1025-00006 · Graystone Forensics LLC · Regulatory Defense/Multistate AG

multistate-ag-closure-letter-annotated.docx DOCUMENT Data Privacy

65 / 88 ← → ✕

CALDERWOOD & HARKNESS LLP

Internal Annotated Copy

MULTISTATE ATTORNEY GENERAL COALITION CLOSURE LETTER NO ENFORCEMENT ACTION

PRIVILEGED & CONFIDENTIAL — ATTORNEY-CLIENT PRIVILEGED / ATTORNEY WORK PRODUCT NOT FOR DISTRIBUTION OUTSIDE LEGAL TEAM

C&H INTERNAL COVER SHEET — ANNOTATION LEGEND AND DISTRIBUTION RESTRICTIONS

This annotated copy of the Multistate Attorney General Coalition Closure Letter dated November 22, 2023, was prepared by Kevin Ostrowski, Partner, Privacy & Data Security Practice, Calderwood & Harkness LLP, on or about November 22–23, 2023, for the exclusive use of the Calderwood & Harkness engagement team assigned to Matter No. 1025-00006.

Annotation Convention. Annotations by Kevin Ostrowski appear as bracketed, bolded comments interspersed within the original letter text. Each annotation is demarcated by the tag "[KO NOTE:]" and is set apart from the body of the original letter by bold formatting. These annotations are not part of the original letter issued by the Multistate Attorney General Coalition and are instead the protected attorney work product of Calderwood & Harkness LLP.

Purpose of Annotations. The annotations contained herein are intended to serve the following purposes:

(a) Flag favorable language and findings contained in the Closure Letter that should be highlighted for the client and preserved for future reference;

(b) Identify any caveats, reservations, or qualifying language that may limit or condition the favorable outcome;

(c) Guide the preparation of the client-facing analysis memorandum, which is planned for delivery on November 24, 2023, to Thomas R. Whitfield (General Counsel, Quorum Insurance Holdings Corp.), Jennifer Liang (Deputy General Counsel, Quorum Insurance Holdings Corp.), and Margaret D. Calloway (Chief Compliance Officer, Quorum Insurance Holdings Corp.); and

(d) Preserve Calderwood & Harkness's internal legal assessment for the matter file in the event that any future regulatory inquiry, litigation, or related proceeding arises concerning the Quorum/Palomar data security incident.

Distribution Restrictions. This annotated copy is restricted to the following members of the Calderwood & Harkness LLP engagement team and may not be shared, forwarded, copied, or distributed to any other person, whether inside or outside the firm, without the prior written authorization of Kevin Ostrowski:

• Kevin Ostrowski, Partner, Privacy & Data Security

• Rachel Bernstein, Of Counsel, Privacy & Data Security

• Alan Burke, Senior Associate, Privacy & Data Security

• Sara Hendricks, Associate, Privacy & Data Security

The substance of this annotated copy will be shared with Thomas R. Whitfield, General Counsel of Quorum Insurance Holdings Corp., and other designated client personnel solely through a separate privileged analysis memorandum prepared under the attorney-client privilege. Under no circumstances should this annotated copy itself be transmitted to the client or any third party.

[BEGIN ORIGINAL LETTER TEXT WITH ANNOTATIONS]

OFFICE OF THE ATTORNEY GENERAL STATE OF CONNECTICUT 165 Capitol Avenue Hartford, CT 06106

Consumer Protection Division

Co-authored on behalf of the Office of the Attorney General, State of New York, Bureau of Internet and Technology, 28 Liberty Street, New York, NY 10005

November 22, 2023

Kevin Ostrowski, Esq. Calderwood & Harkness LLP 1700 K Street NW, Suite 900 Washington, D.C. 20006

Re: Multistate Investigation — Data Security Incident Involving Quorum Insurance Holdings Corp. / Palomar Data Solutions, Inc. (Multistate File No. CT-AG-2023-CYB-04821)

Dear Mr. Ostrowski:

I. PURPOSE AND SCOPE

This letter is issued on behalf of a coalition of twenty-nine (29) state Attorneys General — specifically, the Attorneys General of Connecticut, New York, Massachusetts, California, Illinois, Pennsylvania, New Jersey, Ohio, Texas, Florida, Georgia, Virginia, Maryland, North Carolina, South Carolina, Michigan, Minnesota, Indiana, Wisconsin, Colorado, Arizona, Oregon, Washington, Tennessee, Missouri, Louisiana, Nevada, Iowa, and New Hampshire (collectively, the "Coalition") — regarding the above-referenced multistate investigation into a data security incident involving Quorum Insurance Holdings Corp. ("Quorum") and its third-party claims-processing vendor, Palomar Data Solutions, Inc. ("Palomar"). The full list of participating state Attorneys General offices is set forth in Appendix A to this letter.

This letter follows the joint demand letter issued on September 8, 2023, by Assistant Attorney General Diane Marchetti of the Connecticut Attorney General's Office, Consumer Protection Division, and Assistant Attorney General Mark Petrosian of the New York Attorney General's Office, Bureau of Internet and Technology, on behalf of the Coalition. The September 8, 2023 demand letter requested detailed information from Quorum regarding the data security incident, Quorum's response and remediation efforts, Quorum's vendor risk management practices, and the status of consumer and regulatory notifications.

We acknowledge receipt of Quorum's written response dated October 13, 2023, prepared with the assistance of outside counsel, Calderwood & Harkness LLP, as well as Quorum's supplemental submission dated November 3, 2023, which provided additional documentation and clarifications requested by the Coalition. The Coalition has completed its review of all information provided by Quorum in connection with this inquiry, and this letter sets forth the Coalition's findings and determination.

[KO NOTE: Favorable — the Coalition expressly acknowledges receipt and review of both our October 13 response and November 3 supplemental submission. This confirms the record is complete and the AGs did not identify gaps requiring further production. The language "completed its review of all information provided" is dispositive — there is no suggestion that the AGs believed additional information was needed or that our submissions were deficient in any respect. This is important for the precedent file and should be noted in the client memo. It also validates the thoroughness of our submission preparation, which involved three rounds of internal review (per the October 9 review protocol) before delivery.]

II. BACKGROUND AND SUMMARY OF THE INCIDENT

The Coalition's inquiry concerned a data security incident originating from Quorum's third-party claims-processing vendor, Palomar Data Solutions, Inc., a corporation headquartered in Dallas, Texas, that provides claims intake, data processing, and managed file transfer services to Quorum and other insurance industry clients pursuant to a Master Services Agreement dated January 15, 2019, as amended.

Based on the information provided by Quorum and the forensic investigation conducted by Graystone Forensics LLC under the direction of outside counsel, the Coalition understands that the relevant facts are as follows:

On or about March 14, 2023, a threat actor exploited a known remote code execution vulnerability (identified as CVE-2023-0669) in Palomar's GoAnywhere MFT file transfer appliance to gain unauthorized access to Palomar's network environment. The vulnerability in question had been publicly disclosed and a patch made available by the software vendor prior to the date of exploitation; however, Palomar had not yet applied the relevant patch to its production environment at the time of the intrusion.

Data exfiltration occurred over an approximately thirty-five (35) day period, from on or about March 14, 2023, through on or about April 18, 2023, during which time the threat actor accessed and exfiltrated files containing personally identifiable information processed by Palomar on behalf of Quorum. On April 18, 2023, Palomar's security operations center detected anomalous outbound data transfers and initiated containment measures. Palomar notified Quorum of the potential incident on April 19, 2023.

The incident resulted in the compromise of personally identifiable information of approximately 318,247 individuals residing across the twenty-nine Coalition states and the District of Columbia. The categories of compromised information include, but are not limited to: Social Security numbers, dates of birth, driver's license numbers, financial account information (affecting approximately 84,619 individuals), and protected health information as defined under the Health Insurance Portability and Accountability Act of 1996 (affecting approximately 41,203 individuals).

