar's endpoint detection and response capabilities and network monitoring infrastructure that existed at the time of the incident.
Phase 3: Notification from Palomar to Quorum (April 21, 2023)
On April 21, 2023, Palomar notified Quorum of the security incident. Notification was provided via email from Derek Copeland, General Counsel of Palomar, to Thomas R. Whitfield, General Counsel of Quorum, and David Naranjo, Chief Information Security Officer of Quorum. This notification occurred three (3) calendar days after Palomar's internal discovery of the incident on April 18, 2023.
Under Section 9.4 of the MSA, Palomar was contractually required to notify Quorum within forty-eight (48) hours of discovering a security incident affecting Quorum data. Palomar's notification on April 21, 2023 — approximately seventy-two (72) hours after discovery — was approximately twenty-four (24) hours past the contractual deadline established in Section 9.4. This delay in notification constituted a breach of Palomar's contractual obligations under the MSA.
Palomar's initial notification to Quorum provided limited details regarding the nature and scope of the compromise. Specifically, Palomar's notification indicated that anomalous outbound data transfers had been detected and that an internal investigation had been initiated, but did not identify the specific data sets or Quorum records that may have been affected, nor did it describe the attack vector or the duration of the unauthorized access.
Phase 4: Quorum's Immediate Response and Engagement of Advisors (May 4 – May 8, 2023)
Upon receipt of Palomar's notification, Quorum promptly initiated its incident response activities. The following actions were taken over the period from May 4, 2023 through May 8, 2023:
May 4, 2023 — Engagement of Outside Counsel. Quorum engaged Calderwood & Harkness LLP (Matter No. 1025-00006) to serve as outside counsel for purposes of incident response coordination, oversight of the forensic investigation, notification compliance analysis, and regulatory defense. The Calderwood & Harkness engagement team was comprised of Kevin Ostrowski (Responsible Partner), Rachel Bernstein (Billing Partner), Alan Burke (Lead Associate), and Sara Hendricks (Working Associate), all members of the firm's Privacy & Data Security practice.
Concurrent with the engagement of outside counsel, Quorum activated its internal incident response team, which was comprised of the following senior leaders:
• Thomas R. Whitfield, General Counsel
• David Naranjo, Chief Information Security Officer
• Jennifer Liang, Chief Privacy Officer
• Priya Deshmukh, Vice President, Vendor Risk Management
• Robert Wentworth, Senior Vice President, Claims Operations
This cross-functional team assumed responsibility for coordinating Quorum's internal response activities, interfacing with outside counsel and forensic investigators, and ensuring continuity of claims processing operations during the investigation.
May 5, 2023 — Retention of Forensic Investigator. Calderwood & Harkness retained Graystone Forensics LLC, a digital forensics and incident response firm headquartered in Tysons Corner, Virginia, to conduct the technical forensic investigation of the incident. Graystone Forensics was retained under the direction of counsel and under the protection of the attorney-client privilege and work product doctrine. The Graystone Forensics engagement was led by Dr. Nolan Briggs, Managing Director, Incident Response, and Kendra Faulkner, Senior Forensic Analyst. Graystone Forensics is a nationally recognized incident response firm with extensive experience in the investigation of data security incidents involving financial services and insurance industry clients.
May 6, 2023 — Issuance of Legal Hold. Calderwood & Harkness issued a legal hold notice to Quorum's Information Technology and Claims Operations departments, directing the preservation of all documents, communications, electronic records, system logs, and other materials related to the incident, the vendor relationship with Palomar, and Quorum's incident response activities. The legal hold was designed to ensure that all potentially relevant evidence was preserved in anticipation of potential regulatory inquiries, litigation, and other proceedings.
May 7, 2023 — Finalization of Forensic Investigation Plan. The scope of work and investigation plan for Graystone Forensics was finalized by Calderwood & Harkness in coordination with Quorum's internal incident response team. The investigation plan defined the following key objectives for the forensic analysis:
(a) Identification and confirmation of the threat actor's entry vector into Palomar's network environment;
(b) Determination of the timeline of unauthorized access, including the dates of initial access, lateral movement, data staging, and data exfiltration;
(c) Identification of the specific data sets and files exfiltrated from Palomar's claims processing environment; and
(d) Assessment of the types of personal information, financial information, and protected health information compromised in the exfiltration.
