EXHIBIT D
Quorum Insurance Holdings Corp. Information Security Program Overview
October 13, 2023
Filed as Exhibit D to the Written Response of Quorum Insurance Holdings Corp. to the Joint Demand Letter of the Multistate Attorney General Coalition dated September 8, 2023.
Prepared by: Calderwood & Harkness LLP 1700 K Street NW, Suite 900 Washington, D.C. 20006 On behalf of Quorum Insurance Holdings Corp. 400 Constitution Plaza, Suite 2200 Hartford, CT 06103
Submitted to: Assistant Attorney General Diane Marchetti Connecticut Attorney General's Office, Consumer Protection Division
Assistant Attorney General Mark Petrosian New York Attorney General's Office, Bureau of Internet and Technology
On behalf of the 29-state Multistate Attorney General Coalition
PRIVILEGED AND CONFIDENTIAL Submitted in Response to Regulatory Inquiry; Not a Waiver of Privilege
Calderwood & Harkness Matter No. 1025-00006
Right-click to update Table of Contents
I. Introduction and Purpose
The purpose of this Exhibit D is to provide the Multistate Attorney General Coalition (the "Coalition") with a comprehensive overview of the information security program maintained by Quorum Insurance Holdings Corp. ("Quorum" or the "Company"). This overview addresses the governance framework, technical and administrative safeguards, vendor risk management practices, incident response capabilities, employee training and awareness initiatives, regulatory compliance posture, and post-incident enhancements that collectively constitute Quorum's enterprise information security program. Quorum submits this Exhibit in direct response to the Coalition's Joint Demand Letter dated September 8, 2023, which requested, among other things, detailed information regarding the security measures Quorum had in place at the time of the data breach incident at issue and the remedial steps undertaken thereafter.
Quorum Insurance Holdings Corp. is a Delaware corporation publicly traded on the Nasdaq Stock Market under the ticker symbol QIHC. The Company is headquartered at 400 Constitution Plaza, Suite 2200, Hartford, Connecticut 06103. Quorum is a top-25 United States insurance holding company with operating subsidiaries licensed and conducting business in all fifty states, the District of Columbia, and several United States territories. The Company's diversified product portfolio encompasses personal lines insurance (homeowners, automobile, and umbrella), commercial lines insurance (general liability, commercial property, commercial auto, and workers' compensation), specialty insurance (excess and surplus lines, professional liability, and directors and officers liability), and life and annuity products. In addition, Quorum operates QuorumEdge, a proprietary digital underwriting platform that leverages advanced analytics and machine learning to streamline policy issuance and risk selection across its personal and commercial lines of business.
For fiscal year 2022, Quorum reported annual revenue of approximately $4.82 billion. As of the date of this submission, the Company employs approximately 11,400 individuals across its corporate headquarters, regional offices, claims centers, and technology operations. Quorum's market capitalization is approximately $6.1 billion.
Quorum takes its data protection obligations with the utmost seriousness. As a steward of sensitive policyholder and claimant data — including personally identifiable information ("PII"), protected health information ("PHI"), and financial account data — the Company has invested significantly in building and maintaining a robust, multi-layered information security program that is commensurate with Quorum's size, complexity, the nature of its operations, and the sensitivity of the data it processes. These investments span organizational governance, workforce development, technology infrastructure, vendor oversight, and incident preparedness, as detailed in the sections that follow.
Quorum wishes to clarify at the outset a critical factual point: the data breach that is the subject of the Coalition's inquiry did not originate within Quorum's own systems or network environment. Rather, the breach originated at Palomar Data Solutions, Inc. ("Palomar"), a third-party claims-processing vendor retained by Quorum to process personal lines claims data. The compromise of Palomar's environment was the result of a threat actor's exploitation of CVE-2023-0669, a critical remote code execution vulnerability in Palomar's GoAnywhere MFT file transfer appliance, a product of Severin Corporation (formerly Strathmore Industries). This vulnerability, which was publicly disclosed by Severin Corporation in early February 2023, was exploited by the threat actor before Palomar applied the vendor-issued patch — in contravention of Palomar's contractual obligation to Quorum to remediate critical vulnerabilities within thirty (30) days of vendor patch release. Although the breach occurred within Palomar's environment, Quorum recognizes its responsibilities as the data controller for the affected policyholder and claimant information, and the Company acted swiftly and decisively to investigate, contain, notify, and remediate, as documented in this Response and its accompanying Exhibits.
II. Information Security Governance Structure
Quorum's information security program operates within a governance framework designed to ensure that cybersecurity risk receives appropriate attention at the highest levels of the organization, that accountability is clearly defined, and that information flows effectively between technical practitioners, executive leadership, and the Board of Directors. The governance structure described below reflects Quorum's longstanding commitment to treating cybersecurity risk as a strategic enterprise priority rather than a purely technical concern.
A. Board-Level Oversight
Quorum's Board of Directors exercises oversight of cybersecurity risk principally through its Audit Committee. The Audit Committee is chaired by Franklin Reeves, an independent director with extensive experience in financial services risk management. The Audit Committee's charter expressly includes responsibility for overseeing the Company's enterprise risk management framework, which encompasses cybersecurity and data protection risk.
In the ordinary course of business, the Audit Committee receives periodic briefings from the Chief Information Security Officer ("CISO") and other members of senior management on the Company's cybersecurity posture, the evolving threat landscape, the status of key security initiatives, incident response readiness, and material cybersecurity events. These briefings typically occur on a quarterly basis and are supplemented by ad hoc presentations when circumstances warrant.
In connection with the Palomar data breach incident that is the subject of this Response, the Audit Committee received dedicated, in-depth briefings on the following dates:
• May 11, 2023: Initial briefing following Quorum's activation of its Incident Response Plan, covering the nature of the compromise at Palomar, preliminary scope assessment, engagement of outside counsel and forensic investigators, and anticipated next steps.
