MULTISTATE ATTORNEY GENERAL JOINT DEMAND LETTER C&H INTERNAL ANNOTATED COPY
ATTORNEY-CLIENT PRIVILEGED & CONFIDENTIAL — WORK PRODUCT
Calderwood & Harkness LLP Matter No.: 1025-00006
Client: Quorum Insurance Holdings Corp.
Date Received: September 8, 2023
Annotations by: Kevin Ostrowski, Partner (Responsible Partner) and Alan Burke, Associate (Lead Associate)
Annotation Date: September 9–10, 2023
NOTE: This is an internal annotated copy of the original demand letter for Calderwood & Harkness LLP team use only. Bracketed italicized text represents C&H annotations. Original letter text is presented in standard format. This document is protected by the attorney-client privilege and the work product doctrine. It should not be disclosed, disseminated, or distributed to any person outside the Calderwood & Harkness engagement team or to the client without prior authorization from the Responsible Partner.
CALDERWOOD & HARKNESS LLP COVER MEMORANDUM
FROM: Kevin Ostrowski, Partner, and Alan Burke, Associate Calderwood & Harkness LLP 1700 K Street NW, Suite 900 Washington, D.C. 20006
TO: Thomas R. Whitfield, General Counsel, Quorum Insurance Holdings Corp. Jennifer Liang, Chief Privacy Officer, Quorum Insurance Holdings Corp.
DATE: September 10, 2023
RE: Receipt and Preliminary Analysis of Multistate AG Joint Demand Letter Dated September 8, 2023
Dear Tom and Jennifer,
This memorandum accompanies our internal annotated copy of the joint demand letter that Calderwood & Harkness received via email on Friday, September 8, 2023, from Assistant Attorney General Diane Marchetti of the Connecticut Attorney General's Office, Consumer Protection Division, and Assistant Attorney General Mark Petrosian of the New York Attorney General's Office, Bureau of Internet and Technology. The demand letter was issued on behalf of a twenty-nine-state multistate attorney general coalition, with the Connecticut and New York Attorneys General designated as co-leads of the multistate executive committee.
The demand letter requests extensive information concerning the data breach originating from Palomar Data Solutions, Inc. ("Palomar"), which compromised personally identifiable information ("PII"), financial account data, and protected health information ("PHI") of approximately 318,247 individuals across the twenty-nine participating states and the District of Columbia. The letter contains ten enumerated categories of demands, spanning corporate background information, details of the vendor relationship and contractual framework, a comprehensive incident narrative, data scope and consumer notification details, regulatory notification information, Quorum's information security program, Quorum's vendor risk management program, remedial measures taken, and vendor accountability actions.
Calderwood & Harkness has annotated the demand letter with preliminary legal analysis, identification of key risk areas, and initial response strategy notes. These annotations are presented in bracketed italicized text throughout the attached copy. The annotations are intended to facilitate efficient discussion during our upcoming strategy session and should be read in conjunction with the forthcoming C&H Strategy Memorandum, which we anticipate circulating on September 11, 2023.
Response Deadline. The demand letter requires a written response within thirty (30) calendar days from the date of the letter, establishing a response deadline of October 8, 2023. Calderwood & Harkness intends to seek a five (5) business-day extension of this deadline to October 13, 2023, in order to ensure the completeness and accuracy of the submission. Based on our experience with multistate coalitions, modest extensions of this nature are routinely granted without objection, and we do not anticipate any difficulty securing this accommodation. Alan Burke will prepare the extension request letter for submission by September 12, 2023.
Recommended Next Steps. We strongly recommend scheduling a strategy call with the full Quorum Incident Response team — including yourself, Jennifer, David Naranjo (CISO), Priya Deshmukh (VP, Vendor Risk Management), and Robert Wentworth (SVP, Claims Operations) — no later than September 12, 2023, to discuss our recommended response strategy in detail. This call should address document collection logistics, factual input requirements, privilege considerations, and coordination with ongoing Palomar indemnification negotiations and insurance coverage matters.
We are available at your convenience to discuss this memorandum and the annotated demand letter. Please do not hesitate to contact Kevin Ostrowski at (202) 555-4120 or Alan Burke at (202) 555-4138 to arrange the call.
Respectfully,
Kevin Ostrowski Partner, Calderwood & Harkness LLP
Alan Burke Associate, Calderwood & Harkness LLP
Enclosure: Multistate Attorney General Joint Demand Letter (September 8, 2023) — C&H Internal Annotated Copy
Cross-Reference: C&H Strategy Memorandum (anticipated September 11, 2023)
ORIGINAL JOINT DEMAND LETTER — ANNOTATED
OFFICE OF THE ATTORNEY GENERAL STATE OF CONNECTICUT
OFFICE OF THE ATTORNEY GENERAL STATE OF NEW YORK
September 8, 2023
Thomas R. Whitfield, Esq. General Counsel Quorum Insurance Holdings Corp. 400 Constitution Plaza, Suite 2200 Hartford, CT 06103
cc: Kevin Ostrowski, Esq. Calderwood & Harkness LLP 1700 K Street NW, Suite 900 Washington, D.C. 20006
Re: Multistate Investigation — Data Security Incident at Quorum Insurance Holdings Corp. Involving Palomar Data Solutions, Inc. (Notifications Received August 14, 2023 through August 25, 2023)
Dear Mr. Whitfield:
This letter is sent on behalf of a coalition of the Attorneys General of the following twenty-nine (29) states: Connecticut, New York, Massachusetts, California, Illinois, Pennsylvania, New Jersey, Ohio, Texas, Florida, Georgia, Virginia, Maryland, North Carolina, South Carolina, Michigan, Minnesota, Indiana, Wisconsin, Colorado, Arizona, Oregon, Washington, Tennessee, Missouri, Louisiana, Nevada, Iowa, and New Hampshire (collectively, the "Coalition" or the "Participating States"). The Attorneys General of the State of Connecticut and the State of New York have been designated as co-leads of the multistate executive committee charged with coordinating this investigation.
