1025-00006 · Graystone Forensics LLC · Regulatory Defense/Multistate AG

memo-multistate-ag-closure-analysis.docx DOCUMENT Data Privacy

64 / 88 ← → ✕

CALDERWOOD & HARKNESS LLP Attorneys at Law

1700 K Street NW, Suite 900 Washington, D.C. 20006 Telephone: (202) 555-7100 Facsimile: (202) 555-7199 www.calderwoodharkness.com

PRIVILEGED AND CONFIDENTIAL ATTORNEY-CLIENT PRIVILEGED / ATTORNEY WORK PRODUCT

November 24, 2023

MEMORANDUM

TO:

Thomas R. Whitfield, General Counsel, Quorum Insurance Holdings Corp. Jennifer Liang, Chief Privacy Officer, Quorum Insurance Holdings Corp. Margaret D. Calloway, Chief Executive Officer, Quorum Insurance Holdings Corp.

FROM:

Kevin Ostrowski, Partner, Privacy & Data Security, Calderwood & Harkness LLP Alan Burke, Associate, Privacy & Data Security, Calderwood & Harkness LLP

DATE: November 24, 2023

RE: Analysis of Multistate Attorney General Closure Letter and Implications — Palomar Data Solutions Security Incident

Matter No.: 1025-00006

This memorandum is a privileged and confidential attorney-client communication and attorney work product. It is intended solely for the use of the addressees named above. This memorandum should not be disclosed, distributed, or otherwise made available to any third party without the prior written consent of Calderwood & Harkness LLP. Disclosure to any unauthorized party could result in a waiver of applicable privileges.

I. Executive Summary

This memorandum provides a comprehensive analysis of the closure letter dated November 22, 2023, received from the twenty-nine-state multistate attorney general coalition, which confirms the closure of the enforcement inquiry relating to the Palomar Data Solutions security incident without any enforcement action being taken against Quorum Insurance Holdings Corp. ("Quorum" or the "Company"). The closure letter was signed by Assistant Attorney General Diane Marchetti of the Connecticut Attorney General's Office, Consumer Protection Division, and Assistant Attorney General Mark Petrosian of the New York Attorney General's Office, Bureau of Internet and Technology, in their capacities as co-leads of the multistate coalition, on behalf of all twenty-nine participating states.

This outcome represents a highly favorable resolution for Quorum. Critically, the closure letter imposes no enforcement action, no consent decree, no monetary fine or civil penalty, and no ongoing monitoring obligation of any kind on the Company. The multistate coalition has effectively determined that no further action is warranted based on its review of the facts, Quorum's response to the underlying incident, and the information submitted by Calderwood & Harkness on Quorum's behalf.

By way of procedural context, the multistate inquiry was formally opened on September 8, 2023, when Calderwood & Harkness received the joint demand letter on Quorum's behalf. Quorum, through Calderwood & Harkness, submitted its comprehensive written response on October 13, 2023, accompanied by four detailed exhibits. A supplemental information submission followed on November 3, 2023, providing updated credit monitoring enrollment statistics and a summary of the Palomar indemnification settlement. The closure letter was received approximately seventy-five days after the initial demand letter — a relatively expeditious resolution timeline for a multistate attorney general investigation of this nature, which in our experience can extend for six months or longer in cases involving data compromises of comparable scope.

We further note that this favorable outcome, when combined with the Connecticut Insurance Department closure that is expected imminently (and has since been confirmed as issued on November 28, 2023), and the pending inquiry by the U.S. Department of Health and Human Services, Office for Civil Rights ("HHS-OCR"), positions Quorum to close the regulatory chapter of the incident response in its entirety in the near term. As discussed in greater detail in Section IV of this memorandum, the remaining regulatory tracks — the Connecticut Insurance Department inquiry and the HHS-OCR review — are both on parallel positive trajectories that we expect will result in similarly favorable outcomes.

The balance of this memorandum sets forth the background and procedural history of the matter, a detailed analysis of the closure letter's key language and implications, the status of remaining regulatory inquiries, and our recommendations for immediate and ongoing actions.

II. Background and Procedural History

A. The Underlying Incident

The events giving rise to the multistate attorney general inquiry originated not within Quorum's own systems or network infrastructure, but rather at Palomar Data Solutions, Inc. ("Palomar"), Quorum's third-party claims-processing vendor. Palomar provides claims intake, adjudication support, and payment processing services to Quorum under a Master Services Agreement dated November 12, 2019, as subsequently amended (the "MSA"). In the course of providing these services, Palomar maintains custody of certain personally identifiable information ("PII") and protected health information ("PHI") belonging to Quorum policyholders and claimants.

The breach at Palomar resulted from the exploitation of CVE-2023-0669, a critical remote code execution vulnerability affecting Severin Corporation's GoAnywhere Managed File Transfer ("MFT") platform. This vulnerability, which was publicly disclosed and assigned a Common Vulnerabilities and Exposures identifier in early 2023, allowed threat actors to achieve unauthenticated remote code execution on vulnerable GoAnywhere MFT servers. Palomar's failure to apply the vendor-issued patch for this vulnerability within the timeframe required by its contractual obligations to Quorum — specifically, the thirty-day critical patch deadline set forth in Exhibit D (Data Security Requirements) to the MSA, as amended — provided the threat actor with the attack vector used to gain unauthorized access to Palomar's file transfer appliance.

The unauthorized access window has been determined, through forensic investigation, to span approximately thirty-five days, from March 14, 2023, through April 18, 2023. During this period, the threat actor was able to exfiltrate data files containing information pertaining to Quorum policyholders and claimants. Palomar's Security Operations Center ("SOC") first identified anomalous outbound data transfers from the affected file transfer appliance on April 18, 2023, and initiated its internal investigation on that date.

Palomar provided formal notification to Quorum of the security incident on April 21, 2023. This notification was delivered approximately twenty-four hours past the forty-eight-hour contractual notification requirement established under Section 9.4 of the MSA, as amended. While the delayed notification did not materially alter the scope of the data compromise, it constituted a contractual breach by Palomar that was addressed as part of the subsequent indemnification and remediation discussions.

The forensic investigation and subsequent data mining ultimately determined that a total of 318,247 individuals across twenty-nine states and the District of Columbia were affected by the incident. The types of data compromised varied across the affected population, as follows:

• Personally Identifiable Information (PII): For all 318,247 affected individuals, the compromised data included full names, dates of birth, Social Security numbers, and driver's license numbers.

• Financial Information: For a subset of 84,619 individuals, the compromised data additionally included bank account numbers, routing numbers, and/or payment card numbers associated with premium payments or claims disbursements.

• Protected Health Information (PHI): For a further subset of 41,203 individuals, the compromised data included health conditions, medical diagnosis codes (ICD-10), and treatment information derived from workers' compensation claims and other health-related insurance claims processed by Palomar on Quorum's behalf.

The breadth of the data compromise — encompassing PII, financial information, and PHI across a population exceeding 300,000 individuals in twenty-nine states — made the incident a significant regulatory event requiring coordinated engagement with multiple state and federal regulators.

B. Quorum's Engagement of Counsel and Response

Quorum's response to the incident proceeded on a coordinated and deliberate timeline following receipt of Palomar's notification. The key milestones are summarized below:

Engagement of Outside Counsel. Calderwood & Harkness LLP was engaged by Quorum's General Counsel, Thomas R. Whitfield, on May 4, 2023, to serve as lead outside counsel for all aspects of the data breach response, including forensic investigation oversight, regulatory compliance and notifications, consumer notification management, and regulatory defense.

Retention of Forensic Investigators. On May 5, 2023, Graystone Forensics LLC ("Graystone") was retained under the direction and at the request of Calderwood & Harkness, under the protection of the attorney-client privilege and work product doctrine, to conduct an independent forensic investigation of the Palomar incident and to provide expert analysis of the scope, nature, and cause of the data compromise. Graystone issued its preliminary forensic findings on June 2, 2023, confirming the exploitation of CVE-2023-0669 as the root cause and establishing the approximate unauthorized access window. Graystone's final forensic report was delivered on July 14, 2023, and provided the definitive factual foundation for all subsequent regulatory filings and submissions.

Data Mining and Affected Individual Identification. The process of identifying all affected individuals and the specific data elements compromised for each individual — a critical prerequisite for both regulatory notification and consumer notification compliance — was completed on August 4, 2023. This process required substantial coordination between Graystone, Palomar, and Quorum's internal information technology and claims teams to reconcile the exfiltrated data sets against Quorum's records of insured individuals and claimants.

Consumer Notifications. Individual consumer notification letters were mailed on a rolling basis between August 18, 2023, and September 15, 2023, covering all 318,247 affected individuals. The notifications were managed through Clearfield Notification Services LLC ("Clearfield") and were tailored to comply with the specific statutory requirements of each affected individual's state of residence. Each notification letter included a description of the incident, the categories of information compromised for that individual, a description of the steps Quorum had taken in response, an offer of twenty-four months of complimentary credit monitoring and identity theft protection services, and contact information for the dedicated call center established by Quorum to address inquiries from affected individuals.

Regulatory Notifications. Regulatory notification filings were submitted to all required state regulators and, where applicable, the federal government between August 14, 2023, and August 25, 2023. All notifications were confirmed to be timely under the applicable statutes of each jurisdiction. Specifically, Calderwood & Harkness confirmed compliance with the notification timing requirements of each of the twenty-nine affected states' breach notification statutes, as well as the HIPAA Breach Notification Rule (45 C.F.R. §§ 164.400–414) with respect to the PHI component of the compromise. In no instance did a regulatory notification filing exceed the statutory deadline applicable to that jurisdiction.