May 8, 2023 — Cyber-Insurance Claim and Communications Strategy. Quorum filed a cyber-insurance claim with Atlas Mutual Insurance Company under its primary cyber-insurance policy (Policy No. CYB-2023-041587, Claim No. CYB-CLM-2023-05892). The primary policy provided a per-occurrence limit of $15 million and carried a $2.5 million self-insured retention. In addition, Quorum provided precautionary notice of the incident to Pinnacle Surplus Lines Insurance Corp. under Quorum's excess cyber-insurance policy (Policy No. XS-CYB-2023-7812), which provided a $25 million excess layer above the primary policy limit.
Also on May 8, 2023, Quorum retained BrightPath Consulting Group Inc. to assist with external and internal communications strategy in connection with the incident. The BrightPath engagement was led by Meredith Ashford, Managing Director, and encompassed media relations strategy, employee communications, policyholder communications planning, and coordination with Quorum's investor relations function.
Phase 5: Forensic Investigation (May 5 – July 14, 2023)
The forensic investigation conducted by Graystone Forensics, under the direction of Calderwood & Harkness, proceeded in two principal stages: an initial forensic analysis phase and a comprehensive data mining and analysis phase.
May 5 – June 2, 2023 — Initial Forensic Analysis. During this period, Graystone Forensics conducted its initial forensic analysis, which included examination of Palomar's network logs, GoAnywhere MFT file transfer appliance logs, endpoint artifacts from affected systems within Palomar's environment, and indicators of data staging and exfiltration activity. Graystone Forensics coordinated with Palomar's internal IT security team to obtain access to the necessary log data, system images, and other forensic evidence required for the analysis.
June 2, 2023 — Preliminary Forensic Findings Report. Graystone Forensics delivered its Preliminary Forensic Findings Report to Calderwood & Harkness. This report, which was prepared at the direction of counsel and is protected by the attorney-client privilege and work product doctrine, confirmed the following preliminary findings:
(a) Initial Access Vector. The threat actor exploited CVE-2023-0669, a known remote code execution vulnerability in Palomar's GoAnywhere MFT appliance, to gain initial unauthorized access to Palomar's network environment on or about March 14, 2023.
(b) Lateral Movement and Dwell Time. Following initial access, the threat actor conducted lateral movement through Palomar's network over the period from approximately March 14 through April 18, 2023, a total dwell time of approximately 35 days.
(c) Data Staging and Exfiltration. The threat actor identified, staged, and exfiltrated structured data files from Palomar's claims processing environment that contained Quorum policyholder and claimant data, including files containing PII, financial information, and PHI.
June 2 – July 14, 2023 — Comprehensive Data Mining and Analysis. Following delivery of the preliminary findings, Graystone Forensics conducted comprehensive data mining and analysis to identify the full scope and nature of the compromised data. This phase involved the analysis of the specific data files identified as having been exfiltrated, the extraction and categorization of individual records within those files, and the determination of the specific data elements compromised for each affected individual.
July 14, 2023 — Final Forensic Report. Graystone Forensics delivered its Final Forensic Report to Calderwood & Harkness. This report, also prepared at the direction of counsel and protected by the attorney-client privilege and work product doctrine, confirmed the complete scope of compromised data as follows:
Total affected individuals: 318,247 across 29 states and the District of Columbia.
The categories of compromised data were as follows:
As reflected in the table above, all 318,247 affected individuals had PII compromised, including names, dates of birth, Social Security numbers, and driver's license numbers. A subset of 84,619 individuals also had financial information compromised, including bank account numbers and/or payment card numbers. A further subset of 41,203 individuals had PHI compromised, consisting of health conditions, diagnosis codes, and treatment information derived from workers' compensation and health-related insurance claims processed through Palomar's platform.
Phase 6: Affected Individual Identification and Data Mining (July 14 – August 4, 2023)
July 14 – August 4, 2023. Following finalization of the forensic report, Calderwood & Harkness coordinated the data mining process to identify the specific affected individuals, match records to current mailing addresses using National Change of Address ("NCOA") processing, and categorize individuals by the types of data compromised and state of residence. This process was essential to ensuring that each affected individual received a notification letter tailored to the specific data elements compromised in their case and that notifications complied with the breach notification requirements of the individual's state of residence.
