multistate-ag-response-strategy-memo.docx

1025-00006 · Graystone Forensics LLC · Regulatory Defense/Multistate AG

multistate-ag-response-strategy-memo.docx DOCUMENT Data Privacy

68 / 88 ← → ✕

CALDERWOOD & HARKNESS LLP 1700 K Street NW, Suite 900 Washington, D.C. 20006

STRATEGY MEMORANDUM

September 11, 2023

FROM: Kevin Ostrowski, Responsible Partner, Privacy & Data Security Alan Burke, Lead Associate, Privacy & Data Security Calderwood & Harkness LLP

TO: Thomas R. Whitfield, General Counsel, Quorum Insurance Holdings Corp. Jennifer Liang, Chief Privacy Officer, Quorum Insurance Holdings Corp.

RE: Response Strategy — Multistate Attorney General Joint Demand Letter Dated September 8, 2023 (29-State Coalition)

MATTER NO.: 1025-00006

Right-click to update Table of Contents

I. Executive Summary

On September 8, 2023, Quorum Insurance Holdings Corp. ("Quorum" or the "Company") received a joint demand letter (the "Demand Letter") from the Connecticut Attorney General's Office, Consumer Protection Division, through Assistant Attorney General Diane Marchetti, and the New York Attorney General's Office, Bureau of Internet and Technology, through Assistant Attorney General Mark Petrosian. The Demand Letter was issued on behalf of a coalition of twenty-nine (29) state attorneys general (the "Multistate Coalition" or the "Coalition"). The Demand Letter seeks extensive information regarding the data breach that originated from Quorum's third-party claims-processing vendor, Palomar Data Solutions, Inc. ("Palomar"), which resulted in the exposure of personally identifiable information ("PII"), financial data, and protected health information ("PHI") of approximately 318,247 individuals across twenty-nine states and the District of Columbia.

The purpose of this memorandum is to set forth Calderwood & Harkness LLP's recommended strategy for responding to the Multistate AG inquiry. Our overarching objective is to achieve closure of this inquiry without formal enforcement action, the entry of a consent decree or consent order, or the imposition of monetary penalties or injunctive relief. Based on our extensive experience with multistate AG investigations arising from data security incidents, we believe this objective is achievable given the specific facts of this matter.

Our recommended approach centers on cooperative, transparent, and proactive engagement with the Multistate Coalition. The response should be organized around five mutually reinforcing themes that, taken together, present a compelling case for a no-action closure:

(a) The vendor-originated nature of the breach — Quorum's own systems were not compromised, and the incident was attributable to Palomar's failure to patch a known vulnerability within the contractually required timeframe;

(b) Quorum's robust information security program and vendor oversight — the Company maintained comprehensive contractual safeguards, conducted appropriate due diligence, and implemented meaningful vendor risk management controls;

(c) Full and timely compliance with all notification obligations — Quorum filed all required regulatory notifications within statutory deadlines across all twenty-nine states plus the District of Columbia and submitted notifications to applicable federal regulators;

(d) Comprehensive consumer remediation measures — Quorum offered twenty-four months of complimentary credit monitoring and identity theft protection to all affected individuals, established a dedicated call center, and invested more than $3.2 million in consumer remediation efforts; and

(e) Aggressive vendor accountability steps — Quorum has actively pursued contractual enforcement against Palomar, including a formal indemnification demand under the Master Services Agreement, and is requiring Palomar to implement enhanced security measures to prevent recurrence.

We believe that the combination of these five themes positions Quorum favorably relative to the benchmarks that state attorneys general typically apply when evaluating whether to pursue formal enforcement action in the wake of a data breach. The balance of this memorandum provides our detailed analysis and recommendations.

II. Summary of the Multistate AG Demand Letter

A. Issuing Authorities and Coalition Composition

The Demand Letter is co-authored by two lead state attorneys general offices, which serve as the administrative leads for the Multistate Coalition:

• Connecticut: Office of the Attorney General, Consumer Protection Division. The lead contact is Assistant Attorney General Diane Marchetti, who has served as lead on several recent multistate data breach investigations and has significant experience in this area.

• New York: Office of the Attorney General, Bureau of Internet and Technology. The lead contact is Assistant Attorney General Mark Petrosian, who has been involved in several high-profile data breach investigations conducted by the New York AG's Bureau of Internet and Technology over the past three years.

The Coalition encompasses twenty-nine (29) states, which correspond to the jurisdictions in which affected individuals reside, as identified during the forensic investigation conducted by Graystone Forensics, LLC. The full list of participating states is as follows:

Connecticut, New York, Massachusetts, California, Illinois, Pennsylvania, New Jersey, Ohio, Texas, Florida, Georgia, Virginia, Maryland, North Carolina, South Carolina, Michigan, Minnesota, Indiana, Wisconsin, Colorado, Arizona, Oregon, Washington, Tennessee, Missouri, Louisiana, Nevada, Iowa, and New Hampshire.

It is notable that the Coalition membership aligns precisely with the states where Quorum identified affected residents during the data mining phase of its incident response. This suggests that the Coalition was assembled based on the regulatory filings Quorum submitted to each of these states' attorneys general, which is consistent with standard practice in multistate data breach investigations. The inclusion of both Connecticut and New York as lead states reflects the significant number of affected residents in those jurisdictions — 52,114 individuals in Connecticut and 47,831 individuals in New York — as well as the general tendency of those two offices to assume leadership roles in privacy and data security enforcement actions.

We note that several major states represented in the Coalition, including California, Illinois, and Texas, have their own aggressive data security enforcement postures. However, their participation as coalition members rather than as independent investigators suggests a coordinated, rather than fragmented, approach. This is, on balance, favorable to Quorum, as it consolidates the inquiry into a single channel and reduces the risk of inconsistent demands or duplicative investigations.

B. Key Information Demands

The Demand Letter contains eleven principal categories of information demands, which we summarize below together with our initial assessment of our ability to respond to each:

1. Detailed Incident Timeline. The Coalition requests a detailed account of the incident timeline, including the date of initial unauthorized access, the date on which the breach was discovered, the date on which Palomar notified Quorum, and the dates of all subsequent material events through the completion of consumer notifications. This request is straightforward, and we are well-positioned to provide a comprehensive timeline based on the facts established during the investigation.

2. Root Cause and Attack Vector. The Coalition requests a description of the root cause of the breach and the specific attack vector exploited by the threat actor. We can describe the exploitation of CVE-2023-0669 in Palomar's GoAnywhere MFT file transfer appliance without disclosing privileged forensic analysis. The key messaging point in responding to this demand is that the root cause was a known, patchable vulnerability in Palomar's systems, and that the patch was available well before the exploitation occurred.

3. Scope of Compromised Data. The Coalition requests a breakdown of the categories of compromised data, both by data type and by state. Quorum has completed the data mining necessary to provide this information, and the state-by-state breakdown is available. This demand can be fully addressed.

4. Relationship with Palomar Data Solutions. The Coalition requests information regarding Quorum's contractual relationship with Palomar, including the data security requirements imposed on Palomar under the Master Services Agreement. We can provide a substantive overview of the MSA's data security provisions without disclosing privileged negotiation positions, internal assessments of Palomar's compliance posture, or the specific terms of any ongoing contractual enforcement proceedings.

5. Investigation and Remediation Steps. The Coalition requests a description of the steps Quorum took to investigate and remediate the breach. We can describe the engagement of forensic investigators, the scope of the investigation, and the remedial actions taken, without producing privileged materials such as the Graystone Forensics reports.

6. Consumer Notification Compliance. The Coalition requests detailed information regarding the consumer notification process, including the timing of notifications, the content of notification letters, the delivery method employed, and Quorum's compliance with each state's specific breach notification statute. We are well-positioned to respond comprehensively to this demand, as Quorum maintained meticulous records of its notification activities.

7. Credit Monitoring and Identity Protection Services. The Coalition requests information regarding the credit monitoring and identity protection services offered to affected individuals, including the duration of coverage, the provider, and enrollment statistics. This information is readily available and can be provided.

8. Information Security Program Description. The Coalition requests a description of Quorum's enterprise-wide information security program, including the organizational structure, technical safeguards, and administrative controls. We recommend providing a high-level overview that demonstrates the maturity and comprehensiveness of Quorum's program without disclosing specific technical configurations, penetration testing results, or other sensitive security details that could create risk if disclosed.

9. Vendor Oversight and Accountability Measures. The Coalition requests information regarding the steps Quorum has taken to hold Palomar accountable and to oversee Palomar's remediation efforts. We can describe the contractual enforcement actions taken, the enhanced security measures required of Palomar, and the governance changes implemented, while preserving the confidentiality of specific settlement positions and litigation strategy.

10. Steps to Prevent Recurrence. The Coalition requests a description of the measures Quorum has implemented or plans to implement to prevent similar incidents in the future. We can provide a robust description of the program enhancements Quorum has undertaken and is planning.

11. Response Deadline. The Demand Letter specifies a response deadline of thirty (30) days from receipt, which sets the initial deadline at October 8, 2023. As discussed in Section IV.B below, we recommend requesting a brief five-day extension to October 13, 2023, to ensure that we can provide a comprehensive and accurate response.

III. Strategic Objectives

A. Primary Objective

Our primary objective in responding to the Multistate AG Demand Letter is to achieve closure of the inquiry without formal enforcement action, consent order, monetary penalty, or required injunctive relief. In our experience, state attorneys general evaluating data breach responses consider several key factors when determining whether to pursue enforcement action, including: (i) whether the breach was attributable to the company's own security failures or to a third party; (ii) whether the company maintained a reasonable information security program; (iii) whether the company complied with all applicable notification requirements; (iv) whether the company offered adequate consumer remediation; and (v) whether the company cooperated fully and transparently with the investigation.

Precedent from prior multistate AG data breach investigations strongly supports the conclusion that companies demonstrating genuine cooperation, timely notification, robust remediation, and a commitment to preventing recurrence can achieve "no action" closures. This is particularly true in vendor-originated breach scenarios, where the data controller can demonstrate that it maintained appropriate contractual safeguards and vendor oversight. The facts of Quorum's situation align favorably with each of these factors, and we believe that a well-executed response can bring this matter to a close without adverse consequences.

We note, however, that achieving a no-action closure is not guaranteed. The size of the affected population (318,247 individuals across 29 states), the sensitivity of the data types involved (including SSNs, financial account numbers, and PHI), and the current political environment surrounding data privacy enforcement all present elevated risk factors. Several of the Coalition states, including Connecticut, New York, California, and Illinois, have been particularly aggressive in pursuing data breach enforcement actions in recent years, and several of those states have recently enacted or strengthened their data privacy statutes. Accordingly, our response must be comprehensive, precise, and compelling.

B. Secondary Objectives

In addition to the primary objective described above, our response strategy is designed to advance the following secondary objectives:

Preservation of Quorum's Reputation. Quorum is a top-25 U.S. insurance holding company, publicly traded on the Nasdaq exchange under the ticker symbol QIHC, with an approximate market capitalization of $6.1 billion as of May 2023. The Company's reputation as a responsible data steward is a critical business asset. Our response must demonstrate to the Coalition that Quorum takes its data protection obligations seriously, has invested appropriately in information security, and responded to this incident with the urgency and thoroughness expected of a company of its stature.