The Coalition has reviewed the regulatory breach notification filings submitted by Quorum Insurance Holdings Corp. ("Quorum" or "the Company") to the respective state attorneys general and regulatory authorities of the Participating States between August 14, 2023 and August 25, 2023. Based on these filings and additional publicly available information, the Coalition understands that a security incident originating at Palomar Data Solutions, Inc. ("Palomar"), a third-party claims-processing vendor retained by Quorum, resulted in the compromise of personally identifiable information ("PII"), financial information, and protected health information ("PHI") of approximately 318,247 individuals residing in the Participating States and the District of Columbia.
The Coalition notes that the incident was vendor-originated in nature, arising from the exploitation of a vulnerability in software used within Palomar's data processing environment. The Participating States take seriously their responsibility to protect the personal information of their residents and to ensure that companies doing business in their jurisdictions maintain reasonable data security practices, including with respect to the oversight and management of third-party vendors that are entrusted with access to consumers' personal information.
Accordingly, the Coalition is exercising its authority under the applicable consumer protection and data security statutes of the Participating States to investigate the circumstances of the data security incident, Quorum's data security practices, the adequacy of Quorum's incident response and consumer notification efforts, and the measures Quorum has taken and plans to take to prevent future incidents. The Coalition requests that Quorum provide written responses to each of the following demands for information and production of documents within the timeframe specified below.
[C&H Annotation — Ostrowski]: The tone of this opening section is investigatory but notably restrained — the AGs use "investigation" language rather than "enforcement" or "action" language, and they have not issued a civil investigative demand or subpoena. This is a voluntary demand letter, which is a materially different procedural posture. The fact that the AGs acknowledge the vendor-originated nature of the breach in the third paragraph is favorable and suggests that the Coalition may not be predisposed to view Quorum as the primary wrongdoer. The coalition size (29 states) is significant but consistent with recent multistate data breach inquiries involving insurers and financial services companies — compare the 2022 Quillon Technologies multistate (42 states), the 2021 Blackbaud multistate (43 states + D.C.), and the 2023 Severin Corporation/GoAnywhere multistate (various subsets). The key strategic posture for our response is cooperative engagement: we must not treat this as adversarial litigation. Quorum should demonstrate that it is a responsible corporate actor that (a) maintained a robust information security program, (b) imposed rigorous contractual security requirements on its vendor, (c) responded promptly and comprehensively once notified of the breach, (d) made timely notifications to all required regulators and affected individuals, and (e) held its vendor accountable. Note the co-lead structure — the Connecticut AG is Quorum's home-state regulator, which gives us a direct engagement opportunity with AAG Marchetti. I have previously worked with AAG Marchetti on the Vantage Insurance multistate in 2021 and found her to be professional, reasonable, and responsive to cooperative engagement. This relationship should be leveraged appropriately.
SECTION I: BACKGROUND INFORMATION
Demand 1: Corporate and Organizational Information
Please provide the following information regarding Quorum Insurance Holdings Corp.:
1. The full legal name of the Company, its state of incorporation, the date of incorporation, and its principal place of business.
2. A current organizational chart depicting the Company's corporate structure, including the identification of all operating subsidiaries, affiliates, and divisions. The organizational chart should specifically identify all subsidiaries, affiliates, or divisions that processed, stored, transmitted, or otherwise had access to the personal information of the individuals affected by the data security incident.
3. A description of the Company's business lines, including but not limited to property and casualty insurance, specialty insurance, life and annuity products, and any financial technology or insurtech operations.
4. The Company's total annual revenue for fiscal years 2021 and 2022.
5. The total number of employees of the Company and its subsidiaries as of the date of this letter.
6. The names, titles, and reporting relationships of the Company's Chief Information Security Officer, Chief Privacy Officer, and any other personnel with primary responsibility for data security and privacy, including but not limited to any Vice President or Director of Vendor Risk Management, Information Technology, or Compliance.
[C&H Annotation — Burke]: This is a standard background request and should be responded to fully and without objection. Key information to compile for the response:
— Full legal name: Quorum Insurance Holdings Corp. Incorporated in the State of Delaware. Principal place of business: 400 Constitution Plaza, Suite 2200, Hartford, CT 06103. Publicly traded on the Nasdaq Stock Market under ticker symbol QIHC.
— Organizational chart: Will need to coordinate with Quorum's corporate secretary to obtain a current organizational chart and a comprehensive list of all subsidiaries. The response should specifically identify any subsidiary or division that interfaced with Palomar or that had access to the data processed by Palomar. At minimum, Quorum Claims Services, Inc. (the subsidiary that contracted with Palomar for claims processing) should be identified.
— Business lines: Property & casualty insurance (personal lines and commercial lines); specialty insurance (errors & omissions, directors & officers, cyber liability); life and annuity products (through Quorum Life & Annuity Corp.); and financial technology/insurtech operations through the QuorumEdge digital underwriting platform. QuorumEdge should be described at a high level as a proprietary technology platform — it demonstrates Quorum's sophistication and investment in technology, which supports the narrative that Quorum takes data security seriously.
