RESPONSE OF QUORUM INSURANCE HOLDINGS CORP. TO THE JOINT DEMAND OF THE MULTISTATE ATTORNEY GENERAL COALITION
October 13, 2023
FROM:
CALDERWOOD & HARKNESS LLP 1700 K Street NW, Suite 900 Washington, D.C. 20006 Telephone: (202) 555-4100 Facsimile: (202) 555-4101
| Kevin Ostrowski, Partner — Privacy & Data Security Direct: (202) 555-4118 | kostrowski@calderwoodharkness.com |
| Alan Burke, Associate — Privacy & Data Security Direct: (202) 555-4132 | aburke@calderwoodharkness.com |
| Sara Hendricks, Associate — Privacy & Data Security Direct: (202) 555-4145 | shendricks@calderwoodharkness.com |
ON BEHALF OF:
QUORUM INSURANCE HOLDINGS CORP. 400 Constitution Plaza, Suite 2200 Hartford, CT 06103
SUBMITTED TO:
Office of the Connecticut Attorney General Consumer Protection Division
Attn: Assistant Attorney General Diane Marchetti
165 Capitol Avenue Hartford, CT 06106
Office of the New York Attorney General Bureau of Internet and Technology
Attn: Assistant Attorney General Mark Petrosian
28 Liberty Street New York, NY 10005
RE: Response to Joint Demand Letter Dated September 8, 2023, on Behalf of the 29-State Multistate Attorney General Coalition
DELIVERY: Via Electronic Mail and Certified Mail
INTRODUCTORY COVER LETTER
Dear Assistant Attorney General Marchetti and Assistant Attorney General Petrosian:
Calderwood & Harkness LLP represents Quorum Insurance Holdings Corp. ("Quorum" or the "Company") in connection with the above-referenced matter. We write on behalf of Quorum to provide the Company's comprehensive response to the joint demand letter dated September 8, 2023 (the "Joint Demand Letter"), issued by the multistate coalition of twenty-nine (29) state attorneys general (the "Coalition"), co-led by the Offices of the Connecticut Attorney General and the New York Attorney General.
Quorum Insurance Holdings Corp. is a Delaware corporation publicly traded on the Nasdaq Stock Market under the ticker symbol QIHC, headquartered at 400 Constitution Plaza, Suite 2200, Hartford, Connecticut 06103 (EIN: 06-4832197). Quorum is a top-25 United States insurance holding company with operating subsidiaries licensed and conducting business in all fifty states and the District of Columbia. The Company offers personal and commercial lines insurance, specialty insurance products, and operates a proprietary digital underwriting platform known as QuorumEdge. For the fiscal year ended December 31, 2022, Quorum reported annual revenue of approximately $4.82 billion. The Company employs approximately 11,400 individuals nationwide.
This submission responds fully and in good faith to the Joint Demand Letter. Since the inception of this matter, Quorum has cooperated fully and transparently with all regulators and will continue to do so. Quorum takes its obligations to its policyholders, claimants, and the public with the utmost seriousness, and the Company has spared no effort in its response to the data security incident described herein.
Quorum submits this Response together with four supporting exhibits, each separately bound:
Exhibit A: Incident Timeline and Remedial Measures Summary
Exhibit B: Consumer Notification Samples and Compliance Checklist
Exhibit C: Palomar Vendor Accountability Summary
Exhibit D: Quorum Information Security Program Overview
Based on the facts and circumstances detailed in this Response and the accompanying Exhibits — including, in particular, the vendor-originated nature of the breach, Quorum's prompt and comprehensive response upon learning of the incident, the Company's full and timely compliance with all applicable consumer and regulatory notification obligations, the robust vendor accountability measures undertaken by the Company, and the absence of any evidence of consumer harm — Quorum respectfully requests that the Coalition close its inquiry without enforcement action.
We are available at your convenience to discuss any aspect of this submission and to provide any additional information the Coalition may require. Contact information for the undersigned is set forth above and in the signature block to this Response.
Respectfully,
Kevin Ostrowski Partner, Privacy & Data Security Calderwood & Harkness LLP
RESPONSE OF QUORUM INSURANCE HOLDINGS CORP. TO THE JOINT DEMAND OF THE MULTISTATE ATTORNEY GENERAL COALITION
I. EXECUTIVE SUMMARY
Quorum Insurance Holdings Corp. submits this Response to address the inquiries and demands set forth in the Joint Demand Letter issued by the twenty-nine-state Multistate Attorney General Coalition on September 8, 2023. As demonstrated by the detailed factual record set forth below and in the accompanying Exhibits, the data security incident at issue originated entirely within the systems and network environment of Palomar Data Solutions, Inc. ("Palomar"), a third-party claims-processing vendor headquartered at 7100 Greenville Avenue, Suite 450, Dallas, Texas 75231. Quorum was itself a victim of Palomar's security failures and, upon learning of the incident, acted swiftly, decisively, and responsibly to protect affected individuals and hold its vendor accountable.