• July 21, 2023: Follow-up briefing covering the findings of the forensic investigation conducted by Graystone Forensics LLC, the confirmed scope of affected data and individuals, the status of notification preparations, regulatory filing strategy, and vendor accountability measures under consideration.
• October 16, 2023: Briefing on the status of regulatory inquiries, including the Coalition's Joint Demand Letter, the Company's response strategy, the status of individual consumer notifications and credit monitoring enrollment, and the negotiation of enhanced contractual security requirements with Palomar.
• November 29, 2023: Matter resolution briefing providing a comprehensive post-mortem of the incident, a summary of all remediation actions completed and in progress, and a forward-looking assessment of residual risk.
This level of Board-level engagement ensures that cybersecurity risk is treated as a governance-level priority and that the Company's directors are informed and engaged participants in the oversight of Quorum's information security posture and incident response activities.
B. Executive Leadership
Quorum's executive leadership team includes several officers with direct responsibility for information security, privacy, and related risk management functions. The key members of this leadership structure are as follows:
Chief Executive Officer — Margaret D. Calloway. As the Company's chief executive, Ms. Calloway bears ultimate executive accountability for enterprise risk management, including cybersecurity risk. Ms. Calloway receives regular briefings from the CISO and General Counsel on the Company's security posture and is directly involved in decision-making related to material cybersecurity incidents and significant security investments.
General Counsel — Thomas R. Whitfield. Mr. Whitfield oversees the Company's legal compliance functions, including compliance with data protection and privacy regulations, the management of legal privilege in connection with security incidents, and engagement with regulatory authorities. Mr. Whitfield serves as the primary liaison to Calderwood & Harkness LLP and other outside counsel engaged in connection with cybersecurity and data privacy matters. In the context of the Palomar incident, Mr. Whitfield directed the engagement of outside counsel and the establishment of the attorney-client privilege framework under which forensic investigation and legal analysis were conducted.
Chief Information Security Officer (CISO) — David Naranjo. Mr. Naranjo reports directly to the CEO and is responsible for the design, implementation, and ongoing maintenance of Quorum's enterprise information security program. His areas of oversight include the internal Security Operations Center ("SOC"), vulnerability management, identity and access management, security architecture, security engineering, security awareness, and the technical components of incident response. Mr. Naranjo holds the Certified Information Systems Security Professional (CISSP) and Certified Information Security Manager (CISM) certifications, and he has more than twenty years of experience in information security leadership roles in the financial services and insurance industries.
Chief Privacy Officer (CPO) — Jennifer Liang. Ms. Liang reports to the General Counsel and is responsible for Quorum's privacy compliance program, including data governance, breach notification processes, data subject rights management, privacy impact assessments, and the development and maintenance of privacy policies. Ms. Liang leads the Company's breach notification function and coordinated all individual and regulatory notifications related to the Palomar incident.
VP, Vendor Risk Management — Priya Deshmukh. Ms. Deshmukh reports to the CISO and leads the Company's third-party risk management program. Her responsibilities encompass the vendor security assessment process, the development and enforcement of contractual security requirements, ongoing monitoring of vendor compliance with data security obligations, and the coordination of vendor accountability actions in the event of a vendor-originated security incident. Ms. Deshmukh and her team were responsible for Quorum's oversight of Palomar Data Solutions and played a central role in the Company's post-incident vendor accountability response.
SVP, Claims Operations — Robert Wentworth. Mr. Wentworth oversees the Company's claims processing operations across all lines of business, including the management of the business relationship with Palomar Data Solutions for personal lines claims data processing. Mr. Wentworth's team is responsible for defining business requirements for claims-processing vendors, overseeing day-to-day operational performance, and escalating operational and security concerns to the appropriate internal stakeholders.
C. Cross-Functional Security Steering Committee
In addition to the executive leadership roles described above, Quorum maintains an internal Information Security Steering Committee (the "Steering Committee") that serves as the primary cross-functional governance body for information security matters. The Steering Committee comprises senior representatives from the following functional areas: information security, privacy, legal, compliance, claims operations, information technology, vendor management, internal audit, and business unit leadership from Quorum's major operating subsidiaries.
The Steering Committee meets on a quarterly basis to review the Company's security posture, assess emerging threats and vulnerabilities, evaluate proposed policy updates, review the status of key security initiatives and projects, and consider vendor risk assessments and findings. The Steering Committee also serves as a forum for cross-functional coordination on security-related matters that span organizational boundaries, ensuring that security considerations are integrated into business decision-making processes.
Material issues identified by the Steering Committee are escalated to the Board's Audit Committee through the CISO, with supporting analysis and recommendations from the Steering Committee members. This escalation pathway ensures that significant security matters receive timely attention at the governance level and that the Board is informed of developments that may affect the Company's risk profile or require strategic decision-making.
III. Information Security Program Framework
A. Program Foundation and Standards Alignment
Quorum's information security program is built upon, and designed in alignment with, recognized industry frameworks and standards. The Company's program draws principally from the following frameworks:
• NIST Cybersecurity Framework (CSF): Quorum utilizes the NIST CSF as the foundational organizing framework for its information security program, structuring its security activities across the five core functions: Identify, Protect, Detect, Respond, and Recover. The NIST CSF provides the Company with a comprehensive, risk-based approach to managing cybersecurity risk that is widely recognized by regulators and industry participants alike.
• ISO/IEC 27001: Quorum has aligned its information security management system ("ISMS") with the requirements of ISO/IEC 27001, the international standard for information security management. While the Company has not pursued formal ISO 27001 certification at this time, its policies, procedures, and controls are designed to be consistent with the standard's requirements and control objectives.