— Revenue: FY 2022 total consolidated revenue: $4.82 billion. FY 2021 total consolidated revenue: $4.37 billion. These figures are publicly available from Quorum's SEC filings.
— Employees: Approximately 11,400 employees across all subsidiaries as of September 2023.
— Key personnel: CISO: David Naranjo (reports to Jennifer Liang and, on a dotted-line basis, to the Board Audit Committee). CPO: Jennifer Liang (reports to Tom Whitfield). VP, Vendor Risk Management: Priya Deshmukh (reports to Jennifer Liang). SVP, Claims Operations: Robert Wentworth (reports to COO). All four individuals should be identified by name and title in the response.
Demand 2: Vendor Relationship and Contractual Framework
Please provide the following information and documents regarding the Company's relationship with Palomar Data Solutions, Inc.:
1. A complete description of the business relationship between Quorum and Palomar, including the nature and scope of the services provided by Palomar, the date the relationship commenced, and the current status of the relationship.
2. Copies of the Master Services Agreement ("MSA") and all amendments, addenda, exhibits, statements of work, or other contractual documents governing the processing of data by Palomar on behalf of Quorum.
3. The date the MSA was executed, the term of the MSA (including any renewal provisions), and the annual contract value.
4. A detailed description of the categories and volume of data processed by Palomar on behalf of Quorum, including the types of personal information, the approximate number of records, and the business purposes for which the data was processed.
5. Copies of any data security requirements, standards, specifications, exhibits, or addenda incorporated into or appended to the MSA or any related agreements that set forth obligations regarding Palomar's protection of the data it processed on behalf of Quorum.
6. Documentation of any vendor risk assessments, due diligence evaluations, security questionnaires, on-site audits, or other reviews of Palomar's data security practices conducted by Quorum or on Quorum's behalf prior to the incident, including the dates of such assessments and a summary of the findings.
7. Copies of any SOC 2 Type II audit reports or similar independent audit or certification reports received by Quorum from Palomar, together with the identity of the auditing firm that prepared such reports.
[C&H Annotation — Ostrowski]: This is the most sensitive and strategically important demand category. The response to this demand will substantially shape the Coalition's assessment of whether Quorum exercised adequate vendor oversight. Several key points:
The MSA was executed on November 12, 2019, between Quorum Claims Services, Inc. (as "Client") and Palomar Data Solutions, Inc. (as "Service Provider"). It has been amended twice: Amendment No. 1 (March 3, 2021), which expanded the scope of services and increased the annual contract value, and Amendment No. 2 (September 15, 2022), which added enhanced data security requirements including the SOC 2 Type II audit obligation. The initial term is five years (November 12, 2019 – November 11, 2024), with automatic one-year renewal periods thereafter absent 180-day advance written notice of non-renewal.
The MSA and its amendments contain detailed data security obligations in Exhibit D ("Information Security Requirements"). These include, among other things: (a) requirement to maintain an information security program consistent with industry standards (NIST Cybersecurity Framework and ISO 27001 referenced); (b) encryption of data at rest and in transit using AES-256 or equivalent; (c) access controls including multi-factor authentication for privileged accounts; (d) annual penetration testing by a qualified third-party firm; (e) patching of critical vulnerabilities within thirty (30) days of the vendor's release of a patch (this is the provision Palomar violated with respect to CVE-2023-0669); and (f) the SOC 2 Type II audit requirement (added in Amendment 2). We should produce the MSA and all amendments — withholding would be counterproductive and the AGs would almost certainly compel production in any event.
However, the framing of the production is critical. We must present the MSA provisions as evidence that Quorum imposed robust, commercially reasonable vendor security requirements, and that the breach resulted from Palomar's failure to comply with those contractual obligations — not from any deficiency in Quorum's vendor oversight program. This is the central narrative of our response.
The annual contract value following Amendment No. 1 is $16.3 million per year. This is a material vendor relationship and the AGs will expect to see commensurate oversight. The SOC 2 audit requirement was added in Amendment No. 2 (September 15, 2022). Palomar's SOC 2 auditor is Kessler, Park & Associates CPA, PLLC (Dallas, TX). We need to confirm with Priya Deshmukh exactly what vendor risk assessments and reviews were conducted by Quorum with respect to Palomar and when — this includes initial due diligence at onboarding (2019), any periodic reassessments, and any review or follow-up activities prompted by the SOC 2 reports. The strength of the vendor oversight narrative depends heavily on what Quorum actually did beyond the contractual framework.
[C&H Annotation — Burke]: Two additional items to flag on this demand:
First, Palomar's notification to Quorum on April 21, 2023 was approximately 24 hours late under the MSA's notification requirement. Specifically, Section 9.4 of the MSA requires Palomar to notify Quorum of any actual or suspected security breach "within forty-eight (48) hours of discovery." Palomar's Security Operations Center discovered the anomalous outbound data transfers on April 18, 2023 at approximately 2:15 PM ET. Palomar did not notify Quorum until approximately 3:40 PM ET on April 21, 2023 — approximately 73 hours after discovery, or roughly 24 hours past the contractual deadline. We should address this proactively in the response as an additional Palomar contractual breach, not something Quorum needs to defend. This reinforces the narrative of vendor failure.