Avoidance of Unfavorable Precedent. We are mindful that the resolution of this matter could establish precedent — both formal and informal — regarding the liability of data controllers for vendor-originated breaches. We must ensure that Quorum's response does not concede legal positions that could be used against Quorum or other similarly situated companies in future enforcement actions or private litigation. In particular, we should avoid framing Quorum's vendor oversight practices as having been deficient or inadequate, as such characterizations could be seized upon by plaintiffs' counsel in the putative class actions that have already been filed or are anticipated.

Minimization of Exposure to Private Litigation. Several putative class action lawsuits have already been filed against Quorum in connection with the breach, and additional filings are anticipated. The AG response will likely be discoverable in those proceedings. Accordingly, the response must be drafted with an awareness that it will be scrutinized by plaintiffs' attorneys. Every factual assertion must be accurate and defensible, and the response should demonstrate the reasonableness of Quorum's conduct at every stage — from vendor selection and oversight through incident response and consumer remediation.

Protection of Privileged Materials. The forensic investigation conducted by Graystone Forensics, LLC ("Graystone") was undertaken at the direction of Calderwood & Harkness LLP for the purpose of providing legal advice to Quorum. The preliminary findings report dated June 2, 2023, and the final forensic report dated July 14, 2023, constitute privileged attorney work product. Our response must convey the factual findings of the investigation — the who, what, when, where, and how of the breach — without producing or disclosing the Graystone reports themselves, and without making representations that could be construed as waiver of the attorney-client privilege or work product protection. This requires careful drafting to distinguish between factual information (which can and should be disclosed) and privileged analysis (which must be protected).

Management of Parallel Regulatory Tracks. Quorum is simultaneously subject to inquiry from the Connecticut Insurance Department, through Richard Nakamura of the Financial Analysis Division, Cybersecurity Unit, under Connecticut General Statutes § 38a-999b, and may face follow-up inquiries from the U.S. Department of Health and Human Services, Office for Civil Rights ("HHS-OCR"), Region I (Boston), regarding the PHI component of the breach affecting 41,203 individuals. It is essential that Quorum's factual representations remain fully consistent across all regulatory submissions. Inconsistencies — even minor ones — could undermine Quorum's credibility and create avoidable complications.

IV. Recommended Response Approach

A. Overarching Tone and Posture

The tone and posture of Quorum's response will be as important as its substance. State attorneys general are experienced at distinguishing between companies that genuinely cooperate with investigations and those that merely go through the motions. A defensive or adversarial posture would be counterproductive and could increase the risk of enforcement action. Accordingly, we recommend that the response adopt the following characteristics:

Cooperative and Transparent. The response should convey Quorum's genuine willingness to provide the Coalition with the information it needs to evaluate the incident and Quorum's response. Quorum should present itself as a partner in consumer protection, not as a target resisting oversight. The opening section of the response should expressly acknowledge the importance of the Coalition's inquiry and Quorum's commitment to full cooperation.

Forthcoming Without Being Reckless. We recommend that Quorum voluntarily produce certain categories of information beyond the minimum demanded by the Demand Letter, where doing so reinforces the narrative of proactive, responsible corporate conduct. For example, providing a detailed state-by-state compliance checklist (even though the Demand Letter does not specifically request one in that format) demonstrates that Quorum has carefully tracked its compliance obligations and can account for its performance against each state's requirements. Similarly, providing an overview of Quorum's post-incident program enhancements demonstrates forward-looking commitment to improvement.

However, cooperation should not be confused with capitulation. We must be disciplined about drawing the line between factual information that supports the response narrative and privileged or sensitive materials that should not be disclosed. Specifically, we should avoid volunteering the Graystone forensic reports, internal legal memoranda, attorney-client communications, or specific litigation strategy details related to the Palomar contractual enforcement proceedings. The response should present the facts clearly and comprehensively, but it should do so through Quorum's own narrative rather than through production of underlying privileged documents.

Proactive in Addressing Anticipated Concerns. Rather than waiting for follow-up questions, the response should anticipate the Coalition's likely concerns and address them affirmatively. For example, we should proactively explain why the period between Palomar's notification to Quorum (April 21, 2023) and the commencement of consumer notifications (August 14–25, 2023) was reasonable and consistent with industry practice, given the complexity of the investigation, data mining, and notification preparation process. If we do not address this issue, the Coalition will almost certainly raise it.

B. Requesting a Brief Extension

The Demand Letter establishes a response deadline of thirty (30) days from receipt, which sets the initial deadline at October 8, 2023. We recommend requesting a five-day extension, moving the deadline to October 13, 2023, to ensure that we have adequate time to prepare a comprehensive response.

The basis for the extension request is straightforward and reasonable: the complexity of assembling a response that addresses the requirements of twenty-nine separate state breach notification statutes, the volume of documentary exhibits (including sample notification letters, compliance checklists, and vendor accountability materials), and Quorum's desire to provide complete and accurate information rather than a rushed and potentially incomplete submission. In our experience, modest extension requests of this nature are routinely granted in multistate investigations, particularly when the requesting party demonstrates good faith and a commitment to substantive engagement.

We recommend the following process for requesting the extension:

1. Kevin Ostrowski will place telephone calls to AAG Marchetti and AAG Petrosian on September 12 or 13, 2023, to request the extension informally. This personal outreach serves the dual purpose of introducing Calderwood & Harkness as Quorum's counsel, establishing a constructive working relationship with the lead AAGs, and ensuring that the extension request does not come as a surprise.

2. Following the telephone conversations, Calderwood & Harkness will send written confirmation of the extension request via email and letter to both AAGs, with copies to the other Coalition members as directed by the lead states.

3. If the extension is denied — which we consider unlikely given the modest nature of the request — we are prepared to file a substantially complete response by the original October 8, 2023 deadline. The drafting timeline set forth in Section IX below has been designed with sufficient margin to accommodate this contingency.

V. Key Themes and Messaging Framework

The following six themes constitute the core messaging framework for Quorum's response. Each theme is supported by specific facts and should be woven throughout the written narrative response and supporting exhibits. The themes are designed to work together to present a cohesive narrative: Quorum is a responsible, well-managed company that maintained appropriate safeguards, was victimized by a vendor's security failure, responded promptly and effectively, and is holding the vendor accountable while enhancing its own programs to prevent recurrence.

A. Theme 1 — Vendor-Originated Breach: Quorum as Responsible Steward, Not the Cause

The single most important fact in Quorum's favor is that the breach originated entirely within the network environment of Palomar Data Solutions, Inc., located at 7100 Greenville Avenue, Suite 450, Dallas, Texas 75231. Quorum's own systems, networks, and infrastructure were not compromised at any point during the incident. The threat actor's unauthorized access was confined to Palomar's environment, and the data exfiltration occurred from Palomar's servers. Quorum's network perimeter and internal controls were not breached, and there was no lateral movement from the Palomar incident into any Quorum-controlled system.

The specific attack vector was the exploitation of CVE-2023-0669, a known remote code execution vulnerability in Severin Corporation's GoAnywhere MFT (Managed File Transfer) platform, which Palomar used to facilitate secure file transfers in connection with its claims-processing services for Quorum. The vulnerability was publicly disclosed in early February 2023, and a patch was made available by Severin Corporation shortly thereafter. The exploitation of Palomar's GoAnywhere MFT instance occurred on or about March 14, 2023 — more than thirty days after the patch became available. The unauthorized access and data exfiltration continued over an approximately thirty-five (35) day period, from March 14 through April 18, 2023, when Palomar's internal security team detected the intrusion and contained it.

This timeline is critically important for the messaging framework because it establishes that Palomar failed to apply a critical security patch within a reasonable timeframe — and, more specifically, within the timeframe contractually required by its agreement with Quorum. Under Exhibit D (Data Security Requirements) of the Master Services Agreement dated November 12, 2019, as amended by Amendment 2 dated September 15, 2022, Palomar was required to apply patches for critical vulnerabilities within thirty (30) days of the patch's availability. Palomar's failure to meet this contractual obligation was the proximate cause of the breach.

The response should present these facts clearly and without equivocation. The messaging should convey that Quorum took appropriate steps to contractually require robust vendor security practices, monitored compliance with those requirements through its vendor risk management program, and was ultimately harmed by Palomar's failure to meet the standards to which it had agreed. Quorum was not the source of the vulnerability, did not fail to patch its own systems, and did not contribute to the breach through any action or omission.

At the same time, we should be careful not to position Quorum as a passive victim with no responsibility for the data entrusted to its vendor. The AGs will expect Quorum to take ownership of the consumer impact and the remediation process, even though the breach was vendor-originated. The messaging should strike a balance: Quorum acknowledges its responsibility to its policyholders and affected individuals, has taken full ownership of the notification and remediation process, and is holding Palomar accountable — but the root cause of the incident was the vendor's security failure, not any deficiency in Quorum's own program.

B. Theme 2 — Quorum's Robust Information Security and Vendor Risk Management Program

The Coalition will scrutinize whether Quorum maintained an adequate information security program and, in particular, whether Quorum exercised appropriate oversight of its third-party vendors. To address this scrutiny, the response should present a compelling picture of Quorum's security governance, technical controls, and vendor risk management practices.

Quorum maintains a comprehensive, enterprise-wide information security program overseen by Chief Information Security Officer David Naranjo and Chief Privacy Officer Jennifer Liang. The program is structured around industry-recognized frameworks and incorporates technical, administrative, and physical safeguards appropriate to the sensitivity of the data Quorum processes in its capacity as an insurance holding company. The Company's vendor risk management program is led by Vice President of Vendor Risk Management Priya Deshmukh and includes pre-engagement due diligence assessments, contractual security requirements, and ongoing monitoring of vendor compliance.

With respect to Palomar specifically, the Master Services Agreement was structured with multiple layers of security oversight designed to ensure that Palomar maintained adequate protections for the data it processed on Quorum's behalf:

• Data Security Exhibit (Exhibit D, as amended September 15, 2022, via Amendment 2): Required Palomar to implement and maintain commercially reasonable administrative, technical, and physical safeguards. Established a thirty-day patching requirement for critical vulnerabilities. Required Palomar to conduct annual penetration testing of its systems. Required Palomar to obtain and maintain a SOC 2 Type II audit report from an independent, qualified auditor.

• Breach Notification Clause (Section 9.4): Required Palomar to notify Quorum of any confirmed or suspected security incident within forty-eight (48) hours of discovery.

• Insurance Requirements (Exhibit E): Required Palomar to maintain a minimum of $10 million in cyber liability insurance coverage.

• SOC 2 Type II Audit: Palomar's most recent SOC 2 Type II audit was conducted by Kessler, Park & Associates CPA, PLLC, based in Dallas, Texas (Engagement Partner: Vivian Park). The audit covered the period ending December 31, 2022, and did not identify material deficiencies in Palomar's security controls as of the audit period. We note, however, that SOC 2 audits provide point-in-time or period-of-time assurance and do not guarantee the ongoing effectiveness of controls after the audit period.