The facts are straightforward. On or about March 14, 2023, a threat actor exploited CVE-2023-0669, a known remote code execution vulnerability in Palomar's GoAnywhere MFT file transfer appliance, to gain unauthorized access to Palomar's network environment. The vulnerability had been publicly disclosed and a patch made available by the software vendor prior to the date of exploitation; however, Palomar failed to timely apply the available patch, leaving its systems exposed. Over an approximately thirty-five-day period, from March 14 through April 18, 2023, the threat actor maintained unauthorized access to Palomar's environment, moved laterally through Palomar's internal network, identified and staged data files, and exfiltrated structured data files containing Quorum policyholder and claimant information.
Palomar's Security Operations Center ("SOC") first detected anomalous outbound data transfers on April 18, 2023, at which point the exfiltration ceased. Palomar notified Quorum of the incident on April 21, 2023 — approximately twenty-four hours beyond the contractually required forty-eight-hour notification window set forth in the parties' Master Services Agreement.
The compromised data affects a total of 318,247 individuals across twenty-nine states and the District of Columbia. The types of personal information compromised include names, dates of birth, Social Security numbers, driver's license numbers, and, for certain subsets of affected individuals, financial account information and protected health information.
Upon learning of the incident on April 21, 2023, Quorum immediately began its internal assessment and activated its incident response plan. The Company engaged Calderwood & Harkness LLP as outside counsel on May 4, 2023, and, through counsel, retained the digital forensics firm Graystone Forensics LLC under attorney-client privilege on May 5, 2023. Quorum initiated a comprehensive, multi-workstream response that included forensic investigation, consumer notification, regulatory notification, credit monitoring, crisis communications, and vendor accountability proceedings.
Quorum completed all consumer notifications between August 18 and September 15, 2023, mailing individualized notification letters to all 318,247 affected individuals. All regulatory notifications were filed between August 14 and August 25, 2023, in compliance with all applicable state and federal statutory requirements. Every affected individual was offered twenty-four months of complimentary credit monitoring and identity theft protection services at no cost.
The Company also held Palomar contractually accountable for its security failures. Following formal indemnification proceedings, the parties reached a settlement resulting in a total effective recovery by Quorum of $6,156,000, together with the imposition of materially enhanced data security requirements on Palomar going forward.
Critically, there is no evidence that any of the exfiltrated data has been misused. No confirmed instances of identity theft, fraud, or other consumer harm resulting from this incident have been reported to date. Quorum continues to monitor for any evidence of misuse and remains committed to protecting the interests of all affected individuals.
For the reasons set forth in detail below, Quorum respectfully submits that the factual record demonstrates a responsible corporate actor that was the victim of its vendor's security failures, responded comprehensively and in full compliance with applicable law, and has taken concrete steps to prevent recurrence. The Company respectfully requests that the Coalition close its inquiry without enforcement action.
II. BACKGROUND ON THE PARTIES AND THEIR RELATIONSHIP
A. Quorum Insurance Holdings Corp.
Quorum Insurance Holdings Corp. is a Delaware corporation, publicly traded on the Nasdaq Stock Market under the ticker symbol QIHC. The Company is headquartered at 400 Constitution Plaza, Suite 2200, Hartford, Connecticut 06103. Quorum is a top-25 United States insurance holding company, as measured by direct premiums written, with a diversified portfolio of insurance products spanning property and casualty, specialty lines, and life and annuity segments. The Company's operating subsidiaries are licensed and actively conduct business in all fifty states and the District of Columbia.
In addition to its traditional insurance operations, Quorum operates the QuorumEdge digital underwriting platform, a proprietary insurtech analytics platform that leverages predictive modeling, machine learning, and advanced data analytics to enhance underwriting precision, claims management, and risk assessment across the Company's lines of business. QuorumEdge has been recognized within the industry as a leading example of digital transformation in the insurance sector.
For the fiscal year ended December 31, 2022, Quorum reported annual revenue of approximately $4.82 billion. As of May 2023, the Company's market capitalization was approximately $6.1 billion. Quorum employs approximately 11,400 individuals across its nationwide operations, including corporate headquarters, regional offices, and field operations.
The Company's senior leadership team and key personnel relevant to this matter include the following:
• Margaret D. Calloway — Chief Executive Officer
• Thomas R. Whitfield — General Counsel
• David Naranjo — Chief Information Security Officer (CISO)
• Jennifer Liang — Chief Privacy Officer (CPO)
• Priya Deshmukh — Vice President, Vendor Risk Management
• Robert Wentworth — Senior Vice President, Claims Operations
Quorum is subject to comprehensive regulation by state insurance departments in all fifty states and the District of Columbia, as well as federal regulatory requirements applicable to certain of its insurance operations. The Company maintains a robust compliance infrastructure, including dedicated legal, compliance, information security, and privacy functions, to meet its regulatory obligations.
B. Palomar Data Solutions, Inc.
Palomar Data Solutions, Inc. is a Texas corporation headquartered at 7100 Greenville Avenue, Suite 450, Dallas, Texas 75231. Palomar is a technology and data services provider that specializes in claims data processing, document management, and analytics services for mid-to-large insurance carriers and related financial services firms. For the fiscal year ended December 31, 2022, Palomar reported annual revenue of approximately $340 million. Palomar employs approximately 2,100 individuals.