Second, Exhibit D of the MSA (as in effect at the time of the breach) required patching of "Critical" and "High" severity vulnerabilities within 30 calendar days of the release of a patch by the applicable software vendor. CVE-2023-0669 is a remote code execution vulnerability in Severin Corporation's GoAnywhere MFT software. Severin Corporation released a patch for this vulnerability on approximately February 7, 2023. The exploitation of Palomar's GoAnywhere MFT instance occurred on March 14, 2023 — approximately 35 days after the patch was released. Palomar had not yet applied the patch. This is a clear-cut breach of the 30-day patching requirement in Exhibit D, Section 4.3(e). This is the single strongest fact in Quorum's defense: Quorum imposed a specific, measurable security requirement; Palomar failed to comply; and that failure directly caused the breach.
Demand 3: Detailed Incident Description
Please provide a comprehensive chronological narrative of the data security incident, including the following:
1. The date on which unauthorized access to the systems containing the affected data first occurred.
2. A description of the method by which unauthorized access was achieved, including the specific attack vector, the vulnerability or vulnerabilities exploited, and the systems affected.
3. The duration of the period of unauthorized access.
4. The date on which the incident was first detected and the identity of the individual or entity that first detected the incident.
5. The date on which Quorum was first notified by Palomar of the incident, the method by which such notification was provided, and the identity of the individuals involved.
6. The date on which Quorum engaged outside legal counsel in connection with the incident.
7. The date on which Quorum engaged a third-party forensic investigation firm, or caused such a firm to be engaged, in connection with the incident.
8. The date on which the forensic investigation commenced and the date on which it was completed.
9. A summary of the findings of the forensic investigation, including the scope of data accessed or exfiltrated, the methods employed by the threat actor, and any indicators of compromise identified.
10. The identity of the forensic investigation firm retained, the date of its retention, and whether the firm was retained by Quorum, by Palomar, or jointly.
11. Copies of any preliminary and final forensic investigation reports prepared in connection with the incident. If the Company withholds any such reports on the basis of attorney-client privilege or work product protection, the Company should provide a detailed factual summary of the investigation findings and a privilege log entry identifying each withheld document.
[C&H Annotation — Ostrowski]: This demand presents a critical decision point regarding the forensic investigation reports. Graystone Forensics LLC (Tysons Corner, VA) was retained by Calderwood & Harkness on May 5, 2023, under the attorney-client privilege umbrella, at C&H's direction and for the purpose of providing litigation support and legal advice in connection with the data security incident. The engagement was structured to preserve privilege — Graystone's engagement letter is with C&H, not Quorum, and the scope of work expressly states that the forensic investigation is being conducted at the direction of counsel for the purpose of providing legal advice. Both the preliminary findings memorandum (dated June 2, 2023) and the final forensic investigation report (dated July 14, 2023) are privileged attorney work product and are protected from disclosure. Dr. Nolan Briggs, Managing Director, Incident Response, at Graystone Forensics, led the engagement.
We should NOT produce the Graystone reports. Instead, we will prepare a detailed factual summary of the incident timeline and key forensic findings that we can provide to the Coalition without waiving the attorney-client privilege or work product protection. This approach is standard practice in multistate AG responses to data breach inquiries — I have used it successfully in numerous prior matters, including the Vantage Insurance multistate (2021), the Meridian Financial Services inquiry (2022), and the Coastal Healthcare Partners response (2023). In each instance, the multistate coalition accepted a detailed factual summary without demanding production of the underlying privileged forensic reports.
The key factual elements to include in the summary are as follows:
— Attack vector: CVE-2023-0669, a remote code execution ("RCE") vulnerability in Severin Corporation's GoAnywhere MFT (Managed File Transfer) software, version 7.1.1. This vulnerability was publicly disclosed by Severin Corporation on February 1, 2023 and assigned a CVSS score of 7.2 (High). A patch was released by Severin Corporation on approximately February 7, 2023. The vulnerability was actively exploited by the Cl0p ransomware group and other threat actors beginning in late January/early February 2023.
— Unauthorized access window: March 14, 2023 through April 18, 2023 — approximately 35 days. The threat actor gained initial access to Palomar's GoAnywhere MFT instance on March 14, 2023 through exploitation of the unpatched CVE-2023-0669 vulnerability. The threat actor used this access to move laterally within Palomar's network and access data repositories containing Quorum policyholder and claimant data.
— Detection: Palomar's Security Operations Center ("SOC") identified anomalous outbound data transfer activity on April 18, 2023 at approximately 2:15 PM ET. Palomar initiated containment procedures on the same date.
— Notification to Quorum: Palomar notified Quorum on April 21, 2023 at approximately 3:40 PM ET (approximately 24 hours past the 48-hour contractual notification window).
— C&H engagement: Calderwood & Harkness engaged by Quorum on May 4, 2023.
— Graystone retention: May 5, 2023.
— Forensic investigation period: May 5, 2023 through July 14, 2023.
— No evidence that the compromised data has been published on the dark web or otherwise misused as of the date of the response (confirm with Graystone dark web monitoring at time of filing).
[C&H Annotation — Burke]: Prepare a privilege log entry for the Graystone reports for inclusion with the response in case the AGs push back on the privilege assertion. The privilege log entry should include: (1) document title, (2) date, (3) author(s), (4) recipient(s), (5) general description, and (6) basis for privilege assertion. We should also include a brief but clear privilege assertion statement in the cover letter accompanying the response, explaining that certain forensic investigation materials have been withheld as attorney-client privileged communications and attorney work product, and that a detailed factual summary has been provided in lieu of the privileged materials. In practice, multistate coalitions typically accept detailed factual summaries without objection, particularly where the summary is sufficiently comprehensive. We should ensure that our factual summary is thorough enough to satisfy the Coalition's informational needs without requiring resort to the privileged reports.