August 4, 2023. The data mining and affected individual identification process was completed. The state-by-state breakdown of affected residents is set forth below:
Phase 7: Regulatory Notifications (August 14 – August 25, 2023)
Prior to issuing any regulatory notifications, Calderwood & Harkness conducted a comprehensive 50-state breach notification law analysis and notification trigger analysis to determine Quorum's notification obligations in each affected jurisdiction. This analysis took into account the specific data elements compromised, the residency of affected individuals, the applicable statutory definitions of "personal information" and "breach of the security of the system" in each jurisdiction, and the specific notice requirements and timelines mandated by each state's breach notification statute. Based on this analysis, notification obligations were confirmed in all 29 affected states and the District of Columbia. In addition, notification obligations were confirmed under the Health Insurance Portability and Accountability Act ("HIPAA") with respect to the subset of 41,203 individuals whose PHI was compromised.
Regulatory notifications were filed as follows:
August 14, 2023:
• Connecticut Attorney General — Notification filed pursuant to Conn. Gen. Stat. § 36a-701b, reporting 52,114 affected Connecticut residents. This notification was filed within the applicable statutory timeline and was timely.
• Connecticut Insurance Department — Notification filed pursuant to Conn. Gen. Stat. § 38a-999b (the Connecticut Insurance Data Security Law), providing notice of the data security incident as required for regulated insurance entities. This notification was filed within the applicable statutory timeline and was timely.
August 15, 2023:
• HHS Office for Civil Rights (Region I, Boston) — Notification filed pursuant to 45 C.F.R. § 164.408, reporting a breach of unsecured PHI affecting 41,203 individuals. Because the breach affected more than 500 individuals, notification to the Secretary of Health and Human Services was required without unreasonable delay and no later than 60 days following discovery of the breach. This notification was timely.
• Media Notice — Media notice distributed pursuant to 45 C.F.R. § 164.406, as required for breaches of unsecured PHI affecting more than 500 individuals in a single state or jurisdiction. Media notice was distributed to prominent media outlets serving the relevant geographic areas.
August 16, 2023:
• New York Attorney General — Notification filed pursuant to N.Y. Gen. Bus. Law § 899-aa, reporting 47,831 affected New York residents. This notification was timely.
• California Attorney General — Notification filed pursuant to Cal. Civ. Code § 1798.82, reporting 38,206 affected California residents. Because the breach affected more than 500 California residents, notification to the California Attorney General was required. This notification was timely.
August 17, 2023:
• Massachusetts Attorney General and Department of Consumer Affairs and Business Regulation — Notification filed pursuant to Mass. Gen. Laws ch. 93H, § 3, reporting 10,217 affected Massachusetts residents. This notification was timely.
August 17 – 25, 2023:
• Remaining State Notifications — Notifications were filed with the applicable regulatory authorities in the remaining 24 affected states, pursuant to the breach notification statutes of each respective jurisdiction. All such notifications were filed within the applicable statutory timelines and were timely.
Quorum confirms that all regulatory notifications met the applicable statutory deadlines in every affected jurisdiction.
Phase 8: Consumer Notifications (August 6 – September 15, 2023)
August 6, 2023 — Engagement of Notification Vendor. Quorum, through Calderwood & Harkness, executed a statement of work with Clearfield Notification Services LLC for notification mailing services, call center operations, and credit monitoring and identity theft protection enrollment services. The Clearfield engagement was managed by Jerome Tillman, Account Manager. The total contract value with Clearfield was $3,214,500, broken down as follows:
Notification Letter Versions. To ensure compliance with the varying requirements of applicable state breach notification statutes and to provide each affected individual with information specific to the data elements compromised in their case, multiple versions of the notification letter were prepared, reviewed, and approved. These versions included:
(a) General PII Version — For individuals whose compromised data included Social Security numbers, dates of birth, and/or driver's license numbers, but not financial information or PHI.
(b) SSN Plus Financial Data Version — For the subset of 84,619 individuals whose compromised data included bank account numbers and/or payment card numbers, in addition to PII.
(c) PHI Version — A HIPAA-compliant notification letter for the subset of 41,203 individuals whose compromised data included protected health information, incorporating the content elements required by 45 C.F.R. § 164.404(c).
(d) California-Specific Version — A notification letter tailored to comply with the specific content and formatting requirements of Cal. Civ. Code § 1798.82 and the California Confidentiality of Medical Information Act ("CMIA"), where applicable.
(e) Massachusetts-Specific Version — A notification letter tailored to comply with the specific content and formatting requirements of Mass. Gen. Laws ch. 93H and the Massachusetts data security regulation, 201 CMR 17.00.