C. Multistate AG Inquiry Timeline

The procedural history of the multistate attorney general inquiry that is the primary subject of this memorandum is summarized below:

September 8, 2023 — Joint Demand Letter Received. Calderwood & Harkness received a joint demand letter issued by the Connecticut Attorney General's Office (specifically, AAG Diane Marchetti of the Consumer Protection Division) and the New York Attorney General's Office (specifically, AAG Mark Petrosian of the Bureau of Internet and Technology), acting in their capacities as co-leads of a coalition of twenty-nine state attorneys general. The demand letter identified the Palomar-originated data breach as the subject of the inquiry and requested comprehensive information regarding Quorum's knowledge of the incident, its response and remediation actions, the scope and nature of affected consumer data, the status of consumer notifications, the vendor relationship with Palomar, and Quorum's overall information security program. The letter set a response deadline of thirty days.

September 10, 2023 — Expanded Engagement. Following receipt of the demand letter, Calderwood & Harkness's engagement scope was formally expanded to include full regulatory defense of the multistate attorney general inquiry, in addition to the ongoing data breach response work.

October 13, 2023 — Comprehensive Written Response. Calderwood & Harkness submitted a comprehensive written response to the multistate coalition on Quorum's behalf, accompanied by four supporting exhibits:

• Exhibit A: Detailed incident timeline and description of remedial measures taken by Quorum and Palomar.

• Exhibit B: Representative consumer notification letter samples for each affected jurisdiction, along with a jurisdictional compliance checklist demonstrating timely filing and content compliance for each state.

• Exhibit C: Palomar vendor accountability summary, including a narrative of Palomar's contractual obligations, the specific contractual breach (failure to apply the CVE-2023-0669 patch within the contractual thirty-day window), the indemnification demand, and the status of indemnification discussions.

• Exhibit D: Quorum information security program overview, describing the Company's enterprise-wide data security framework, governance structure, technical controls, and vendor risk management practices.

The response was designed to present Quorum's incident response in the most comprehensive and favorable light, emphasizing the vendor-origin nature of the breach, the timeliness and completeness of Quorum's response and notifications, the robustness of Quorum's own information security program, and the concrete accountability measures being pursued with respect to Palomar.

November 3, 2023 — Supplemental Information Submission. In response to an informal follow-up communication from the coalition, Calderwood & Harkness submitted a supplemental information package that included two key updates. First, the submission provided current credit monitoring enrollment statistics, reporting that approximately forty percent of affected individuals — roughly 127,299 enrollees out of 318,247 total affected individuals — had enrolled in the complimentary credit monitoring and identity theft protection services offered by Quorum. This enrollment rate, which is above the industry average for incidents of this type, was cited as evidence of the effectiveness of Quorum's consumer notification process and the value of the remediation services offered. Second, the submission provided a summary of the Palomar indemnification settlement executed on October 27, 2023, including the financial terms and the enhanced security requirements imposed through MSA Amendment 3.

November 22, 2023 — Closure Letter Received. The multistate coalition issued its closure letter confirming that the inquiry had been concluded without enforcement action. This memorandum provides Calderwood & Harkness's detailed analysis of that closure letter.

III. Analysis of the Closure Letter

A. Key Language and Findings

The closure letter, which is being provided to Quorum under separate cover in its original form, confirms in its operative language that "the multistate coalition has concluded its review of this matter and has determined that no further action is warranted at this time." This language is unambiguous in its import: the twenty-nine-state coalition has made an affirmative determination, following its review of the extensive materials submitted by Quorum, that the matter does not warrant the initiation of any enforcement action.

Importantly, the closure letter identifies and acknowledges several specific factors that the coalition considered in reaching its determination. While the letter does not constitute a formal adjudication or finding, the explicit acknowledgment of these factors is significant because it reflects the coalition's assessment that Quorum acted reasonably and responsibly in connection with the incident. The factors acknowledged by the coalition include the following:

Third-Party Vendor Origin of the Breach. The closure letter expressly acknowledges that the data breach originated at a third-party vendor, Palomar Data Solutions, and not within Quorum's own systems or network infrastructure. This acknowledgment validates the central narrative that Calderwood & Harkness advanced in the October 13 response and throughout our engagement with the coalition — namely, that Quorum was the victim of its vendor's security failure rather than the entity responsible for the vulnerability that was exploited.

Prompt Engagement of Counsel and Forensic Investigators. The letter acknowledges that Quorum acted promptly upon receiving notification of the incident from Palomar, engaging experienced outside counsel and qualified forensic investigators to assess the scope and impact of the compromise. This recognition reflects favorably on Quorum's incident response preparedness and the speed with which the Company mobilized its response team.

Timely Consumer and Regulatory Notifications. The coalition acknowledged that Quorum completed all consumer and regulatory notifications within the timeframes required by the applicable state breach notification statutes across all twenty-nine affected jurisdictions. This finding was a critical component of the favorable outcome, as notification timing is frequently the primary point of scrutiny in multistate attorney general inquiries following data breaches. The fact that the coalition affirmatively found full compliance across all twenty-nine jurisdictions eliminates any basis for an enforcement action predicated on notification delay.

Complimentary Credit Monitoring and Identity Theft Protection. The letter notes that Quorum offered twenty-four months of complimentary credit monitoring and identity theft protection services to all 318,247 affected individuals. The twenty-four-month duration exceeds the minimum period that several of the participating states have indicated (through consent decrees and enforcement guidance in other matters) they consider appropriate, and this offering was explicitly acknowledged as a favorable factor.

Vendor Accountability Actions. The coalition recognized that Quorum took meaningful vendor accountability actions in response to the breach, including pursuing contractual indemnification against Palomar and securing enhanced data security requirements through the execution of MSA Amendment 3. This acknowledgment is particularly noteworthy because it reflects an evolving expectation among state regulators that data controllers — in addition to remediating the harm to affected consumers — should hold their vendors accountable for security failures that result in data compromises.

Comprehensive Information Security Program. The closure letter acknowledges that Quorum demonstrated a comprehensive information security program, including dedicated leadership positions responsible for information security governance. The letter specifically references the roles of David Naranjo (Chief Information Security Officer), Jennifer Liang (Chief Privacy Officer), and Priya Deshmukh (Vice President, Vendor Risk Management), reflecting the coalition's recognition that Quorum has invested in appropriate organizational structures and personnel to manage data security risks.

B. Reservations or Caveats

As is standard practice in multistate attorney general closure communications, the closure letter includes certain reservation-of-rights language. Specifically, the letter states that the closure of the multistate inquiry does not preclude individual state attorneys general from taking separate action should new facts come to light or should circumstances change materially in the future. This reservation-of-rights language preserves the theoretical ability of any of the twenty-nine participating states to initiate a standalone enforcement action at a later date.

Calderwood & Harkness wishes to emphasize, however, that this language is boilerplate and is included as a matter of course in virtually all multistate attorney general closure letters. We have reviewed closure letters from prior multistate investigations across a range of industries and subject matters, and this same or materially similar reservation language appears in substantially all of them. The inclusion of this language does not signal any present intent on the part of any participating state attorney general to pursue further action. Rather, it serves as a standard legal safeguard that preserves the sovereign enforcement authority of each individual state.

Critically, the closure letter imposes no specific conditions or requirements on Quorum of any kind. There is no requirement for Quorum to submit ongoing reports to the coalition or to any individual state attorney general. There is no requirement for Quorum to undergo compliance monitoring, auditing, or assessment by the coalition or any third party on behalf of the coalition. There is no requirement for Quorum to implement any specific remedial measures beyond those the Company has already voluntarily undertaken.

Additionally, the closure letter does not constitute or contain any admission of liability by Quorum, nor does it contain a finding that Quorum violated or failed to violate any applicable law, regulation, or standard. The absence of any finding of violation is important for Quorum's litigation risk profile, as discussed in Section V.A below.

C. Factors Contributing to the Favorable Outcome

In our assessment, several key factors contributed to the favorable closure of the multistate attorney general inquiry. We summarize these factors here both for the informational benefit of Quorum's leadership and as a basis for refining the Company's incident response protocols going forward.

The Vendor-Origin Narrative. From the outset of the multistate engagement, Calderwood & Harkness advanced a consistent and well-documented narrative that the data breach resulted from Palomar's failure to patch a known critical vulnerability (CVE-2023-0669) within the thirty-day window required by the Data Security Exhibit (Exhibit D) to the MSA, as amended. This narrative was substantiated by the Graystone forensic analysis and was presented in a manner that clearly distinguished Quorum as the victim client — the party whose data was entrusted to a vendor that failed to meet its contractual and security obligations — rather than the responsible party. This distinction is legally and factually significant, as state breach notification statutes and enforcement frameworks generally assign primary responsibility for a data security failure to the entity that maintained custody of the data and failed to protect it, rather than to the data owner that relied on its vendor to do so. By emphasizing this distinction consistently and credibly, Calderwood & Harkness was able to direct the coalition's focus toward Palomar's security failures and away from Quorum's own practices.

Timeliness and Completeness of Notifications. The demonstrable compliance of all regulatory filings across all twenty-nine states with the applicable statutory deadlines was a decisive factor. In our experience, notification timing is the single most common basis for attorney general enforcement actions in the data breach context. By ensuring that all notifications — both to regulators and to consumers — were filed and mailed within the required statutory windows, Quorum eliminated the most likely basis for an enforcement action. The jurisdictional compliance checklist included as part of Exhibit B to the October 13 response provided the coalition with a clear, state-by-state demonstration of compliance that left no ambiguity on this point.

Robust Consumer Remediation Measures. The offer of twenty-four months of complimentary credit monitoring and identity theft protection services through Clearfield Notification Services LLC, combined with the establishment of a dedicated consumer call center that remained operational for a twelve-week window following the commencement of consumer notifications, demonstrated a commitment to consumer protection that met or exceeded the expectations articulated in recent attorney general enforcement actions and consent decrees involving comparable incidents. The approximately forty percent credit monitoring enrollment rate reported in the November 3 supplemental submission further supported the effectiveness of these measures.