• Applicable Insurance Regulatory Requirements: Quorum's program is designed to comply with the insurance industry-specific cybersecurity regulatory requirements applicable to the Company and its subsidiaries. These include, most notably, the NAIC Insurance Data Security Model Law (Model #668) and the Connecticut Insurance Data Security Law, Conn. Gen. Stat. § 38a-999b, which impose specific information security program requirements on insurers domiciled or licensed in the state.
The program encompasses a comprehensive set of administrative, technical, and physical safeguards designed to protect the confidentiality, integrity, and availability of policyholder and claimant data. The data protected by Quorum's security program includes, without limitation, personally identifiable information ("PII"), protected health information ("PHI"), financial account data, Social Security numbers, driver's license numbers, insurance policy and claims information, and other categories of sensitive personal information as defined by applicable law.
B. Risk Assessment
Quorum conducts annual enterprise-wide information security risk assessments to systematically identify threats and vulnerabilities relevant to the Company's information assets and operations. These assessments evaluate the likelihood and potential impact of identified risks across the Company's technology environment, operational processes, and third-party relationships. The results of these risk assessments are used to prioritize remediation efforts and inform the allocation of security resources and investments.
In addition to the annual enterprise-wide assessment, Quorum conducts targeted risk assessments as warranted by material changes in the Company's technology environment, business operations, or the broader threat landscape. For example, targeted assessments may be triggered by the deployment of new systems or applications, significant changes to network architecture, the onboarding of new critical vendors, the emergence of novel threat vectors or widespread vulnerabilities, or the occurrence of a security incident (whether internal or at a third party).
The results of all risk assessments — both annual and targeted — are documented, reviewed by the CISO and the Steering Committee, and reported to the Audit Committee. Risk assessment findings serve as a critical input to the Company's security roadmap and capital planning processes, ensuring that security investments are aligned with the Company's actual risk profile.
C. Policies and Procedures
Quorum maintains a comprehensive suite of information security policies and procedures that establish requirements and expectations for the protection of information assets across the enterprise. These policies apply to all Quorum employees, contractors, and authorized third parties with access to Company systems or data. The policies are approved by the CISO and, where appropriate, by the General Counsel and the Steering Committee. The Company's core information security policies include, but are not limited to, the following:
• Information Security Policy (Enterprise-Wide): Establishes the overarching framework, objectives, and governance structure for the Company's information security program.
• Data Classification and Handling Policy: Defines data classification levels (e.g., Restricted, Confidential, Internal, Public) and establishes requirements for the handling, storage, transmission, and disposal of data at each classification level.
• Access Control and Identity Management Policy: Sets requirements for the provisioning, management, review, and de-provisioning of user access to Company systems and data, including role-based access control and least-privilege principles.
• Encryption Policy: Specifies encryption requirements for data at rest and in transit, including approved encryption algorithms and key management practices.
• Vulnerability Management and Patch Management Policy: Establishes requirements for the identification, assessment, prioritization, and remediation of vulnerabilities in the Company's technology environment, including defined timelines for patching based on vulnerability severity.
• Incident Response Policy and Plan: Defines the Company's procedures for detecting, reporting, escalating, containing, investigating, and remediating security incidents, including roles and responsibilities and communication protocols.
• Acceptable Use Policy: Establishes rules governing the acceptable use of Company technology resources, including computers, networks, email, internet access, and mobile devices.
• Remote Access and Mobile Device Policy: Sets requirements for secure remote access to Company systems, including VPN usage, multi-factor authentication, and mobile device management.
• Vendor/Third-Party Risk Management Policy: Governs the assessment, onboarding, monitoring, and off-boarding of third-party vendors that access, process, store, or transmit Company data.
• Data Retention and Disposal Policy: Establishes retention schedules and secure disposal requirements for data and records, consistent with legal, regulatory, and business requirements.
• Business Continuity and Disaster Recovery Policy: Defines the Company's approach to maintaining business operations and recovering technology systems in the event of disruptions, including natural disasters, technology failures, and cybersecurity incidents.
All information security policies are reviewed and updated at least annually to ensure that they remain current with evolving threats, technologies, regulatory requirements, and industry best practices. In addition, ad hoc updates are made as needed in response to specific regulatory changes, emerging threats, lessons learned from incidents or exercises, or changes in the Company's business operations or technology environment.
IV. Technical Safeguards
Quorum's information security program incorporates a defense-in-depth approach, employing multiple layers of technical safeguards to protect the Company's information assets, detect threats, and support rapid response to security incidents. The principal categories of technical controls deployed by Quorum are described below.
A. Network Security
Quorum maintains a multi-layered network architecture that employs segmentation to isolate critical data environments — including those containing PII, PHI, and financial data — from general-purpose network segments and from external-facing systems. This segmentation limits the potential blast radius of a compromise in any single network zone and impedes lateral movement by threat actors.
The Company's network security infrastructure includes next-generation firewalls that provide application-layer filtering, deep packet inspection, and threat intelligence integration at all network perimeters and inter-zone boundaries. Intrusion detection and prevention systems ("IDS/IPS") are deployed to monitor network traffic for known attack signatures and anomalous patterns, with the capability to automatically block or alert on suspicious activity in real time.
Quorum operates a security information and event management ("SIEM") platform that aggregates, correlates, and analyzes security event data from network devices, servers, applications, and security tools across the enterprise. The SIEM platform enables the Company's SOC analysts to identify and investigate potential threats based on correlated data from multiple sources, improving the speed and accuracy of threat detection.
Secure remote access to Quorum's corporate network is provided through an enterprise VPN solution, with multi-factor authentication ("MFA") required for all remote connections. This ensures that employees and authorized personnel accessing Company systems from outside the corporate network are subject to strong authentication controls, reducing the risk of unauthorized access through compromised credentials.
B. Endpoint Security
Quorum deploys an enterprise endpoint detection and response ("EDR") solution across all endpoints within its environment, including desktops, laptops, and servers. The EDR solution provides continuous monitoring, behavioral analysis, and automated response capabilities that enable the detection and containment of advanced threats — including fileless malware, living-off-the-land attacks, and zero-day exploits — that may evade traditional signature-based anti-malware tools.