Palomar's leadership and counsel relevant to this matter include:
• Marcus J. Trevino — Chief Executive Officer
• Anita Raghavan — Chief Technology Officer
• Derek Copeland — General Counsel
• Outside Counsel: Mercer, Haight & Dunlop LLP (Dallas, TX); Catherine Langford, Partner
Palomar provides claims data processing services to multiple insurance carriers across the United States, and Quorum is Palomar's second-largest client by revenue.
C. The Contractual Relationship
Quorum and Palomar entered into a Master Services Agreement (the "MSA") on November 12, 2019, with an initial five-year term expiring November 11, 2024. Under the MSA, Palomar provides claims data processing services for Quorum's personal lines insurance division, including intake, processing, analysis, and storage of claims data. The original annual contract value ("ACV") of the engagement was $14.2 million, making Quorum Palomar's second-largest client by revenue.
The MSA has been amended twice since its original execution, and a third amendment was executed concurrently with the vendor settlement discussed in Section VIII below:
Amendment 1 (executed March 3, 2021): Expanded the scope of services to include processing of data related to the QuorumEdge digital underwriting platform. This amendment increased the ACV by $2.1 million to $16.3 million, effective April 1, 2021.
Amendment 2 (executed September 15, 2022): Updated the Data Security Exhibit (Exhibit D to the MSA) to reflect evolving industry best practices and heightened security requirements. Among other things, Amendment 2 added a requirement that Palomar obtain and provide a SOC 2 Type II audit report on an annual basis and updated the minimum cyber-insurance coverage that Palomar was required to maintain.
The MSA, together with its exhibits and amendments, contains comprehensive data security and incident response provisions. In particular, the Data Security Exhibit (Exhibit D, as amended by Amendment 2) requires Palomar to maintain commercially reasonable administrative, technical, and physical safeguards to protect Quorum data in Palomar's custody. The Data Security Exhibit specifically requires Palomar to patch critical vulnerabilities within thirty (30) days of the availability of a vendor-issued patch. The exhibit further requires Palomar to conduct annual penetration testing and to provide Quorum with a SOC 2 Type II audit report prepared by a qualified independent auditor. Palomar's SOC 2 Type II audit was conducted by Kessler, Park & Associates CPA, PLLC, a Dallas-based accounting firm.
Section 9.4 of the MSA contains a breach notification clause requiring Palomar to notify Quorum within forty-eight (48) hours of discovering any security incident that affects or is reasonably believed to affect Quorum data. As discussed in detail below, Palomar's notification to Quorum following the incident at issue was approximately twenty-four hours beyond this contractual deadline.
Section 12.2 of the MSA contains an indemnification provision under which Palomar agreed to indemnify and hold harmless Quorum from and against any losses, costs, damages, or expenses arising from Palomar's breach of its obligations under the MSA, including its data security obligations. The indemnification obligation is subject to a contractual cap of two times (2×) the trailing twelve-month fees paid or payable under the MSA — which, based on the then-current ACV of $16.3 million, amounts to an indemnification cap of $32,600,000.
III. DETAILED INCIDENT TIMELINE
A comprehensive incident timeline is provided in Exhibit A to this Response. For the convenience of the Coalition, a summary of the key events and dates is set forth below.
March 14, 2023 — Initial Compromise. On or about March 14, 2023, an unauthorized threat actor exploited CVE-2023-0669, a known critical remote code execution vulnerability in Palomar's GoAnywhere MFT (Managed File Transfer) file transfer appliance, to gain initial unauthorized access to Palomar's network environment. The GoAnywhere MFT appliance was deployed in Palomar's infrastructure to facilitate the secure transfer of data files between Palomar's systems and those of its clients, including Quorum. The CVE-2023-0669 vulnerability had been publicly disclosed by the software vendor and a remedial patch had been made available prior to the date of exploitation; however, Palomar had not applied the available patch to the affected appliance.
March 14 – April 18, 2023 (Approximately 35 Days) — Lateral Movement and Exfiltration. Following initial access, the threat actor engaged in lateral movement within Palomar's internal network over an approximately thirty-five-day period. During this time, the threat actor identified, accessed, and staged structured data files containing Quorum policyholder and claimant data within Palomar's claims processing environment. The threat actor subsequently exfiltrated these staged data files through outbound channels. The forensic investigation established the specific methods and pathways used for lateral movement, data staging, and exfiltration, as detailed in the Graystone Forensics report discussed in Section VI.B below.
April 18, 2023 — Detection by Palomar. On April 18, 2023, Palomar's Security Operations Center ("SOC") detected unusual outbound data transfers and identified the anomalous activity as indicative of a potential security incident. Palomar's internal security team initiated its own investigation and containment procedures on this date. The exfiltration of data ceased on or about April 18, 2023, coinciding with the detection of the anomalous activity.
April 21, 2023 — Notification to Quorum. On April 21, 2023, Palomar's General Counsel, Derek Copeland, notified Quorum's General Counsel, Thomas R. Whitfield, and Quorum's Chief Information Security Officer, David Naranjo, via electronic mail of the security incident involving Quorum data. This notification was transmitted approximately seventy-two (72) hours after Palomar's SOC initially detected the anomalous activity on April 18, 2023 — approximately twenty-four (24) hours beyond the forty-eight-hour contractual notification requirement set forth in Section 9.4 of the MSA. Quorum notes this delay as one of the contractual breaches identified in Section VIII below.