Vendor Accountability. The Palomar indemnification settlement executed on October 27, 2023 — comprising a $4,200,000 cash payment plus $1,956,000 in eighteen-month fee reductions, for a total effective recovery of $6,156,000 against Quorum's total incident costs of $8,230,250 — demonstrated that Quorum held its vendor financially accountable for the breach. This was a significant factor in the coalition's assessment. State attorneys general have increasingly scrutinized whether data controllers take meaningful action against vendors whose security failures result in data compromises, and Quorum's pursuit of substantial indemnification recovery reinforced the message that the Company did not simply absorb the costs of a breach for which its vendor was responsible.

In addition to the financial recovery, the execution of MSA Amendment 3 on October 27, 2023, imposed materially enhanced security requirements on Palomar, including the following:

• Reduction of the critical patch application deadline from thirty days to fourteen days;

• Implementation of mandatory endpoint detection and response ("EDR") technology across all systems processing or storing Quorum data;

• Quarterly vulnerability scanning of Palomar's infrastructure, with reports to be provided directly to Quorum's vendor risk management team;

• Annual independent third-party security assessments of Palomar's information security program, with findings reported to Quorum; and

• Reduction of the incident notification window from forty-eight hours to twenty-four hours.

The combination of financial recovery and prospective security enhancements conveyed to the coalition that Quorum was taking comprehensive, rather than merely reactive, steps to address the vendor relationship that gave rise to the incident.

Cooperative and Transparent Engagement. Finally, Quorum's posture throughout the multistate inquiry was cooperative and transparent. Calderwood & Harkness's comprehensive October 13 response addressed each of the coalition's inquiries in detail, and the November 3 supplemental submission was provided promptly in response to the coalition's follow-up request. This responsiveness reinforced a posture of good faith and openness that, in our experience, significantly influences the enforcement calculus of state attorneys general. Regulators are more inclined to close matters without action when the subject of the inquiry demonstrates a willingness to engage constructively and to provide complete and transparent information.

IV. Status of Remaining Regulatory Inquiries

A. Connecticut Insurance Department

In addition to the multistate attorney general inquiry, Quorum's notification of the incident to the Connecticut Insurance Department triggered a separate regulatory inquiry by that agency. The inquiry was initiated by Richard Nakamura of the Financial Analysis Division, Cybersecurity Unit, following Quorum's filing of the regulatory notification under Connecticut General Statutes § 38a-999b on August 14, 2023.

Calderwood & Harkness submitted a comprehensive response to the Connecticut Insurance Department's inquiry on September 22, 2023, and provided supplemental information on October 20, 2023. The Connecticut Insurance Department inquiry was particularly significant because Quorum is domiciled in Connecticut as a domestic insurer, meaning that the Connecticut Insurance Department is Quorum's home-state insurance regulator and exercises primary oversight over the Company's insurance operations, including its cybersecurity and data protection practices.

Based on informal communications with the Connecticut Insurance Department, Calderwood & Harkness was informed that a closure letter was anticipated by late November 2023. We have subsequently confirmed that the closure letter was issued on November 28, 2023, consistent with this expectation. The closure of the multistate attorney general inquiry strengthened the position for a favorable resolution with the Connecticut Insurance Department, as both regulators were aware of each other's inquiries and the Connecticut Attorney General's Office — which participated in the multistate coalition — had effectively determined that no enforcement action was warranted. While the Connecticut Insurance Department operates independently from the Attorney General's Office and applies different regulatory standards (focused on insurer solvency, policyholder protection, and compliance with insurance-specific cybersecurity requirements), the alignment of outcomes across both regulatory tracks is consistent and mutually reinforcing.

B. HHS Office for Civil Rights (Region I, Boston)

The component of the data compromise involving protected health information — specifically, the PHI of the 41,203 individuals whose health conditions, diagnosis codes, and treatment information from workers' compensation and health-related claims were compromised — required notification to the U.S. Department of Health and Human Services, Office for Civil Rights ("HHS-OCR"), under the HIPAA Breach Notification Rule.

Quorum filed its HIPAA breach notification with HHS-OCR on August 15, 2023, through the HHS breach reporting portal. Because the breach affected more than 500 individuals, it also triggered the requirement for media notification in states with affected individuals, which was coordinated as part of the overall consumer notification process. HHS-OCR assigned the matter to its Region I (Boston) office.

Calderwood & Harkness submitted a response to HHS-OCR's inquiry on October 5, 2023, addressing the agency's questions regarding the circumstances of the breach, the safeguards in place at the time, the notification process, and the remedial measures implemented. Based on the content of HHS-OCR's inquiry communications and our experience with the agency's enforcement priorities, we anticipate that HHS-OCR will issue a no further action letter. The favorable multistate attorney general resolution, coupled with Quorum's demonstrated compliance with the HIPAA Breach Notification Rule — including timely notification, appropriate notification content, and compliant media notice for jurisdictions with more than 500 affected individuals — supports a no-action outcome. We expect the HHS-OCR closure to occur by the end of November or early December 2023.

V. Implications and Remaining Considerations

A. Litigation Risk Assessment

The closure of the multistate attorney general inquiry without enforcement action significantly reduces the overall risk profile for the Palomar Data Solutions incident. The multistate inquiry represented the most consequential regulatory threat facing Quorum in connection with the breach, given the potential for a coordinated enforcement action by twenty-nine state attorneys general, which could have resulted in substantial monetary penalties, injunctive relief, and a consent decree imposing ongoing monitoring and compliance obligations. The elimination of this threat is a material and favorable development for the Company.

As of the date of this memorandum, no private class action litigation has been filed against Quorum in connection with the Palomar breach. The passage of approximately two to three months since the commencement of consumer notifications (August through September 2023) without the filing of litigation is a favorable indicator, as class action complaints in data breach matters are typically filed within the first thirty to sixty days following consumer notification, when media attention and consumer awareness are at their peak. However, we note that the applicable statutes of limitations for potential claims — including negligence, breach of contract, breach of implied covenant, state consumer protection act violations, and statutory data breach claims — have not expired, and the possibility of future litigation cannot be excluded entirely.

Should private litigation arise in the future, the multistate attorney general closure letter and the absence of any finding of violation by the coalition would constitute favorable factors in Quorum's defense. While the closure letter itself is not binding on private plaintiffs and does not preclude private claims, the absence of a regulatory finding of wrongdoing undermines the foundation of any plaintiff theory premised on the assumption that Quorum failed to comply with applicable legal standards. Additionally, the facts supporting the favorable closure — the vendor-origin nature of the breach, the timeliness of notifications, and the robustness of Quorum's response — would be equally favorable in the litigation context.

Quorum should maintain all documents and evidence related to the incident in accordance with the document retention protocol that Calderwood & Harkness will issue in connection with the matter closure. The preservation of the factual record supporting the favorable regulatory outcome will be important in the event of any future litigation.

B. SEC Disclosure Considerations

Calderwood & Harkness's Privacy & Data Security practice group, in consultation with the firm's Securities & Capital Markets practice group, previously prepared an SEC Disclosure Analysis Memorandum dated July 19, 2023 (prepared by Rachel Bernstein, Partner, Securities & Capital Markets, and Alan Burke, Associate, Privacy & Data Security), which assessed the incident against the SEC's cybersecurity disclosure requirements, including the then-newly adopted rules regarding material cybersecurity incident disclosure on Form 8-K. That analysis concluded that the incident, considered in the context of Quorum's overall financial position and operations, did not appear to constitute a material cybersecurity incident requiring a standalone 8-K filing.

The favorable closure of the multistate attorney general inquiry, combined with the following financial considerations, reinforces that conclusion:

• Quorum's total incident costs of $8,230,250 are modest relative to the Company's $4.82 billion annual revenue and approximately $6.1 billion market capitalization.

• Quorum's cyber insurance policy with Atlas Mutual Insurance Company (Policy No. CYB-2023-041587) provides coverage for $5,730,250 of the total costs (i.e., total costs of $8,230,250 less the $2,500,000 self-insured retention), substantially offsetting the Company's out-of-pocket exposure.

• The Palomar indemnification recovery of $6,156,000 ($4,200,000 cash plus $1,956,000 in fee reductions) further mitigates the financial impact of the incident. When both the insurance recovery and the Palomar indemnification recovery are considered, Quorum's net financial impact from the incident is expected to be negligible or potentially result in a modest net recovery position.

Given these factors, we continue to recommend that the incident does not require a standalone 8-K filing as a material cybersecurity incident. However, we recommend that Quorum include appropriate risk factor disclosure in its upcoming 10-Q and 10-K filings, referencing the incident, its favorable regulatory resolution, and the remediation measures implemented, without the need for a standalone current report. This approach balances the Company's disclosure obligations under the federal securities laws with the non-material nature of the incident's financial and operational impact.

Coordination with Halstead & Monroe LLP, Quorum's external auditor (engagement partner Gregory Chin), may be appropriate to the extent there are any financial statement implications arising from the incident costs, insurance recoveries, or Palomar indemnification recovery that should be addressed in the Company's quarterly or annual financial statements or related disclosures.

C. Vendor Relationship — Palomar Data Solutions

The MSA with Palomar Data Solutions, which has an original term running through November 11, 2024, remains in full force and effect, as supplemented by the enhanced security and operational requirements set forth in MSA Amendment 3, executed on October 27, 2023. Several near-term action items relating to the Palomar vendor relationship require attention:

Cash Payment. Palomar's obligation to remit the $4,200,000 cash indemnification payment is due within thirty days of the execution of the indemnification settlement (i.e., by approximately November 26, 2023). Quorum's finance team should confirm receipt of this payment by the contractual deadline and promptly notify Calderwood & Harkness if payment is not received.