The Company maintains an automated patch management system that ensures timely deployment of operating system and application patches across all managed endpoints. Patch deployment is prioritized based on vulnerability severity, with critical patches subject to the Company's 14-day remediation timeline as described in Section IV.E below.
In addition to EDR capabilities, anti-malware and advanced threat protection solutions are deployed on all endpoints, providing signature-based, heuristic, and behavioral detection of malicious software. These tools are configured to receive automatic updates to ensure coverage of the latest known threats.
C. Data Protection
Quorum employs encryption to protect sensitive data both at rest and in transit. Data at rest — including data stored in databases, file systems, and backup media — is encrypted using the Advanced Encryption Standard with 256-bit key length ("AES-256"), which is widely recognized as a strong, industry-standard encryption algorithm. Data in transit — including data transmitted over internal and external networks — is protected using Transport Layer Security ("TLS") version 1.2 or higher, ensuring the confidentiality and integrity of data during transmission.
The Company has deployed data loss prevention ("DLP") tools across its environment to monitor and prevent the unauthorized exfiltration of sensitive data. DLP policies are configured to detect and block the transmission of data classified as Restricted or Confidential — including PII, PHI, financial account numbers, and Social Security numbers — through unauthorized channels such as personal email, unapproved cloud storage services, or unencrypted file transfer mechanisms.
Database activity monitoring solutions are deployed for critical data stores that contain PII, PHI, and financial data. These tools provide real-time visibility into database access patterns, query activity, and data modifications, enabling the detection of anomalous or unauthorized database activity that may indicate a potential compromise or insider threat.
D. Identity and Access Management
Quorum's identity and access management ("IAM") controls are designed to ensure that access to Company systems and data is granted only to authorized individuals, limited to the minimum level necessary to perform their job functions, and promptly revoked when no longer required.
The Company implements role-based access control ("RBAC") with least-privilege principles, meaning that user access is provisioned based on the individual's role and responsibilities and is limited to the specific systems and data required for that role. Access permissions are defined through a formal access request and approval process that requires management authorization.
Multi-factor authentication ("MFA") is required for all remote access to Company systems and for all privileged accounts (i.e., accounts with administrative or elevated access rights). MFA adds a layer of protection beyond passwords by requiring users to authenticate using at least two independent factors, such as something the user knows (password) and something the user possesses (a hardware token or mobile authenticator application).
Quorum deploys a privileged access management ("PAM") solution to control and monitor the use of administrative accounts. The PAM solution provides capabilities including just-in-time access provisioning, session recording, credential vaulting, and automated credential rotation, reducing the risk associated with the misuse or compromise of highly privileged accounts.
The Company conducts regular access reviews and certification to validate that user access rights remain appropriate. Privileged accounts are reviewed on a quarterly basis, while all other user accounts are reviewed on a semi-annual basis. These reviews are performed by system owners and management and are documented for audit purposes.
E. Vulnerability Management and Patch Management
Quorum maintains a continuous vulnerability scanning program that covers both internal and external-facing systems. Automated vulnerability scans are conducted on a regular cadence and are supplemented by ad hoc scans in response to the disclosure of significant new vulnerabilities or changes to the Company's technology environment.
Identified vulnerabilities are prioritized for remediation based on their Common Vulnerability Scoring System ("CVSS") score, with critical and high-severity vulnerabilities receiving the highest priority. Quorum's internal policy requires the patching or mitigation of critical vulnerabilities (CVSS 9.0 and above) within fourteen (14) days of the availability of a vendor-issued patch. High-severity vulnerabilities (CVSS 7.0–8.9) must be remediated within thirty (30) days.
It is noteworthy, for purposes of this Response, that Quorum's own internal patching standard of fourteen (14) days for critical vulnerabilities is more stringent than the thirty (30)-day critical patching requirement that Quorum imposed on Palomar Data Solutions under Exhibit D to the Palomar Master Services Agreement. As detailed in Section V.E below, Palomar failed to meet even this less stringent contractual standard with respect to CVE-2023-0669, the vulnerability that was exploited to compromise Palomar's GoAnywhere MFT environment.
Quorum engages independent third-party security firms to conduct annual penetration testing of its external and internal network environments, web applications, and critical infrastructure. Penetration test findings are documented, prioritized, and remediated in accordance with the Company's vulnerability management policy. Results and remediation status are reported to the CISO and the Steering Committee.
Remediation of identified vulnerabilities is tracked through the Company's vulnerability management platform, with regular reporting to the CISO, the Steering Committee, and, for material findings, the Audit Committee. This tracking ensures visibility into the Company's vulnerability posture and accountability for timely remediation.
F. Logging, Monitoring, and Detection
Quorum maintains centralized logging of security-relevant events across its infrastructure, applications, and endpoints. Log data is collected from network devices, firewalls, servers, databases, applications, authentication systems, endpoint security tools, and other sources, and is aggregated in the Company's SIEM platform for correlation, analysis, and retention.
The Company operates a 24/7 Security Operations Center ("SOC") staffed by dedicated security analysts. SOC analysts are responsible for monitoring security alerts generated by the SIEM and other security tools, triaging and investigating potential security events, and escalating confirmed or suspected incidents in accordance with the Incident Response Plan. The SOC operates on a continuous basis, including nights, weekends, and holidays, to ensure that threats are detected and addressed in a timely manner regardless of when they occur.
Automated alerting and correlation rules are configured within the SIEM platform to identify patterns of activity that may indicate a security threat, including indicators of compromise ("IoCs"), anomalous user behavior, unauthorized access attempts, lateral movement, data exfiltration patterns, and other threat indicators. These rules are regularly tuned and tested to optimize detection accuracy and reduce false positives, ensuring that SOC analysts can focus their attention on genuine threats.