All notification letters, regardless of version, included the following core elements:
• A clear and concise description of the incident, including a general description of what occurred and the relevant dates;
• A description of the types of personal information compromised for the individual recipient;
• A description of the steps Quorum had taken and was continuing to take in response to the incident;
• An offer of twenty-four (24) months of complimentary credit monitoring and identity theft protection services through a nationally recognized provider, along with enrollment instructions and an activation code; and
• A toll-free call center number staffed by trained representatives to answer questions and assist affected individuals.
August 18, 2023 — Commencement of Consumer Notification Mailing. Consumer notification letters were dispatched on a rolling basis beginning on August 18, 2023. The mailing was managed and executed by Clearfield Notification Services LLC using first-class United States mail.
September 15, 2023 — Completion of Consumer Notification Mailing. The notification mailing was completed on September 15, 2023, at which point all 318,247 affected individuals had been sent individual written notification. The total mailing window spanned approximately twenty-eight (28) days.
In addition to individual written notification, substitute notice was posted on Quorum's corporate website, providing a description of the incident, the steps Quorum was taking, and instructions for affected individuals to enroll in credit monitoring services. The dedicated toll-free call center, operated by Clearfield Notification Services LLC, was staffed and operational for a twelve (12)-week period following the commencement of the notification mailing to assist affected individuals with questions and credit monitoring enrollment.
As of the date of this Exhibit, the estimated credit monitoring enrollment take-rate was approximately 40%, representing approximately 127,299 enrollees out of the total 318,247 affected individuals.
Phase 9: Multistate Attorney General Engagement (September 8 – November 22, 2023)
September 8, 2023 — Receipt of Joint Demand Letter. Quorum received a joint demand letter from the Connecticut Attorney General, through Assistant Attorney General Diane Marchetti of the Consumer Protection Division, and the New York Attorney General, through Assistant Attorney General Mark Petrosian of the Bureau of Internet and Technology, acting on behalf of a 29-state multistate attorney general coalition. The joint demand letter requested detailed information regarding the circumstances of the incident, Quorum's investigation and response activities, the scope of affected individuals, the notification measures taken, and the remedial measures implemented by Quorum.
The participating states in the multistate coalition are as follows: Connecticut, New York, Massachusetts, California, Illinois, Pennsylvania, New Jersey, Ohio, Texas, Florida, Georgia, Virginia, Maryland, North Carolina, South Carolina, Michigan, Minnesota, Indiana, Wisconsin, Colorado, Arizona, Oregon, Washington, Tennessee, Missouri, Louisiana, Nevada, Iowa, and New Hampshire.
October 13, 2023 — Submission of Quorum's Response. Calderwood & Harkness submitted a comprehensive written response on behalf of Quorum, addressing all items set forth in the joint demand letter. The response was accompanied by Exhibits A through D, providing detailed supporting documentation. This Exhibit constitutes Exhibit A to that response.
November 3, 2023 — Submission of Supplemental Information. Calderwood & Harkness submitted supplemental information to the multistate attorney general coalition, including updated credit monitoring enrollment statistics, an updated cost summary, and a summary of the settlement agreement reached with Palomar Data Solutions, Inc. (described in Phase 11 below).
November 22, 2023 — Closure of Multistate Inquiry. The multistate attorney general coalition issued a closure letter confirming that, based on its review of Quorum's response and supplemental submissions, and in light of the remedial measures and vendor accountability steps taken by Quorum, the coalition had determined that no enforcement action would be taken against Quorum in connection with the incident. The closure letter acknowledged Quorum's cooperation and the comprehensiveness of its response.
Phase 10: Other Regulatory Engagements (September – November 2023)
Connecticut Insurance Department
Following Quorum's notification filing with the Connecticut Insurance Department on August 14, 2023, the Department opened a formal inquiry into the incident. The inquiry was assigned to Richard Nakamura of the Department's Financial Analysis Division, Cybersecurity Unit.
On September 22, 2023, Quorum submitted a formal inquiry response to the Connecticut Insurance Department through Calderwood & Harkness, addressing the Department's questions regarding the incident timeline, the nature of the compromised data, Quorum's vendor oversight practices, and the remedial steps taken.
On October 20, 2023, Quorum submitted supplemental information to the Department, providing additional detail regarding Quorum's vendor risk management program, its oversight of Palomar, and the post-incident remediation measures being implemented.