[KO NOTE: The AGs correctly characterize this as a vendor-originated breach and attribute the root cause to Palomar's unpatched vulnerability — specifically, the failure to apply the CVE-2023-0669 patch to the GoAnywhere MFT appliance. This framing is extremely favorable and directly reflects the narrative we have consistently advanced throughout the engagement, beginning with our initial incident response memorandum dated April 22, 2023, and continuing through both the October 13 response and the November 3 supplemental submission. Critically, the AGs do not attribute any independent security failure to Quorum itself. There is no suggestion that Quorum's own security controls, vendor oversight, or monitoring practices were deficient. The entire causal chain is laid at the feet of Palomar's failure to patch. This distinction is essential for any future litigation defense and for Quorum's ongoing vendor management narrative. Flag for client memo and Board briefing.

Additionally, note that the AGs' recitation of the factual background is entirely consistent with the facts as we presented them. There are no material discrepancies, no contested facts, and no characterizations that diverge from our submissions. This further confirms that the AGs accepted our factual presentation as accurate and complete.]

III. QUORUM'S RESPONSE AND REMEDIAL ACTIONS

The Coalition acknowledges the following response and remedial actions taken by Quorum in connection with the data security incident:

Investigation and Forensic Review. Quorum promptly engaged outside counsel, Calderwood & Harkness LLP, and, under the direction of counsel, retained a forensic investigation firm, Graystone Forensics LLC, to investigate the nature, scope, and impact of the incident. Quorum completed a comprehensive forensic investigation and data mining process, identifying all individuals whose personally identifiable information was compromised, by August 4, 2023.

Regulatory Notifications. Quorum filed regulatory notifications with all required state attorneys general and applicable regulatory agencies, commencing on August 14, 2023, and completing all such filings by August 25, 2023. The Coalition has reviewed the dates and content of Quorum's regulatory notification filings and has determined that all such notifications were timely filed under the applicable state breach notification statutes in each of the twenty-nine Coalition states.

Consumer Notifications. Quorum mailed individual consumer notification letters on a rolling basis from August 18, 2023, through September 15, 2023, to all 318,247 affected individuals. The Coalition has reviewed the content and format of the consumer notification letters utilized by Quorum and has determined that such letters included all content elements required by the applicable state breach notification statutes.

Credit Monitoring and Identity Theft Protection. Quorum offered all affected individuals twenty-four (24) months of complimentary credit monitoring and identity theft protection services through a nationally recognized provider, including credit report monitoring, identity restoration assistance, and a $1,000,000 identity theft insurance policy.

[KO NOTE: This is a critical section of the letter. The Coalition explicitly finds that: (1) all regulatory notifications were timely under the applicable state statutes; (2) all consumer notifications were timely mailed; and (3) the content of the notification letters met the statutory requirements in each of the 29 Coalition states. These are affirmative findings of compliance — not merely silence or a failure to challenge. This is extremely strong and favorable language for our file and for any future litigation defense. In private data breach class actions, plaintiffs frequently allege delayed or inadequate notification as a basis for claims. The AGs' affirmative finding of timeliness and compliance will be a powerful tool in responding to any such allegations.

Also note the acknowledgment that Graystone Forensics LLC was retained "under the direction of counsel." The AGs did not challenge the privilege framework under which the forensic investigation was conducted, nor did they request production of privileged forensic investigation materials. This validates our privilege protocol and the approach we outlined in the April 22, 2023 engagement letter with Graystone.]

Vendor Accountability. The Coalition further acknowledges that Quorum took affirmative steps to hold Palomar accountable for its role in the data security incident. Specifically, Quorum asserted contractual indemnification claims against Palomar under the Master Services Agreement and negotiated a settlement agreement, executed on October 27, 2023, that includes the following components:

(a) A cash settlement payment of $4,200,000 from Palomar to Quorum;

(b) An eighteen (18) month fee reduction under the Master Services Agreement, reflecting a negotiated reduction in Palomar's service fees during the remediation period; and

(c) Requirements for enhanced security measures, including an obligation for Palomar to undergo independent third-party security assessments on a semi-annual basis and to adopt accelerated patch management timelines for critical and high-severity vulnerabilities.

In addition, Quorum executed MSA Amendment 3, effective as of October 27, 2023, which imposes enhanced data security and audit obligations on Palomar, including:

(a) A fourteen (14) day critical patch application requirement, reduced from the thirty (30) day requirement set forth in the original Master Services Agreement;

(b) A twenty-four (24) hour incident notification requirement, reduced from the forty-eight (48) hour requirement set forth in the original Master Services Agreement; and

(c) Enhanced audit and inspection rights permitting Quorum to conduct or commission security audits of Palomar's systems and practices with ten (10) business days' notice, without limitation on frequency.

[KO NOTE: The AGs specifically reference the vendor accountability measures — both the financial settlement and the enhanced contractual protections imposed through MSA Amendment 3. The level of specificity in the letter is notable: the AGs identify the exact dollar amount of the settlement ($4.2M), the specific patch timeline reduction (30 days to 14 days), and the specific incident notification timeline reduction (48 hours to 24 hours). This degree of detail strongly suggests that the Coalition viewed these vendor accountability measures favorably and that they weighed materially in the decision not to pursue enforcement action.

This demonstrates that our strategy of emphasizing proactive vendor enforcement — as recommended in the September 11, 2023 strategy memorandum and as implemented through the October negotiations with Palomar and Mercer Haight — was well-received by the AGs and achieved the intended regulatory benefit. This is an important precedent for our practice: proactive vendor remediation and public accountability can meaningfully influence AG enforcement decisions in vendor-originated breach cases.]

Post-Incident Program Enhancements. The Coalition further notes that Quorum has represented that it has undertaken a comprehensive post-incident review of its vendor risk management program, overseen by Vice President of Vendor Risk Priya Deshmukh, and its information security program, overseen by Chief Information Security Officer David Naranjo. Quorum has represented that it has implemented the following program enhancements in connection with this review:

(a) Expanded third-party audit requirements for critical and high-risk vendors, including the adoption of SOC 2 Type II report requirements and annual penetration testing validation;

(b) Implementation of semi-annual tabletop exercises simulating vendor-originated data security incidents, involving cross-functional teams from information security, legal, compliance, and executive leadership;

(c) Comprehensive data minimization reviews across all active vendor relationships to reduce the volume and sensitivity of personally identifiable information shared with or processed by third-party service providers; and

(d) Enhanced vendor onboarding and due diligence protocols, including security questionnaire and technical assessment requirements for all new vendor engagements involving the processing or storage of personally identifiable information.

IV. FINDINGS AND DETERMINATION

Based on the Coalition's review of Quorum's submissions, the remedial actions taken by Quorum in response to the data security incident, Quorum's cooperation with the multistate inquiry, and Quorum's demonstrated commitment to compliance with applicable data breach notification laws and consumer protection statutes, the Coalition has determined that no enforcement action against Quorum Insurance Holdings Corp. is warranted at this time.

Accordingly, the investigation file referenced above (Multistate File No. CT-AG-2023-CYB-04821) is hereby closed.

[KO NOTE: KEY LANGUAGE — "no enforcement action … is warranted at this time." This is the dispositive finding of the letter and constitutes a full closure of the multistate investigation without any enforcement action, consent order, financial penalty, or mandatory injunctive commitment.

Note the qualifier "at this time." This is standard AG closure language that appears in virtually all multistate closure letters, regardless of the nature or outcome of the investigation. It does not constitute a covenant not to sue, a release of claims, or a permanent bar to future action. Rather, it preserves the inherent authority of the Attorneys General to investigate and take action in the future should circumstances warrant. However, as a practical matter, this language represents a definitive closure of this specific investigation, and absent new facts or a future incident, the likelihood of the Coalition reopening this matter is negligible.