Additionally, Quorum's own information security program included network segmentation, access controls, and monitoring capabilities that prevented any lateral movement from the Palomar incident into Quorum's own network. This is a significant fact that demonstrates the effectiveness of Quorum's defense-in-depth architecture: even though a vendor in Quorum's supply chain was compromised, Quorum's own systems remained secure.

We recommend providing a high-level overview of the Quorum information security program as Exhibit D to the AG response. This overview should describe the program's governance structure, technical and administrative safeguards, vendor risk management processes, and employee training requirements. It should not, however, disclose specific technical configurations (e.g., firewall rules, intrusion detection system configurations), penetration testing results, or other granular security details that could create operational security risk if disclosed or that could become publicly available through FOIA requests.

C. Theme 3 — Timely and Comprehensive Consumer and Regulatory Notifications

Compliance with state and federal breach notification statutes is one of the most important factors that attorneys general evaluate when deciding whether to pursue enforcement action. A company that fails to provide timely notification — or that provides inadequate or misleading notification — is far more likely to face formal enforcement action than a company that demonstrates meticulous compliance. Quorum's notification record in this matter is strong, and the response should present it in detail.

Quorum filed all required regulatory notifications within the statutory deadlines applicable in each of the twenty-nine states plus the District of Columbia, as well as with applicable federal regulators. The key filings are summarized below:

• Connecticut Attorney General and Connecticut Insurance Department: Filed August 14, 2023, in compliance with Connecticut General Statutes § 36a-701b (AG notification) and § 38a-999b (Insurance Department notification). Connecticut requires notification without unreasonable delay but does not impose a specific day count. Quorum's filing occurred eleven (11) days after the completion of data mining and the identification of all affected Connecticut residents.

• HHS-OCR (HIPAA Notification): Filed August 15, 2023, in compliance with 45 C.F.R. § 164.408, for the 41,203 individuals whose protected health information was compromised. HIPAA requires notification to HHS within sixty (60) days of the discovery of the breach. Quorum's filing was well within this deadline.

• New York Attorney General: Filed August 16, 2023, in compliance with New York General Business Law § 899-aa, for the 47,831 affected New York residents.

• California Attorney General: Filed August 16, 2023, in compliance with California Civil Code § 1798.82, for the 38,206 affected California residents. California requires AG notification when a breach affects more than 500 California residents.

• Massachusetts Attorney General and Department of Consumer Rights: Filed August 17, 2023, in compliance with Massachusetts General Laws ch. 93H, § 3, for the 10,217 affected Massachusetts residents.

• All Remaining State Filings: Completed between August 17 and August 25, 2023, within the applicable statutory timeframes for each jurisdiction.

Consumer notification letters were mailed to all 318,247 affected individuals on a rolling basis from August 18 through September 15, 2023, representing an approximately twenty-eight (28) day mailing window. The use of a rolling mailing schedule reflected the logistical realities of producing, quality-checking, and mailing more than 318,000 individualized letters, each of which was tailored to the specific categories of data compromised for that individual. Multiple notification letter versions were prepared to ensure that each affected individual received accurate, specific information regarding the types of data compromised:

• General PII Version: Sent to all 318,247 affected individuals. This version addressed the compromise of names, dates of birth, Social Security numbers, and driver's license numbers.

• Financial Data Version: Sent to the 84,619 individuals whose financial information was compromised, including bank account numbers and payment card numbers. This version included additional guidance regarding monitoring financial accounts and placing fraud alerts.

• PHI Version: Sent to the 41,203 individuals whose protected health information was compromised, including health conditions, diagnosis codes, and treatment information derived from workers' compensation and health-related insurance claims. This version was drafted in compliance with HIPAA notification requirements under 45 C.F.R. § 164.404(c), including the required content elements.

• State-Specific Versions: Additional tailored versions were prepared for California (incorporating requirements under the California Consumer Privacy Act and the Confidentiality of Medical Information Act) and Massachusetts (incorporating requirements under 201 CMR 17.00).

In addition to direct mail notification, Quorum published a substitute notice and website posting on August 15, 2023, and distributed a media notice in compliance with 45 C.F.R. § 164.406 for breaches affecting more than 500 individuals in any given state.

We recommend including a full state-by-state compliance checklist and sample copies of all notification letter versions as Exhibit B to the AG response. This comprehensive exhibit will demonstrate the thoroughness and precision of Quorum's notification efforts and provide the Coalition with the information it needs to independently verify Quorum's compliance with each state's specific requirements.

D. Theme 4 — Comprehensive Consumer Remediation

Beyond the notification itself, the Coalition will evaluate the adequacy of the remediation measures Quorum offered to affected individuals. Quorum's remediation package is robust and compares favorably to — and in many respects exceeds — the remediation typically offered in similar incidents.

Quorum offered twenty-four (24) months of complimentary credit monitoring and identity theft protection services to all 318,247 affected individuals, regardless of the specific categories of data compromised. This duration exceeds the twelve-month standard that many companies offer and demonstrates Quorum's commitment to providing meaningful, long-term protection to its policyholders and claimants.

The enrollment process for these services is being managed by Clearfield Notification Services LLC ("Clearfield"), a nationally recognized breach response services provider. Quorum's account is managed by Jerome Tillman, Account Manager, at Clearfield's offices at 4500 Rockside Road, Suite 210, Independence, Ohio 44131. The enrollment process was designed to be simple and accessible, requiring affected individuals to call a dedicated toll-free number or visit a secure enrollment website using a unique activation code provided in their notification letter.

As of the date of this memorandum, the estimated enrollment take-rate is approximately 40%, representing approximately 127,299 enrollees. The actual enrollment figure as of the date of the AG response submission will be included in the response, as enrollment is ongoing. This take-rate is consistent with industry averages for incidents of this nature and scale.

In addition to credit monitoring services, Quorum established a dedicated toll-free call center operated by Clearfield for a twelve-week window to assist affected individuals with questions about the incident, the notification letters, and the enrollment process for credit monitoring services. The call center was staffed with trained representatives who could provide information in multiple languages and were equipped to escalate complex inquiries as needed.

The total cost of notification and consumer remediation services is approximately $3,214,500, broken down as follows:

The messaging with respect to consumer remediation should emphasize that Quorum invested substantial resources in protecting and assisting affected individuals, even though the breach originated entirely at a third-party vendor. This demonstrates Quorum's commitment to consumer welfare and its willingness to bear the costs of remediation while simultaneously pursuing indemnification from the responsible party.

E. Theme 5 — Aggressive Vendor Accountability

The Coalition will expect to see that Quorum is holding Palomar accountable for its security failures. A company that simply absorbs the consequences of a vendor breach without pursuing meaningful accountability against the vendor sends a troubling signal to regulators. Quorum's approach has been appropriately aggressive in pursuing its contractual rights and requiring enhanced security measures.

Quorum promptly pursued contractual accountability against Palomar upon confirming the scope and nature of the breach:

• Formal Breach of Contract Demand Letter: On June 20, 2023, Calderwood & Harkness LLP, on behalf of Quorum, sent a formal demand letter to Palomar's counsel, Mercer, Haight & Dunlop LLP (Catherine Langford, Partner), asserting breach of contract and demanding full indemnification under Section 12.2 of the Master Services Agreement.

• Indemnification Demand: The demand sought indemnification for total incident response costs of $8,230,250, which encompasses forensic investigation costs, legal fees, notification and remediation expenses, internal response costs, and other related expenditures. The indemnification cap under the MSA is $32,600,000, calculated as two times (2×) the trailing twelve-month fees paid by Quorum to Palomar of $16,300,000. Quorum's current claim is well within the contractual cap.

• Specific Contractual Breaches Identified: The demand letter identified two specific breaches of the MSA by Palomar: (1) failure to apply the patch for CVE-2023-0669 within the thirty-day window required by Exhibit D of the MSA, and (2) late notification to Quorum of the security incident, which occurred approximately twenty-four (24) hours past the forty-eight (48) hour contractual notification window specified in Section 9.4 of the MSA. (Palomar discovered the breach on April 18, 2023, but did not notify Quorum until April 21, 2023 — approximately seventy-two hours after discovery, exceeding the forty-eight-hour requirement by approximately one day.)

As of the date of this memorandum, vendor accountability negotiations are ongoing. Calderwood & Harkness is engaged in discussions with Mercer, Haight & Dunlop LLP regarding the indemnification claim and the terms of enhanced security requirements that Palomar will be required to implement as a condition of continuing to provide services to Quorum.

In addition to the contractual enforcement proceedings, Quorum is requiring Palomar to implement a series of enhanced security measures, including upgraded patch management processes with accelerated deployment timelines, enhanced endpoint detection and response capabilities, additional network monitoring and logging, and third-party verification of remediation completeness.

We recommend summarizing the vendor accountability steps in Exhibit C to the AG response. This exhibit should provide sufficient detail to demonstrate the seriousness and comprehensiveness of Quorum's enforcement efforts, without disclosing specific settlement negotiation positions, dollar figures related to the indemnification demand, or privileged litigation strategy. The exhibit should characterize the contractual enforcement proceedings as "active contractual enforcement proceedings" and note that Quorum is pursuing all available contractual remedies.

F. Theme 6 — Steps to Prevent Recurrence

The final theme addresses the forward-looking measures Quorum has undertaken to prevent similar incidents in the future. Attorneys general are particularly attentive to this element, as it demonstrates that the company has learned from the incident and is committed to continuous improvement. A response that focuses exclusively on what happened and what the company did after the fact, without addressing what the company is doing to prevent recurrence, will leave the Coalition unsatisfied.

Quorum has undertaken the following program-wide enhancements to its vendor risk management program and broader information security posture as a result of this incident:

• Enhanced Vendor Security Due Diligence Protocols: Quorum has updated its vendor onboarding and renewal assessment protocols to include more rigorous evaluation of prospective and existing vendors' patch management practices, vulnerability management programs, and incident response capabilities. The updated protocols include mandatory questionnaires addressing specific technical controls, as well as enhanced documentation and review requirements.

• Shortened Contractual Incident Notification Windows: For all future vendor agreements, and as amendments are negotiated for existing agreements, Quorum is implementing a reduced contractual incident notification window of twenty-four (24) hours (down from the current forty-eight-hour standard), to ensure that Quorum receives more timely notice of security incidents affecting vendor-held data.

• Expanded Third-Party Audit Requirements: Quorum is expanding its requirements for independent third-party security audits of critical vendors, including more frequent audit cycles and expanded audit scope to cover specific control areas such as patch management and vulnerability remediation.

• Crisis Communications and Stakeholder Engagement: Quorum has engaged BrightPath Consulting Group Inc. (Meredith Ashford, Managing Director) to assist with crisis communications and stakeholder engagement, ensuring that Quorum communicates transparently and effectively with affected individuals, regulators, business partners, and the public.

• Internal Incident Response Plan Review and Update: Quorum's incident response plan has been reviewed and updated in light of lessons learned from this incident. The updated plan incorporates enhanced vendor breach response protocols, accelerated decision-making frameworks, and streamlined communication chains.