May 4, 2023 — Engagement of Outside Counsel. On May 4, 2023, Quorum formally engaged Calderwood & Harkness LLP as outside counsel to advise the Company in connection with the incident (Calderwood & Harkness Matter No. 1025-00006). The engagement team includes Kevin Ostrowski (Partner), Rachel Bernstein (Partner), Alan Burke (Associate), and Sara Hendricks (Associate) from the firm's Privacy & Data Security practice group. Upon engagement, Quorum activated its formal incident response plan, with outside counsel coordinating the Company's legal strategy and overseeing the forensic investigation, consumer and regulatory notification, and vendor accountability workstreams.
May 5, 2023 — Retention of Forensic Investigators. On May 5, 2023, at the direction of Calderwood & Harkness LLP, Quorum retained Graystone Forensics LLC, a digital forensics and incident response firm headquartered in Tysons Corner, Virginia, to conduct an independent forensic investigation of the incident. Graystone Forensics was retained under the direction of outside counsel, and all work product and communications in connection with the engagement are subject to the protection of the attorney-client privilege and the work product doctrine. The Graystone engagement was led by Dr. Nolan Briggs, Managing Director, Incident Response, and Kendra Faulkner, Senior Forensic Analyst.
May 8, 2023 — Cyber-Insurance Claim Filed. On May 8, 2023, Quorum filed a notice of claim with its primary cyber-liability insurer, Atlas Mutual Insurance Company (Chicago, Illinois), under Policy No. CYB-2023-041587 (Claim No. CYB-CLM-2023-05892). Quorum also provided precautionary notice to its excess carrier, Pinnacle Surplus Lines Insurance Corp. (Boston, Massachusetts), under Policy No. XS-CYB-2023-7812. The insurance claim and coverage are discussed in greater detail in Section VI.D below.
June 2, 2023 — Preliminary Forensic Findings. On June 2, 2023, Graystone Forensics issued its preliminary forensic findings report. The preliminary report confirmed the exfiltration of structured data files from Palomar's claims processing environment and identified the initial entry vector as the exploitation of CVE-2023-0669 in Palomar's GoAnywhere MFT appliance. The preliminary findings also confirmed the approximate timeline of unauthorized access (March 14 – April 18, 2023) and identified the general categories of data at risk.
July 14, 2023 — Final Forensic Report. On July 14, 2023, Graystone Forensics issued its final forensic report, confirming the full scope of compromised data and the complete population of affected individuals. The final report established that 318,247 individuals across twenty-nine states and the District of Columbia were affected by the incident, and it identified the specific categories and types of data compromised for each affected individual.
August 4, 2023 — Data Mining Completed. Data mining and affected individual identification processes were completed on August 4, 2023. These processes, conducted by Clearfield Notification Services LLC under the direction of Calderwood & Harkness, involved the analysis of the compromised data files to identify each affected individual, determine the specific types of information compromised for each individual, verify mailing addresses, and prepare the notification mailing lists.
August 14, 2023 — Initial Regulatory Notifications. On August 14, 2023, Quorum filed regulatory notifications with the Connecticut Attorney General's Office pursuant to Connecticut General Statutes § 36a-701b and with the Connecticut Insurance Department pursuant to the Connecticut Insurance Data Security Law, Connecticut General Statutes § 38a-999b. These were the first regulatory notifications filed in connection with the incident.
August 15, 2023 — HIPAA Notification and Media Notice. On August 15, 2023, Quorum filed its HIPAA breach notification with the U.S. Department of Health and Human Services, Office for Civil Rights (Region I, Boston), pursuant to 45 C.F.R. § 164.408, reporting the breach as affecting more than 500 individuals whose protected health information was compromised. On the same date, Quorum issued a media notice as required by 45 C.F.R. § 164.406 for breaches involving the protected health information of more than 500 individuals in a single state or jurisdiction.
August 16, 2023 — New York and California Regulatory Notifications. On August 16, 2023, Quorum filed regulatory notifications with the New York Attorney General's Office pursuant to the New York SHIELD Act (N.Y. General Business Law § 899-aa) and with the California Attorney General's Office pursuant to California Civil Code § 1798.82 (notification required where more than 500 California residents are affected).
August 17 – August 25, 2023 — Remaining Regulatory Notifications. Between August 17 and August 25, 2023, Quorum filed regulatory notifications with the attorneys general and/or other designated regulatory authorities in the remaining twenty-five states with affected residents, as well as the District of Columbia. On August 17, 2023, Quorum also filed notification with the Massachusetts Attorney General's Office and the Massachusetts Director of Consumer Affairs and Business Regulation pursuant to Massachusetts General Laws chapter 93H, § 3. All notifications were filed within the applicable statutory deadlines. A complete regulatory notification tracker confirming all filings and their respective filing dates is included in Exhibit B.