We should flag for the client that this language represents the strongest form of closure we could have expected from a 29-state coalition. Full no-action closure — without monetary penalties, consent decrees, or assurances of voluntary compliance — is relatively uncommon in multistate data breach investigations of this scale (318,000+ affected individuals across 29 states, involving SSNs, financial data, and PHI). The vast majority of multistate AG data breach investigations of comparable scope result in some form of negotiated resolution, typically including a financial payment and a consent order with prospective security obligations. The fact that the Coalition determined that no such measures were warranted here is a significant and favorable outcome for Quorum.]

[KO NOTE: Also note the phrase "Quorum's cooperation with the multistate inquiry." The Coalition explicitly credits Quorum's cooperative posture as a factor in its determination. This validates the strategy we recommended in our September 11, 2023 internal strategy memorandum, in which we counseled against an adversarial or obstructive approach and instead recommended full, voluntary cooperation with the Coalition's information requests. Our approach included voluntary production of materials beyond what was strictly demanded, proactive engagement with the lead AAGs (Marchetti and Petrosian), and prompt supplemental submissions in response to follow-up inquiries. This cooperative approach yielded the result we anticipated, and it establishes an important precedent for how we advise clients in future multistate data breach investigations.]

V. RESERVATIONS AND CAVEATS

The closure of this investigation does not constitute an approval, endorsement, or certification of Quorum's data security practices, policies, or procedures, and should not be construed or represented as such by Quorum or any person acting on its behalf.

The Coalition reserves all rights to investigate and take enforcement action in the event of future data security incidents involving Quorum, or if additional information comes to light regarding the current incident that materially differs from the representations made by Quorum in its October 13, 2023 written response and November 3, 2023 supplemental submission.

This letter does not bind any individual state Attorney General from pursuing a separate investigation or enforcement action independently under its own consumer protection and data breach notification statutes. However, the Coalition notes that no individual state Attorney General has indicated an intention to pursue a separate investigation or enforcement action as of the date of this letter.

Each participating state Attorney General retains independent authority under its own applicable consumer protection, data security, and data breach notification statutes, and nothing in this letter shall be construed to limit, waive, or otherwise affect such authority.

[KO NOTE: This is standard reservation-of-rights boilerplate that appears in substantially all multistate AG closure letters. These caveats are customary and expected, and they do not diminish the favorable nature of the closure determination in any material respect. The non-endorsement language in the first paragraph is entirely routine and simply prevents Quorum from characterizing the closure letter as an AG "seal of approval" on its security practices.

However, one element of this section merits particular attention: the affirmative statement that "no individual state Attorney General has indicated an intention to pursue a separate investigation or enforcement action as of the date of this letter" is notable and unusual. In our experience, typical multistate closure letters either remain silent on whether individual states intend to proceed independently, or they include a generic reservation of rights without commentary. The fact that the Coalition affirmatively represented that no individual state has indicated an intent to pursue separate action goes further than standard closure language and effectively signals that all 29 states are aligned on closure. This provides an additional layer of assurance that is meaningful and should be highlighted for the Board and CEO in the November 29 briefing memo.

Separately, the caveat regarding "material differences" from Quorum's representations reinforces the critical importance of ensuring the accuracy and completeness of all factual statements made in our October 13 response and November 3 supplemental submission. While I am confident in the accuracy of our submissions based on the thorough review process we conducted, this caveat serves as an important reminder that any material inaccuracies or omissions could provide a basis for the Coalition to reopen the investigation. Alan Burke should verify that the matter file preserves all underlying documentation supporting every factual representation made in both submissions, including the Graystone forensic reports, Quorum's internal incident timeline, the breach notification tracker, the Palomar settlement documents, and all supporting correspondence. This is also relevant for the document retention protocol memorandum we are preparing for finalization by December 1, 2023.]

VI. ACKNOWLEDGMENTS AND COMMENDATIONS

The Coalition wishes to acknowledge Quorum's prompt and thorough response to the data security incident, including its timely engagement of experienced outside counsel and forensic investigators; its timely and comprehensive consumer and regulatory notifications, which met or exceeded the requirements of all applicable state breach notification statutes; its proactive vendor accountability measures, including the negotiation of meaningful financial and contractual remedies from its third-party vendor; and its cooperative engagement with the multistate Coalition throughout the inquiry process.

The Coalition encourages Quorum to continue to invest in its information security program and vendor risk management practices, and to maintain the enhanced security and oversight measures described in its submissions, in order to protect the personally identifiable information of its customers and policyholders.

[KO NOTE: This commendatory language is not pro forma. In our experience, a significant majority of multistate AG closure letters do not include any commendatory or acknowledgment language — they simply close the file with a reservation of rights. The inclusion of an explicit acknowledgment section, with specific references to Quorum's "prompt and thorough response," "timely and comprehensive" notifications, "proactive vendor accountability measures," and "cooperative engagement," provides significant reputational and legal value to Quorum.

From a reputational standpoint, this language demonstrates that the Attorneys General of 29 states affirmatively recognized and commended Quorum's response, which can be referenced — with appropriate care and subject to the non-endorsement caveat — in future regulatory interactions, cyberinsurance renewal applications, and communications with business partners and counterparties.

From a legal standpoint, this language may provide meaningful defensive value in the event that private class action litigation arises from the breach. Plaintiffs in data breach class actions frequently allege that the breached entity's response was inadequate, delayed, or insufficient. The AGs' express finding that Quorum's response was "prompt and thorough" and that notifications were "timely and comprehensive" provides a contemporaneous, independent assessment by a 29-state regulatory coalition that directly contradicts such allegations. While AG closure letters are not dispositive in private litigation, they carry persuasive weight, particularly at the motion-to-dismiss or summary judgment stage.

Flag for client memo and Board briefing. Also flag for Sara Hendricks to include in the litigation readiness binder.]

VII. CONTACT INFORMATION

Any questions regarding this letter or the closure of this investigation should be directed to:

Diane Marchetti, Assistant Attorney General Consumer Protection Division Office of the Attorney General, State of Connecticut 165 Capitol Avenue Hartford, CT 06106 Telephone: (860) 808-5400

Mark Petrosian, Assistant Attorney General Bureau of Internet and Technology Office of the Attorney General, State of New York 28 Liberty Street New York, NY 10005 Telephone: (212) 416-8400

The Coalition appreciates Quorum's cooperation throughout the course of this inquiry.

Sincerely,

________________________________________

Diane Marchetti Assistant Attorney General Consumer Protection Division Office of the Attorney General State of Connecticut On behalf of the 29-State Multistate Coalition

________________________________________

Mark Petrosian Assistant Attorney General Bureau of Internet and Technology Office of the Attorney General State of New York On behalf of the 29-State Multistate Coalition

Enclosure: Appendix A — List of 29 Participating State Attorneys General Offices

cc:

Thomas R. Whitfield, General Counsel Quorum Insurance Holdings Corp. 400 Constitution Plaza, Suite 2200 Hartford, CT 06103

Catherine Langford, Esq. Mercer, Haight & Dunlop LLP 2100 Ross Avenue, Suite 3600 Dallas, TX 75201 (Counsel to Palomar Data Solutions, Inc.)

[KO NOTE: Note that the AGs copied Palomar's outside counsel, Catherine Langford at Mercer, Haight & Dunlop. This confirms that the AGs were tracking the vendor relationship and Palomar's role throughout the investigation. The copy to Palomar's counsel also signals that the Coalition considered and closed the matter as to the full incident chain — i.e., both Quorum's role and Palomar's role — and not merely Quorum's response in isolation. This is meaningful because it suggests that the Coalition is not contemplating a separate enforcement action against Palomar arising from the same incident, at least through the multistate vehicle. However, we should note that individual states retain independent authority to pursue Palomar directly, and some states (notably California and New York) have historically pursued enforcement actions against vendors in breach incidents. We have no indication that any such action is contemplated, but this should be monitored. Sara Hendricks should add a docket reminder to check for any Palomar-related AG filings on a quarterly basis through Q3 2024.]