• Senior Leadership Tabletop Exercises: Quorum is scheduling tabletop exercises for senior leadership and key members of the incident response team, to be conducted in Q4 2023 and Q1 2024, to test the updated incident response plan and ensure organizational readiness.

• Data Minimization Review: Quorum has initiated a comprehensive review of the categories and volumes of data shared with third-party vendors, with the objective of minimizing the data entrusted to vendors to only what is strictly necessary for the performance of contracted services. This review is expected to result in reduced data footprints across Quorum's vendor ecosystem.

The response should present these enhancements as evidence of Quorum's commitment to continuous improvement and its proactive approach to strengthening its data protection posture. The messaging should convey that Quorum views this incident not merely as a crisis to be managed, but as an opportunity to strengthen its programs and better protect the individuals whose data it is entrusted to safeguard.

VI. Proposed Response Structure and Exhibits

A. Written Narrative Response

The written narrative response to the Multistate Coalition should be organized into the following sections, each of which corresponds to one or more of the information demands set forth in the Demand Letter and incorporates the themes and messaging framework discussed in Section V above:

Introductory Section. The response should open with a cooperative and respectful introduction identifying Quorum Insurance Holdings Corp. and acknowledging the receipt of the Demand Letter. The introduction should note the engagement of Calderwood & Harkness LLP as counsel for this matter, express Quorum's commitment to cooperating fully with the Coalition's inquiry, and provide a brief overview of the response structure and accompanying exhibits.

Section I: Incident Overview and Timeline. This section should provide a clear, chronological narrative of the incident from the date of initial unauthorized access through the completion of consumer notifications and ongoing remediation efforts. The timeline should be presented in a factual, straightforward manner, avoiding legal conclusions or characterizations that could be construed as admissions.

Section II: Root Cause Analysis. This section should describe the root cause of the breach — the exploitation of CVE-2023-0669 in Palomar's GoAnywhere MFT appliance — and explain that the breach was vendor-originated and attributable to Palomar's failure to timely patch a known vulnerability. This section should present factual information derived from the investigation without producing or referencing privileged materials.

Section III: Scope of Compromised Data. This section should provide a comprehensive breakdown of the compromised data, both by data type and by state. The state-by-state figures, based on the data mining completed by August 4, 2023, are as follows:

The response should also break down the data by type: general PII (all 318,247 individuals), financial data (84,619 individuals), and PHI (41,203 individuals), with descriptions of each category.

Section IV: Quorum's Relationship with Palomar. This section should describe the nature of Quorum's contractual relationship with Palomar, the scope of services Palomar provides, and the data security requirements imposed on Palomar under the MSA. This section should provide a substantive overview of the key contractual provisions without disclosing privileged negotiation positions or the specific terms of the ongoing indemnification proceedings.

Section V: Investigation and Remediation Steps. This section should describe the steps Quorum took upon learning of the incident, including the engagement of forensic investigators, the scope and findings of the investigation, the remedial actions taken within Palomar's environment, and Quorum's own validation and verification activities. This section should be drafted carefully to present factual information without producing privileged materials.

Section VI: Consumer Notification Compliance. This section should provide a detailed account of Quorum's consumer and regulatory notification process, including the timing, content, and delivery method of all notifications, and Quorum's compliance with each state's specific breach notification statute. This section should cross-reference the compliance checklist in Exhibit B.

Section VII: Consumer Remediation. This section should describe the credit monitoring and identity theft protection services offered to affected individuals, the call center established to assist affected individuals, enrollment statistics, and the total investment in consumer remediation.

Section VIII: Vendor Accountability Measures. This section should describe the steps Quorum has taken to hold Palomar accountable, including the contractual enforcement actions pursued, the enhanced security measures required of Palomar, and the governance changes implemented. This section should cross-reference the vendor accountability summary in Exhibit C.

Section IX: Quorum's Information Security Program. This section should provide a high-level description of Quorum's enterprise-wide information security program, its governance structure, and its key technical and administrative controls. This section should cross-reference the program overview in Exhibit D.

Section X: Preventive Measures and Enhancements. This section should describe the forward-looking measures Quorum has implemented or is implementing to prevent recurrence, including enhancements to the vendor risk management program, shortened notification windows, expanded audit requirements, data minimization efforts, and incident response plan updates.

B. Exhibit A — Incident Timeline and Remedial Measures Summary

Exhibit A should present a comprehensive, chronological timeline of the incident and Quorum's response, beginning with the date of initial unauthorized access and continuing through the date of the response submission. The timeline should include the following key milestones:

• March 14, 2023: Threat actor exploits CVE-2023-0669 in Palomar's GoAnywhere MFT appliance; unauthorized access to Palomar's network environment begins.

• March 14 – April 18, 2023: Unauthorized access and data exfiltration continue within Palomar's environment over an approximately 35-day period.

• April 18, 2023: Palomar's internal security team detects the intrusion and initiates containment procedures.

• April 21, 2023: Palomar notifies Quorum of the security incident (approximately 72 hours after discovery; approximately 24 hours past the 48-hour contractual notification deadline under MSA Section 9.4).

• May 4, 2023: Quorum engages Calderwood & Harkness LLP as outside counsel for the incident response.

• May 5, 2023: Calderwood & Harkness, at Quorum's direction, engages Graystone Forensics, LLC to conduct a forensic investigation under the direction and privilege of counsel. (Note: The response should reference the engagement of forensic investigators without identifying the engagement as privileged or producing any privileged materials.)

• May 8, 2023: Quorum submits a claim under its cyber liability insurance policy with Atlas Mutual Insurance Company (Policy No. CYB-2023-041587).

• May 10, 2023: Common Interest Agreement executed between Quorum and Atlas Mutual Insurance Company.

• June 2, 2023: Preliminary forensic findings available. (Note: The response should reference the availability of preliminary findings without disclosing the content of the privileged Graystone report. Factual findings may be conveyed through Quorum's own narrative.)

• July 14, 2023: Final forensic report completed. (Same privilege note as above.)

• August 4, 2023: Data mining completed; identification of all affected individuals and corresponding data types finalized.

• August 14–25, 2023: Regulatory notifications filed with all required state attorneys general, state insurance regulators, and federal agencies.

• August 15, 2023: Substitute notice / website posting published; HHS-OCR notification filed.

• August 18 – September 15, 2023: Consumer notification letters mailed to all 318,247 affected individuals.

• Ongoing as of submission date: Consumer remediation services (credit monitoring, call center), vendor accountability proceedings, and program enhancements.

C. Exhibit B — Consumer Notification Samples and Compliance Checklist

Exhibit B should include the following materials:

1. Copies of all five notification letter versions (General PII, Financial Data, PHI, California-specific, Massachusetts-specific).

2. A state-by-state compliance checklist in tabular format, showing for each of the twenty-nine states plus the District of Columbia: the applicable statute, the statutory notification deadline, the date of Quorum's filing, the method of filing (e.g., online portal, email, certified mail), and Quorum's compliance status.

3. A copy of the substitute notice / website posting text.

4. A copy of the media notice distributed in compliance with 45 C.F.R. § 164.406.

This exhibit is designed to provide the Coalition with comprehensive, independently verifiable evidence of Quorum's notification compliance.

D. Exhibit C — Palomar Vendor Accountability Summary

Exhibit C should provide a summary of Quorum's vendor accountability efforts that is sufficiently detailed to demonstrate the seriousness of Quorum's approach, while protecting privileged and sensitive information. The exhibit should include:

1. An overview of the key MSA provisions requiring Palomar to maintain adequate data security, including the critical patch management requirement, the breach notification clause, and the indemnification provisions.

2. A description of Palomar's specific contractual breaches (failure to patch CVE-2023-0669 within the 30-day window; late notification exceeding the 48-hour requirement by approximately 24 hours).

3. A summary of the steps Quorum has taken to enforce its contractual rights, characterized as "active contractual enforcement proceedings" without disclosing specific dollar figures, settlement positions, or litigation strategy.

4. A description of the enhanced security measures Quorum is requiring Palomar to implement as a condition of the continued business relationship.

5. A caveat noting that certain information related to the contractual enforcement proceedings is subject to attorney-client privilege and work product protection and is not being disclosed in this submission.

E. Exhibit D — Quorum Information Security Program Overview

Exhibit D should provide a high-level description of Quorum's enterprise-wide information security program, organized around the following elements:

1. Governance Structure: Description of the organizational structure for information security governance, including the roles of CISO David Naranjo, CPO Jennifer Liang, and VP Vendor Risk Management Priya Deshmukh, and their reporting relationships to senior management and the Board of Directors.

2. Technical Safeguards: Overview of key technical controls, including network segmentation, access controls, encryption, monitoring and detection capabilities, and incident response infrastructure. This overview should be high-level and should not disclose specific configurations or technical details.

3. Administrative Safeguards: Description of policies, procedures, and governance frameworks, including information security policies, acceptable use policies, data classification standards, and risk assessment processes.

4. Vendor Risk Management Program: Description of the vendor due diligence, assessment, and monitoring program, including the contractual requirements imposed on vendors, the audit and assessment schedule, and the vendor risk tiering methodology.

5. Employee Training: Description of the security awareness training program, including frequency, content, and completion tracking.

6. Post-Incident Enhancements: Summary of the program enhancements undertaken in response to this incident, cross-referencing the preventive measures described in the narrative response.

VII. Privilege and Confidentiality Considerations

The protection of privileged materials is a critical concern throughout the preparation and submission of the AG response. We address the key privilege considerations below.

Graystone Forensics Investigation. The forensic investigation conducted by Graystone Forensics, LLC (Dr. Nolan Briggs, Lead Forensic Examiner; Kendra Faulkner, Senior Analyst) was initiated at the direction of Calderwood & Harkness LLP for the purpose of providing legal advice to Quorum in connection with the data security incident. The engagement letter with Graystone was executed between Calderwood & Harkness and Graystone, with Calderwood & Harkness identified as the client for purposes of the engagement and the direction of the forensic work. The preliminary findings report dated June 2, 2023, and the final forensic report dated July 14, 2023, constitute privileged attorney work product prepared in anticipation of litigation and at the direction of counsel.

The AG response should present the factual findings regarding the incident — the identity of the threat actor's attack vector, the timeline of unauthorized access, the scope of compromised data, and the root cause of the breach — through Quorum's own narrative, based on information known to Quorum through its own investigation and its receipt of factual briefings from counsel. The response should not produce, attach, quote from, or specifically reference the Graystone reports. Factual information about the breach can be conveyed in Quorum's own words without privilege waiver, provided the response does not disclose the mental impressions, conclusions, opinions, or legal theories of counsel or the forensic experts acting at counsel's direction.

Internal Legal Analysis and Strategy. All internal legal analyses, strategy memoranda (including this memorandum), communications between Calderwood & Harkness and Quorum, and communications among the Calderwood & Harkness engagement team are protected by the attorney-client privilege and/or the work product doctrine. None of these materials should be produced or referenced in the AG response.