The Company periodically tests its detection capabilities through red-team exercises, purple-team engagements, and simulation of known attack techniques to validate the effectiveness of its monitoring and alerting infrastructure.
V. Vendor Risk Management Program
A. Program Overview
Quorum's Vendor Risk Management Program (the "VRM Program") is a comprehensive, risk-based program designed to assess, manage, and monitor the cybersecurity and data protection risks associated with the Company's third-party vendor relationships. The VRM Program is led by Priya Deshmukh, VP, Vendor Risk Management, and operates under the oversight of the CISO, David Naranjo.
The VRM Program applies to all third-party vendors that access, process, store, or transmit Quorum data, with enhanced due diligence and monitoring requirements for vendors that handle sensitive categories of data, including PII, PHI, and financial data. The program encompasses the full lifecycle of vendor relationships, including vendor onboarding and pre-engagement due diligence, contractual negotiation and execution, ongoing monitoring and periodic reassessment, and off-boarding and data return or destruction upon the conclusion of the vendor relationship.
B. Vendor Onboarding and Due Diligence
Quorum employs a risk-tiered approach to vendor classification and due diligence. During the onboarding process, each vendor is categorized by risk level — Critical, High, Moderate, or Low — based on a multifactor assessment that considers the sensitivity and volume of the data the vendor will access or process, the level of access the vendor will have to Quorum's systems and networks, the business criticality of the vendor's services to Quorum's operations, and the potential impact of a disruption or security incident at the vendor on Quorum's business and its policyholders.
Palomar Data Solutions, Inc. was classified as a "Critical" vendor under Quorum's tiering framework. This classification was based on Palomar's role in processing personal lines claims data that contained PII (including names, addresses, dates of birth, Social Security numbers, and driver's license numbers), PHI (including medical records and health-related claims information for workers' compensation and health-adjacent claims), and financial information (including bank account numbers and payment card data) for Quorum policyholders and claimants. The Critical designation subjected Palomar to the most rigorous tier of due diligence and ongoing monitoring under Quorum's VRM Program.
Pre-engagement due diligence for Critical and High-risk vendors includes the following components:
• Completion of a comprehensive security questionnaire covering the vendor's information security program, policies, controls, incident response capabilities, and business continuity planning.
• Review of the vendor's most recent SOC 2 Type II report (or equivalent independent audit report) to evaluate the design and operating effectiveness of the vendor's security controls.
• Assessment of the vendor's insurance coverage, including verification that the vendor carries adequate cyber liability insurance, errors and omissions coverage, and general commercial liability insurance.
• Evaluation of the vendor's incident response capabilities, including the vendor's ability to detect, contain, and notify in the event of a security incident.
• Review of any publicly available information regarding the vendor's security posture, including prior security incidents, regulatory actions, or litigation related to data security.
C. Contractual Protections
Quorum requires contractual data security obligations for all vendors that access, process, store, or transmit sensitive Company data. These contractual requirements are tailored based on the vendor's risk tier, with the most comprehensive requirements imposed on Critical and High-risk vendors.
The contractual data security protections in the Palomar Master Services Agreement ("MSA"), which was executed on November 12, 2019, and subsequently amended by Amendment 1 (dated March 3, 2021) and Amendment 2 (dated September 15, 2022), included the following key provisions:
Data Security Exhibit (Exhibit D, as amended). The MSA included a dedicated Data Security Exhibit (Exhibit D) that set forth the security requirements applicable to Palomar's handling of Quorum data. As amended by Amendment 2, Exhibit D required Palomar to:
• Maintain "commercially reasonable" administrative, technical, and physical safeguards appropriate to the sensitivity of the data being processed, consistent with applicable industry standards and regulatory requirements;
• Patch critical vulnerabilities (as defined by a CVSS score of 9.0 or above) within thirty (30) days of the availability of a vendor-issued patch;
• Conduct annual penetration testing of systems used to process Quorum data and provide Quorum with a summary of findings and remediation actions;
• Obtain and provide to Quorum an annual SOC 2 Type II report covering the security, availability, and confidentiality trust services criteria; and
• Encrypt all Quorum data at rest and in transit using industry-standard encryption protocols.
Breach Notification Clause (Section 9.4). Section 9.4 of the MSA required Palomar to notify Quorum within forty-eight (48) hours of discovering any security incident that resulted in or was reasonably believed to have resulted in unauthorized access to, use of, or disclosure of Quorum data. The notification was required to include a description of the nature of the incident, the categories and approximate number of data subjects affected, the likely consequences of the incident, and the measures taken or proposed to address and mitigate the incident.
Indemnification (Section 12.2). Under Section 12.2 of the MSA, Palomar agreed to indemnify, defend, and hold harmless Quorum and its affiliates from and against any losses, damages, claims, liabilities, costs, and expenses (including reasonable attorneys' fees) arising from or related to Palomar's breach of its data security obligations under the MSA, including the Data Security Exhibit. This indemnification obligation was subject to a liability cap equal to two times (2×) the trailing twelve-month fees paid by Quorum to Palomar, which at the time of the incident equated to a cap of $32,600,000.
Insurance Requirements (Exhibit E). Exhibit E to the MSA required Palomar to obtain and maintain specified insurance coverages throughout the term of the MSA, including a minimum of $10,000,000 in cyber liability insurance coverage, with Quorum named as an additional insured.
Termination for Cause (Section 14.2). Section 14.2 of the MSA provided Quorum with the right to terminate the MSA upon Palomar's material breach of the agreement, subject to a thirty (30)-day cure period following written notice of the breach.
Amendment 2, executed on September 15, 2022, specifically updated the Data Security Exhibit and added the SOC 2 Type II audit requirement and updated cyber insurance minimums (increasing the required minimum from $5 million to $10 million). This amendment reflected Quorum's commitment to continuously strengthening its vendor security requirements in response to the evolving threat landscape and industry best practices.