Fee Reductions. The eighteen-month eight percent fee reduction, effective November 1, 2023, through April 30, 2025, which represents an aggregate value of approximately $1,956,000, should be tracked and confirmed in each subsequent invoice cycle. Quorum's accounts payable team and Priya Deshmukh's vendor risk management team should jointly verify that the fee reductions are properly reflected beginning with the November 2023 invoice.

Enhanced Security Obligations. Under MSA Amendment 3, Palomar is obligated to engage an independent third-party security assessor and to implement the enhanced patch management protocols and mandatory endpoint detection and response technology within ninety days of October 27, 2023 (i.e., by approximately January 25, 2024). Calderwood & Harkness recommends that these deadlines be actively monitored by Priya Deshmukh and her vendor risk management team, with formal confirmation of compliance obtained from Palomar as each milestone is reached.

Termination Rights. Quorum retains the right to terminate the MSA for cause under Section 14.2 of the agreement based on Palomar's material breaches in connection with the incident (including the failure to patch CVE-2023-0669 within the required window and the delayed incident notification). Calderwood & Harkness recommends that Quorum evaluate whether to exercise these termination rights or to allow the MSA to run through its remaining term, taking into account the following considerations: (a) the business continuity implications of transitioning claims-processing operations to an alternative vendor, including the timeline and cost of such a transition; (b) the enhanced security provisions now in place under MSA Amendment 3, which materially strengthen the contractual security framework governing the relationship; and (c) the financial value of the remaining fee reductions under the indemnification settlement, which would need to be assessed in the context of any early termination. This evaluation should be conducted by Quorum's business leadership, in consultation with General Counsel and with input from Calderwood & Harkness as needed.

D. Insurance Recovery

Calderwood & Harkness, in coordination with Quorum's risk management team, submitted the proof of loss and final cost summary to Atlas Mutual Insurance Company on November 15, 2023, under Quorum's cyber insurance policy (Policy No. CYB-2023-041587, Claim No. CYB-CLM-2023-05892). The submission seeks reimbursement of $5,730,250, representing the difference between Quorum's total incident costs of $8,230,250 and the $2,500,000 self-insured retention ("SIR") under the policy.

Atlas Mutual has acknowledged coverage for the claim, and we do not anticipate any coverage dispute. The favorable regulatory outcome — and, in particular, the absence of any finding of violation or penalty — should facilitate a straightforward claims adjustment process.

We note that the Pinnacle Surplus Lines excess layer policy (Policy No. XS-CYB-2023-7812), which provides $25,000,000 in coverage excess of the $15,000,000 primary layer, was not implicated by this incident, as total costs remained well within the primary policy limits.

One area requiring attention is the coordination between the Palomar indemnification recovery and the Atlas insurance claim. The $6,156,000 total recovery from Palomar should be evaluated in light of the Atlas policy's subrogation provisions, which may entitle Atlas Mutual to assert subrogation rights against Palomar to the extent that Atlas pays Quorum's claim. Quorum's settlement with Palomar was executed prior to the final submission of the insurance proof of loss, and Calderwood & Harkness recommends that the insurance recovery be coordinated carefully with the Atlas claims team (contact: Paul Enriquez) to ensure proper allocation of recoveries and to confirm that the Palomar settlement does not create any issues under the policy's subrogation clause. This may require providing Atlas with notice of the Palomar settlement and obtaining Atlas's consent or waiver of subrogation to the extent applicable.

VI. Recommendations

Based on the foregoing analysis, Calderwood & Harkness recommends the following immediate and ongoing actions.

A. Immediate Steps

1. Board Notification. Circulate the closure letter to the Quorum Board of Directors Audit Committee (Franklin Reeves, Chair) as part of the matter resolution briefing. The favorable closure of the multistate attorney general inquiry is a material development that should be communicated to the Board in a timely manner, consistent with the Company's governance practices and the Board's prior involvement in overseeing the incident response.

2. Palomar Payment Confirmation. Confirm receipt of Palomar's $4,200,000 cash indemnification payment by the contractual deadline of approximately November 26, 2023. If payment is not received by that date, Calderwood & Harkness should be notified immediately to assess enforcement options under the settlement agreement.

3. Insurance Coordination. Coordinate with Rachel Bernstein (Calderwood & Harkness, Securities & Capital Markets) and the Atlas Mutual claims team (Paul Enriquez) regarding final insurance recovery processing and any subrogation implications arising from the Palomar indemnification settlement. Ensure that the Palomar settlement terms and recovery amounts are properly disclosed to Atlas to avoid any potential issues under the policy's subrogation provisions.

4. Internal Communication. Issue an internal communication to Quorum senior leadership confirming the favorable resolution of the multistate attorney general track. This communication should be prepared in consultation with Calderwood & Harkness to ensure that it is appropriately worded and does not inadvertently waive any privileges or create any unintended implications.

B. Ongoing Compliance Steps

1. Palomar Amendment 3 Monitoring. Continue monitoring Palomar's compliance with the enhanced security requirements imposed by MSA Amendment 3, including the fourteen-day critical patch management deadline, mandatory endpoint detection and response implementation, quarterly vulnerability scanning with reports to Quorum, and the engagement of an independent third-party security assessor for an annual assessment. Primary oversight responsibility should be assigned to Priya Deshmukh, Vice President, Vendor Risk Management, with periodic reporting to General Counsel and the Chief Privacy Officer.

2. Post-Incident Recommendations. Implement the post-incident recommendations that will be detailed in Calderwood & Harkness's forthcoming Post-Incident Lessons Learned & Remediation Recommendations Memorandum, which will be prepared upon the conclusion of all regulatory tracks and will address opportunities to strengthen Quorum's incident response protocols, vendor management practices, and information security governance based on the experience gained through this matter.

3. Document Retention and Privilege Maintenance. Maintain all privileged documents, attorney work product, and attorney-client communications related to the matter in accordance with the Document Retention & Privilege Log Protocol to be issued by Calderwood & Harkness in connection with the matter closure. It is essential that the integrity of the privilege over these materials be preserved, particularly in light of the potential — however remote — for future private litigation.

4. Vendor Risk Management Program Enhancements. Update Quorum's enterprise-wide vendor risk management program based on the lessons learned from the Palomar incident. Specific areas for enhancement include strengthened vendor security due diligence processes during onboarding and renewal; shorter contractual notification windows for all critical vendors handling sensitive data; expanded third-party audit and assessment requirements built into vendor contracts; and enhanced contractual indemnification provisions addressing vendor-originated security incidents.

5. Tabletop Exercises. Conduct tabletop exercises that specifically incorporate vendor-originated data breach scenarios, to test and refine Quorum's incident response capabilities in the context of third-party security events. These exercises should involve cross-functional participation from legal, information security, privacy, vendor risk management, and business operations teams, and should be designed to simulate the coordination challenges inherent in responding to a breach that originates outside the Company's direct control.

C. Engagement Status

Upon the closure of the Connecticut Insurance Department inquiry (confirmed as issued November 28, 2023) and receipt of the HHS-OCR no further action letter (expected by the end of November or early December 2023), Calderwood & Harkness will prepare the Matter Closing Memorandum and formally close Matter No. 1025-00006. Based on current expectations, the anticipated matter closure date is December 1, 2023, subject to the timing of the HHS-OCR resolution.

VII. Conclusion

The closure of the multistate attorney general inquiry without enforcement action represents the most significant regulatory milestone in the Palomar Data Solutions incident response and constitutes a highly favorable outcome for Quorum Insurance Holdings Corp. The multistate inquiry — involving a coalition of twenty-nine state attorneys general, co-led by the Connecticut and New York Attorneys General — posed the most consequential regulatory risk arising from the incident, and its resolution without any fine, penalty, consent decree, or monitoring obligation is a testament to the effectiveness of Quorum's incident response strategy and the strength of the factual record that was presented to the coalition.

The favorable closure validates the core elements of the overall incident response approach that Quorum, with the guidance of Calderwood & Harkness, pursued from the outset: the prompt engagement of experienced outside counsel and qualified forensic investigators; transparent and timely regulatory and consumer notifications across all affected jurisdictions; robust consumer remediation measures, including twenty-four months of complimentary credit monitoring and identity theft protection; meaningful financial and contractual accountability imposed on the vendor responsible for the security failure; and cooperative, good-faith engagement with regulators throughout the inquiry process.

With the Connecticut Insurance Department closure now confirmed and the HHS-OCR matter on a parallel positive trajectory, Quorum is well positioned to conclude the entire regulatory and enforcement chapter of the data breach response in the very near term. Upon closure of all regulatory tracks, Calderwood & Harkness will deliver the final Matter Closing Memorandum and the Post-Incident Lessons Learned & Remediation Recommendations Memorandum to support Quorum's continued strengthening of its information security and vendor risk management programs.

Calderwood & Harkness remains available to discuss this analysis and its implications with Quorum's leadership at any time. We will continue to monitor the remaining regulatory tracks and will provide prompt updates as additional developments occur.