Common Interest Agreement with Atlas Mutual Insurance Company. On May 10, 2023, Quorum and Atlas Mutual Insurance Company executed a Common Interest Agreement (the "CIA") to protect the confidentiality and privilege of information shared between the parties in connection with the insurance claim arising from the Palomar data breach (Policy No. CYB-2023-041587, Claim No. CYB-CLM-2023-05892). The CIA establishes that information shared between Quorum and Atlas Mutual in furtherance of their common legal interest in defending against claims arising from the breach remains protected by the attorney-client privilege and work product doctrine. We must ensure that no communications with or materials shared with Atlas Mutual are inadvertently disclosed in the AG response.

Privilege Assertion if Forensic Report Demanded. If the Coalition demands production of the Graystone forensic report, we should assert the attorney-client privilege and work product protection and offer, as an alternative, to provide a factual summary of the investigation's findings through Quorum's own narrative. This approach is consistent with the well-established principle that a party may disclose the facts learned during a privileged investigation without waiving privilege over the investigator's report, analysis, or conclusions, provided the disclosure is made through the party's own account of the facts rather than through production of the privileged document itself. We should be prepared to provide legal authority supporting this position if the assertion is challenged.

Confidentiality Marking on Submissions. All submissions to the Multistate AG Coalition should be marked as "Confidential — Submitted Pursuant to Investigation; Not a Public Record" to the extent permissible under each participating state's Freedom of Information Act or public records law. While we cannot guarantee that such markings will prevent disclosure in all circumstances — as state FOIA laws vary and some provide limited exemptions for investigative materials — the marking will put the Coalition on notice of Quorum's confidentiality expectations and provide a basis for objecting to any public records requests seeking disclosure of the submission.

VIII. Coordination with Parallel Regulatory Tracks

A. Connecticut Insurance Department

In addition to the Multistate AG inquiry, Quorum is subject to a separate inquiry from the Connecticut Insurance Department, Financial Analysis Division, Cybersecurity Unit, conducted by Richard Nakamura. This inquiry is being conducted under the authority of Conne