August 18 – September 15, 2023 — Consumer Notification Mailing. Between August 18 and September 15, 2023, Quorum mailed individualized consumer notification letters to all 318,247 affected individuals on a rolling basis over an approximately twenty-eight-day mailing window. The notification mailing is discussed in detail in Section VII below.
IV. ROOT CAUSE ANALYSIS
A. The Vulnerability: CVE-2023-0669
The root cause of the data security incident was Palomar's failure to timely patch a known critical vulnerability in its GoAnywhere MFT file transfer appliance. The vulnerability, designated CVE-2023-0669, is a pre-authentication remote code execution vulnerability that allows an unauthenticated attacker to execute arbitrary code on the affected appliance. This vulnerability was publicly disclosed by the software vendor and assigned a critical severity rating. A remedial patch was made available by the software vendor prior to the date on which the threat actor exploited the vulnerability to gain access to Palomar's network.
Under the Data Security Exhibit (Exhibit D) of the MSA, as updated by Amendment 2 (executed September 15, 2022), Palomar was contractually obligated to apply patches for critical vulnerabilities within thirty (30) days of the availability of a vendor-issued patch. Despite the availability of the patch and the clear contractual obligation to apply it within the prescribed window, Palomar failed to do so. This failure left the GoAnywhere MFT appliance exposed to exploitation and directly enabled the threat actor's initial unauthorized access to Palomar's network.
Quorum notes that this failure was entirely within Palomar's control. Quorum had no access to, control over, or responsibility for patching or maintaining Palomar's GoAnywhere MFT appliance or any other component of Palomar's network infrastructure. Quorum's contractual provisions requiring timely patching were specifically designed to address precisely this type of risk.
B. The Attack
Having exploited the unpatched CVE-2023-0669 vulnerability, the threat actor gained an initial foothold within Palomar's network environment on or about March 14, 2023. Over the ensuing approximately thirty-five days, the threat actor conducted lateral movement through Palomar's internal network, escalating access privileges and navigating to systems and file repositories containing Quorum policyholder and claimant data within Palomar's claims processing environment.
The threat actor identified and staged structured data files containing the personal information of Quorum policyholders and claimants, and subsequently exfiltrated those files through outbound data transfer channels. The exfiltration continued undetected until April 18, 2023, when Palomar's SOC identified unusual outbound data transfers. The forensic investigation conducted by Graystone Forensics established the specific technical details of the threat actor's lateral movement patterns, data staging methodology, and exfiltration techniques.
The prolonged thirty-five-day dwell time — from initial compromise to detection — reflects limitations in Palomar's security monitoring and detection capabilities. Quorum's own contractual audit rights and vendor oversight processes were not designed to provide real-time monitoring of Palomar's internal network activity, as such monitoring is the responsibility of the vendor under the MSA's data security framework.
C. Vendor-Originated Nature of the Breach
It is essential to the Coalition's assessment of this matter that the breach occurred entirely within Palomar's environment and was caused entirely by Palomar's security failures. At no point during the incident were Quorum's own networks, infrastructure, systems, or applications compromised, accessed, or affected in any way. The threat actor's activities were confined to Palomar's environment.
Quorum's proprietary systems, including the QuorumEdge digital underwriting platform and all other internal systems, were not implicated in the breach. Quorum's own information security program — including its network segmentation, multi-factor authentication, intrusion detection systems, endpoint protection, and other technical and administrative safeguards — was not breached, tested, or circumvented by the threat actor.
The data at issue was in Palomar's custody and under Palomar's exclusive control at the time of the unauthorized access and exfiltration. While Quorum recognizes its obligations to affected individuals under applicable breach notification statutes — obligations the Company has fulfilled fully and timely, as demonstrated in this Response — the causal responsibility for the breach rests with Palomar.
V. SCOPE OF COMPROMISED DATA
A. Total Affected Population
The forensic investigation conducted by Graystone Forensics, as confirmed in the final forensic report dated July 14, 2023, established that a total of 318,247 individuals across twenty-nine states and the District of Columbia were affected by the data security incident. All affected individuals had the following categories of personally identifiable information ("PII") compromised:
• Full names
• Dates of birth
• Social Security numbers
• Driver's license numbers
The compromised information was contained in structured data files within Palomar's claims processing environment, reflecting data provided by or on behalf of Quorum policyholders and claimants in connection with insurance claims processed by Palomar under the MSA.
B. Financial Data Subset
A subset of 84,619 individuals — included within the total affected population of 318,247 — also had financial information compromised as a result of the incident. The financial information at issue includes:
• Bank account numbers
• Payment card numbers (credit and debit card numbers)
This financial data was associated with claims payment and premium processing records maintained by Palomar in connection with its services to Quorum.
C. Protected Health Information (PHI) Subset
A further subset of 41,203 individuals — also included within the total affected population of 318,247 — had protected health information ("PHI") compromised as a result of the incident. The PHI at issue includes:
• Health conditions
• Medical diagnosis codes
• Treatment information
This PHI was derived from workers' compensation claims and health-related insurance claims processed by Palomar on behalf of Quorum. The compromise of this PHI triggered notification obligations under the HIPAA Breach Notification Rule, specifically 45 C.F.R. § 164.408, which requires covered entities and business associates to notify the Secretary of Health and Human Services of breaches of unsecured PHI affecting 500 or more individuals. Quorum's compliance with these HIPAA obligations is addressed in Section VII.E below.