[END ORIGINAL LETTER TEXT]

APPENDIX A

LIST OF 29 PARTICIPATING STATE ATTORNEYS GENERAL

*(As Referenced in the Closure Letter)*

The following twenty-nine (29) state Attorneys General offices participated in the multistate Coalition and are signatories to the Closure Letter dated November 22, 2023:

C&H INTERNAL SUMMARY ANNOTATION BLOCK

*(Not Part of Original Letter — Attorney Work Product)*

PRIVILEGED & CONFIDENTIAL — ATTORNEY WORK PRODUCT Prepared by Kevin Ostrowski, November 22–23, 2023 Calderwood & Harkness LLP — Matter No. 1025-00006

Overall Assessment. This is an unequivocal favorable outcome for Quorum Insurance Holdings Corp. The twenty-nine-state multistate Attorney General Coalition has closed its investigation (Multistate File No. CT-AG-2023-CYB-04821) without enforcement action, without a consent order or assurance of voluntary compliance, without financial penalties or monetary payment by Quorum, and without mandatory injunctive commitments or prospective security obligations imposed on Quorum.

The Closure Letter contains affirmatively commendatory language regarding Quorum's incident response, the timeliness and comprehensiveness of its consumer and regulatory notifications, its compliance with applicable state breach notification statutes, its proactive vendor accountability measures, and its cooperative engagement with the Coalition. This outcome is among the most favorable we have achieved in a multistate data breach investigation of comparable scale.

For context, a breach involving 318,247 affected individuals across 29 states, with compromised data categories including Social Security numbers, financial account information, and protected health information, would typically be expected to result in a negotiated resolution involving some combination of monetary penalties, prospective compliance obligations, and a formal consent order. The Coalition's decision to close the investigation without any such measures reflects the strength of Quorum's response and the effectiveness of the legal strategy we pursued throughout the engagement.

Key Takeaways for Client Memorandum (November 24, 2023)

The following key takeaways should be incorporated into the client-facing analysis memorandum to be delivered to Thomas R. Whitfield, Jennifer Liang, and Margaret D. Calloway on November 24, 2023:

1. Notification Compliance Confirmed. All regulatory notifications and consumer notifications have been confirmed timely and compliant by the 29-state Coalition. The AGs affirmatively found that notifications met all applicable statutory requirements — this is an affirmative compliance determination, not merely the absence of an adverse finding.

2. Vendor-Originated Breach Characterization Accepted. The Coalition accepted the characterization of the incident as vendor-originated, attributed the root cause to Palomar's failure to patch CVE-2023-0669, and did not attribute any independent security failure to Quorum. No findings of deficiency were made regarding Quorum's own information security program, vendor risk management practices, or monitoring capabilities.

3. Vendor Accountability Measures Viewed Favorably. The Coalition specifically referenced and described in detail the vendor accountability measures taken by Quorum, including the $4.2 million financial settlement, MSA Amendment 3, and the enhanced contractual security and audit obligations imposed on Palomar. The specificity of these references strongly suggests that these measures weighed materially and favorably in the Coalition's enforcement determination.

4. Strongest Standard Closure Language Achieved. The determination that "no enforcement action … is warranted at this time" represents the strongest form of closure language available from a multistate AG coalition. Full no-action closure without monetary penalties, consent orders, or mandatory compliance commitments is a relatively uncommon outcome in multistate data breach investigations of this scale.

5. No Individual State Separate Action Indicated. The Coalition's affirmative statement that no individual state Attorney General has indicated an intent to pursue a separate investigation or enforcement action provides an additional and unusual layer of assurance beyond standard closure language. This signals alignment across all 29 participating states.

6. Commendatory Language Provides Defensive Value. The explicit commendations regarding Quorum's "prompt and thorough response," "timely and comprehensive" notifications, "proactive vendor accountability measures," and "cooperative engagement" provide significant defensive value for future proceedings, including any private class action litigation, regulatory inquiries, or cyberinsurance renewal negotiations.

Remaining Open Items

The following items remain open as of November 23, 2023, and should be tracked to completion:

Distribution Instructions.

• Original Letter (unredacted, without annotations): To be filed in the Calderwood & Harkness LLP document management system under Matter No. 1025-00006, document category "Regulatory Correspondence — Inbound."

• Annotated Copy (this document): Distribution restricted to C&H engagement team only — Kevin Ostrowski, Rachel Bernstein, Alan Burke, and Sara Hendricks. To be filed in the document management system under Matter No. 1025-00006, document category "Internal Work Product — Attorney Annotations." This document is not to be produced, shared, or distributed to any person outside the engagement team without the prior written authorization of Kevin Ostrowski.

• Client-Facing Analysis Memorandum: To be prepared as a separate privileged memorandum dated November 24, 2023, addressed to Thomas R. Whitfield (General Counsel), Jennifer Liang (Deputy General Counsel), and Margaret D. Calloway (Chief Compliance Officer), Quorum Insurance Holdings Corp. The memorandum will summarize the Closure Letter, identify key findings and takeaways, assess remaining open regulatory matters, and provide recommendations for the November 29, 2023 Board Audit Committee briefing. The memorandum will be transmitted via secure email and marked as Attorney-Client Privileged.

End of Internal Annotated Copy — Calderwood & Harkness LLP Matter No. 1025-00006 Prepared by Kevin Ostrowski, Partner, Privacy & Data Security Practice November 22–23, 2023 PRIVILEGED & CONFIDENTIAL — ATTORNEY-CLIENT PRIVILEGED / ATTORNEY WORK PRODUCT

Date of Original Letter:	November 22, 2023
Received by:	Calderwood & Harkness LLP, on behalf of Quorum Insurance Holdings Corp.
Annotations by:	Kevin Ostrowski, Responsible Partner, Privacy & Data Security Practice, Calderwood & Harkness LLP
Matter Number:	1025-00006
Client:	Quorum Insurance Holdings Corp.
Matter Description:	Multistate AG Investigation — Palomar Data Solutions Breach Incident
No.	State
1	Connecticut (Lead State)
2	New York (Co-Lead State)
3	Massachusetts
4	California
5	Illinois
6	Pennsylvania
7	New Jersey
8	Ohio
9	Texas
10	Florida
11	Georgia
12	Virginia
13	Maryland
14	North Carolina
15	South Carolina
16	Michigan
17	Minnesota
18	Indiana

19	Wisconsin
20	Colorado
21	Arizona
22	Oregon
23	Washington
24	Tennessee
25	Missouri
26	Louisiana
27	Nevada
28	Iowa
29	New Hampshire
Item	Status	Expected Resolution
Connecticut Insurance Department inquiry (separate from AG investigation)	Pending — final response submitted November 15, 2023	Expected closure on or about November 28, 2023
HHS Office for Civil Rights (OCR) inquiry — HIPAA-related aspects of the breach	Pending — response submitted October 20, 2023	Expected no-further-action determination on or about November 30, 2023
Document retention protocol memorandum — establishing retention requirements for all matter-related documents, correspondence, and work product	In preparation — Alan Burke drafting	To be finalized by December 1, 2023
Board Audit Committee briefing memorandum — matter resolution and closure summary for Board presentation	In preparation — Kevin Ostrowski and Rachel Bernstein drafting	To be completed for the November 29, 2023 Board Audit Committee meeting
Litigation readiness binder — compilation of key documents for defense of any future private litigation arising from the breach	In preparation — Sara Hendricks compiling	Ongoing; initial compilation by December 15, 2023
Quarterly Palomar/AG monitoring — docket checks for any independent state AG action against Palomar	To be calendared	Quarterly through Q3 2024