PRIVILEGED AND CONFIDENTIAL — ATTORNEY-CLIENT COMMUNICATION / ATTORNEY WORK PRODUCT THIS MEMORANDUM AND ITS CONTENTS ARE PROTECTED BY THE ATTORNEY-CLIENT PRIVILEGE AND THE WORK PRODUCT DOCTRINE. DO NOT COPY, DISTRIBUTE, OR DISCLOSE WITHOUT PRIOR AUTHORIZATION OF CALDERWOOD & HARKNESS LLP.
CALDERWOOD & HARKNESS LLP 1700 K Street NW, Suite 900 Washington, D.C. 20006
STRATEGY MEMORANDUM
September 11, 2023
FROM: Kevin Ostrowski, Responsible Partner, Privacy & Data Security Alan Burke, Lead Associate, Privacy & Data Security Calderwood & Harkness LLP
TO: Thomas R. Whitfield, General Counsel, Quorum Insurance Holdings Corp. Jennifer Liang, Chief Privacy Officer, Quorum Insurance Holdings Corp.
RE: Response Strategy — Multistate Attorney General Joint Demand Letter Dated September 8, 2023 (29-State Coalition)
MATTER NO.: 1025-00006
Right-click to update Table of Contents
I. Executive Summary
On September 8, 2023, Quorum Insurance Holdings Corp. ("Quorum" or the "Company") received a joint demand letter (the "Demand Letter") from the Connecticut Attorney General's Office, Consumer Protection Division, through Assistant Attorney General Diane Marchetti, and the New York Attorney General's Office, Bureau of Internet and Technology, through Assistant Attorney General Mark Petrosian. The Demand Letter was issued on behalf of a coalition of twenty-nine (29) state attorneys general (the "Multistate Coalition" or the "Coalition"). The Demand Letter seeks extensive information regarding the data breach that originated from Quorum's third-party claims-processing vendor, Palomar Data Solutions, Inc. ("Palomar"), which resulted in the exposure of personally identifiable information ("PII"), financial data, and protected health information ("PHI") of approximately 318,247 individuals across twenty-nine states and the District of Columbia.
The purpose of this memorandum is to set forth Calderwood & Harkness LLP's recommended strategy for responding to the Multistate AG inquiry. Our overarching objective is to achieve closure of this inquiry without formal enforcement action, the entry of a consent decree or consent order, or the imposition of monetary penalties or injunctive relief. Based on our extensive experience with multistate AG investigations arising from data security incidents, we believe this objective is achievable given the specific facts of this matter.
Our recommended approach centers on cooperative, transparent, and proactive engagement with the Multistate Coalition. The response should be organized around five mutually reinforcing themes that, taken together, present a compelling case for a no-action closure:
(a) The vendor-originated nature of the breach — Quorum's own systems were not compromised, and the incident was attributable to Palomar's failure to patch a known vulnerability within the contractually required timeframe;
(b) Quorum's robust information security program and vendor oversight — the Company maintained comprehensive contractual safeguards, conducted appropriate due diligence, and implemented meaningful vendor risk management controls;
(c) Full and timely compliance with all notification obligations — Quorum filed all required regulatory notifications within statutory deadlines across all twenty-nine states plus the District of Columbia and submitted notifications to applicable federal regulators;
(d) Comprehensive consumer remediation measures — Quorum offered twenty-four months of complimentary credit monitoring and identity theft protection to all affected individuals, established a dedicated call center, and invested more than $3.2 million in consumer remediation efforts; and
(e) Aggressive vendor accountability steps — Quorum has actively pursued contractual enforcement against Palomar, including a formal indemnification demand under the Master Services Agreement, and is requiring Palomar to implement enhanced security measures to prevent recurrence.
We believe that the combination of these five themes positions Quorum favorably relative to the benchmarks that state attorneys general typically apply when evaluating whether to pursue formal enforcement action in the wake of a data breach. The balance of this memorandum provides our detailed analysis and recommendations.
II. Summary of the Multistate AG Demand Letter
A. Issuing Authorities and Coalition Composition
The Demand Letter is co-authored by two lead state attorneys general offices, which serve as the administrative leads for the Multistate Coalition:
• Connecticut: Office of the Attorney General, Consumer Protection Division. The lead contact is Assistant Attorney General Diane Marchetti, who has served as lead on several recent multistate data breach investigations and has significant experience in this area.
• New York: Office of the Attorney General, Bureau of Internet and Technology. The lead contact is Assistant Attorney General Mark Petrosian, who has been involved in several high-profile data breach investigations conducted by the New York AG's Bureau of Internet and Technology over the past three years.
The Coalition encompasses twenty-nine (29) states, which correspond to the jurisdictions in which affected individuals reside, as identified during the forensic investigation conducted by Graystone Forensics, LLC. The full list of participating states is as follows:
Connecticut, New York, Massachusetts, California, Illinois, Pennsylvania, New Jersey, Ohio, Texas, Florida, Georgia, Virginia, Maryland, North Carolina, South Carolina, Michigan, Minnesota, Indiana, Wisconsin, Colorado, Arizona, Oregon, Washington, Tennessee, Missouri, Louisiana, Nevada, Iowa, and New Hampshire.
It is notable that the Coalition membership aligns precisely with the states where Quorum identified affected residents during the data mining phase of its incident response. This suggests that the Coalition was assembled based on the regulatory filings Quorum submitted to each of these states' attorneys general, which is consistent with standard practice in multistate data breach investigations. The inclusion of both Connecticut and New York as lead states reflects the significant number of affected residents in those jurisdictions — 52,114 individuals in Connecticut and 47,831 individuals in New York — as well as the general tendency of those two offices to assume leadership roles in privacy and data security enforcement actions.
We note that several major states represented in the Coalition, including California, Illinois, and Texas, have their own aggressive data security enforcement postures. However, their participation as coalition members rather than as independent investigators suggests a coordinated, rather than fragmented, approach. This is, on balance, favorable to Quorum, as it consolidates the inquiry into a single channel and reduces the risk of inconsistent demands or duplicative investigations.
B. Key Information Demands
The Demand Letter contains eleven principal categories of information demands, which we summarize below together with our initial assessment of our ability to respond to each:
1. Detailed Incident Timeline. The Coalition requests a detailed account of the incident timeline, including the date of initial unauthorized access, the date on which the breach was discovered, the date on which Palomar notified Quorum, and the dates of all subsequent material events through the completion of consumer notifications. This request is straightforward, and we are well-positioned to provide a comprehensive timeline based on the facts established during the investigation.
2. Root Cause and Attack Vector. The Coalition requests a description of the root cause of the breach and the specific attack vector exploited by the threat actor. We can describe the exploitation of CVE-2023-0669 in Palomar's GoAnywhere MFT file transfer appliance without disclosing privileged forensic analysis. The key messaging point in responding to this demand is that the root cause was a known, patchable vulnerability in Palomar's systems, and that the patch was available well before the exploitation occurred.
3. Scope of Compromised Data. The Coalition requests a breakdown of the categories of compromised data, both by data type and by state. Quorum has completed the data mining necessary to provide this information, and the state-by-state breakdown is available. This demand can be fully addressed.
4. Relationship with Palomar Data Solutions. The Coalition requests information regarding Quorum's contractual relationship with Palomar, including the data security requirements imposed on Palomar under the Master Services Agreement. We can provide a substantive overview of the MSA's data security provisions without disclosing privileged negotiation positions, internal assessments of Palomar's compliance posture, or the specific terms of any ongoing contractual enforcement proceedings.
5. Investigation and Remediation Steps. The Coalition requests a description of the steps Quorum took to investigate and remediate the breach. We can describe the engagement of forensic investigators, the scope of the investigation, and the remedial actions taken, without producing privileged materials such as the Graystone Forensics reports.
6. Consumer Notification Compliance. The Coalition requests detailed information regarding the consumer notification process, including the timing of notifications, the content of notification letters, the delivery method employed, and Quorum's compliance with each state's specific breach notification statute. We are well-positioned to respond comprehensively to this demand, as Quorum maintained meticulous records of its notification activities.
7. Credit Monitoring and Identity Protection Services. The Coalition requests information regarding the credit monitoring and identity protection services offered to affected individuals, including the duration of coverage, the provider, and enrollment statistics. This information is readily available and can be provided.
8. Information Security Program Description. The Coalition requests a description of Quorum's enterprise-wide information security program, including the organizational structure, technical safeguards, and administrative controls. We recommend providing a high-level overview that demonstrates the maturity and comprehensiveness of Quorum's program without disclosing specific technical configurations, penetration testing results, or other sensitive security details that could create risk if disclosed.
9. Vendor Oversight and Accountability Measures. The Coalition requests information regarding the steps Quorum has taken to hold Palomar accountable and to oversee Palomar's remediation efforts. We can describe the contractual enforcement actions taken, the enhanced security measures required of Palomar, and the governance changes implemented, while preserving the confidentiality of specific settlement positions and litigation strategy.
10. Steps to Prevent Recurrence. The Coalition requests a description of the measures Quorum has implemented or plans to implement to prevent similar incidents in the future. We can provide a robust description of the program enhancements Quorum has undertaken and is planning.
11. Response Deadline. The Demand Letter specifies a response deadline of thirty (30) days from receipt, which sets the initial deadline at October 8, 2023. As discussed in Section IV.B below, we recommend requesting a brief five-day extension to October 13, 2023, to ensure that we can provide a comprehensive and accurate response.
III. Strategic Objectives
A. Primary Objective
Our primary objective in responding to the Multistate AG Demand Letter is to achieve closure of the inquiry without formal enforcement action, consent order, monetary penalty, or required injunctive relief. In our experience, state attorneys general evaluating data breach responses consider several key factors when determining whether to pursue enforcement action, including: (i) whether the breach was attributable to the company's own security failures or to a third party; (ii) whether the company maintained a reasonable information security program; (iii) whether the company complied with all applicable notification requirements; (iv) whether the company offered adequate consumer remediation; and (v) whether the company cooperated fully and transparently with the investigation.
Precedent from prior multistate AG data breach investigations strongly supports the conclusion that companies demonstrating genuine cooperation, timely notification, robust remediation, and a commitment to preventing recurrence can achieve "no action" closures. This is particularly true in vendor-originated breach scenarios, where the data controller can demonstrate that it maintained appropriate contractual safeguards and vendor oversight. The facts of Quorum's situation align favorably with each of these factors, and we believe that a well-executed response can bring this matter to a close without adverse consequences.
We note, however, that achieving a no-action closure is not guaranteed. The size of the affected population (318,247 individuals across 29 states), the sensitivity of the data types involved (including SSNs, financial account numbers, and PHI), and the current political environment surrounding data privacy enforcement all present elevated risk factors. Several of the Coalition states, including Connecticut, New York, California, and Illinois, have been particularly aggressive in pursuing data breach enforcement actions in recent years, and several of those states have recently enacted or strengthened their data privacy statutes. Accordingly, our response must be comprehensive, precise, and compelling.
B. Secondary Objectives
In addition to the primary objective described above, our response strategy is designed to advance the following secondary objectives:
Preservation of Quorum's Reputation. Quorum is a top-25 U.S. insurance holding company, publicly traded on the Nasdaq exchange under the ticker symbol QIHC, with an approximate market capitalization of $6.1 billion as of May 2023. The Company's reputation as a responsible data steward is a critical business asset. Our response must demonstrate to the Coalition that Quorum takes its data protection obligations seriously, has invested appropriately in information security, and responded to this incident with the urgency and thoroughness expected of a company of its stature.
Avoidance of Unfavorable Precedent. We are mindful that the resolution of this matter could establish precedent — both formal and informal — regarding the liability of data controllers for vendor-originated breaches. We must ensure that Quorum's response does not concede legal positions that could be used against Quorum or other similarly situated companies in future enforcement actions or private litigation. In particular, we should avoid framing Quorum's vendor oversight practices as having been deficient or inadequate, as such characterizations could be seized upon by plaintiffs' counsel in the putative class actions that have already been filed or are anticipated.
Minimization of Exposure to Private Litigation. Several putative class action lawsuits have already been filed against Quorum in connection with the breach, and additional filings are anticipated. The AG response will likely be discoverable in those proceedings. Accordingly, the response must be drafted with an awareness that it will be scrutinized by plaintiffs' attorneys. Every factual assertion must be accurate and defensible, and the response should demonstrate the reasonableness of Quorum's conduct at every stage — from vendor selection and oversight through incident response and consumer remediation.
Protection of Privileged Materials. The forensic investigation conducted by Graystone Forensics, LLC ("Graystone") was undertaken at the direction of Calderwood & Harkness LLP for the purpose of providing legal advice to Quorum. The preliminary findings report dated June 2, 2023, and the final forensic report dated July 14, 2023, constitute privileged attorney work product. Our response must convey the factual findings of the investigation — the who, what, when, where, and how of the breach — without producing or disclosing the Graystone reports themselves, and without making representations that could be construed as waiver of the attorney-client privilege or work product protection. This requires careful drafting to distinguish between factual information (which can and should be disclosed) and privileged analysis (which must be protected).
Management of Parallel Regulatory Tracks. Quorum is simultaneously subject to inquiry from the Connecticut Insurance Department, through Richard Nakamura of the Financial Analysis Division, Cybersecurity Unit, under Connecticut General Statutes § 38a-999b, and may face follow-up inquiries from the U.S. Department of Health and Human Services, Office for Civil Rights ("HHS-OCR"), Region I (Boston), regarding the PHI component of the breach affecting 41,203 individuals. It is essential that Quorum's factual representations remain fully consistent across all regulatory submissions. Inconsistencies — even minor ones — could undermine Quorum's credibility and create avoidable complications.
IV. Recommended Response Approach
A. Overarching Tone and Posture
The tone and posture of Quorum's response will be as important as its substance. State attorneys general are experienced at distinguishing between companies that genuinely cooperate with investigations and those that merely go through the motions. A defensive or adversarial posture would be counterproductive and could increase the risk of enforcement action. Accordingly, we recommend that the response adopt the following characteristics:
Cooperative and Transparent. The response should convey Quorum's genuine willingness to provide the Coalition with the information it needs to evaluate the incident and Quorum's response. Quorum should present itself as a partner in consumer protection, not as a target resisting oversight. The opening section of the response should expressly acknowledge the importance of the Coalition's inquiry and Quorum's commitment to full cooperation.