D. Ongoing Monitoring
Quorum's ongoing monitoring of Critical and High-risk vendors includes the following activities:
Annual SOC 2 Review. Quorum conducts an annual review of each Critical and High-risk vendor's SOC 2 Type II report to evaluate the design and operating effectiveness of the vendor's security controls. With respect to Palomar, the vendor's SOC 2 Type II audit was performed by Kessler, Park & Associates CPA, PLLC, located in Dallas, Texas, with Engagement Partner Vivian Park. Quorum's VRM team reviewed Palomar's SOC 2 reports annually and evaluated any reported control deficiencies or qualified opinions.
Periodic Security Questionnaire Updates. Quorum periodically requires Critical vendors to complete updated security questionnaires to identify any material changes to the vendor's security program, technology environment, or risk profile since the prior assessment.
Incident-Triggered Reviews. Following a material security incident or a significant change in a vendor's operations or ownership, Quorum's VRM team conducts a targeted review of the vendor's security posture to assess any new or heightened risks to Quorum data.
Contractual Audit Rights. The Palomar MSA, consistent with Quorum's standard vendor contract terms for Critical vendors, included audit rights provisions allowing Quorum to request additional security assessments, penetration testing results, or on-site inspections of Palomar's facilities, subject to reasonable notice and scheduling requirements.
E. Palomar-Specific Vendor Oversight Findings
Quorum's investigation of the Palomar data breach incident identified two specific areas in which Palomar failed to meet its contractual obligations to Quorum:
Failure to Timely Patch a Critical Vulnerability. The data breach at issue resulted from the exploitation of CVE-2023-0669, a critical remote code execution vulnerability in Palomar's GoAnywhere MFT file transfer appliance. Severin Corporation publicly disclosed this vulnerability and released a patch on or about February 1, 2023. Under Exhibit D of the MSA, as amended, Palomar was contractually required to apply critical patches within thirty (30) days of vendor patch release — that is, by approximately March 3, 2023. Palomar did not apply the patch prior to the exploitation of the vulnerability. This failure to timely patch a known critical vulnerability was the direct and proximate cause of the data breach.
Late Notification. Palomar's forensic evidence indicates that Palomar first discovered anomalous activity in its GoAnywhere MFT environment on April 18, 2023. Under Section 9.4 of the MSA, Palomar was required to notify Quorum within forty-eight (48) hours of discovering a security incident — that is, by April 20, 2023. Palomar did not provide notification to Quorum until April 21, 2023, approximately twenty-four (24) hours beyond the contractual deadline.
These failures — the failure to timely patch and the late notification — were identified by Quorum's VRM team and were addressed through the vendor accountability actions detailed in Exhibit C to this Response. Quorum views these failures as serious breaches of Palomar's contractual obligations and has taken significant steps to hold Palomar accountable and to prevent recurrence, as described in Section IX below.
VI. Incident Response Program
A. Incident Response Plan
Quorum maintains a formal, documented Incident Response Plan ("IRP") that defines the Company's procedures for detecting, reporting, escalating, containing, investigating, and remediating security incidents. The IRP is designed to enable a rapid, coordinated, and effective response to security events of all types and severity levels, from minor security alerts to significant data breach incidents.
The IRP defines clear roles, responsibilities, and escalation paths to ensure that incidents receive prompt attention from the appropriate personnel and are elevated to senior leadership and the Board as warranted by their severity and potential impact. The IRP designates an Incident Response Team ("IRT") comprising the following standing members:
• CISO — David Naranjo: Serves as the IRT lead and is responsible for overall coordination of the incident response, including technical containment and investigation activities.
• CPO — Jennifer Liang: Leads the breach notification workstream, including determination of notification obligations, preparation of notification letters, and coordination with notification vendors.
• General Counsel — Thomas R. Whitfield: Provides legal guidance on privilege, regulatory obligations, litigation risk, and engagement of outside counsel.
• VP, Vendor Risk Management — Priya Deshmukh: Coordinates with third-party vendors involved in or affected by the incident and leads vendor accountability assessments.
• SVP, Claims Operations — Robert Wentworth: Provides subject matter expertise on claims operations and the business context for incidents affecting claims data.
• Representatives from IT, Communications, and Compliance: Provide operational support for containment and remediation, manage internal and external communications, and ensure compliance considerations are addressed.
The IRP also includes procedures for engaging external resources under the attorney-client privilege umbrella, including outside counsel, forensic investigators, notification vendors, and crisis communications firms. These procedures are designed to ensure that the Company can rapidly deploy specialized expertise while preserving legal privilege over the work product generated in connection with incident investigation and response.
B. Incident Response to the Palomar Breach
Upon receiving notification from Palomar Data Solutions on April 21, 2023, that a security incident had occurred involving Quorum policyholder and claimant data, Quorum immediately activated its Incident Response Plan and convened the Incident Response Team. The key steps taken in Quorum's response to the Palomar incident are summarized below:
Engagement of Outside Counsel. On May 4, 2023, Quorum engaged Calderwood & Harkness LLP, through the Privacy & Data Security practice led by Partner Kevin Ostrowski, to serve as breach response counsel. Calderwood & Harkness was engaged to provide legal guidance on all aspects of the Company's incident response, including forensic investigation, regulatory compliance, breach notification, vendor accountability, and communications strategy.
Engagement of Forensic Investigators. On May 5, 2023, Calderwood & Harkness retained Graystone Forensics LLC to conduct a privileged forensic investigation of the Palomar incident. The engagement was structured under the attorney-client privilege umbrella, with Graystone engaged by and reporting to outside counsel. The Graystone engagement team was led by Dr. Nolan Briggs, Managing Director, Incident Response, and Kendra Faulkner, Senior Forensic Analyst. Graystone's investigation included analysis of forensic evidence provided by Palomar, reconstruction of the attack timeline, identification of the exploited vulnerability, and determination of the scope and nature of data compromised.