CALDERWOOD & HARKNESS LLP
Internal Annotated Copy
MULTISTATE ATTORNEY GENERAL COALITION CLOSURE LETTER NO ENFORCEMENT ACTION
PRIVILEGED & CONFIDENTIAL — ATTORNEY-CLIENT PRIVILEGED / ATTORNEY WORK PRODUCT NOT FOR DISTRIBUTION OUTSIDE LEGAL TEAM
C&H INTERNAL COVER SHEET — ANNOTATION LEGEND AND DISTRIBUTION RESTRICTIONS
This annotated copy of the Multistate Attorney General Coalition Closure Letter dated November 22, 2023, was prepared by Kevin Ostrowski, Partner, Privacy & Data Security Practice, Calderwood & Harkness LLP, on or about November 22–23, 2023, for the exclusive use of the Calderwood & Harkness engagement team assigned to Matter No. 1025-00006.
Annotation Convention. Annotations by Kevin Ostrowski appear as bracketed, bolded comments interspersed within the original letter text. Each annotation is demarcated by the tag "[KO NOTE:]" and is set apart from the body of the original letter by bold formatting. These annotations are not part of the original letter issued by the Multistate Attorney General Coalition and are instead the protected attorney work product of Calderwood & Harkness LLP.
Purpose of Annotations. The annotations contained herein are intended to serve the following purposes:
(a) Flag favorable language and findings contained in the Closure Letter that should be highlighted for the client and preserved for future reference;
(b) Identify any caveats, reservations, or qualifying language that may limit or condition the favorable outcome;
(c) Guide the preparation of the client-facing analysis memorandum, which is planned for delivery on November 24, 2023, to Thomas R. Whitfield (General Counsel, Quorum Insurance Holdings Corp.), Jennifer Liang (Deputy General Counsel, Quorum Insurance Holdings Corp.), and Margaret D. Calloway (Chief Compliance Officer, Quorum Insurance Holdings Corp.); and
(d) Preserve Calderwood & Harkness's internal legal assessment for the matter file in the event that any future regulatory inquiry, litigation, or related proceeding arises concerning the Quorum/Palomar data security incident.
Distribution Restrictions. This annotated copy is restricted to the following members of the Calderwood & Harkness LLP engagement team and may not be shared, forwarded, copied, or distributed to any other person, whether inside or outside the firm, without the prior written authorization of Kevin Ostrowski:
•  Kevin Ostrowski, Partner, Privacy & Data Security
•  Rachel Bernstein, Of Counsel, Privacy & Data Security
•  Alan Burke, Senior Associate, Privacy & Data Security
•  Sara Hendricks, Associate, Privacy & Data Security
The substance of this annotated copy will be shared with Thomas R. Whitfield, General Counsel of Quorum Insurance Holdings Corp., and other designated client personnel solely through a separate privileged analysis memorandum prepared under the attorney-client privilege. Under no circumstances should this annotated copy itself be transmitted to the client or any third party.
[BEGIN ORIGINAL LETTER TEXT WITH ANNOTATIONS]
OFFICE OF THE ATTORNEY GENERAL STATE OF CONNECTICUT 165 Capitol Avenue Hartford, CT 06106
Consumer Protection Division
Co-authored on behalf of the Office of the Attorney General, State of New York, Bureau of Internet and Technology, 28 Liberty Street, New York, NY 10005
November 22, 2023
Kevin Ostrowski, Esq. Calderwood & Harkness LLP 1700 K Street NW, Suite 900 Washington, D.C. 20006
Re: Multistate Investigation — Data Security Incident Involving Quorum Insurance Holdings Corp. / Palomar Data Solutions, Inc. (Multistate File No. CT-AG-2023-CYB-04821)
Dear Mr. Ostrowski:
I. PURPOSE AND SCOPE
This letter is issued on behalf of a coalition of twenty-nine (29) state Attorneys General — specifically, the Attorneys General of Connecticut, New York, Massachusetts, California, Illinois, Pennsylvania, New Jersey, Ohio, Texas, Florida, Georgia, Virginia, Maryland, North Carolina, South Carolina, Michigan, Minnesota, Indiana, Wisconsin, Colorado, Arizona, Oregon, Washington, Tennessee, Missouri, Louisiana, Nevada, Iowa, and New Hampshire (collectively, the "Coalition") — regarding the above-referenced multistate investigation into a data security incident involving Quorum Insurance Holdings Corp. ("Quorum") and its third-party claims-processing vendor, Palomar Data Solutions, Inc. ("Palomar"). The full list of participating state Attorneys General offices is set forth in Appendix A to this letter.
This letter follows the joint demand letter issued on September 8, 2023, by Assistant Attorney General Diane Marchetti of the Connecticut Attorney General's Office, Consumer Protection Division, and Assistant Attorney General Mark Petrosian of the New York Attorney General's Office, Bureau of Internet and Technology, on behalf of the Coalition. The September 8, 2023 demand letter requested detailed information from Quorum regarding the data security incident, Quorum's response and remediation efforts, Quorum's vendor risk management practices, and the status of consumer and regulatory notifications.
We acknowledge receipt of Quorum's written response dated October 13, 2023, prepared with the assistance of outside counsel, Calderwood & Harkness LLP, as well as Quorum's supplemental submission dated November 3, 2023, which provided additional documentation and clarifications requested by the Coalition. The Coalition has completed its review of all information provided by Quorum in connection with this inquiry, and this letter sets forth the Coalition's findings and determination.
[KO NOTE: Favorable — the Coalition expressly acknowledges receipt and review of both our October 13 response and November 3 supplemental submission. This confirms the record is complete and the AGs did not identify gaps requiring further production. The language "completed its review of all information provided" is dispositive — there is no suggestion that the AGs believed additional information was needed or that our submissions were deficient in any respect. This is important for the precedent file and should be noted in the client memo. It also validates the thoroughness of our submission preparation, which involved three rounds of internal review (per the October 9 review protocol) before delivery.]
II. BACKGROUND AND SUMMARY OF THE INCIDENT
The Coalition's inquiry concerned a data security incident originating from Quorum's third-party claims-processing vendor, Palomar Data Solutions, Inc., a corporation headquartered in Dallas, Texas, that provides claims intake, data processing, and managed file transfer services to Quorum and other insurance industry clients pursuant to a Master Services Agreement dated January 15, 2019, as amended.
Based on the information provided by Quorum and the forensic investigation conducted by Graystone Forensics LLC under the direction of outside counsel, the Coalition understands that the relevant facts are as follows:
On or about March 14, 2023, a threat actor exploited a known remote code execution vulnerability (identified as CVE-2023-0669) in Palomar's GoAnywhere MFT file transfer appliance to gain unauthorized access to Palomar's network environment. The vulnerability in question had been publicly disclosed and a patch made available by the software vendor prior to the date of exploitation; however, Palomar had not yet applied the relevant patch to its production environment at the time of the intrusion.
Data exfiltration occurred over an approximately thirty-five (35) day period, from on or about March 14, 2023, through on or about April 18, 2023, during which time the threat actor accessed and exfiltrated files containing personally identifiable information processed by Palomar on behalf of Quorum. On April 18, 2023, Palomar's security operations center detected anomalous outbound data transfers and initiated containment measures. Palomar notified Quorum of the potential incident on April 19, 2023.
The incident resulted in the compromise of personally identifiable information of approximately 318,247 individuals residing across the twenty-nine Coalition states and the District of Columbia. The categories of compromised information include, but are not limited to: Social Security numbers, dates of birth, driver's license numbers, financial account information (affecting approximately 84,619 individuals), and protected health information as defined under the Health Insurance Portability and Accountability Act of 1996 (affecting approximately 41,203 individuals).
[KO NOTE: The AGs correctly characterize this as a vendor-originated breach and attribute the root cause to Palomar's unpatched vulnerability — specifically, the failure to apply the CVE-2023-0669 patch to the GoAnywhere MFT appliance. This framing is extremely favorable and directly reflects the narrative we have consistently advanced throughout the engagement, beginning with our initial incident response memorandum dated April 22, 2023, and continuing through both the October 13 response and the November 3 supplemental submission. Critically, the AGs do not attribute any independent security failure to Quorum itself. There is no suggestion that Quorum's own security controls, vendor oversight, or monitoring practices were deficient. The entire causal chain is laid at the feet of Palomar's failure to patch. This distinction is essential for any future litigation defense and for Quorum's ongoing vendor management narrative. Flag for client memo and Board briefing.