Respectfully submitted,

CALDERWOOD & HARKNESS LLP

By: ________

Kevin Ostrowski Partner, Privacy & Data Security Direct: (202) 555-7142 kostrowski@calderwoodharkness.com

By: ________

Alan Burke Associate, Privacy & Data Security Direct: (202) 555-7238 aburke@calderwoodharkness.com

PRIVILEGED AND CONFIDENTIAL — ATTORNEY-CLIENT PRIVILEGE / ATTORNEY WORK PRODUCT Calderwood & Harkness LLP

CALDERWOOD & HARKNESS LLP Attorneys at Law
1700 K Street NW, Suite 900 Washington, D.C. 20006 Telephone: (202) 555-7100 Facsimile: (202) 555-7199 www.calderwoodharkness.com
PRIVILEGED AND CONFIDENTIAL ATTORNEY-CLIENT PRIVILEGED / ATTORNEY WORK PRODUCT
November 24, 2023
MEMORANDUM
TO:
Thomas R. Whitfield, General Counsel, Quorum Insurance Holdings Corp. Jennifer Liang, Chief Privacy Officer, Quorum Insurance Holdings Corp. Margaret D. Calloway, Chief Executive Officer, Quorum Insurance Holdings Corp.
FROM:
Kevin Ostrowski, Partner, Privacy & Data Security, Calderwood & Harkness LLP Alan Burke, Associate, Privacy & Data Security, Calderwood & Harkness LLP
DATE: November 24, 2023
RE: Analysis of Multistate Attorney General Closure Letter and Implications — Palomar Data Solutions Security Incident
Matter No.: 1025-00006
This memorandum is a privileged and confidential attorney-client communication and attorney work product. It is intended solely for the use of the addressees named above. This memorandum should not be disclosed, distributed, or otherwise made available to any third party without the prior written consent of Calderwood & Harkness LLP. Disclosure to any unauthorized party could result in a waiver of applicable privileges.
I. Executive Summary
This memorandum provides a comprehensive analysis of the closure letter dated November 22, 2023, received from the twenty-nine-state multistate attorney general coalition, which confirms the closure of the enforcement inquiry relating to the Palomar Data Solutions security incident without any enforcement action being taken against Quorum Insurance Holdings Corp. ("Quorum" or the "Company"). The closure letter was signed by Assistant Attorney General Diane Marchetti of the Connecticut Attorney General's Office, Consumer Protection Division, and Assistant Attorney General Mark Petrosian of the New York Attorney General's Office, Bureau of Internet and Technology, in their capacities as co-leads of the multistate coalition, on behalf of all twenty-nine participating states.
This outcome represents a highly favorable resolution for Quorum. Critically, the closure letter imposes no enforcement action, no consent decree, no monetary fine or civil penalty, and no ongoing monitoring obligation of any kind on the Company. The multistate coalition has effectively determined that no further action is warranted based on its review of the facts, Quorum's response to the underlying incident, and the information submitted by Calderwood & Harkness on Quorum's behalf.
By way of procedural context, the multistate inquiry was formally opened on September 8, 2023, when Calderwood & Harkness received the joint demand letter on Quorum's behalf. Quorum, through Calderwood & Harkness, submitted its comprehensive written response on October 13, 2023, accompanied by four detailed exhibits. A supplemental information submission followed on November 3, 2023, providing updated credit monitoring enrollment statistics and a summary of the Palomar indemnification settlement. The closure letter was received approximately seventy-five days after the initial demand letter — a relatively expeditious resolution timeline for a multistate attorney general investigation of this nature, which in our experience can extend for six months or longer in cases involving data compromises of comparable scope.
We further note that this favorable outcome, when combined with the Connecticut Insurance Department closure that is expected imminently (and has since been confirmed as issued on November 28, 2023), and the pending inquiry by the U.S. Department of Health and Human Services, Office for Civil Rights ("HHS-OCR"), positions Quorum to close the regulatory chapter of the incident response in its entirety in the near term. As discussed in greater detail in Section IV of this memorandum, the remaining regulatory tracks — the Connecticut Insurance Department inquiry and the HHS-OCR review — are both on parallel positive trajectories that we expect will result in similarly favorable outcomes.
The balance of this memorandum sets forth the background and procedural history of the matter, a detailed analysis of the closure letter's key language and implications, the status of remaining regulatory inquiries, and our recommendations for immediate and ongoing actions.
II. Background and Procedural History
A. The Underlying Incident
The events giving rise to the multistate attorney general inquiry originated not within Quorum's own systems or network infrastructure, but rather at Palomar Data Solutions, Inc. ("Palomar"), Quorum's third-party claims-processing vendor. Palomar provides claims intake, adjudication support, and payment processing services to Quorum under a Master Services Agreement dated November 12, 2019, as subsequently amended (the "MSA"). In the course of providing these services, Palomar maintains custody of certain personally identifiable information ("PII") and protected health information ("PHI") belonging to Quorum policyholders and claimants.
The breach at Palomar resulted from the exploitation of CVE-2023-0669, a critical remote code execution vulnerability affecting Severin Corporation's GoAnywhere Managed File Transfer ("MFT") platform. This vulnerability, which was publicly disclosed and assigned a Common Vulnerabilities and Exposures identifier in early 2023, allowed threat actors to achieve unauthenticated remote code execution on vulnerable GoAnywhere MFT servers. Palomar's failure to apply the vendor-issued patch for this vulnerability within the timeframe required by its contractual obligations to Quorum — specifically, the thirty-day critical patch deadline set forth in Exhibit D (Data Security Requirements) to the MSA, as amended — provided the threat actor with the attack vector used to gain unauthorized access to Palomar's file transfer appliance.
The unauthorized access window has been determined, through forensic investigation, to span approximately thirty-five days, from March 14, 2023, through April 18, 2023. During this period, the threat actor was able to exfiltrate data files containing information pertaining to Quorum policyholders and claimants. Palomar's Security Operations Center ("SOC") first identified anomalous outbound data transfers from the affected file transfer appliance on April 18, 2023, and initiated its internal investigation on that date.
Palomar provided formal notification to Quorum of the security incident on April 21, 2023. This notification was delivered approximately twenty-four hours past the forty-eight-hour contractual notification requirement established under Section 9.4 of the MSA, as amended. While the delayed notification did not materially alter the scope of the data compromise, it constituted a contractual breach by Palomar that was addressed as part of the subsequent indemnification and remediation discussions.
The forensic investigation and subsequent data mining ultimately determined that a total of 318,247 individuals across twenty-nine states and the District of Columbia were affected by the incident. The types of data compromised varied across the affected population, as follows:
• Personally Identifiable Information (PII): For all 318,247 affected individuals, the compromised data included full names, dates of birth, Social Security numbers, and driver's license numbers.
• Financial Information: For a subset of 84,619 individuals, the compromised data additionally included bank account numbers, routing numbers, and/or payment card numbers associated with premium payments or claims disbursements.
• Protected Health Information (PHI): For a further subset of 41,203 individuals, the compromised data included health conditions, medical diagnosis codes (ICD-10), and treatment information derived from workers' compensation claims and other health-related insurance claims processed by Palomar on Quorum's behalf.
The breadth of the data compromise — encompassing PII, financial information, and PHI across a population exceeding 300,000 individuals in twenty-nine states — made the incident a significant regulatory event requiring coordinated engagement with multiple state and federal regulators.
B. Quorum's Engagement of Counsel and Response
Quorum's response to the incident proceeded on a coordinated and deliberate timeline following receipt of Palomar's notification. The key milestones are summarized below:
Engagement of Outside Counsel. Calderwood & Harkness LLP was engaged by Quorum's General Counsel, Thomas R. Whitfield, on May 4, 2023, to serve as lead outside counsel for all aspects of the data breach response, including forensic investigation oversight, regulatory compliance and notifications, consumer notification management, and regulatory defense.
Retention of Forensic Investigators. On May 5, 2023, Graystone Forensics LLC ("Graystone") was retained under the direction and at the request of Calderwood & Harkness, under the protection of the attorney-client privilege and work product doctrine, to conduct an independent forensic investigation of the Palomar incident and to provide expert analysis of the scope, nature, and cause of the data compromise. Graystone issued its preliminary forensic findings on June 2, 2023, confirming the exploitation of CVE-2023-0669 as the root cause and establishing the approximate unauthorized access window. Graystone's final forensic report was delivered on July 14, 2023, and provided the definitive factual foundation for all subsequent regulatory filings and submissions.
Data Mining and Affected Individual Identification. The process of identifying all affected individuals and the specific data elements compromised for each individual — a critical prerequisite for both regulatory notification and consumer notification compliance — was completed on August 4, 2023. This process required substantial coordination between Graystone, Palomar, and Quorum's internal information technology and claims teams to reconcile the exfiltrated data sets against Quorum's records of insured individuals and claimants.
Consumer Notifications. Individual consumer notification letters were mailed on a rolling basis between August 18, 2023, and September 15, 2023, covering all 318,247 affected individuals. The notifications were managed through Clearfield Notification Services LLC ("Clearfield") and were tailored to comply with the specific statutory requirements of each affected individual's state of residence. Each notification letter included a description of the incident, the categories of information compromised for that individual, a description of the steps Quorum had taken in response, an offer of twenty-four months of complimentary credit monitoring and identity theft protection services, and contact information for the dedicated call center established by Quorum to address inquiries from affected individuals.
Regulatory Notifications. Regulatory notification filings were submitted to all required state regulators and, where applicable, the federal government between August 14, 2023, and August 25, 2023. All notifications were confirmed to be timely under the applicable statutes of each jurisdiction. Specifically, Calderwood & Harkness confirmed compliance with the notification timing requirements of each of the twenty-nine affected states' breach notification statutes, as well as the HIPAA Breach Notification Rule (45 C.F.R. §§ 164.400–414) with respect to the PHI component of the compromise. In no instance did a regulatory notification filing exceed the statutory deadline applicable to that jurisdiction.
C. Multistate AG Inquiry Timeline
The procedural history of the multistate attorney general inquiry that is the primary subject of this memorandum is summarized below:
September 8, 2023 — Joint Demand Letter Received. Calderwood & Harkness received a joint demand letter issued by the Connecticut Attorney General's Office (specifically, AAG Diane Marchetti of the Consumer Protection Division) and the New York Attorney General's Office (specifically, AAG Mark Petrosian of the Bureau of Internet and Technology), acting in their capacities as co-leads of a coalition of twenty-nine state attorneys general. The demand letter identified the Palomar-originated data breach as the subject of the inquiry and requested comprehensive information regarding Quorum's knowledge of the incident, its response and remediation actions, the scope and nature of affected consumer data, the status of consumer notifications, the vendor relationship with Palomar, and Quorum's overall information security program. The letter set a response deadline of thirty days.
September 10, 2023 — Expanded Engagement. Following receipt of the demand letter, Calderwood & Harkness's engagement scope was formally expanded to include full regulatory defense of the multistate attorney general inquiry, in addition to the ongoing data breach response work.
October 13, 2023 — Comprehensive Written Response. Calderwood & Harkness submitted a comprehensive written response to the multistate coalition on Quorum's behalf, accompanied by four supporting exhibits:
• Exhibit A: Detailed incident timeline and description of remedial measures taken by Quorum and Palomar.
• Exhibit B: Representative consumer notification letter samples for each affected jurisdiction, along with a jurisdictional compliance checklist demonstrating timely filing and content compliance for each state.
• Exhibit C: Palomar vendor accountability summary, including a narrative of Palomar's contractual obligations, the specific contractual breach (failure to apply the CVE-2023-0669 patch within the contractual thirty-day window), the indemnification demand, and the status of indemnification discussions.
• Exhibit D: Quorum information security program overview, describing the Company's enterprise-wide data security framework, governance structure, technical controls, and vendor risk management practices.
The response was designed to present Quorum's incident response in the most comprehensive and favorable light, emphasizing the vendor-origin nature of the breach, the timeliness and completeness of Quorum's response and notifications, the robustness of Quorum's own information security program, and the concrete accountability measures being pursued with respect to Palomar.
November 3, 2023 — Supplemental Information Submission. In response to an informal follow-up communication from the coalition, Calderwood & Harkness submitted a supplemental information package that included two key updates. First, the submission provided current credit monitoring enrollment statistics, reporting that approximately forty percent of affected individuals — roughly 127,299 enrollees out of 318,247 total affected individuals — had enrolled in the complimentary credit monitoring and identity theft protection services offered by Quorum. This enrollment rate, which is above the industry average for incidents of this type, was cited as evidence of the effectiveness of Quorum's consumer notification process and the value of the remediation services offered. Second, the submission provided a summary of the Palomar indemnification settlement executed on October 27, 2023, including the financial terms and the enhanced security requirements imposed through MSA Amendment 3.
November 22, 2023 — Closure Letter Received. The multistate coalition issued its closure letter confirming that the inquiry had been concluded without enforcement action. This memorandum provides Calderwood & Harkness's detailed analysis of that closure letter.
III. Analysis of the Closure Letter
A. Key Language and Findings
The closure letter, which is being provided to Quorum under separate cover in its original form, confirms in its operative language that "the multistate coalition has concluded its review of this matter and has determined that no further action is warranted at this time." This language is unambiguous in its import: the twenty-nine-state coalition has made an affirmative determination, following its review of the extensive materials submitted by Quorum, that the matter does not warrant the initiation of any enforcement action.
Importantly, the closure letter identifies and acknowledges several specific factors that the coalition considered in reaching its determination. While the letter does not constitute a formal adjudication or finding, the explicit acknowledgment of these factors is significant because it reflects the coalition's assessment that Quorum acted reasonably and responsibly in connection with the incident. The factors acknowledged by the coalition include the following:
Third-Party Vendor Origin of the Breach. The closure letter expressly acknowledges that the data breach originated at a third-party vendor, Palomar Data Solutions, and not within Quorum's own systems or network infrastructure. This acknowledgment validates the central narrative that Calderwood & Harkness advanced in the October 13 response and throughout our engagement with the coalition — namely, that Quorum was the victim of its vendor's security failure rather than the entity responsible for the vulnerability that was exploited.
Prompt Engagement of Counsel and Forensic Investigators. The letter acknowledges that Quorum acted promptly upon receiving notification of the incident from Palomar, engaging experienced outside counsel and qualified forensic investigators to assess the scope and impact of the compromise. This recognition reflects favorably on Quorum's incident response preparedness and the speed with which the Company mobilized its response team.
Timely Consumer and Regulatory Notifications. The coalition acknowledged that Quorum completed all consumer and regulatory notifications within the timeframes required by the applicable state breach notification statutes across all twenty-nine affected jurisdictions. This finding was a critical component of the favorable outcome, as notification timing is frequently the primary point of scrutiny in multistate attorney general inquiries following data breaches. The fact that the coalition affirmatively found full compliance across all twenty-nine jurisdictions eliminates any basis for an enforcement action predicated on notification delay.
Complimentary Credit Monitoring and Identity Theft Protection. The letter notes that Quorum offered twenty-four months of complimentary credit monitoring and identity theft protection services to all 318,247 affected individuals. The twenty-four-month duration exceeds the minimum period that several of the participating states have indicated (through consent decrees and enforcement guidance in other matters) they consider appropriate, and this offering was explicitly acknowledged as a favorable factor.
Vendor Accountability Actions. The coalition recognized that Quorum took meaningful vendor accountability actions in response to the breach, including pursuing contractual indemnification against Palomar and securing enhanced data security requirements through the execution of MSA Amendment 3. This acknowledgment is particularly noteworthy because it reflects an evolving expectation among state regulators that data controllers — in addition to remediating the harm to affected consumers — should hold their vendors accountable for security failures that result in data compromises.
Comprehensive Information Security Program. The closure letter acknowledges that Quorum demonstrated a comprehensive information security program, including dedicated leadership positions responsible for information security governance. The letter specifically references the roles of David Naranjo (Chief Information Security Officer), Jennifer Liang (Chief Privacy Officer), and Priya Deshmukh (Vice President, Vendor Risk Management), reflecting the coalition's recognition that Quorum has invested in appropriate organizational structures and personnel to manage data security risks.
B. Reservations or Caveats
As is standard practice in multistate attorney general closure communications, the closure letter includes certain reservation-of-rights language. Specifically, the letter states that the closure of the multistate inquiry does not preclude individual state attorneys general from taking separate action should new facts come to light or should circumstances change materially in the future. This reservation-of-rights language preserves the theoretical ability of any of the twenty-nine participating states to initiate a standalone enforcement action at a later date.
Calderwood & Harkness wishes to emphasize, however, that this language is boilerplate and is included as a matter of course in virtually all multistate attorney general closure letters. We have reviewed closure letters from prior multistate investigations across a range of industries and subject matters, and this same or materially similar reservation language appears in substantially all of them. The inclusion of this language does not signal any present intent on the part of any participating state attorney general to pursue further action. Rather, it serves as a standard legal safeguard that preserves the sovereign enforcement authority of each individual state.
Critically, the closure letter imposes no specific conditions or requirements on Quorum of any kind. There is no requirement for Quorum to submit ongoing reports to the coalition or to any individual state attorney general. There is no requirement for Quorum to undergo compliance monitoring, auditing, or assessment by the coalition or any third party on behalf of the coalition. There is no requirement for Quorum to implement any specific remedial measures beyond those the Company has already voluntarily undertaken.
Additionally, the closure letter does not constitute or contain any admission of liability by Quorum, nor does it contain a finding that Quorum violated or failed to violate any applicable law, regulation, or standard. The absence of any finding of violation is important for Quorum's litigation risk profile, as discussed in Section V.A below.
C. Factors Contributing to the Favorable Outcome
In our assessment, several key factors contributed to the favorable closure of the multistate attorney general inquiry. We summarize these factors here both for the informational benefit of Quorum's leadership and as a basis for refining the Company's incident response protocols going forward.
The Vendor-Origin Narrative. From the outset of the multistate engagement, Calderwood & Harkness advanced a consistent and well-documented narrative that the data breach resulted from Palomar's failure to patch a known critical vulnerability (CVE-2023-0669) within the thirty-day window required by the Data Security Exhibit (Exhibit D) to the MSA, as amended. This narrative was substantiated by the Graystone forensic analysis and was presented in a manner that clearly distinguished Quorum as the victim client — the party whose data was entrusted to a vendor that failed to meet its contractual and security obligations — rather than the responsible party. This distinction is legally and factually significant, as state breach notification statutes and enforcement frameworks generally assign primary responsibility for a data security failure to the entity that maintained custody of the data and failed to protect it, rather than to the data owner that relied on its vendor to do so. By emphasizing this distinction consistently and credibly, Calderwood & Harkness was able to direct the coalition's focus toward Palomar's security failures and away from Quorum's own practices.
Timeliness and Completeness of Notifications. The demonstrable compliance of all regulatory filings across all twenty-nine states with the applicable statutory deadlines was a decisive factor. In our experience, notification timing is the single most common basis for attorney general enforcement actions in the data breach context. By ensuring that all notifications — both to regulators and to consumers — were filed and mailed within the required statutory windows, Quorum eliminated the most likely basis for an enforcement action. The jurisdictional compliance checklist included as part of Exhibit B to the October 13 response provided the coalition with a clear, state-by-state demonstration of compliance that left no ambiguity on this point.