Forensic Findings. Graystone Forensics delivered its preliminary forensic findings to Calderwood & Harkness on June 2, 2023, and its final forensic report on July 14, 2023. The final forensic report confirmed the following scope of the compromise:
• Total affected individuals: 318,247 individuals across 29 states and the District of Columbia.
• PII compromised (all affected individuals): Names, addresses, dates of birth, Social Security numbers, driver's license numbers, policy numbers, and claims information.
• Financial information compromised: Bank account numbers, routing numbers, and/or payment card data for 84,619 individuals.
• PHI compromised: Medical records, diagnosis codes, treatment information, and/or health insurance information for 41,203 individuals in connection with workers' compensation and health-related claims.
Cyber-Insurance Claim. On May 8, 2023, Quorum filed a cyber-insurance claim with its cyber-liability insurer, Atlas Mutual Insurance Company, under Policy No. CYB-2023-041587. The claim was assigned Claim No. CYB-CLM-2023-05892. Quorum has cooperated with Atlas Mutual throughout the claims process.
Notification Vendor Engagement. Quorum engaged Clearfield Notification Services LLC to manage the consumer notification and credit monitoring fulfillment process. Jerome Tillman served as the Account Manager for the engagement. Clearfield was responsible for the printing, mailing, and tracking of individual notification letters and for establishing and administering the credit monitoring enrollment process.
Crisis Communications. BrightPath Consulting Group Inc. was retained to provide crisis communications support. Meredith Ashford, Managing Director, led the engagement. BrightPath assisted Quorum in developing internal and external communications strategies, preparing public-facing statements, training customer-facing personnel, and managing media inquiries.
Consumer Notifications. Individual notification letters were mailed to all 318,247 affected individuals on a rolling basis from August 18, 2023, through September 15, 2023. The notification letters provided a description of the incident, the categories of information affected, the steps taken by Quorum in response, the availability of complimentary credit monitoring and identity theft protection services, and information on how to enroll. Notifications were tailored by state to comply with the specific content and formatting requirements of each applicable state breach notification statute.
Regulatory Notifications. Quorum filed regulatory notifications with all required state attorneys general and data protection authorities, as well as with the U.S. Department of Health and Human Services, Office for Civil Rights ("HHS-OCR") for the PHI component. All regulatory notifications were filed during the period from August 14, 2023, through August 25, 2023. All filings were made within the timelines required by applicable law.
Credit Monitoring and Identity Theft Protection. Quorum offered twenty-four (24) months of complimentary credit monitoring and identity theft protection services to all 318,247 affected individuals, regardless of the specific categories of data compromised. As of the date of this submission, the estimated enrollment take-rate is approximately 40%, corresponding to approximately 127,299 enrollees.
C. Tabletop Exercises and Testing
Quorum conducts annual tabletop exercises that simulate cybersecurity incidents and test the Company's Incident Response Plan, communication protocols, and decision-making processes. These exercises are designed to expose gaps in the IRP, improve cross-functional coordination, and build institutional muscle memory for incident response.
Tabletop exercise scenarios are developed to reflect realistic and current threat scenarios, including scenarios specifically involving vendor-originated breaches — a scenario type that has been included in Quorum's exercise program since 2021. Exercises involve cross-functional participation from information security, legal, privacy, claims operations, communications, compliance, and executive leadership.
Following each exercise, an after-action review is conducted to identify lessons learned, strengths, and areas for improvement. Findings from these reviews are documented and incorporated into updates to the IRP, training programs, and technical controls as appropriate.
VII. Employee Training and Awareness
Quorum recognizes that its employees are a critical line of defense in the protection of Company and policyholder data. The Company maintains a comprehensive information security and privacy awareness training program designed to equip all employees with the knowledge and skills necessary to identify, prevent, and report security threats.
Annual Training Requirement. All Quorum employees — including full-time, part-time, and temporary employees — are required to complete annual information security and privacy awareness training. This training is delivered through an interactive, online learning platform and covers a range of topics essential to maintaining a strong security culture, including:
• Recognition and reporting of phishing and social engineering attacks;
• Proper data handling and classification procedures;
• Requirements and procedures for reporting suspected security incidents;
• Acceptable use of Company technology resources;
• Password hygiene and multi-factor authentication;
• Regulatory requirements applicable to the protection of policyholder and claimant data; and
• The Company's data retention and disposal policies.
Role-Specific Training. In addition to the enterprise-wide annual training, Quorum provides targeted training to employees in high-risk roles whose functions involve regular access to or processing of sensitive data. These roles include claims processing personnel, vendor management specialists, IT administrators with privileged access, and employees in the privacy and compliance functions. Role-specific training covers topics of particular relevance to these functions, such as secure coding practices, privileged account management, vendor security assessment techniques, and regulatory reporting obligations.
Supplemental Awareness Campaigns. Throughout the year, Quorum conducts supplemental awareness campaigns to reinforce key security concepts and keep employees vigilant against evolving threats. These campaigns include simulated phishing exercises, security awareness newsletters, targeted alerts regarding emerging threats (such as new phishing campaigns or widespread vulnerabilities), and periodic awareness events and communications.
Tracking and Accountability. Training completion is tracked through the Company's learning management system, and completion rates are reported to the CISO and departmental management. Employees who fail to complete required training within the designated timeframe are subject to escalation to their management chain and, if non-compliance persists, potential disciplinary action. The Company consistently achieves training completion rates above 97% for its annual information security awareness program.