Additionally, note that the AGs' recitation of the factual background is entirely consistent with the facts as we presented them. There are no material discrepancies, no contested facts, and no characterizations that diverge from our submissions. This further confirms that the AGs accepted our factual presentation as accurate and complete.]
III. QUORUM'S RESPONSE AND REMEDIAL ACTIONS
The Coalition acknowledges the following response and remedial actions taken by Quorum in connection with the data security incident:
Investigation and Forensic Review. Quorum promptly engaged outside counsel, Calderwood & Harkness LLP, and, under the direction of counsel, retained a forensic investigation firm, Graystone Forensics LLC, to investigate the nature, scope, and impact of the incident. Quorum completed a comprehensive forensic investigation and data mining process, identifying all individuals whose personally identifiable information was compromised, by August 4, 2023.
Regulatory Notifications. Quorum filed regulatory notifications with all required state attorneys general and applicable regulatory agencies, commencing on August 14, 2023, and completing all such filings by August 25, 2023. The Coalition has reviewed the dates and content of Quorum's regulatory notification filings and has determined that all such notifications were timely filed under the applicable state breach notification statutes in each of the twenty-nine Coalition states.
Consumer Notifications. Quorum mailed individual consumer notification letters on a rolling basis from August 18, 2023, through September 15, 2023, to all 318,247 affected individuals. The Coalition has reviewed the content and format of the consumer notification letters utilized by Quorum and has determined that such letters included all content elements required by the applicable state breach notification statutes.
Credit Monitoring and Identity Theft Protection. Quorum offered all affected individuals twenty-four (24) months of complimentary credit monitoring and identity theft protection services through a nationally recognized provider, including credit report monitoring, identity restoration assistance, and a $1,000,000 identity theft insurance policy.
[KO NOTE: This is a critical section of the letter. The Coalition explicitly finds that: (1) all regulatory notifications were timely under the applicable state statutes; (2) all consumer notifications were timely mailed; and (3) the content of the notification letters met the statutory requirements in each of the 29 Coalition states. These are affirmative findings of compliance — not merely silence or a failure to challenge. This is extremely strong and favorable language for our file and for any future litigation defense. In private data breach class actions, plaintiffs frequently allege delayed or inadequate notification as a basis for claims. The AGs' affirmative finding of timeliness and compliance will be a powerful tool in responding to any such allegations.
Also note the acknowledgment that Graystone Forensics LLC was retained "under the direction of counsel." The AGs did not challenge the privilege framework under which the forensic investigation was conducted, nor did they request production of privileged forensic investigation materials. This validates our privilege protocol and the approach we outlined in the April 22, 2023 engagement letter with Graystone.]
Vendor Accountability. The Coalition further acknowledges that Quorum took affirmative steps to hold Palomar accountable for its role in the data security incident. Specifically, Quorum asserted contractual indemnification claims against Palomar under the Master Services Agreement and negotiated a settlement agreement, executed on October 27, 2023, that includes the following components:
(a) A cash settlement payment of $4,200,000 from Palomar to Quorum;
(b) An eighteen (18) month fee reduction under the Master Services Agreement, reflecting a negotiated reduction in Palomar's service fees during the remediation period; and
(c) Requirements for enhanced security measures, including an obligation for Palomar to undergo independent third-party security assessments on a semi-annual basis and to adopt accelerated patch management timelines for critical and high-severity vulnerabilities.
In addition, Quorum executed MSA Amendment 3, effective as of October 27, 2023, which imposes enhanced data security and audit obligations on Palomar, including:
(a) A fourteen (14) day critical patch application requirement, reduced from the thirty (30) day requirement set forth in the original Master Services Agreement;
(b) A twenty-four (24) hour incident notification requirement, reduced from the forty-eight (48) hour requirement set forth in the original Master Services Agreement; and
(c) Enhanced audit and inspection rights permitting Quorum to conduct or commission security audits of Palomar's systems and practices with ten (10) business days' notice, without limitation on frequency.
[KO NOTE: The AGs specifically reference the vendor accountability measures — both the financial settlement and the enhanced contractual protections imposed through MSA Amendment 3. The level of specificity in the letter is notable: the AGs identify the exact dollar amount of the settlement ($4.2M), the specific patch timeline reduction (30 days to 14 days), and the specific incident notification timeline reduction (48 hours to 24 hours). This degree of detail strongly suggests that the Coalition viewed these vendor accountability measures favorably and that they weighed materially in the decision not to pursue enforcement action.
This demonstrates that our strategy of emphasizing proactive vendor enforcement — as recommended in the September 11, 2023 strategy memorandum and as implemented through the October negotiations with Palomar and Mercer Haight — was well-received by the AGs and achieved the intended regulatory benefit. This is an important precedent for our practice: proactive vendor remediation and public accountability can meaningfully influence AG enforcement decisions in vendor-originated breach cases.]
Post-Incident Program Enhancements. The Coalition further notes that Quorum has represented that it has undertaken a comprehensive post-incident review of its vendor risk management program, overseen by Vice President of Vendor Risk Priya Deshmukh, and its information security program, overseen by Chief Information Security Officer David Naranjo. Quorum has represented that it has implemented the following program enhancements in connection with this review:
(a) Expanded third-party audit requirements for critical and high-risk vendors, including the adoption of SOC 2 Type II report requirements and annual penetration testing validation;
(b) Implementation of semi-annual tabletop exercises simulating vendor-originated data security incidents, involving cross-functional teams from information security, legal, compliance, and executive leadership;
(c) Comprehensive data minimization reviews across all active vendor relationships to reduce the volume and sensitivity of personally identifiable information shared with or processed by third-party service providers; and
(d) Enhanced vendor onboarding and due diligence protocols, including security questionnaire and technical assessment requirements for all new vendor engagements involving the processing or storage of personally identifiable information.
IV. FINDINGS AND DETERMINATION
Based on the Coalition's review of Quorum's submissions, the remedial actions taken by Quorum in response to the data security incident, Quorum's cooperation with the multistate inquiry, and Quorum's demonstrated commitment to compliance with applicable data breach notification laws and consumer protection statutes, the Coalition has determined that no enforcement action against Quorum Insurance Holdings Corp. is warranted at this time.
Accordingly, the investigation file referenced above (Multistate File No. CT-AG-2023-CYB-04821) is hereby closed.
[KO NOTE: KEY LANGUAGE — "no enforcement action … is warranted at this time." This is the dispositive finding of the letter and constitutes a full closure of the multistate investigation without any enforcement action, consent order, financial penalty, or mandatory injunctive commitment.
Note the qualifier "at this time." This is standard AG closure language that appears in virtually all multistate closure letters, regardless of the nature or outcome of the investigation. It does not constitute a covenant not to sue, a release of claims, or a permanent bar to future action. Rather, it preserves the inherent authority of the Attorneys General to investigate and take action in the future should circumstances warrant. However, as a practical matter, this language represents a definitive closure of this specific investigation, and absent new facts or a future incident, the likelihood of the Coalition reopening this matter is negligible.