Forthcoming Without Being Reckless. We recommend that Quorum voluntarily produce certain categories of information beyond the minimum demanded by the Demand Letter, where doing so reinforces the narrative of proactive, responsible corporate conduct. For example, providing a detailed state-by-state compliance checklist (even though the Demand Letter does not specifically request one in that format) demonstrates that Quorum has carefully tracked its compliance obligations and can account for its performance against each state's requirements. Similarly, providing an overview of Quorum's post-incident program enhancements demonstrates forward-looking commitment to improvement.
However, cooperation should not be confused with capitulation. We must be disciplined about drawing the line between factual information that supports the response narrative and privileged or sensitive materials that should not be disclosed. Specifically, we should avoid volunteering the Graystone forensic reports, internal legal memoranda, attorney-client communications, or specific litigation strategy details related to the Palomar contractual enforcement proceedings. The response should present the facts clearly and comprehensively, but it should do so through Quorum's own narrative rather than through production of underlying privileged documents.
Proactive in Addressing Anticipated Concerns. Rather than waiting for follow-up questions, the response should anticipate the Coalition's likely concerns and address them affirmatively. For example, we should proactively explain why the period between Palomar's notification to Quorum (April 21, 2023) and the commencement of consumer notifications (August 14–25, 2023) was reasonable and consistent with industry practice, given the complexity of the investigation, data mining, and notification preparation process. If we do not address this issue, the Coalition will almost certainly raise it.
B. Requesting a Brief Extension
The Demand Letter establishes a response deadline of thirty (30) days from receipt, which sets the initial deadline at October 8, 2023. We recommend requesting a five-day extension, moving the deadline to October 13, 2023, to ensure that we have adequate time to prepare a comprehensive response.
The basis for the extension request is straightforward and reasonable: the complexity of assembling a response that addresses the requirements of twenty-nine separate state breach notification statutes, the volume of documentary exhibits (including sample notification letters, compliance checklists, and vendor accountability materials), and Quorum's desire to provide complete and accurate information rather than a rushed and potentially incomplete submission. In our experience, modest extension requests of this nature are routinely granted in multistate investigations, particularly when the requesting party demonstrates good faith and a commitment to substantive engagement.
We recommend the following process for requesting the extension:
1. Kevin Ostrowski will place telephone calls to AAG Marchetti and AAG Petrosian on September 12 or 13, 2023, to request the extension informally. This personal outreach serves the dual purpose of introducing Calderwood & Harkness as Quorum's counsel, establishing a constructive working relationship with the lead AAGs, and ensuring that the extension request does not come as a surprise.
2. Following the telephone conversations, Calderwood & Harkness will send written confirmation of the extension request via email and letter to both AAGs, with copies to the other Coalition members as directed by the lead states.
3. If the extension is denied — which we consider unlikely given the modest nature of the request — we are prepared to file a substantially complete response by the original October 8, 2023 deadline. The drafting timeline set forth in Section IX below has been designed with sufficient margin to accommodate this contingency.
V. Key Themes and Messaging Framework
The following six themes constitute the core messaging framework for Quorum's response. Each theme is supported by specific facts and should be woven throughout the written narrative response and supporting exhibits. The themes are designed to work together to present a cohesive narrative: Quorum is a responsible, well-managed company that maintained appropriate safeguards, was victimized by a vendor's security failure, responded promptly and effectively, and is holding the vendor accountable while enhancing its own programs to prevent recurrence.
A. Theme 1 — Vendor-Originated Breach: Quorum as Responsible Steward, Not the Cause
The single most important fact in Quorum's favor is that the breach originated entirely within the network environment of Palomar Data Solutions, Inc., located at 7100 Greenville Avenue, Suite 450, Dallas, Texas 75231. Quorum's own systems, networks, and infrastructure were not compromised at any point during the incident. The threat actor's unauthorized access was confined to Palomar's environment, and the data exfiltration occurred from Palomar's servers. Quorum's network perimeter and internal controls were not breached, and there was no lateral movement from the Palomar incident into any Quorum-controlled system.
The specific attack vector was the exploitation of CVE-2023-0669, a known remote code execution vulnerability in Severin Corporation's GoAnywhere MFT (Managed File Transfer) platform, which Palomar used to facilitate secure file transfers in connection with its claims-processing services for Quorum. The vulnerability was publicly disclosed in early February 2023, and a patch was made available by Severin Corporation shortly thereafter. The exploitation of Palomar's GoAnywhere MFT instance occurred on or about March 14, 2023 — more than thirty days after the patch became available. The unauthorized access and data exfiltration continued over an approximately thirty-five (35) day period, from March 14 through April 18, 2023, when Palomar's internal security team detected the intrusion and contained it.
This timeline is critically important for the messaging framework because it establishes that Palomar failed to apply a critical security patch within a reasonable timeframe — and, more specifically, within the timeframe contractually required by its agreement with Quorum. Under Exhibit D (Data Security Requirements) of the Master Services Agreement dated November 12, 2019, as amended by Amendment 2 dated September 15, 2022, Palomar was required to apply patches for critical vulnerabilities within thirty (30) days of the patch's availability. Palomar's failure to meet this contractual obligation was the proximate cause of the breach.
The response should present these facts clearly and without equivocation. The messaging should convey that Quorum took appropriate steps to contractually require robust vendor security practices, monitored compliance with those requirements through its vendor risk management program, and was ultimately harmed by Palomar's failure to meet the standards to which it had agreed. Quorum was not the source of the vulnerability, did not fail to patch its own systems, and did not contribute to the breach through any action or omission.
At the same time, we should be careful not to position Quorum as a passive victim with no responsibility for the data entrusted to its vendor. The AGs will expect Quorum to take ownership of the consumer impact and the remediation process, even though the breach was vendor-originated. The messaging should strike a balance: Quorum acknowledges its responsibility to its policyholders and affected individuals, has taken full ownership of the notification and remediation process, and is holding Palomar accountable — but the root cause of the incident was the vendor's security failure, not any deficiency in Quorum's own program.
B. Theme 2 — Quorum's Robust Information Security and Vendor Risk Management Program
The Coalition will scrutinize whether Quorum maintained an adequate information security program and, in particular, whether Quorum exercised appropriate oversight of its third-party vendors. To address this scrutiny, the response should present a compelling picture of Quorum's security governance, technical controls, and vendor risk management practices.
Quorum maintains a comprehensive, enterprise-wide information security program overseen by Chief Information Security Officer David Naranjo and Chief Privacy Officer Jennifer Liang. The program is structured around industry-recognized frameworks and incorporates technical, administrative, and physical safeguards appropriate to the sensitivity of the data Quorum processes in its capacity as an insurance holding company. The Company's vendor risk management program is led by Vice President of Vendor Risk Management Priya Deshmukh and includes pre-engagement due diligence assessments, contractual security requirements, and ongoing monitoring of vendor compliance.
With respect to Palomar specifically, the Master Services Agreement was structured with multiple layers of security oversight designed to ensure that Palomar maintained adequate protections for the data it processed on Quorum's behalf:
• Data Security Exhibit (Exhibit D, as amended September 15, 2022, via Amendment 2): Required Palomar to implement and maintain commercially reasonable administrative, technical, and physical safeguards. Established a thirty-day patching requirement for critical vulnerabilities. Required Palomar to conduct annual penetration testing of its systems. Required Palomar to obtain and maintain a SOC 2 Type II audit report from an independent, qualified auditor.
• Breach Notification Clause (Section 9.4): Required Palomar to notify Quorum of any confirmed or suspected security incident within forty-eight (48) hours of discovery.
• Insurance Requirements (Exhibit E): Required Palomar to maintain a minimum of $10 million in cyber liability insurance coverage.
• SOC 2 Type II Audit: Palomar's most recent SOC 2 Type II audit was conducted by Kessler, Park & Associates CPA, PLLC, based in Dallas, Texas (Engagement Partner: Vivian Park). The audit covered the period ending December 31, 2022, and did not identify material deficiencies in Palomar's security controls as of the audit period. We note, however, that SOC 2 audits provide point-in-time or period-of-time assurance and do not guarantee the ongoing effectiveness of controls after the audit period.
Additionally, Quorum's own information security program included network segmentation, access controls, and monitoring capabilities that prevented any lateral movement from the Palomar incident into Quorum's own network. This is a significant fact that demonstrates the effectiveness of Quorum's defense-in-depth architecture: even though a vendor in Quorum's supply chain was compromised, Quorum's own systems remained secure.
We recommend providing a high-level overview of the Quorum information security program as Exhibit D to the AG response. This overview should describe the program's governance structure, technical and administrative safeguards, vendor risk management processes, and employee training requirements. It should not, however, disclose specific technical configurations (e.g., firewall rules, intrusion detection system configurations), penetration testing results, or other granular security details that could create operational security risk if disclosed or that could become publicly available through FOIA requests.
C. Theme 3 — Timely and Comprehensive Consumer and Regulatory Notifications
Compliance with state and federal breach notification statutes is one of the most important factors that attorneys general evaluate when deciding whether to pursue enforcement action. A company that fails to provide timely notification — or that provides inadequate or misleading notification — is far more likely to face formal enforcement action than a company that demonstrates meticulous compliance. Quorum's notification record in this matter is strong, and the response should present it in detail.
Quorum filed all required regulatory notifications within the statutory deadlines applicable in each of the twenty-nine states plus the District of Columbia, as well as with applicable federal regulators. The key filings are summarized below:
• Connecticut Attorney General and Connecticut Insurance Department: Filed August 14, 2023, in compliance with Connecticut General Statutes § 36a-701b (AG notification) and § 38a-999b (Insurance Department notification). Connecticut requires notification without unreasonable delay but does not impose a specific day count. Quorum's filing occurred eleven (11) days after the completion of data mining and the identification of all affected Connecticut residents.
• HHS-OCR (HIPAA Notification): Filed August 15, 2023, in compliance with 45 C.F.R. § 164.408, for the 41,203 individuals whose protected health information was compromised. HIPAA requires notification to HHS within sixty (60) days of the discovery of the breach. Quorum's filing was well within this deadline.
• New York Attorney General: Filed August 16, 2023, in compliance with New York General Business Law § 899-aa, for the 47,831 affected New York residents.
• California Attorney General: Filed August 16, 2023, in compliance with California Civil Code § 1798.82, for the 38,206 affected California residents. California requires AG notification when a breach affects more than 500 California residents.
• Massachusetts Attorney General and Department of Consumer Rights: Filed August 17, 2023, in compliance with Massachusetts General Laws ch. 93H, § 3, for the 10,217 affected Massachusetts residents.
• All Remaining State Filings: Completed between August 17 and August 25, 2023, within the applicable statutory timeframes for each jurisdiction.
Consumer notification letters were mailed to all 318,247 affected individuals on a rolling basis from August 18 through September 15, 2023, representing an approximately twenty-eight (28) day mailing window. The use of a rolling mailing schedule reflected the logistical realities of producing, quality-checking, and mailing more than 318,000 individualized letters, each of which was tailored to the specific categories of data compromised for that individual. Multiple notification letter versions were prepared to ensure that each affected individual received accurate, specific information regarding the types of data compromised:
• General PII Version: Sent to all 318,247 affected individuals. This version addressed the compromise of names, dates of birth, Social Security numbers, and driver's license numbers.
• Financial Data Version: Sent to the 84,619 individuals whose financial information was compromised, including bank account numbers and payment card numbers. This version included additional guidance regarding monitoring financial accounts and placing fraud alerts.
• PHI Version: Sent to the 41,203 individuals whose protected health information was compromised, including health conditions, diagnosis codes, and treatment information derived from workers' compensation and health-related insurance claims. This version was drafted in compliance with HIPAA notification requirements under 45 C.F.R. § 164.404(c), including the required content elements.
• State-Specific Versions: Additional tailored versions were prepared for California (incorporating requirements under the California Consumer Privacy Act and the Confidentiality of Medical Information Act) and Massachusetts (incorporating requirements under 201 CMR 17.00).
In addition to direct mail notification, Quorum published a substitute notice and website posting on August 15, 2023, and distributed a media notice in compliance with 45 C.F.R. § 164.406 for breaches affecting more than 500 individuals in any given state.
We recommend including a full state-by-state compliance checklist and sample copies of all notification letter versions as Exhibit B to the AG response. This comprehensive exhibit will demonstrate the thoroughness and precision of Quorum's notification efforts and provide the Coalition with the information it needs to independently verify Quorum's compliance with each state's specific requirements.
D. Theme 4 — Comprehensive Consumer Remediation
Beyond the notification itself, the Coalition will evaluate the adequacy of the remediation measures Quorum offered to affected individuals. Quorum's remediation package is robust and compares favorably to — and in many respects exceeds — the remediation typically offered in similar incidents.
Quorum offered twenty-four (24) months of complimentary credit monitoring and identity theft protection services to all 318,247 affected individuals, regardless of the specific categories of data compromised. This duration exceeds the twelve-month standard that many companies offer and demonstrates Quorum's commitment to providing meaningful, long-term protection to its policyholders and claimants.
The enrollment process for these services is being managed by Clearfield Notification Services LLC ("Clearfield"), a nationally recognized breach response services provider. Quorum's account is managed by Jerome Tillman, Account Manager, at Clearfield's offices at 4500 Rockside Road, Suite 210, Independence, Ohio 44131. The enrollment process was designed to be simple and accessible, requiring affected individuals to call a dedicated toll-free number or visit a secure enrollment website using a unique activation code provided in their notification letter.
As of the date of this memorandum, the estimated enrollment take-rate is approximately 40%, representing approximately 127,299 enrollees. The actual enrollment figure as of the date of the AG response submission will be included in the response, as enrollment is ongoing. This take-rate is consistent with industry averages for incidents of this nature and scale.
In addition to credit monitoring services, Quorum established a dedicated toll-free call center operated by Clearfield for a twelve-week window to assist affected individuals with questions about the incident, the notification letters, and the enrollment process for credit monitoring services. The call center was staffed with trained representatives who could provide information in multiple languages and were equipped to escalate complex inquiries as needed.