Demand 4: Scope of Compromised Data
Please provide the following information regarding the scope of the data compromised in the incident:
1. The total number of individuals whose personal information was compromised as a result of the incident, broken down by state of residence.
2. A detailed description of the types of personal information that were compromised, including but not limited to: full names, Social Security numbers, dates of birth, driver's license or state identification numbers, financial account information (including bank account and routing numbers), payment card numbers, and any protected health information as defined under the Health Insurance Portability and Accountability Act ("HIPAA").
3. The number of individuals affected by each category of compromised data.
4. A description of the data mining and affected-individual identification process used to determine which individuals were affected and what categories of data were compromised for each affected individual, including the identity of any vendor retained to perform data mining, the date such vendor was engaged, and the date the identification process was completed.
[C&H Annotation — Burke]: This demand should be responded to fully. The data mining and affected-individual identification process was completed on August 4, 2023. Below is the breakdown to be included in the response:
Total affected individuals: 318,247 across 29 states and the District of Columbia.
Data categories and affected population: — PII (full names, dates of birth, Social Security numbers, driver's license/state ID numbers): All 318,247 individuals. — Financial information (bank account numbers, routing numbers, and/or payment card numbers): 84,619 individuals. — Protected health information (health conditions, diagnosis codes, treatment information derived from workers' compensation claims and health-related insurance claims processed by Palomar): 41,203 individuals.
State-by-state breakdown (states with more than 10,000 affected individuals):
Data mining was performed by Graystone Forensics LLC as part of the forensic investigation. Note: we should describe the data mining function as a separate workstream from the privileged forensic analysis, to avoid any implication that production of data mining results constitutes a waiver of privilege over the broader forensic investigation. The data mining was conducted for the business purpose of identifying affected individuals for notification, and the results (the affected-individual list, state-by-state breakdown, and data-type categorization) are not themselves privileged. Confirm this framing with Kevin Ostrowski before finalizing the response.
Demand 5: Consumer Notification
Please provide the following information and documents regarding the Company's notification of affected individuals:
1. Copies of all versions of consumer notification letters sent to affected individuals, including any state-specific versions required by applicable law.
2. The dates on which notification mailings were initiated and completed.
3. The total number of notifications mailed, broken down by notification letter version and by state.
4. A description of any substitute notice provided in connection with the incident, including any website postings or media notices.
5. A description of the credit monitoring and identity theft protection services offered to affected individuals, including the identity of the service provider, the duration of the services offered, and the enrollment rate as of the date of the Company's response.
6. A description of the call center operations established in connection with the incident, including the identity of the call center vendor, the hours of operation, the total call volume received to date, and a summary of the most common categories of inquiries received.
[C&H Annotation — Burke]: We have complete documentation to respond to this demand. Key details:
Notification letter versions: Five (5) distinct versions were prepared and mailed: 1. General PII Version (sent to individuals whose only compromised data was names, DOB, SSN, and/or DL numbers — no financial or health data). 2. SSN + Financial Data Version (sent to individuals whose compromised data included financial account information in addition to PII). 3. PHI/HIPAA-Compliant Version (sent to individuals whose compromised data included protected health information — this version includes the specific HIPAA-compliant language required by 45 C.F.R. § 164.404). 4. California-Specific Version (incorporating the additional content requirements of Cal. Civ. Code § 1798.82, including the specific heading format mandated by the statute). 5. Massachusetts-Specific Version (incorporating the additional content required by Mass. Gen. Laws ch. 93H, § 3, and 201 C.M.R. § 17.00, including the statement regarding the right to obtain a police report and security freeze).
Mailing window: Notifications were mailed on a rolling basis between August 18, 2023 and September 15, 2023. All 318,247 individuals have been notified. Initial mailings (Connecticut and New York residents) went out on August 18, 2023; the final batch of mailings (remaining states) was completed by September 15, 2023. All mailings were timely under applicable state notification deadlines.
Notification vendor: Clearfield Notification Services LLC, Independence, OH. Account Manager: Jerome Tillman. Clearfield managed the entire notification logistics operation, including printing, mailing, call center operations, and credit monitoring enrollment.
Substitute notice: Quorum posted a notice of the data security incident on the Company's website (www.quoruminsurance.com/security-incident) on August 15, 2023, prior to the commencement of individual mailings. This posting serves as substitute notice for any individuals who cannot be reached by mail and satisfies the substitute notice requirements of applicable state statutes.
Media notice: Quorum issued a media notice on August 15, 2023 in compliance with the HIPAA Breach Notification Rule, 45 C.F.R. § 164.406, which requires media notice for breaches affecting more than 500 residents of a single state where PHI is involved. Media notices were issued to major media outlets in each state where more than 500 residents' PHI was affected.
Credit monitoring: Quorum is offering 24 months of complimentary credit monitoring and identity theft protection services through Dunmore Services Inc. (provided via Clearfield's enrollment platform) to all 318,247 affected individuals, regardless of the category of data compromised. Estimated enrollment take-rate as of early September 2023: approximately 40%, or approximately 127,299 enrollees. We should request updated enrollment statistics from Jerome Tillman at Clearfield before filing the response, as the AGs will want current numbers. The enrollment window remains open for 90 days from the date of the individual's notification letter.