On November 28, 2023, the Connecticut Insurance Department closed its inquiry without taking any enforcement action or imposing any penalties.
HHS Office for Civil Rights
Following Quorum's HIPAA breach notification to the HHS Office for Civil Rights on August 15, 2023, HHS-OCR issued a follow-up inquiry requesting additional information regarding the incident, Quorum's HIPAA compliance program, and the specific circumstances of the PHI breach.
On October 5, 2023, Quorum submitted a formal inquiry response to HHS-OCR through Calderwood & Harkness, providing detailed information responsive to the inquiry, including a description of Quorum's HIPAA Privacy and Security Rule compliance program, the specific PHI data elements compromised, the notification measures taken, and the remedial steps implemented.
On November 30, 2023, HHS-OCR issued a no further action letter, concluding its review of the matter without imposing any corrective action plan, resolution agreement, or civil monetary penalty.
Phase 11: Vendor Accountability — Palomar Data Solutions (May – October 2023)
From the outset of Quorum's incident response, Quorum pursued vendor accountability measures against Palomar to hold Palomar responsible for the security failures that gave rise to the incident and to recover the costs incurred by Quorum as a result. The following sets forth the chronology of Quorum's vendor accountability efforts.
May 12, 2023 — Contractual Analysis. Calderwood & Harkness completed a comprehensive contractual analysis of Palomar's obligations under the MSA, identifying the following material breaches by Palomar:
(a) Failure to Timely Patch Critical Vulnerability. Palomar failed to apply the patch for CVE-2023-0669 within the thirty (30)-day timeframe required by Exhibit D to the MSA, as amended by Amendment 2. This failure was the direct cause of the threat actor's ability to gain initial unauthorized access to Palomar's network environment.
(b) Late Notification to Quorum. Palomar's notification to Quorum on April 21, 2023 — approximately seventy-two (72) hours after discovery — exceeded the forty-eight (48)-hour notification deadline established in Section 9.4 of the MSA by approximately twenty-four (24) hours.
June 20, 2023 — Formal Indemnification Demand. Calderwood & Harkness sent a formal breach of contract and indemnification demand letter to Catherine Langford at Mercer, Haight & Dunlop LLP, Palomar's outside counsel. The demand letter detailed Palomar's contractual breaches, asserted Quorum's right to full indemnification under Section 12.2 of the MSA, and demanded reimbursement of $8,230,250 in total incident response costs incurred by Quorum as a result of the incident. The demand letter noted that the indemnification cap under Section 12.2 of the MSA was $32,600,000, calculated as two times (2×) the trailing twelve-month fees paid to Palomar ($16.3 million × 2), and that Quorum's demand was well within this cap.
July 7, 2023 — Palomar's Response. Palomar's outside counsel at Mercer, Haight & Dunlop responded to Calderwood & Harkness's demand letter, disputing causation and the scope of Palomar's liability. Palomar's position was that the attack was perpetrated by a sophisticated threat actor and that the exploitation of CVE-2023-0669 alone did not establish that Palomar's patch management practices were the proximate cause of the full scope of the data exfiltration. Palomar's response offered a $1,500,000 "goodwill credit" against future fees as a resolution of the matter, without any admission of liability.
July 25, 2023 — Quorum's Rebuttal. Calderwood & Harkness sent a rebuttal letter rejecting Palomar's causation defenses and characterizing the $1,500,000 goodwill offer as manifestly inadequate. The rebuttal letter detailed the undisputed facts establishing Palomar's liability — specifically, the known vulnerability, the available patch, the express contractual obligation to patch within 30 days, and the direct causal link between the unpatched vulnerability and the threat actor's initial access — and reiterated Quorum's demand for full indemnification of its incident response costs.
August – October 2023 — Settlement Negotiations. Over the following months, Calderwood & Harkness and Mercer, Haight & Dunlop conducted extensive negotiations on behalf of their respective clients, including multiple rounds of written proposals and counterproposals, telephonic negotiations, and an in-person negotiation session. The negotiations addressed both the monetary recovery sought by Quorum and the forward-looking security enhancements that Quorum required as a condition of continuing the vendor relationship.
October 27, 2023 — Settlement Agreement and Mutual Release. The parties executed a Settlement Agreement and Mutual Release, the key terms of which are as follows:
(a) Cash Payment. Palomar agreed to pay Quorum a cash settlement in the amount of $4,200,000, payable within thirty (30) days of execution of the agreement.