D. State-by-State Breakdown of Affected Residents
The following table sets forth the number of affected individuals residing in each of the twenty-nine affected states and the District of Columbia, based on verified mailing addresses:
The detailed state-by-state breakdown for all twenty-nine states and the District of Columbia, including the individual counts for the remaining nineteen states and D.C. not separately enumerated above, is provided in Exhibit A to this Response.
VI. QUORUM'S INCIDENT RESPONSE
A. Immediate Response Actions
Upon receiving Palomar's notification of the security incident on April 21, 2023, Quorum immediately commenced its internal assessment and response. Quorum's Chief Information Security Officer, David Naranjo, and Chief Privacy Officer, Jennifer Liang, jointly led the Company's initial internal response, coordinating with the Company's General Counsel, Thomas R. Whitfield, and Senior Vice President of Claims Operations, Robert Wentworth, to assess the scope and potential impact of the incident.
On May 4, 2023, Quorum formally engaged Calderwood & Harkness LLP as outside counsel to advise the Company in all aspects of its incident response. The Calderwood & Harkness engagement team included Kevin Ostrowski (Partner), Rachel Bernstein (Partner), Alan Burke (Associate), and Sara Hendricks (Associate). Upon engagement, counsel worked with Company leadership to activate Quorum's formal, documented incident response plan, which establishes the Company's protocols for managing data security incidents, including escalation procedures, communication protocols, forensic investigation procedures, notification obligations, and remediation measures.
On May 5, 2023, at the direction of Calderwood & Harkness, Quorum retained Graystone Forensics LLC, a nationally recognized digital forensics and incident response firm headquartered in Tysons Corner, Virginia, to conduct an independent forensic investigation of the incident. The Graystone engagement was structured to be directed by and through Calderwood & Harkness, and all work product and communications arising from the engagement are protected by the attorney-client privilege and the work product doctrine.
Concurrently with the engagement of outside counsel and forensic investigators, Quorum issued legal hold notices to relevant personnel in the Company's Information Technology and Claims Operations departments, directing the preservation of all documents, communications, and electronic records potentially relevant to the incident. These legal holds were implemented promptly to ensure the integrity and availability of relevant evidence.
B. Forensic Investigation
The forensic investigation was led by Dr. Nolan Briggs, Managing Director of Incident Response at Graystone Forensics, and Kendra Faulkner, Senior Forensic Analyst. Graystone's investigation was thorough, methodical, and conducted in accordance with industry best practices and forensic standards.
Graystone issued its preliminary forensic findings report on June 2, 2023. The preliminary report confirmed the exfiltration of structured data files from Palomar's claims processing environment and identified CVE-2023-0669 as the initial entry vector. The preliminary findings provided the basis for Quorum's initial assessment of the scope of the incident and informed the Company's planning for consumer and regulatory notifications.
On July 14, 2023, Graystone issued its final forensic report, which confirmed the complete scope of the compromised data and the full population of affected individuals. Specifically, the final report established:
• Entry Vector: Exploitation of CVE-2023-0669 in Palomar's GoAnywhere MFT file transfer appliance.
• Timeline of Unauthorized Access: March 14, 2023 through April 18, 2023 (approximately thirty-five days).
• Lateral Movement: The threat actor moved laterally through Palomar's internal network, escalating privileges and navigating to file repositories containing Quorum data.
• Data Staging: The threat actor identified and staged structured data files containing Quorum policyholder and claimant information for exfiltration.
• Exfiltration: The staged data files were exfiltrated through outbound channels over the period of unauthorized access.
• Affected Population: 318,247 individuals across twenty-nine states and the District of Columbia, with subsets of individuals having financial data and protected health information compromised as described in Section V above.
Following the issuance of the final forensic report, data mining processes were initiated to identify each affected individual, determine the specific types of information compromised for each individual, verify current mailing addresses through national change-of-address databases, and prepare the notification mailing lists. These data mining processes were completed on August 4, 2023. The data mining was conducted by Clearfield Notification Services LLC under the direction and oversight of Calderwood & Harkness.
C. Crisis Communications
Recognizing the importance of clear, accurate, and timely communications to affected individuals, employees, investors, regulators, and the public, Quorum retained BrightPath Consulting Group Inc., a crisis communications firm headquartered in New York, New York, to manage external and internal communications related to the incident. The BrightPath engagement was led by Meredith Ashford, Managing Director.
BrightPath coordinated the development and dissemination of press statements, employee communications, and investor-facing disclosures related to the incident. The Company's communications strategy was designed to be transparent, accurate, and timely, and to minimize confusion among affected individuals and other stakeholders. Employee communications included internal briefings for relevant business units and guidance for customer-facing personnel to handle inquiries from policyholders and claimants. Investor-facing disclosures were prepared in coordination with Quorum's legal and finance teams and were made in accordance with applicable securities disclosure requirements.