Call center: Operated by Clearfield Notification Services LLC. Hours: Monday through Saturday, 8:00 AM to 8:00 PM ET. The call center was activated on August 18, 2023 and is scheduled to operate for 12 weeks. We should obtain call volume data and common inquiry categories from Jerome Tillman for inclusion in the response.
Demand 6: Regulatory Notifications
Please provide the following information and documents regarding the Company's regulatory notification activities:
1. A complete list of all state and federal regulatory bodies to which the Company submitted notifications of the data security incident, including the specific date of each notification and the statutory or regulatory provision under which each notification was submitted.
2. Copies of all regulatory notification filings submitted by the Company in connection with the incident.
3. The identification of any other regulatory inquiries, investigations, examinations, or proceedings that have been initiated or are pending in connection with the incident, by any federal, state, or local governmental authority.
[C&H Annotation — Burke]: All regulatory notifications were filed between August 14 and August 25, 2023, and all filings were timely under the applicable statutes and regulations. Below is the filing summary for inclusion in the response:
— Connecticut Attorney General: August 14, 2023 (Conn. Gen. Stat. § 36a-701b). — Connecticut Insurance Department: August 14, 2023 (Conn. Gen. Stat. § 38a-999b). Filed with Richard Nakamura, Examiner, Financial Regulation Division. — U.S. Department of Health and Human Services, Office for Civil Rights ("HHS-OCR"): August 15, 2023 (45 C.F.R. § 164.408). Filed with HHS-OCR Region I (Boston). — New York Attorney General: August 16, 2023 (N.Y. Gen. Bus. Law § 899-aa). — California Attorney General: August 16, 2023 (Cal. Civ. Code § 1798.82). — Massachusetts Attorney General: August 17, 2023 (Mass. Gen. Laws ch. 93H, § 3). — Remaining 24 states (and applicable state insurance departments): August 17 – August 25, 2023, pursuant to the respective state breach notification statutes.
We should produce the regulatory notification tracker and confirmation log that was finalized on August 25, 2023. This document provides a comprehensive, state-by-state summary of all filings, dates, and confirmation numbers.
Regarding other regulatory inquiries: We must disclose the following: 1. Connecticut Insurance Department — The CT Insurance Department (Richard Nakamura) has opened its own separate inquiry into the incident, focused on Quorum's compliance with Connecticut insurance data security regulations (Conn. Gen. Stat. § 38a-999b). We have been in preliminary discussions with Mr. Nakamura. 2. HHS-OCR — The Office for Civil Rights (Region I, Boston) has opened an inquiry into the PHI component of the breach under the HIPAA Breach Notification Rule and the HIPAA Security Rule. This inquiry relates to the 41,203 individuals whose PHI was compromised.
We must disclose both of these inquiries in response to this demand. Failure to do so would be viewed as non-cooperative and could undermine our credibility with the Coalition.
SECTION II: INFORMATION SECURITY PROGRAM
Demand 7: Quorum's Information Security Program
Please provide the following information regarding the Company's information security program:
1. A comprehensive description of the Company's written information security program ("WISP" or "ISP"), including:
(a) The governance structure of the program, including the role of the Board of Directors or any committee thereof in overseeing data security and privacy, the executive or officer with primary accountability for the program, and the reporting structure;
(b) The Company's risk assessment methodology, including the frequency with which risk assessments are conducted and the date of the most recent risk assessment completed prior to the incident;
(c) A description of the technical safeguards employed by the Company, including but not limited to encryption standards, access controls, network segmentation, endpoint detection and response, intrusion detection and prevention systems, multi-factor authentication, and data loss prevention tools;
(d) A description of the administrative safeguards employed by the Company, including but not limited to information security policies and procedures, employee security awareness training programs, background checks for employees with access to personal information, and acceptable use policies;
(e) A description of the physical safeguards employed to protect systems and facilities that store or process personal information;
(f) A description of the Company's incident response plan, including the date the plan was most recently updated and the date of the most recent tabletop exercise or simulation conducted to test the plan.
2. A description of any third-party assessments, penetration tests, audits, or certifications of the Company's own information security program conducted within the twenty-four (24) months prior to the date of the incident, including the identity of the firm that conducted each assessment and a summary of findings and recommendations.
3. The identity of the Company's external auditor and a description of any cybersecurity-focused or IT audit procedures performed by the external auditor in connection with the Company's most recent annual audit.
[C&H Annotation — Ostrowski]: This demand is significant because it probes Quorum's own security posture, as distinguished from Palomar's. This is where we demonstrate that Quorum maintained a robust, well-resourced, and actively managed information security program. It is critical to draw a clear line between Quorum's own systems (which were not breached) and Palomar's environment (which was). The breach did not result from any failure in Quorum's own technical infrastructure or security controls — it resulted from Palomar's failure to apply a critical patch in its own environment.
David Naranjo (CISO) should prepare a comprehensive summary of Quorum's information security program for inclusion in the response. Key elements to highlight:
— Governance: The Board of Directors' Audit Committee (chaired by Franklin Reeves, independent director) exercises oversight of the Company's cybersecurity and data privacy program. The CISO (Naranjo) presents quarterly updates to the Audit Committee on the state of the Company's cybersecurity posture, emerging threats, and risk mitigation activities. The CPO (Liang) reports to the General Counsel (Whitfield) and coordinates with the CISO on data privacy compliance.