Robust Consumer Remediation Measures. The offer of twenty-four months of complimentary credit monitoring and identity theft protection services through Clearfield Notification Services LLC, combined with the establishment of a dedicated consumer call center that remained operational for a twelve-week window following the commencement of consumer notifications, demonstrated a commitment to consumer protection that met or exceeded the expectations articulated in recent attorney general enforcement actions and consent decrees involving comparable incidents. The approximately forty percent credit monitoring enrollment rate reported in the November 3 supplemental submission further supported the effectiveness of these measures.
Vendor Accountability. The Palomar indemnification settlement executed on October 27, 2023 — comprising a $4,200,000 cash payment plus $1,956,000 in eighteen-month fee reductions, for a total effective recovery of $6,156,000 against Quorum's total incident costs of $8,230,250 — demonstrated that Quorum held its vendor financially accountable for the breach. This was a significant factor in the coalition's assessment. State attorneys general have increasingly scrutinized whether data controllers take meaningful action against vendors whose security failures result in data compromises, and Quorum's pursuit of substantial indemnification recovery reinforced the message that the Company did not simply absorb the costs of a breach for which its vendor was responsible.
In addition to the financial recovery, the execution of MSA Amendment 3 on October 27, 2023, imposed materially enhanced security requirements on Palomar, including the following:
• Reduction of the critical patch application deadline from thirty days to fourteen days;
• Implementation of mandatory endpoint detection and response ("EDR") technology across all systems processing or storing Quorum data;
• Quarterly vulnerability scanning of Palomar's infrastructure, with reports to be provided directly to Quorum's vendor risk management team;
• Annual independent third-party security assessments of Palomar's information security program, with findings reported to Quorum; and
• Reduction of the incident notification window from forty-eight hours to twenty-four hours.
The combination of financial recovery and prospective security enhancements conveyed to the coalition that Quorum was taking comprehensive, rather than merely reactive, steps to address the vendor relationship that gave rise to the incident.
Cooperative and Transparent Engagement. Finally, Quorum's posture throughout the multistate inquiry was cooperative and transparent. Calderwood & Harkness's comprehensive October 13 response addressed each of the coalition's inquiries in detail, and the November 3 supplemental submission was provided promptly in response to the coalition's follow-up request. This responsiveness reinforced a posture of good faith and openness that, in our experience, significantly influences the enforcement calculus of state attorneys general. Regulators are more inclined to close matters without action when the subject of the inquiry demonstrates a willingness to engage constructively and to provide complete and transparent information.
IV. Status of Remaining Regulatory Inquiries
A. Connecticut Insurance Department
In addition to the multistate attorney general inquiry, Quorum's notification of the incident to the Connecticut Insurance Department triggered a separate regulatory inquiry by that agency. The inquiry was initiated by Richard Nakamura of the Financial Analysis Division, Cybersecurity Unit, following Quorum's filing of the regulatory notification under Connecticut General Statutes § 38a-999b on August 14, 2023.
Calderwood & Harkness submitted a comprehensive response to the Connecticut Insurance Department's inquiry on September 22, 2023, and provided supplemental information on October 20, 2023. The Connecticut Insurance Department inquiry was particularly significant because Quorum is domiciled in Connecticut as a domestic insurer, meaning that the Connecticut Insurance Department is Quorum's home-state insurance regulator and exercises primary oversight over the Company's insurance operations, including its cybersecurity and data protection practices.
Based on informal communications with the Connecticut Insurance Department, Calderwood & Harkness was informed that a closure letter was anticipated by late November 2023. We have subsequently confirmed that the closure letter was issued on November 28, 2023, consistent with this expectation. The closure of the multistate attorney general inquiry strengthened the position for a favorable resolution with the Connecticut Insurance Department, as both regulators were aware of each other's inquiries and the Connecticut Attorney General's Office — which participated in the multistate coalition — had effectively determined that no enforcement action was warranted. While the Connecticut Insurance Department operates independently from the Attorney General's Office and applies different regulatory standards (focused on insurer solvency, policyholder protection, and compliance with insurance-specific cybersecurity requirements), the alignment of outcomes across both regulatory tracks is consistent and mutually reinforcing.
B. HHS Office for Civil Rights (Region I, Boston)
The component of the data compromise involving protected health information — specifically, the PHI of the 41,203 individuals whose health conditions, diagnosis codes, and treatment information from workers' compensation and health-related claims were compromised — required notification to the U.S. Department of Health and Human Services, Office for Civil Rights ("HHS-OCR"), under the HIPAA Breach Notification Rule.
Quorum filed its HIPAA breach notification with HHS-OCR on August 15, 2023, through the HHS breach reporting portal. Because the breach affected more than 500 individuals, it also triggered the requirement for media notification in states with affected individuals, which was coordinated as part of the overall consumer notification process. HHS-OCR assigned the matter to its Region I (Boston) office.
Calderwood & Harkness submitted a response to HHS-OCR's inquiry on October 5, 2023, addressing the agency's questions regarding the circumstances of the breach, the safeguards in place at the time, the notification process, and the remedial measures implemented. Based on the content of HHS-OCR's inquiry communications and our experience with the agency's enforcement priorities, we anticipate that HHS-OCR will issue a no further action letter. The favorable multistate attorney general resolution, coupled with Quorum's demonstrated compliance with the HIPAA Breach Notification Rule — including timely notification, appropriate notification content, and compliant media notice for jurisdictions with more than 500 affected individuals — supports a no-action outcome. We expect the HHS-OCR closure to occur by the end of November or early December 2023.
V. Implications and Remaining Considerations
A. Litigation Risk Assessment
The closure of the multistate attorney general inquiry without enforcement action significantly reduces the overall risk profile for the Palomar Data Solutions incident. The multistate inquiry represented the most consequential regulatory threat facing Quorum in connection with the breach, given the potential for a coordinated enforcement action by twenty-nine state attorneys general, which could have resulted in substantial monetary penalties, injunctive relief, and a consent decree imposing ongoing monitoring and compliance obligations. The elimination of this threat is a material and favorable development for the Company.
As of the date of this memorandum, no private class action litigation has been filed against Quorum in connection with the Palomar breach. The passage of approximately two to three months since the commencement of consumer notifications (August through September 2023) without the filing of litigation is a favorable indicator, as class action complaints in data breach matters are typically filed within the first thirty to sixty days following consumer notification, when media attention and consumer awareness are at their peak. However, we note that the applicable statutes of limitations for potential claims — including negligence, breach of contract, breach of implied covenant, state consumer protection act violations, and statutory data breach claims — have not expired, and the possibility of future litigation cannot be excluded entirely.
Should private litigation arise in the future, the multistate attorney general closure letter and the absence of any finding of violation by the coalition would constitute favorable factors in Quorum's defense. While the closure letter itself is not binding on private plaintiffs and does not preclude private claims, the absence of a regulatory finding of wrongdoing undermines the foundation of any plaintiff theory premised on the assumption that Quorum failed to comply with applicable legal standards. Additionally, the facts supporting the favorable closure — the vendor-origin nature of the breach, the timeliness of notifications, and the robustness of Quorum's response — would be equally favorable in the litigation context.
Quorum should maintain all documents and evidence related to the incident in accordance with the document retention protocol that Calderwood & Harkness will issue in connection with the matter closure. The preservation of the factual record supporting the favorable regulatory outcome will be important in the event of any future litigation.
B. SEC Disclosure Considerations
Calderwood & Harkness's Privacy & Data Security practice group, in consultation with the firm's Securities & Capital Markets practice group, previously prepared an SEC Disclosure Analysis Memorandum dated July 19, 2023 (prepared by Rachel Bernstein, Partner, Securities & Capital Markets, and Alan Burke, Associate, Privacy & Data Security), which assessed the incident against the SEC's cybersecurity disclosure requirements, including the then-newly adopted rules regarding material cybersecurity incident disclosure on Form 8-K. That analysis concluded that the incident, considered in the context of Quorum's overall financial position and operations, did not appear to constitute a material cybersecurity incident requiring a standalone 8-K filing.
The favorable closure of the multistate attorney general inquiry, combined with the following financial considerations, reinforces that conclusion:
• Quorum's total incident costs of $8,230,250 are modest relative to the Company's $4.82 billion annual revenue and approximately $6.1 billion market capitalization.
• Quorum's cyber insurance policy with Atlas Mutual Insurance Company (Policy No. CYB-2023-041587) provides coverage for $5,730,250 of the total costs (i.e., total costs of $8,230,250 less the $2,500,000 self-insured retention), substantially offsetting the Company's out-of-pocket exposure.
• The Palomar indemnification recovery of $6,156,000 ($4,200,000 cash plus $1,956,000 in fee reductions) further mitigates the financial impact of the incident. When both the insurance recovery and the Palomar indemnification recovery are considered, Quorum's net financial impact from the incident is expected to be negligible or potentially result in a modest net recovery position.
Given these factors, we continue to recommend that the incident does not require a standalone 8-K filing as a material cybersecurity incident. However, we recommend that Quorum include appropriate risk factor disclosure in its upcoming 10-Q and 10-K filings, referencing the incident, its favorable regulatory resolution, and the remediation measures implemented, without the need for a standalone current report. This approach balances the Company's disclosure obligations under the federal securities laws with the non-material nature of the incident's financial and operational impact.
Coordination with Halstead & Monroe LLP, Quorum's external auditor (engagement partner Gregory Chin), may be appropriate to the extent there are any financial statement implications arising from the incident costs, insurance recoveries, or Palomar indemnification recovery that should be addressed in the Company's quarterly or annual financial statements or related disclosures.
C. Vendor Relationship — Palomar Data Solutions
The MSA with Palomar Data Solutions, which has an original term running through November 11, 2024, remains in full force and effect, as supplemented by the enhanced security and operational requirements set forth in MSA Amendment 3, executed on October 27, 2023. Several near-term action items relating to the Palomar vendor relationship require attention:
Cash Payment. Palomar's obligation to remit the $4,200,000 cash indemnification payment is due within thirty days of the execution of the indemnification settlement (i.e., by approximately November 26, 2023). Quorum's finance team should confirm receipt of this payment by the contractual deadline and promptly notify Calderwood & Harkness if payment is not received.
Fee Reductions. The eighteen-month eight percent fee reduction, effective November 1, 2023, through April 30, 2025, which represents an aggregate value of approximately $1,956,000, should be tracked and confirmed in each subsequent invoice cycle. Quorum's accounts payable team and Priya Deshmukh's vendor risk management team should jointly verify that the fee reductions are properly reflected beginning with the November 2023 invoice.
Enhanced Security Obligations. Under MSA Amendment 3, Palomar is obligated to engage an independent third-party security assessor and to implement the enhanced patch management protocols and mandatory endpoint detection and response technology within ninety days of October 27, 2023 (i.e., by approximately January 25, 2024). Calderwood & Harkness recommends that these deadlines be actively monitored by Priya Deshmukh and her vendor risk management team, with formal confirmation of compliance obtained from Palomar as each milestone is reached.
Termination Rights. Quorum retains the right to terminate the MSA for cause under Section 14.2 of the agreement based on Palomar's material breaches in connection with the incident (including the failure to patch CVE-2023-0669 within the required window and the delayed incident notification). Calderwood & Harkness recommends that Quorum evaluate whether to exercise these termination rights or to allow the MSA to run through its remaining term, taking into account the following considerations: (a) the business continuity implications of transitioning claims-processing operations to an alternative vendor, including the timeline and cost of such a transition; (b) the enhanced security provisions now in place under MSA Amendment 3, which materially strengthen the contractual security framework governing the relationship; and (c) the financial value of the remaining fee reductions under the indemnification settlement, which would need to be assessed in the context of any early termination. This evaluation should be conducted by Quorum's business leadership, in consultation with General Counsel and with input from Calderwood & Harkness as needed.
D. Insurance Recovery
Calderwood & Harkness, in coordination with Quorum's risk management team, submitted the proof of loss and final cost summary to Atlas Mutual Insurance Company on November 15, 2023, under Quorum's cyber insurance policy (Policy No. CYB-2023-041587, Claim No. CYB-CLM-2023-05892). The submission seeks reimbursement of $5,730,250, representing the difference between Quorum's total incident costs of $8,230,250 and the $2,500,000 self-insured retention ("SIR") under the policy.
Atlas Mutual has acknowledged coverage for the claim, and we do not anticipate any coverage dispute. The favorable regulatory outcome — and, in particular, the absence of any finding of violation or penalty — should facilitate a straightforward claims adjustment process.
We note that the Pinnacle Surplus Lines excess layer policy (Policy No. XS-CYB-2023-7812), which provides $25,000,000 in coverage excess of the $15,000,000 primary layer, was not implicated by this incident, as total costs remained well within the primary policy limits.
One area requiring attention is the coordination between the Palomar indemnification recovery and the Atlas insurance claim. The $6,156,000 total recovery from Palomar should be evaluated in light of the Atlas policy's subrogation provisions, which may entitle Atlas Mutual to assert subrogation rights against Palomar to the extent that Atlas pays Quorum's claim. Quorum's settlement with Palomar was executed prior to the final submission of the insurance proof of loss, and Calderwood & Harkness recommends that the insurance recovery be coordinated carefully with the Atlas claims team (contact: Paul Enriquez) to ensure proper allocation of recoveries and to confirm that the Palomar settlement does not create any issues under the policy's subrogation clause. This may require providing Atlas with notice of the Palomar settlement and obtaining Atlas's consent or waiver of subrogation to the extent applicable.
VI. Recommendations
Based on the foregoing analysis, Calderwood & Harkness recommends the following immediate and ongoing actions.
A. Immediate Steps
1. Board Notification. Circulate the closure letter to the Quorum Board of Directors Audit Committee (Franklin Reeves, Chair) as part of the matter resolution briefing. The favorable closure of the multistate attorney general inquiry is a material development that should be communicated to the Board in a timely manner, consistent with the Company's governance practices and the Board's prior involvement in overseeing the incident response.
2. Palomar Payment Confirmation. Confirm receipt of Palomar's $4,200,000 cash indemnification payment by the contractual deadline of approximately November 26, 2023. If payment is not received by that date, Calderwood & Harkness should be notified immediately to assess enforcement options under the settlement agreement.
3. Insurance Coordination. Coordinate with Rachel Bernstein (Calderwood & Harkness, Securities & Capital Markets) and the Atlas Mutual claims team (Paul Enriquez) regarding final insurance recovery processing and any subrogation implications arising from the Palomar indemnification settlement. Ensure that the Palomar settlement terms and recovery amounts are properly disclosed to Atlas to avoid any potential issues under the policy's subrogation provisions.
4. Internal Communication. Issue an internal communication to Quorum senior leadership confirming the favorable resolution of the multistate attorney general track. This communication should be prepared in consultation with Calderwood & Harkness to ensure that it is appropriately worded and does not inadvertently waive any privileges or create any unintended implications.
B. Ongoing Compliance Steps
1. Palomar Amendment 3 Monitoring. Continue monitoring Palomar's compliance with the enhanced security requirements imposed by MSA Amendment 3, including the fourteen-day critical patch management deadline, mandatory endpoint detection and response implementation, quarterly vulnerability scanning with reports to Quorum, and the engagement of an independent third-party security assessor for an annual assessment. Primary oversight responsibility should be assigned to Priya Deshmukh, Vice President, Vendor Risk Management, with periodic reporting to General Counsel and the Chief Privacy Officer.
2. Post-Incident Recommendations. Implement the post-incident recommendations that will be detailed in Calderwood & Harkness's forthcoming Post-Incident Lessons Learned & Remediation Recommendations Memorandum, which will be prepared upon the conclusion of all regulatory tracks and will address opportunities to strengthen Quorum's incident response protocols, vendor management practices, and information security governance based on the experience gained through this matter.
3. Document Retention and Privilege Maintenance. Maintain all privileged documents, attorney work product, and attorney-client communications related to the matter in accordance with the Document Retention & Privilege Log Protocol to be issued by Calderwood & Harkness in connection with the matter closure. It is essential that the integrity of the privilege over these materials be preserved, particularly in light of the potential — however remote — for future private litigation.
4. Vendor Risk Management Program Enhancements. Update Quorum's enterprise-wide vendor risk management program based on the lessons learned from the Palomar incident. Specific areas for enhancement include strengthened vendor security due diligence processes during onboarding and renewal; shorter contractual notification windows for all critical vendors handling sensitive data; expanded third-party audit and assessment requirements built into vendor contracts; and enhanced contractual indemnification provisions addressing vendor-originated security incidents.
5. Tabletop Exercises. Conduct tabletop exercises that specifically incorporate vendor-originated data breach scenarios, to test and refine Quorum's incident response capabilities in the context of third-party security events. These exercises should involve cross-functional participation from legal, information security, privacy, vendor risk management, and business operations teams, and should be designed to simulate the coordination challenges inherent in responding to a breach that originates outside the Company's direct control.
C. Engagement Status
Upon the closure of the Connecticut Insurance Department inquiry (confirmed as issued November 28, 2023) and receipt of the HHS-OCR no further action letter (expected by the end of November or early December 2023), Calderwood & Harkness will prepare the Matter Closing Memorandum and formally close Matter No. 1025-00006. Based on current expectations, the anticipated matter closure date is December 1, 2023, subject to the timing of the HHS-OCR resolution.
VII. Conclusion
The closure of the multistate attorney general inquiry without enforcement action represents the most significant regulatory milestone in the Palomar Data Solutions incident response and constitutes a highly favorable outcome for Quorum Insurance Holdings Corp. The multistate inquiry — involving a coalition of twenty-nine state attorneys general, co-led by the Connecticut and New York Attorneys General — posed the most consequential regulatory risk arising from the incident, and its resolution without any fine, penalty, consent decree, or monitoring obligation is a testament to the effectiveness of Quorum's incident response strategy and the strength of the factual record that was presented to the coalition.
The favorable closure validates the core elements of the overall incident response approach that Quorum, with the guidance of Calderwood & Harkness, pursued from the outset: the prompt engagement of experienced outside counsel and qualified forensic investigators; transparent and timely regulatory and consumer notifications across all affected jurisdictions; robust consumer remediation measures, including twenty-four months of complimentary credit monitoring and identity theft protection; meaningful financial and contractual accountability imposed on the vendor responsible for the security failure; and cooperative, good-faith engagement with regulators throughout the inquiry process.
With the Connecticut Insurance Department closure now confirmed and the HHS-OCR matter on a parallel positive trajectory, Quorum is well positioned to conclude the entire regulatory and enforcement chapter of the data breach response in the very near term. Upon closure of all regulatory tracks, Calderwood & Harkness will deliver the final Matter Closing Memorandum and the Post-Incident Lessons Learned & Remediation Recommendations Memorandum to support Quorum's continued strengthening of its information security and vendor risk management programs.
Calderwood & Harkness remains available to discuss this analysis and its implications with Quorum's leadership at any time. We will continue to monitor the remaining regulatory tracks and will provide prompt updates as additional developments occur.
Respectfully submitted,
CALDERWOOD & HARKNESS LLP
By: ________
Kevin Ostrowski Partner, Privacy & Data Security Direct: (202) 555-7142 kostrowski@calderwoodharkness.com
By: ________
Alan Burke Associate, Privacy & Data Security Direct: (202) 555-7238 aburke@calderwoodharkness.com
PRIVILEGED AND CONFIDENTIAL — ATTORNEY-CLIENT PRIVILEGE / ATTORNEY WORK PRODUCT Calderwood & Harkness LLP | 1700 K Street NW, Suite 900, Washington, D.C. 20006 | Matter No. 1025-00006 Distribution of this memorandum is limited to the addressees identified herein. Any unauthorized distribution, copying, or disclosure of the contents of this memorandum may result in a waiver of applicable attorney-client privilege and work product protections.

CALDERWOOD & HARKNESS LLP Attorneys at Law

PRIVILEGED AND CONFIDENTIAL ATTORNEY-CLIENT PRIVILEGED / ATTORNEY WORK PRODUCT

MEMORANDUM

CALDERWOOD & HARKNESS LLP

Record

Parties

Dates

Amounts