(b) Fee Reduction. Palomar agreed to a reduction in fees of eight percent (8%) for a period of eighteen (18) months, effective November 1, 2023. Based on the annual contract value of $16.3 million, this fee reduction represents approximately $1,956,000 in savings to Quorum over the 18-month period ($16,300,000 × 8% × 1.5 years = $1,956,000).
(c) Independent Security Assessment. Palomar agreed to engage, at Palomar's sole expense, an independent third-party security assessor to conduct enhanced annual security audits of Palomar's information security program, with findings and remediation plans to be shared with Quorum.
(d) Enhanced Security Capabilities. Palomar agreed to implement enhanced patch management procedures and deploy endpoint detection and response ("EDR") capabilities across its network environment within ninety (90) days of execution of the agreement.
(e) Mutual Release. The parties exchanged mutual releases of all claims, demands, actions, and causes of action arising out of or related to the data security incident.
The total effective recovery by Quorum under the settlement was $6,156,000, comprised of the $4,200,000 cash payment and $1,956,000 in fee reductions over the 18-month period.
October 27, 2023 — Execution of MSA Amendment 3. Simultaneously with the execution of the settlement agreement, the parties executed Amendment 3 to the MSA, which amended Exhibit D (the Data Security Exhibit) to impose significantly enhanced security requirements on Palomar. The key amendments included:
(a) Accelerated Patch Management Timeline. The timeframe for Palomar to apply patches for critical vulnerabilities was reduced from thirty (30) days to fourteen (14) days following the vendor's release of such patches.
(b) Mandatory Endpoint Detection and Response. Palomar was required to deploy and maintain endpoint detection and response capabilities across all systems involved in processing Quorum data.
(c) Quarterly Vulnerability Scanning. Palomar was required to conduct quarterly vulnerability scans of its systems and provide summary reports of findings and remediation activities to Quorum.
(d) Annual Independent Security Assessment. Palomar was required to undergo an annual independent security assessment conducted by a qualified third-party assessor, at Palomar's sole expense, with results provided to Quorum.
(e) Enhanced Incident Notification Timeline. The incident notification deadline in Section 9.4 of the MSA was reduced from forty-eight (48) hours to twenty-four (24) hours following Palomar's discovery of a security incident affecting Quorum data.
IV. Summary of Remedial Measures Taken by Quorum
The following is a consolidated summary of the remedial measures taken by Quorum in connection with the incident, organized by category.
A. Immediate Response Measures
Quorum took the following immediate response measures upon learning of the incident:
1. Activation of Incident Response Plan and Internal Team. Quorum activated its enterprise incident response plan and convened its internal incident response team, comprised of senior leadership from the Legal, Information Security, Privacy, Vendor Risk Management, and Claims Operations functions, effective May 4, 2023.
2. Engagement of Experienced Outside Counsel. Quorum promptly engaged Calderwood & Harkness LLP, a nationally recognized law firm with deep expertise in privacy, data security, and incident response, to serve as outside counsel for all aspects of the incident response, including forensic investigation oversight, notification compliance analysis, regulatory defense, and vendor accountability.
3. Retention of Privileged Forensic Investigator. Through outside counsel, Quorum retained Graystone Forensics LLC, a leading digital forensics and incident response firm, to conduct the technical forensic investigation under the protection of the attorney-client privilege and work product doctrine.
4. Issuance of Legal Hold. Calderwood & Harkness issued a comprehensive legal hold notice to all relevant Quorum departments, directing the preservation of all documents, communications, and electronic records related to the incident, the Palomar vendor relationship, and Quorum's response activities.
5. Filing of Cyber-Insurance Claim. Quorum promptly filed a cyber-insurance claim with Atlas Mutual Insurance Company under its primary cyber-insurance policy and provided precautionary notice to its excess carrier, Pinnacle Surplus Lines Insurance Corp.
6. Engagement of Crisis Communications Firm. Quorum retained BrightPath Consulting Group Inc. to develop and execute an external and internal communications strategy, ensuring that policyholders, employees, media, and investors received accurate and timely information.
B. Notification and Consumer Protection Measures
Quorum implemented the following notification and consumer protection measures:
1. Timely Regulatory Notifications. Quorum filed regulatory notifications with the attorneys general and/or other designated regulatory authorities in all 29 affected states and the District of Columbia, with the Connecticut Insurance Department, and with the HHS Office for Civil Rights. All filings met applicable statutory deadlines.