We should flag for the client that this language represents the strongest form of closure we could have expected from a 29-state coalition. Full no-action closure — without monetary penalties, consent decrees, or assurances of voluntary compliance — is relatively uncommon in multistate data breach investigations of this scale (318,000+ affected individuals across 29 states, involving SSNs, financial data, and PHI). The vast majority of multistate AG data breach investigations of comparable scope result in some form of negotiated resolution, typically including a financial payment and a consent order with prospective security obligations. The fact that the Coalition determined that no such measures were warranted here is a significant and favorable outcome for Quorum.]
[KO NOTE: Also note the phrase "Quorum's cooperation with the multistate inquiry." The Coalition explicitly credits Quorum's cooperative posture as a factor in its determination. This validates the strategy we recommended in our September 11, 2023 internal strategy memorandum, in which we counseled against an adversarial or obstructive approach and instead recommended full, voluntary cooperation with the Coalition's information requests. Our approach included voluntary production of materials beyond what was strictly demanded, proactive engagement with the lead AAGs (Marchetti and Petrosian), and prompt supplemental submissions in response to follow-up inquiries. This cooperative approach yielded the result we anticipated, and it establishes an important precedent for how we advise clients in future multistate data breach investigations.]
V. RESERVATIONS AND CAVEATS
The closure of this investigation does not constitute an approval, endorsement, or certification of Quorum's data security practices, policies, or procedures, and should not be construed or represented as such by Quorum or any person acting on its behalf.
The Coalition reserves all rights to investigate and take enforcement action in the event of future data security incidents involving Quorum, or if additional information comes to light regarding the current incident that materially differs from the representations made by Quorum in its October 13, 2023 written response and November 3, 2023 supplemental submission.
This letter does not bind any individual state Attorney General from pursuing a separate investigation or enforcement action independently under its own consumer protection and data breach notification statutes. However, the Coalition notes that no individual state Attorney General has indicated an intention to pursue a separate investigation or enforcement action as of the date of this letter.
Each participating state Attorney General retains independent authority under its own applicable consumer protection, data security, and data breach notification statutes, and nothing in this letter shall be construed to limit, waive, or otherwise affect such authority.
[KO NOTE: This is standard reservation-of-rights boilerplate that appears in substantially all multistate AG closure letters. These caveats are customary and expected, and they do not diminish the favorable nature of the closure determination in any material respect. The non-endorsement language in the first paragraph is entirely routine and simply prevents Quorum from characterizing the closure letter as an AG "seal of approval" on its security practices.
However, one element of this section merits particular attention: the affirmative statement that "no individual state Attorney General has indicated an intention to pursue a separate investigation or enforcement action as of the date of this letter" is notable and unusual. In our experience, typical multistate closure letters either remain silent on whether individual states intend to proceed independently, or they include a generic reservation of rights without commentary. The fact that the Coalition affirmatively represented that no individual state has indicated an intent to pursue separate action goes further than standard closure language and effectively signals that all 29 states are aligned on closure. This provides an additional layer of assurance that is meaningful and should be highlighted for the Board and CEO in the November 29 briefing memo.
Separately, the caveat regarding "material differences" from Quorum's representations reinforces the critical importance of ensuring the accuracy and completeness of all factual statements made in our October 13 response and November 3 supplemental submission. While I am confident in the accuracy of our submissions based on the thorough review process we conducted, this caveat serves as an important reminder that any material inaccuracies or omissions could provide a basis for the Coalition to reopen the investigation. Alan Burke should verify that the matter file preserves all underlying documentation supporting every factual representation made in both submissions, including the Graystone forensic reports, Quorum's internal incident timeline, the breach notification tracker, the Palomar settlement documents, and all supporting correspondence. This is also relevant for the document retention protocol memorandum we are preparing for finalization by December 1, 2023.]
VI. ACKNOWLEDGMENTS AND COMMENDATIONS
The Coalition wishes to acknowledge Quorum's prompt and thorough response to the data security incident, including its timely engagement of experienced outside counsel and forensic investigators; its timely and comprehensive consumer and regulatory notifications, which met or exceeded the requirements of all applicable state breach notification statutes; its proactive vendor accountability measures, including the negotiation of meaningful financial and contractual remedies from its third-party vendor; and its cooperative engagement with the multistate Coalition throughout the inquiry process.
The Coalition encourages Quorum to continue to invest in its information security program and vendor risk management practices, and to maintain the enhanced security and oversight measures described in its submissions, in order to protect the personally identifiable information of its customers and policyholders.
[KO NOTE: This commendatory language is not pro forma. In our experience, a significant majority of multistate AG closure letters do not include any commendatory or acknowledgment language — they simply close the file with a reservation of rights. The inclusion of an explicit acknowledgment section, with specific references to Quorum's "prompt and thorough response," "timely and comprehensive" notifications, "proactive vendor accountability measures," and "cooperative engagement," provides significant reputational and legal value to Quorum.
From a reputational standpoint, this language demonstrates that the Attorneys General of 29 states affirmatively recognized and commended Quorum's response, which can be referenced — with appropriate care and subject to the non-endorsement caveat — in future regulatory interactions, cyberinsurance renewal applications, and communications with business partners and counterparties.
From a legal standpoint, this language may provide meaningful defensive value in the event that private class action litigation arises from the breach. Plaintiffs in data breach class actions frequently allege that the breached entity's response was inadequate, delayed, or insufficient. The AGs' express finding that Quorum's response was "prompt and thorough" and that notifications were "timely and comprehensive" provides a contemporaneous, independent assessment by a 29-state regulatory coalition that directly contradicts such allegations. While AG closure letters are not dispositive in private litigation, they carry persuasive weight, particularly at the motion-to-dismiss or summary judgment stage.
Flag for client memo and Board briefing. Also flag for Sara Hendricks to include in the litigation readiness binder.]
VII. CONTACT INFORMATION
Any questions regarding this letter or the closure of this investigation should be directed to:
Diane Marchetti, Assistant Attorney General Consumer Protection Division Office of the Attorney General, State of Connecticut 165 Capitol Avenue Hartford, CT 06106 Telephone: (860) 808-5400
Mark Petrosian, Assistant Attorney General Bureau of Internet and Technology Office of the Attorney General, State of New York 28 Liberty Street New York, NY 10005 Telephone: (212) 416-8400
The Coalition appreciates Quorum's cooperation throughout the course of this inquiry.
Sincerely,
________________________________________
Diane Marchetti Assistant Attorney General Consumer Protection Division Office of the Attorney General State of Connecticut On behalf of the 29-State Multistate Coalition
________________________________________
Mark Petrosian Assistant Attorney General Bureau of Internet and Technology Office of the Attorney General State of New York On behalf of the 29-State Multistate Coalition
Enclosure: Appendix A — List of 29 Participating State Attorneys General Offices
cc:
Thomas R. Whitfield, General Counsel Quorum Insurance Holdings Corp. 400 Constitution Plaza, Suite 2200 Hartford, CT 06103
Catherine Langford, Esq. Mercer, Haight & Dunlop LLP 2100 Ross Avenue, Suite 3600 Dallas, TX 75201 (Counsel to Palomar Data Solutions, Inc.)