VIII. Regulatory Compliance
Quorum's information security program is designed to comply with the numerous federal and state regulatory requirements applicable to the Company and its operating subsidiaries. As a large, diversified insurance holding company conducting business in all fifty states and the District of Columbia, Quorum is subject to an extensive and evolving body of data protection and privacy regulation. The principal regulatory frameworks with which Quorum's program is designed to comply include the following:
Connecticut Insurance Data Security Law (Conn. Gen. Stat. § 38a-999b). As a company domiciled in Connecticut, Quorum is subject to the Connecticut Insurance Data Security Law, which is based on the NAIC Insurance Data Security Model Law (Model #668). This law requires licensed insurers and other entities under the jurisdiction of the Connecticut Insurance Department to develop, implement, and maintain a comprehensive, written information security program that contains administrative, technical, and physical safeguards appropriate to the size and complexity of the entity, the nature and scope of its activities, and the sensitivity of the nonpublic information used. Quorum's information security program is designed to satisfy the requirements of this statute.
HIPAA Security Rule and Breach Notification Rule (45 C.F.R. Parts 160, 164). Quorum processes PHI in connection with workers' compensation claims and certain health-related insurance products. To the extent Quorum acts as a covered entity or business associate under HIPAA, its handling of PHI is subject to the requirements of the HIPAA Security Rule, which mandates administrative, physical, and technical safeguards for electronic PHI, and the HIPAA Breach Notification Rule, which requires notification to affected individuals, HHS-OCR, and, in certain cases, the media, following a breach of unsecured PHI. Quorum's regulatory notification to HHS-OCR in connection with the Palomar incident was filed on August 14, 2023, within the required timeframe.
New York SHIELD Act (N.Y. Gen. Bus. Law § 899-aa). The New York Stop Hacks and Improve Electronic Data Security Act requires any person or business that owns or licenses computerized data that includes the private information of a New York resident to implement and maintain reasonable safeguards to protect the security, confidentiality, and integrity of such private information. Quorum's information security program satisfies the requirements of the SHIELD Act.
State Breach Notification Statutes. Quorum operates in all fifty states and is subject to the breach notification statutes of each state in which it has affected individuals. In connection with the Palomar incident, Quorum complied with the breach notification requirements of all twenty-nine (29) affected states and the District of Columbia, including variations in notification content, timing, format, and regulatory filing requirements.
SEC Cybersecurity Disclosure Requirements. As a publicly traded company, Quorum is subject to the Securities and Exchange Commission's cybersecurity disclosure requirements, including the obligation to report material cybersecurity incidents on Form 8-K (Item 1.05) and to provide risk factor disclosures regarding cybersecurity risks in its periodic reports on Forms 10-Q and 10-K. Quorum's disclosure of the Palomar incident was made in compliance with applicable SEC requirements.
State Insurance Department Examination. Quorum is subject to examination by the Connecticut Insurance Department, including its Financial Analysis Division and Cybersecurity Unit. At the time of this submission, the Department, through Examiner Richard Nakamura, had initiated an inquiry related to the Palomar data breach incident. Quorum is cooperating fully with the Department's inquiry.
External Audit. Quorum's external auditor, Halstead & Monroe LLP, based in Philadelphia, Pennsylvania (Engagement Partner: Gregory Chin), audits the Company's annual financial statements and evaluates internal controls over financial reporting, including those internal controls related to the security, integrity, and availability of information technology systems. The external audit process provides an additional layer of independent assurance over the Company's control environment.
IX. Post-Incident Enhancements
Following the Palomar data breach incident, Quorum undertook a comprehensive review of its information security program and vendor risk management practices to identify opportunities for enhancement. While Quorum believes that its pre-incident security program was robust and commensurate with industry standards, the Company recognizes that continuous improvement is essential in the face of an ever-evolving threat landscape. The following enhancements have been implemented or are in the process of implementation as of the date of this submission.
A. Vendor Risk Management Enhancements
Quorum has implemented significant enhancements to its vendor risk management program in the wake of the Palomar incident, reflecting the Company's determination to strengthen its oversight of third-party vendors and to reduce the risk of future vendor-originated data breaches.
Enhanced Due Diligence Requirements. Quorum has updated its VRM Program to require more frequent and more rigorous review of the security posture of Critical vendors. For Critical vendors, security questionnaires will now be updated semi-annually (increased from annually), and Quorum's VRM team will conduct targeted reviews of Critical vendor patch management and vulnerability management practices on a quarterly basis.
MSA Amendment 3 with Palomar. On October 27, 2023, Quorum and Palomar Data Solutions executed MSA Amendment 3, which imposes significantly enhanced security requirements on Palomar. The key provisions of Amendment 3 include:
• Enhanced Patch Management: Palomar is now required to patch critical vulnerabilities (CVSS 9.0 and above) within fourteen (14) days of vendor patch release, reduced from the prior requirement of thirty (30) days. This standard aligns with Quorum's own internal patching timeline.
• Mandatory Endpoint Detection and Response (EDR): Palomar is required to deploy and maintain an enterprise EDR solution on all systems used to process Quorum data.
• Quarterly Vulnerability Scanning: Palomar is required to conduct quarterly vulnerability scans of systems used to process Quorum data and to provide Quorum with reports summarizing the results and remediation actions taken.
• Annual Independent Security Assessment: Palomar is required to engage an independent third-party security assessor to conduct an annual security assessment of Palomar's information security program, at Palomar's sole expense, with the results provided to Quorum.
• Enhanced Incident Notification: The incident notification window has been reduced from forty-eight (48) hours to twenty-four (24) hours, ensuring that Quorum receives earlier notice of any security incidents affecting its data.
Enterprise-Wide Contract Updates. Beyond the Palomar-specific amendments, Quorum's VRM team has undertaken a review and tightening of contractual notification windows and security requirements across all of its Critical and High-risk vendor agreements. This initiative is intended to ensure that the enhanced protections implemented with Palomar are extended, where appropriate, to Quorum's broader vendor portfolio.
B. Internal Security Enhancements