— Risk assessment: Quorum conducts annual enterprise-wide information security risk assessments. Confirm the date of the most recent pre-incident assessment with Naranjo.
— Technical safeguards: Quorum employs industry-standard technical controls including AES-256 encryption at rest and TLS 1.2+ encryption in transit; role-based access controls with multi-factor authentication for all systems containing personal information; network segmentation between production, development, and corporate environments; enterprise endpoint detection and response (EDR); next-generation firewalls with intrusion detection and prevention capabilities; security information and event management (SIEM); and data loss prevention (DLP) tools. The Company operates the proprietary QuorumEdge digital underwriting platform, demonstrating substantial investment in technology infrastructure and security.
— Administrative safeguards: Annual mandatory security awareness training for all employees; phishing simulation exercises (quarterly); dedicated information security policies and procedures manual (confirm date of last revision); background checks for all employees with access to PII and PHI.
— Incident response plan: Confirm date of last update and date of most recent tabletop exercise with Naranjo. If the tabletop exercise was conducted in the 12 months prior to the breach, that is a strong fact to highlight.
— External auditor: Halstead & Monroe LLP (Philadelphia, PA). Engagement Partner: Gregory Chin. Confirm with Chin and with Quorum's internal audit team whether Halstead & Monroe conducted any IT audit procedures or cybersecurity-focused testing as part of the FY 2022 annual audit. If so, include a high-level description. If not, we should note that IT controls testing was conducted as part of Quorum's SOX compliance program.
Key message: The vulnerability that was exploited existed in Palomar's environment, not in Quorum's. Quorum's own information security program meets or exceeds industry standards for a financial services company of its size and complexity.
Demand 8: Vendor Risk Management Program
Please provide the following information regarding the Company's vendor risk management program:
1. A comprehensive description of the Company's vendor risk management program, including:
(a) The process by which vendors with access to personal information are identified, categorized, and risk-rated;
(b) The due diligence conducted before onboarding new data-processing vendors, including any security questionnaires, assessments, or reviews required prior to contract execution;
(c) The contractual data security requirements imposed on vendors as a standard practice;
(d) The procedures for ongoing monitoring and periodic audit of vendor security practices, including the frequency and methodology of such monitoring activities;
(e) The procedures for addressing vendor security deficiencies identified through monitoring, audit, or assessment activities;
(f) The frequency with which vendor risk assessments are reassessed or updated.
2. Specific information regarding all vendor risk management activities conducted with respect to Palomar Data Solutions, Inc., including the dates of any assessments, audits, reviews, questionnaires, or other oversight activities, and a summary of any findings, deficiencies noted, or remediation required.
[C&H Annotation — Ostrowski]: Priya Deshmukh (VP, Vendor Risk Management) is the primary source for this response and should be consulted immediately. Key points to emphasize:
— Quorum maintains a formal, documented vendor risk management program under Deshmukh's leadership. Vendors with access to PII, financial data, or PHI are classified into risk tiers (Critical, High, Medium, Low). Palomar was classified as a "Critical" vendor due to the volume and sensitivity of the data it processed.
— Pre-onboarding due diligence: Confirm with Deshmukh what due diligence was conducted prior to executing the MSA in November 2019. At minimum, this should have included a vendor security questionnaire, review of Palomar's information security policies, and reference checks.
— Contractual requirements: As detailed in the response to Demand 2, the MSA (as amended) imposed comprehensive data security requirements through Exhibit D and Exhibit E. These requirements are robust and commercially reasonable for a vendor relationship of this nature and scale. Specific contractual requirements include: NIST/ISO alignment, AES-256 encryption, MFA for privileged accounts, annual penetration testing, 30-day critical patch window, SOC 2 Type II audit (added September 2022), 48-hour breach notification, and minimum $10 million cyber liability insurance coverage.
— Ongoing monitoring: This is the area where we need the most input from Deshmukh. We need to know exactly what Quorum did beyond imposing contractual requirements — e.g., did Quorum review Palomar's SOC 2 reports when received? Were there any periodic vendor risk reassessments? Were any questionnaires re-issued? Were any on-site visits conducted? The answers to these questions will significantly impact our risk exposure.
— SOC 2 review: The SOC 2 Type II audit requirement was added in Amendment 2 (September 15, 2022). Palomar's SOC 2 auditor is Kessler, Park & Associates CPA, PLLC (Dallas, TX). Confirm with Deshmukh: (a) whether Palomar actually produced a SOC 2 report post-Amendment 2, (b) if so, the date of the report and covering period, (c) whether Quorum reviewed the report, and (d) whether any exceptions or qualifications were identified. This is important — if Palomar produced a clean SOC 2 report, that supports Quorum's reasonable reliance on the vendor's representations regarding its security posture.
Strategy: Emphasize the contractual framework and Quorum's reasonable reliance on Palomar's contractual representations and independent audit reports. This is the standard of care for vendor oversight in the insurance industry.