[KO NOTE: Note that the AGs copied Palomar's outside counsel, Catherine Langford at Mercer, Haight & Dunlop. This confirms that the AGs were tracking the vendor relationship and Palomar's role throughout the investigation. The copy to Palomar's counsel also signals that the Coalition considered and closed the matter as to the full incident chain — i.e., both Quorum's role and Palomar's role — and not merely Quorum's response in isolation. This is meaningful because it suggests that the Coalition is not contemplating a separate enforcement action against Palomar arising from the same incident, at least through the multistate vehicle. However, we should note that individual states retain independent authority to pursue Palomar directly, and some states (notably California and New York) have historically pursued enforcement actions against vendors in breach incidents. We have no indication that any such action is contemplated, but this should be monitored. Sara Hendricks should add a docket reminder to check for any Palomar-related AG filings on a quarterly basis through Q3 2024.]
[END ORIGINAL LETTER TEXT]
APPENDIX A
LIST OF 29 PARTICIPATING STATE ATTORNEYS GENERAL
*(As Referenced in the Closure Letter)*
The following twenty-nine (29) state Attorneys General offices participated in the multistate Coalition and are signatories to the Closure Letter dated November 22, 2023:
C&H INTERNAL SUMMARY ANNOTATION BLOCK
*(Not Part of Original Letter — Attorney Work Product)*
PRIVILEGED & CONFIDENTIAL — ATTORNEY WORK PRODUCT Prepared by Kevin Ostrowski, November 22–23, 2023 Calderwood & Harkness LLP — Matter No. 1025-00006
Overall Assessment.  This is an unequivocal favorable outcome for Quorum Insurance Holdings Corp. The twenty-nine-state multistate Attorney General Coalition has closed its investigation (Multistate File No. CT-AG-2023-CYB-04821) without enforcement action, without a consent order or assurance of voluntary compliance, without financial penalties or monetary payment by Quorum, and without mandatory injunctive commitments or prospective security obligations imposed on Quorum.
The Closure Letter contains affirmatively commendatory language regarding Quorum's incident response, the timeliness and comprehensiveness of its consumer and regulatory notifications, its compliance with applicable state breach notification statutes, its proactive vendor accountability measures, and its cooperative engagement with the Coalition. This outcome is among the most favorable we have achieved in a multistate data breach investigation of comparable scale.
For context, a breach involving 318,247 affected individuals across 29 states, with compromised data categories including Social Security numbers, financial account information, and protected health information, would typically be expected to result in a negotiated resolution involving some combination of monetary penalties, prospective compliance obligations, and a formal consent order. The Coalition's decision to close the investigation without any such measures reflects the strength of Quorum's response and the effectiveness of the legal strategy we pursued throughout the engagement.
Key Takeaways for Client Memorandum (November 24, 2023)
The following key takeaways should be incorporated into the client-facing analysis memorandum to be delivered to Thomas R. Whitfield, Jennifer Liang, and Margaret D. Calloway on November 24, 2023:
1.  Notification Compliance Confirmed. All regulatory notifications and consumer notifications have been confirmed timely and compliant by the 29-state Coalition. The AGs affirmatively found that notifications met all applicable statutory requirements — this is an affirmative compliance determination, not merely the absence of an adverse finding.
2.  Vendor-Originated Breach Characterization Accepted. The Coalition accepted the characterization of the incident as vendor-originated, attributed the root cause to Palomar's failure to patch CVE-2023-0669, and did not attribute any independent security failure to Quorum. No findings of deficiency were made regarding Quorum's own information security program, vendor risk management practices, or monitoring capabilities.
3.  Vendor Accountability Measures Viewed Favorably. The Coalition specifically referenced and described in detail the vendor accountability measures taken by Quorum, including the $4.2 million financial settlement, MSA Amendment 3, and the enhanced contractual security and audit obligations imposed on Palomar. The specificity of these references strongly suggests that these measures weighed materially and favorably in the Coalition's enforcement determination.
4.  Strongest Standard Closure Language Achieved. The determination that "no enforcement action … is warranted at this time" represents the strongest form of closure language available from a multistate AG coalition. Full no-action closure without monetary penalties, consent orders, or mandatory compliance commitments is a relatively uncommon outcome in multistate data breach investigations of this scale.
5.  No Individual State Separate Action Indicated. The Coalition's affirmative statement that no individual state Attorney General has indicated an intent to pursue a separate investigation or enforcement action provides an additional and unusual layer of assurance beyond standard closure language. This signals alignment across all 29 participating states.
6.  Commendatory Language Provides Defensive Value. The explicit commendations regarding Quorum's "prompt and thorough response," "timely and comprehensive" notifications, "proactive vendor accountability measures," and "cooperative engagement" provide significant defensive value for future proceedings, including any private class action litigation, regulatory inquiries, or cyberinsurance renewal negotiations.
Remaining Open Items
The following items remain open as of November 23, 2023, and should be tracked to completion:
Distribution Instructions.  
•  Original Letter (unredacted, without annotations): To be filed in the Calderwood & Harkness LLP document management system under Matter No. 1025-00006, document category "Regulatory Correspondence — Inbound."
•  Annotated Copy (this document): Distribution restricted to C&H engagement team only — Kevin Ostrowski, Rachel Bernstein, Alan Burke, and Sara Hendricks. To be filed in the document management system under Matter No. 1025-00006, document category "Internal Work Product — Attorney Annotations." This document is not to be produced, shared, or distributed to any person outside the engagement team without the prior written authorization of Kevin Ostrowski.
•  Client-Facing Analysis Memorandum: To be prepared as a separate privileged memorandum dated November 24, 2023, addressed to Thomas R. Whitfield (General Counsel), Jennifer Liang (Deputy General Counsel), and Margaret D. Calloway (Chief Compliance Officer), Quorum Insurance Holdings Corp. The memorandum will summarize the Closure Letter, identify key findings and takeaways, assess remaining open regulatory matters, and provide recommendations for the November 29, 2023 Board Audit Committee briefing. The memorandum will be transmitted via secure email and marked as Attorney-Client Privileged.
End of Internal Annotated Copy — Calderwood & Harkness LLP Matter No. 1025-00006 Prepared by Kevin Ostrowski, Partner, Privacy & Data Security Practice November 22–23, 2023 PRIVILEGED & CONFIDENTIAL — ATTORNEY-CLIENT PRIVILEGED / ATTORNEY WORK PRODUCT
Date of Original Letter: | November 22, 2023
Received by: | Calderwood & Harkness LLP, on behalf of Quorum Insurance Holdings Corp.
Annotations by: | Kevin Ostrowski, Responsible Partner, Privacy & Data Security Practice, Calderwood & Harkness LLP
Matter Number: | 1025-00006
Client: | Quorum Insurance Holdings Corp.
Matter Description: | Multistate AG Investigation — Palomar Data Solutions Breach Incident
No. | State
1 | Connecticut (Lead State)
2 | New York (Co-Lead State)
3 | Massachusetts
4 | California
5 | Illinois
6 | Pennsylvania
7 | New Jersey
8 | Ohio
9 | Texas
10 | Florida
11 | Georgia
12 | Virginia
13 | Maryland
14 | North Carolina
15 | South Carolina
16 | Michigan
17 | Minnesota
18 | Indiana
19 | Wisconsin
20 | Colorado
21 | Arizona
22 | Oregon
23 | Washington
24 | Tennessee
25 | Missouri
26 | Louisiana
27 | Nevada
28 | Iowa
29 | New Hampshire
Item | Status | Expected Resolution
Connecticut Insurance Department inquiry (separate from AG investigation) | Pending — final response submitted November 15, 2023 | Expected closure on or about November 28, 2023
HHS Office for Civil Rights (OCR) inquiry — HIPAA-related aspects of the breach | Pending — response submitted October 20, 2023 | Expected no-further-action determination on or about November 30, 2023
Document retention protocol memorandum — establishing retention requirements for all matter-related documents, correspondence, and work product | In preparation — Alan Burke drafting | To be finalized by December 1, 2023
Board Audit Committee briefing memorandum — matter resolution and closure summary for Board presentation | In preparation — Kevin Ostrowski and Rachel Bernstein drafting | To be completed for the November 29, 2023 Board Audit Committee meeting
Litigation readiness binder — compilation of key documents for defense of any future private litigation arising from the breach | In preparation — Sara Hendricks compiling | Ongoing; initial compilation by December 15, 2023
Quarterly Palomar/AG monitoring — docket checks for any independent state AG action against Palomar | To be calendared | Quarterly through Q3 2024