D. Cyber-Insurance Activation
Quorum maintains a comprehensive cyber-liability insurance program designed to provide financial protection in the event of a data security incident. The Company's cyber-insurance tower is structured as follows:
Primary Policy: Insurer: Atlas Mutual Insurance Company (Chicago, Illinois) Policy No.: CYB-2023-041587 Policy Period: January 1, 2023 – January 1, 2024 Per-Occurrence Limit: $15,000,000 Self-Insured Retention (SIR): $2,500,000
Excess Policy: Insurer: Pinnacle Surplus Lines Insurance Corp. (Boston, Massachusetts) Policy No.: XS-CYB-2023-7812 Policy Period: January 1, 2023 – January 1, 2024 Limit: $25,000,000 excess of primary Total Tower: $40,000,000
Quorum's cyber insurance program is placed through Whitmore Risk Advisors Inc., with Sandra Whitmore-Kim serving as Lead Broker for the account.
On May 8, 2023, Quorum filed a timely notice of claim with Atlas Mutual under the primary policy (Claim No. CYB-CLM-2023-05892). Precautionary notice was also provided to Pinnacle Surplus Lines under the excess policy on the same date.
Atlas Mutual acknowledged receipt of the claim, conducted its coverage review, and accepted coverage for the incident. Covered costs include forensic investigation expenses, consumer notification and mailing costs, credit monitoring and identity theft protection services, crisis communications costs, and regulatory defense costs, all in excess of the $2,500,000 self-insured retention. Based on the total incident response costs of $8,230,250 discussed in Section X below, the amount covered by the primary policy is $5,730,250 (total costs less the SIR).
VII. CONSUMER NOTIFICATION COMPLIANCE
A. Notification Obligation Analysis
Upon engagement, Calderwood & Harkness conducted a comprehensive, state-by-state analysis of the breach notification statutes in all fifty states and the District of Columbia to determine Quorum's notification obligations in connection with the incident. Based on the types of personal information compromised and the residency of affected individuals, counsel determined that consumer notification was required in all twenty-nine states where affected residents reside, as well as the District of Columbia.
The analysis addressed the specific requirements of each applicable state statute, including:
• Statutory definitions of "personal information" and the specific data elements that trigger notification obligations;
• Timing requirements for consumer and regulatory notifications;
• Content requirements for consumer notification letters, including mandated disclosures and consumer guidance;
• Requirements for notification to state attorneys general, state insurance regulators, and other designated agencies;
• Substitute notice provisions and thresholds;
• Special requirements applicable to insurance companies or entities subject to sector-specific regulation.
In addition to state-specific breach notification statutes, Calderwood & Harkness analyzed the following regulatory frameworks:
• HIPAA Breach Notification Rule (45 C.F.R. §§ 164.400–164.414): Applicable to the 41,203 individuals whose protected health information was compromised. Because the breach affected more than 500 individuals, notification to the Secretary of HHS was required within 60 days, and media notice was required in states where more than 500 residents were affected.
• Connecticut Insurance Data Security Law (Conn. Gen. Stat. § 38a-999b): Applicable to Quorum as a licensed insurer in Connecticut, requiring notification to the Connecticut Insurance Commissioner of cybersecurity events.
• New York SHIELD Act (N.Y. Gen. Bus. Law § 899-aa): Applicable given the 47,831 affected New York residents and imposing specific content and timing requirements for notifications.
• California Civil Code § 1798.82 and the Confidentiality of Medical Information Act (CMIA): Applicable given the 38,206 affected California residents, with specific notification requirements where more than 500 California residents are affected and where medical information is involved.
• Massachusetts General Laws chapter 93H, § 3: Applicable given the 10,217 affected Massachusetts residents, with specific notification requirements to the Massachusetts Attorney General and Director of Consumer Affairs and Business Regulation.
Based on this comprehensive analysis, Quorum determined the notification requirements applicable in each jurisdiction and developed a notification strategy designed to ensure full compliance with all applicable requirements.
B. Consumer Notification Letters
Quorum prepared multiple tailored versions of the consumer notification letter to address the varying statutory requirements of affected jurisdictions and the different categories of information compromised for different subsets of affected individuals. The notification letter versions included:
1. General PII Version: Prepared for all 318,247 affected individuals. This version described the incident, identified the types of personal information compromised (name, date of birth, Social Security number, driver's license number), and provided guidance on protective steps.
2. SSN + Financial Data Version: Prepared for the 84,619 individuals whose financial information (bank account numbers, payment card numbers) was also compromised, in addition to the general PII categories. This version included additional guidance specific to the monitoring of financial accounts.
3. PHI Version (HIPAA-Compliant): Prepared for the 41,203 individuals whose protected health information was compromised. This version was drafted in compliance with the HIPAA Breach Notification Rule and included the specific content elements required by 45 C.F.R. § 164.404(c), including a description of the types of unsecured PHI involved, recommended protective steps, a description of what Quorum is doing to investigate and mitigate harm, and contact procedures for questions.
4. California-Specific Version: Adapted for the 38,206 affected California residents to comply with the specific content and formatting requirements of California Civil Code § 1798.82, including the required prescribed heading and format requirements.
5. Massachusetts-Specific Version: Adapted for the 10,217 affected Massachusetts residents to comply with the specific content requirements of Massachusetts General Laws chapter 93H, § 3, including the right to obtain a police report and security freeze information.