[C&H Annotation — Burke]: Potential area of concern: If Quorum relied solely on contractual provisions and SOC 2 reports without conducting any independent security assessments of Palomar's environment — such as independent penetration testing, on-site security reviews, or periodic vendor questionnaire updates — the AGs may argue that Quorum's vendor oversight was inadequate, particularly for a "Critical" tier vendor processing data for 300,000+ individuals at an ACV of $16.3 million/year. We need to understand the full picture before we can assess this risk. If the ongoing monitoring was limited in scope, we should frame this as consistent with industry-standard practice for business process outsourcing vendors of Palomar's size, sophistication, and independent audit posture. We should also reference the NAIC Insurance Data Security Model Law (adopted in Connecticut as Conn. Gen. Stat. § 38a-38) and its provisions regarding "due diligence" in the selection of third-party service providers, which do not prescribe specific independent assessment methodologies. Confirm with Deshmukh and discuss with Ostrowski before finalizing the response strategy on this point.
SECTION III: REMEDIATION AND FORWARD-LOOKING MEASURES
Demand 9: Remedial Measures Taken
Please provide a comprehensive description of all remedial measures taken by the Company in response to the incident, including:
1. A description of the steps taken to contain and remediate the breach at Palomar, including the timeline for containment and any measures taken to verify that the threat actor's access was terminated.
2. A description of any changes made to the Company's own information security program as a result of the incident, including any enhancements to technical, administrative, or physical safeguards.
3. A description of any changes made to the Company's vendor risk management practices as a result of the incident, including any new policies, procedures, or oversight mechanisms implemented or planned.
4. A description of any enhancements to the contractual data security requirements imposed on Palomar, including any amendments to the MSA executed or in negotiation since the incident.
5. A description of any personnel changes, organizational restructuring, or disciplinary actions taken in connection with the incident.
6. A timeline for the implementation of all remedial measures described above, indicating which measures have been completed and which are in progress or planned.
[C&H Annotation — Ostrowski]: This demand is an opportunity to demonstrate Quorum's proactive, comprehensive response to the incident. The remedial actions taken to date are extensive and should be presented in a structured, chronological format. Key remedial actions to include:
(1) Engagement of Calderwood & Harkness LLP as outside breach counsel (May 4, 2023) and Graystone Forensics LLC as privileged forensic investigators (May 5, 2023).
(2) Immediate evidence preservation and institution of litigation hold across all relevant Quorum systems and custodians (May 6, 2023).
(3) Filing of insurance claim under Quorum's cyber liability insurance policy with Atlas Mutual Insurance Company (Policy No. CYB-2023-041587; filed May 8, 2023; Claim No. CYB-CLM-2023-05892). Atlas Mutual acknowledged coverage and assigned claims adjuster Paul Enriquez.
(4) Comprehensive forensic investigation by Graystone Forensics (May 5 – July 14, 2023), resulting in full identification of the attack vector, scope of compromise, and affected-individual population.
(5) Timely and comprehensive consumer notifications to all 318,247 affected individuals (August 18 – September 15, 2023), with state-specific notification versions as required by applicable law.
(6) Timely regulatory notifications to all 29 state attorneys general, applicable state insurance departments, and HHS-OCR (August 14 – August 25, 2023).
(7) Provision of 24-month complimentary credit monitoring and identity theft protection services to all affected individuals through Dunmore Services Inc..
(8) Establishment of dedicated call center for affected individuals (August 18, 2023; operated by Clearfield Notification Services LLC).
(9) Vendor accountability actions — formal indemnification demand against Palomar (June 20, 2023; see Demand 10 below).
(10) Enhanced contractual requirements — anticipate that MSA Amendment No. 3 will be executed by the time we file the response. Amendment 3 will include: (a) reduction of the critical patch window from 30 days to 14 days; (b) mandatory deployment of endpoint detection and response (EDR) across all Palomar systems processing Quorum data; (c) quarterly vulnerability scanning and reporting to Quorum; (d) reduction of the breach notification window from 48 hours to 24 hours; (e) requirement for Palomar to engage an independent third-party security assessor (to be approved by Quorum) for enhanced annual security audits at Palomar's expense.
(11) Engagement of BrightPath Consulting Group Inc. (Meredith Ashford, Managing Director) for crisis communications strategy and support.
(12) By the time we file the response on approximately October 13, 2023, we should have the Palomar indemnification settlement finalized (target: late October 2023). If the settlement is finalized before the filing date, include it as a completed remedial action. If not, describe the negotiations as ongoing.
The response should present this as a comprehensive, multi-track remediation program, demonstrating that Quorum took the incident seriously, mobilized significant resources, and implemented lasting improvements to its vendor oversight and security practices.
[C&H Annotation — Burke]: We should explicitly reference the vendor indemnification and accountability track in this section of the response. The AGs will view favorably that Quorum held its vendor financially and operationally accountable rather than absorbing the loss passively or treating it as a cost of doing business. Reference the indemnification demand of $8,230,250 (representing Quorum's full incident response costs, including forensic investigation, legal fees, consumer notification, credit monitoring, and call center operations) against Palomar's contractual indemnification obligation under MSA Section 12.1, subject to the contractual liability cap of $32,600,000 (calculated as 2× trailing twelve-month fees, per Section 12.4). Note that the $8,230,250 demand is well within the contractual cap, which further supports the reasonableness of Quorum's position. If the settlement is not finalized by the response date, describe it as ongoing negotiations.
Demand 10: Vendor Accountability Actions
Please provide a specific description of all actions taken by the Company against Palomar Data Solutions, Inc. in connection with the incident, including:
1. A description of any contractual remedies pursued by the Company against Palomar, including any demands for indemnification, any exercise of termination rights, and any claims asserted or threatened.
2. A description of any changes to the contractual relationship between the Company and Palomar, including any amendments to the MSA or any new agreements entered into since the incident.