2. Individual Written Notification. Quorum sent individual written notification letters to all 318,247 affected individuals, with tailored notification letter versions based on the types of data compromised and the state-specific notification requirements applicable to each individual recipient.
3. Complimentary Credit Monitoring and Identity Theft Protection. Quorum offered all 318,247 affected individuals twenty-four (24) months of complimentary credit monitoring and identity theft protection services through a nationally recognized provider. Enrollment instructions and activation codes were included in each notification letter.
4. Dedicated Toll-Free Call Center. Quorum established a dedicated toll-free call center, operated by Clearfield Notification Services LLC and staffed by trained representatives, for a twelve (12)-week period to assist affected individuals with questions, concerns, and enrollment in credit monitoring services.
5. Substitute Notice. Substitute notice was posted on Quorum's corporate website, providing a description of the incident, the steps being taken by Quorum, and instructions for affected individuals.
C. Vendor Accountability Measures
Quorum pursued the following vendor accountability measures against Palomar:
1. Formal Contractual Demand for Indemnification. Through Calderwood & Harkness, Quorum issued a formal breach of contract and indemnification demand to Palomar's outside counsel, demanding reimbursement of the full $8,230,250 in incident response costs under Section 12.2 of the MSA.
2. Negotiated Settlement. Following extensive negotiations, Quorum secured a settlement agreement providing for total effective recovery of $6,156,000, comprised of a $4,200,000 cash payment from Palomar and $1,956,000 in fee reductions over an 18-month period.
3. Enhanced Contractual Security Requirements. Quorum required, as a condition of continuing the vendor relationship, the execution of Amendment 3 to the MSA, which imposed significantly enhanced security requirements on Palomar. These enhanced requirements include:
• Reduction of the critical vulnerability patching timeline from 30 days to 14 days;
• Mandatory deployment and maintenance of endpoint detection and response capabilities;
• Quarterly vulnerability scanning with summary reports provided to Quorum;
• Annual independent third-party security assessments, conducted at Palomar's sole expense, with results shared with Quorum; and
• Reduction of the breach notification timeline from 48 hours to 24 hours.
D. Enhancements to Quorum's Information Security and Vendor Risk Management Program
In addition to the vendor-specific measures described above, Quorum has undertaken the following enhancements to its broader information security and vendor risk management program:
1. Enhancement of Vendor Risk Management Program. Under the leadership of Priya Deshmukh, Vice President, Vendor Risk Management, Quorum has reviewed and enhanced its vendor risk management program, including the implementation of enhanced due diligence requirements for all vendors that process sensitive personal information, increased frequency of vendor security assessments (moving from annual to semi-annual assessments for critical and high-risk vendors), and strengthened contractual security requirements and data protection provisions in vendor agreements.
2. Update of Enterprise Incident Response Plan. Quorum has reviewed and updated its enterprise incident response plan to incorporate lessons learned from this incident, including refined escalation procedures, updated communications protocols, and enhanced vendor-incident coordination procedures.
3. Enhanced Monitoring of Third-Party Data Processing. Quorum has implemented enhanced monitoring and oversight of third-party data processing activities, including expanded logging and alerting capabilities and more frequent review of vendor security reports and certifications.
4. Internal Training and Awareness. Quorum has enhanced its internal training and awareness programs for relevant personnel, including members of the IT Security, Claims Operations, Privacy, and Vendor Risk Management teams, focusing on vendor security oversight, incident identification and escalation, and evolving cybersecurity threats.
V. Summary of Total Incident Response Costs
The following table summarizes the total incident response costs incurred by Quorum in connection with the incident:
Cyber-Insurance Recovery. Quorum's primary cyber-insurance policy with Atlas Mutual Insurance Company (Policy No. CYB-2023-041587) carried a $2,500,000 self-insured retention, which was borne by Quorum. The remaining $5,730,250 of the total incident response costs was covered by the Atlas Mutual primary policy, which provided a $15,000,000 per-occurrence limit. The claim did not reach the excess layer provided by Pinnacle Surplus Lines Insurance Corp.
Vendor Recovery. As described in Phase 11 of the timeline above, Quorum secured total effective recovery of $6,156,000 from Palomar under the settlement agreement, comprised of a $4,200,000 cash payment and $1,956,000 in fee reductions over an 18-month period.