All notification letter versions included the following elements:
• A clear and plain-language description of the incident, including the dates of unauthorized access and the date of discovery;
• Identification of the types of personal information involved;
• A description of the steps Quorum has taken and is taking in response to the incident;
• Recommendations for steps individuals can take to protect themselves, including monitoring of credit reports, financial accounts, and benefits statements;
• A dedicated toll-free telephone number for a call center staffed by trained representatives to answer questions and provide guidance;
• An offer of twenty-four (24) months of complimentary credit monitoring and identity theft protection services at no cost to the affected individual, together with enrollment instructions;
• Contact information for the Federal Trade Commission, relevant state attorney general, and consumer reporting agencies.
Sample copies of all notification letter versions are provided in Exhibit B to this Response.
C. Notification Mailing
The printing, mailing, and fulfillment of the consumer notification letters were managed by Clearfield Notification Services LLC, a nationally recognized notification and breach response services provider headquartered in Independence, Ohio. The Clearfield engagement was managed by Jerome Tillman, Account Manager.
Consumer notification letters were mailed to all 318,247 affected individuals on a rolling basis between August 18 and September 15, 2023, spanning an approximately twenty-eight-day mailing window. The rolling mailing schedule was necessitated by the volume of notifications and the need to coordinate with the call center launch, credit monitoring enrollment processes, and the completion of address verification procedures. Each letter was mailed via first-class United States mail to the most current mailing address available for the affected individual, as verified through national change-of-address databases.
In addition to individual notification letters, Quorum posted substitute notice on the Company's website in accordance with the substitute notice provisions of applicable state breach notification statutes. The web posting included a description of the incident, guidance for affected individuals, and the toll-free call center telephone number.
D. Call Center and Credit Monitoring
Clearfield Notification Services operated a dedicated toll-free call center for a twelve-week window following the initial mailing of consumer notification letters. The call center was staffed by trained representatives equipped to answer questions from affected individuals about the incident, the types of information compromised, the steps Quorum is taking in response, and the process for enrolling in complimentary credit monitoring and identity theft protection services.
Quorum offered all 318,247 affected individuals twenty-four (24) months of complimentary credit monitoring and identity theft protection services at no cost to the individual. The credit monitoring services include three-bureau credit monitoring, identity theft detection alerts, dark web monitoring, and identity theft insurance with a restoration benefit. Credit monitoring enrollment was managed by Clearfield at a negotiated flat fee. As of the date of this Response, the estimated take-rate for credit monitoring enrollment is approximately forty percent (40%), representing approximately 127,299 enrollees.
E. Regulatory Notification Compliance
All regulatory notifications were filed timely and in compliance with all applicable statutory deadlines. The following table summarizes the key regulatory notification filings:
On August 15, 2023, Quorum also issued a media notice as required by the HIPAA Breach Notification Rule, 45 C.F.R. § 164.406, which mandates that covered entities and business associates provide notice to prominent media outlets serving each state or jurisdiction where the breach of unsecured PHI affects more than 500 residents of that state or jurisdiction.
A complete regulatory notification tracker confirming all filings, filing dates, applicable statutes, and compliance status is provided in Exhibit B to this Response.
VIII. VENDOR ACCOUNTABILITY MEASURES
A. Identification of Palomar's Contractual Breaches
The forensic investigation and Quorum's own legal analysis identified at least two material breaches by Palomar of its obligations under the MSA:
1. Failure to Timely Patch. Palomar failed to apply the available patch for the critical CVE-2023-0669 vulnerability in its GoAnywhere MFT file transfer appliance within thirty (30) days of the vendor patch release, in direct violation of the patching requirements set forth in the Data Security Exhibit (Exhibit D) of the MSA, as amended by Amendment 2 (executed September 15, 2022). This failure was the direct and proximate cause of the threat actor's initial unauthorized access to Palomar's network and the subsequent data compromise. The patching requirement was a material term of the MSA specifically negotiated by Quorum's Vendor Risk Management team to mitigate the risk of exploitation of known vulnerabilities in vendor systems.
2. Late Breach Notification. Palomar failed to comply with the forty-eight-hour breach notification requirement set forth in Section 9.4 of the MSA. Palomar's SOC detected the anomalous activity on April 18, 2023, but Palomar's General Counsel did not notify Quorum's General Counsel and CISO until April 21, 2023 — approximately seventy-two hours after detection and approximately twenty-four hours beyond the contractual forty-eight-hour notification deadline. This delay, while relatively limited in duration, constituted a breach of an important contractual safeguard designed to enable Quorum to respond as quickly as possible to security incidents affecting its data.
B. Indemnification Demand
On June 20, 2023, Calderwood & Harkness transmitted a formal breach of contract and indemnification demand letter to Mercer, Haight & Dunlop LLP (Catherine Langford, Partner; Brian Soto, Associate), outside counsel for Palomar, on behalf of Quorum. The demand letter identified the specific contractual breaches set forth above, detailed the damages and costs incurred and anticipated by Quorum as a result of those breaches, and demanded full indemnification under Section 12.2 of the MSA for all costs, damages, and expenses arising from the incident.