The total cost of notification and consumer remediation services is approximately $3,214,500, broken down as follows:
The messaging with respect to consumer remediation should emphasize that Quorum invested substantial resources in protecting and assisting affected individuals, even though the breach originated entirely at a third-party vendor. This demonstrates Quorum's commitment to consumer welfare and its willingness to bear the costs of remediation while simultaneously pursuing indemnification from the responsible party.
E. Theme 5 — Aggressive Vendor Accountability
The Coalition will expect to see that Quorum is holding Palomar accountable for its security failures. A company that simply absorbs the consequences of a vendor breach without pursuing meaningful accountability against the vendor sends a troubling signal to regulators. Quorum's approach has been appropriately aggressive in pursuing its contractual rights and requiring enhanced security measures.
Quorum promptly pursued contractual accountability against Palomar upon confirming the scope and nature of the breach:
• Formal Breach of Contract Demand Letter: On June 20, 2023, Calderwood & Harkness LLP, on behalf of Quorum, sent a formal demand letter to Palomar's counsel, Mercer, Haight & Dunlop LLP (Catherine Langford, Partner), asserting breach of contract and demanding full indemnification under Section 12.2 of the Master Services Agreement.
• Indemnification Demand: The demand sought indemnification for total incident response costs of $8,230,250, which encompasses forensic investigation costs, legal fees, notification and remediation expenses, internal response costs, and other related expenditures. The indemnification cap under the MSA is $32,600,000, calculated as two times (2×) the trailing twelve-month fees paid by Quorum to Palomar of $16,300,000. Quorum's current claim is well within the contractual cap.
• Specific Contractual Breaches Identified: The demand letter identified two specific breaches of the MSA by Palomar: (1) failure to apply the patch for CVE-2023-0669 within the thirty-day window required by Exhibit D of the MSA, and (2) late notification to Quorum of the security incident, which occurred approximately twenty-four (24) hours past the forty-eight (48) hour contractual notification window specified in Section 9.4 of the MSA. (Palomar discovered the breach on April 18, 2023, but did not notify Quorum until April 21, 2023 — approximately seventy-two hours after discovery, exceeding the forty-eight-hour requirement by approximately one day.)
As of the date of this memorandum, vendor accountability negotiations are ongoing. Calderwood & Harkness is engaged in discussions with Mercer, Haight & Dunlop LLP regarding the indemnification claim and the terms of enhanced security requirements that Palomar will be required to implement as a condition of continuing to provide services to Quorum.
In addition to the contractual enforcement proceedings, Quorum is requiring Palomar to implement a series of enhanced security measures, including upgraded patch management processes with accelerated deployment timelines, enhanced endpoint detection and response capabilities, additional network monitoring and logging, and third-party verification of remediation completeness.
We recommend summarizing the vendor accountability steps in Exhibit C to the AG response. This exhibit should provide sufficient detail to demonstrate the seriousness and comprehensiveness of Quorum's enforcement efforts, without disclosing specific settlement negotiation positions, dollar figures related to the indemnification demand, or privileged litigation strategy. The exhibit should characterize the contractual enforcement proceedings as "active contractual enforcement proceedings" and note that Quorum is pursuing all available contractual remedies.
F. Theme 6 — Steps to Prevent Recurrence
The final theme addresses the forward-looking measures Quorum has undertaken to prevent similar incidents in the future. Attorneys general are particularly attentive to this element, as it demonstrates that the company has learned from the incident and is committed to continuous improvement. A response that focuses exclusively on what happened and what the company did after the fact, without addressing what the company is doing to prevent recurrence, will leave the Coalition unsatisfied.
Quorum has undertaken the following program-wide enhancements to its vendor risk management program and broader information security posture as a result of this incident:
• Enhanced Vendor Security Due Diligence Protocols: Quorum has updated its vendor onboarding and renewal assessment protocols to include more rigorous evaluation of prospective and existing vendors' patch management practices, vulnerability management programs, and incident response capabilities. The updated protocols include mandatory questionnaires addressing specific technical controls, as well as enhanced documentation and review requirements.
• Shortened Contractual Incident Notification Windows: For all future vendor agreements, and as amendments are negotiated for existing agreements, Quorum is implementing a reduced contractual incident notification window of twenty-four (24) hours (down from the current forty-eight-hour standard), to ensure that Quorum receives more timely notice of security incidents affecting vendor-held data.
• Expanded Third-Party Audit Requirements: Quorum is expanding its requirements for independent third-party security audits of critical vendors, including more frequent audit cycles and expanded audit scope to cover specific control areas such as patch management and vulnerability remediation.
• Crisis Communications and Stakeholder Engagement: Quorum has engaged BrightPath Consulting Group Inc. (Meredith Ashford, Managing Director) to assist with crisis communications and stakeholder engagement, ensuring that Quorum communicates transparently and effectively with affected individuals, regulators, business partners, and the public.
• Internal Incident Response Plan Review and Update: Quorum's incident response plan has been reviewed and updated in light of lessons learned from this incident. The updated plan incorporates enhanced vendor breach response protocols, accelerated decision-making frameworks, and streamlined communication chains.
• Senior Leadership Tabletop Exercises: Quorum is scheduling tabletop exercises for senior leadership and key members of the incident response team, to be conducted in Q4 2023 and Q1 2024, to test the updated incident response plan and ensure organizational readiness.
• Data Minimization Review: Quorum has initiated a comprehensive review of the categories and volumes of data shared with third-party vendors, with the objective of minimizing the data entrusted to vendors to only what is strictly necessary for the performance of contracted services. This review is expected to result in reduced data footprints across Quorum's vendor ecosystem.
The response should present these enhancements as evidence of Quorum's commitment to continuous improvement and its proactive approach to strengthening its data protection posture. The messaging should convey that Quorum views this incident not merely as a crisis to be managed, but as an opportunity to strengthen its programs and better protect the individuals whose data it is entrusted to safeguard.
VI. Proposed Response Structure and Exhibits
A. Written Narrative Response
The written narrative response to the Multistate Coalition should be organized into the following sections, each of which corresponds to one or more of the information demands set forth in the Demand Letter and incorporates the themes and messaging framework discussed in Section V above:
Introductory Section. The response should open with a cooperative and respectful introduction identifying Quorum Insurance Holdings Corp. and acknowledging the receipt of the Demand Letter. The introduction should note the engagement of Calderwood & Harkness LLP as counsel for this matter, express Quorum's commitment to cooperating fully with the Coalition's inquiry, and provide a brief overview of the response structure and accompanying exhibits.
Section I: Incident Overview and Timeline. This section should provide a clear, chronological narrative of the incident from the date of initial unauthorized access through the completion of consumer notifications and ongoing remediation efforts. The timeline should be presented in a factual, straightforward manner, avoiding legal conclusions or characterizations that could be construed as admissions.
Section II: Root Cause Analysis. This section should describe the root cause of the breach — the exploitation of CVE-2023-0669 in Palomar's GoAnywhere MFT appliance — and explain that the breach was vendor-originated and attributable to Palomar's failure to timely patch a known vulnerability. This section should present factual information derived from the investigation without producing or referencing privileged materials.
Section III: Scope of Compromised Data. This section should provide a comprehensive breakdown of the compromised data, both by data type and by state. The state-by-state figures, based on the data mining completed by August 4, 2023, are as follows:
The response should also break down the data by type: general PII (all 318,247 individuals), financial data (84,619 individuals), and PHI (41,203 individuals), with descriptions of each category.
Section IV: Quorum's Relationship with Palomar. This section should describe the nature of Quorum's contractual relationship with Palomar, the scope of services Palomar provides, and the data security requirements imposed on Palomar under the MSA. This section should provide a substantive overview of the key contractual provisions without disclosing privileged negotiation positions or the specific terms of the ongoing indemnification proceedings.
Section V: Investigation and Remediation Steps. This section should describe the steps Quorum took upon learning of the incident, including the engagement of forensic investigators, the scope and findings of the investigation, the remedial actions taken within Palomar's environment, and Quorum's own validation and verification activities. This section should be drafted carefully to present factual information without producing privileged materials.
Section VI: Consumer Notification Compliance. This section should provide a detailed account of Quorum's consumer and regulatory notification process, including the timing, content, and delivery method of all notifications, and Quorum's compliance with each state's specific breach notification statute. This section should cross-reference the compliance checklist in Exhibit B.
Section VII: Consumer Remediation. This section should describe the credit monitoring and identity theft protection services offered to affected individuals, the call center established to assist affected individuals, enrollment statistics, and the total investment in consumer remediation.
Section VIII: Vendor Accountability Measures. This section should describe the steps Quorum has taken to hold Palomar accountable, including the contractual enforcement actions pursued, the enhanced security measures required of Palomar, and the governance changes implemented. This section should cross-reference the vendor accountability summary in Exhibit C.
Section IX: Quorum's Information Security Program. This section should provide a high-level description of Quorum's enterprise-wide information security program, its governance structure, and its key technical and administrative controls. This section should cross-reference the program overview in Exhibit D.
Section X: Preventive Measures and Enhancements. This section should describe the forward-looking measures Quorum has implemented or is implementing to prevent recurrence, including enhancements to the vendor risk management program, shortened notification windows, expanded audit requirements, data minimization efforts, and incident response plan updates.
B. Exhibit A — Incident Timeline and Remedial Measures Summary
Exhibit A should present a comprehensive, chronological timeline of the incident and Quorum's response, beginning with the date of initial unauthorized access and continuing through the date of the response submission. The timeline should include the following key milestones:
• March 14, 2023: Threat actor exploits CVE-2023-0669 in Palomar's GoAnywhere MFT appliance; unauthorized access to Palomar's network environment begins.
• March 14 – April 18, 2023: Unauthorized access and data exfiltration continue within Palomar's environment over an approximately 35-day period.
• April 18, 2023: Palomar's internal security team detects the intrusion and initiates containment procedures.
• April 21, 2023: Palomar notifies Quorum of the security incident (approximately 72 hours after discovery; approximately 24 hours past the 48-hour contractual notification deadline under MSA Section 9.4).
• May 4, 2023: Quorum engages Calderwood & Harkness LLP as outside counsel for the incident response.
• May 5, 2023: Calderwood & Harkness, at Quorum's direction, engages Graystone Forensics, LLC to conduct a forensic investigation under the direction and privilege of counsel. (Note: The response should reference the engagement of forensic investigators without identifying the engagement as privileged or producing any privileged materials.)
• May 8, 2023: Quorum submits a claim under its cyber liability insurance policy with Atlas Mutual Insurance Company (Policy No. CYB-2023-041587).
• May 10, 2023: Common Interest Agreement executed between Quorum and Atlas Mutual Insurance Company.
• June 2, 2023: Preliminary forensic findings available. (Note: The response should reference the availability of preliminary findings without disclosing the content of the privileged Graystone report. Factual findings may be conveyed through Quorum's own narrative.)
• July 14, 2023: Final forensic report completed. (Same privilege note as above.)
• August 4, 2023: Data mining completed; identification of all affected individuals and corresponding data types finalized.
• August 14–25, 2023: Regulatory notifications filed with all required state attorneys general, state insurance regulators, and federal agencies.
• August 15, 2023: Substitute notice / website posting published; HHS-OCR notification filed.
• August 18 – September 15, 2023: Consumer notification letters mailed to all 318,247 affected individuals.
• Ongoing as of submission date: Consumer remediation services (credit monitoring, call center), vendor accountability proceedings, and program enhancements.
C. Exhibit B — Consumer Notification Samples and Compliance Checklist
Exhibit B should include the following materials:
1. Copies of all five notification letter versions (General PII, Financial Data, PHI, California-specific, Massachusetts-specific).
2. A state-by-state compliance checklist in tabular format, showing for each of the twenty-nine states plus the District of Columbia: the applicable statute, the statutory notification deadline, the date of Quorum's filing, the method of filing (e.g., online portal, email, certified mail), and Quorum's compliance status.
3. A copy of the substitute notice / website posting text.
4. A copy of the media notice distributed in compliance with 45 C.F.R. § 164.406.
This exhibit is designed to provide the Coalition with comprehensive, independently verifiable evidence of Quorum's notification compliance.
D. Exhibit C — Palomar Vendor Accountability Summary
Exhibit C should provide a summary of Quorum's vendor accountability efforts that is sufficiently detailed to demonstrate the seriousness of Quorum's approach, while protecting privileged and sensitive information. The exhibit should include:
1. An overview of the key MSA provisions requiring Palomar to maintain adequate data security, including the critical patch management requirement, the breach notification clause, and the indemnification provisions.
2. A description of Palomar's specific contractual breaches (failure to patch CVE-2023-0669 within the 30-day window; late notification exceeding the 48-hour requirement by approximately 24 hours).
3. A summary of the steps Quorum has taken to enforce its contractual rights, characterized as "active contractual enforcement proceedings" without disclosing specific dollar figures, settlement positions, or litigation strategy.
4. A description of the enhanced security measures Quorum is requiring Palomar to implement as a condition of the continued business relationship.
5. A caveat noting that certain information related to the contractual enforcement proceedings is subject to attorney-client privilege and work product protection and is not being disclosed in this submission.
E. Exhibit D — Quorum Information Security Program Overview
Exhibit D should provide a high-level description of Quorum's enterprise-wide information security program, organized around the following elements:
1. Governance Structure: Description of the organizational structure for information security governance, including the roles of CISO David Naranjo, CPO Jennifer Liang, and VP Vendor Risk Management Priya Deshmukh, and their reporting relationships to senior management and the Board of Directors.
2. Technical Safeguards: Overview of key technical controls, including network segmentation, access controls, encryption, monitoring and detection capabilities, and incident response infrastructure. This overview should be high-level and should not disclose specific configurations or technical details.
3. Administrative Safeguards: Description of policies, procedures, and governance frameworks, including information security policies, acceptable use policies, data classification standards, and risk assessment processes.
4. Vendor Risk Management Program: Description of the vendor due diligence, assessment, and monitoring program, including the contractual requirements imposed on vendors, the audit and assessment schedule, and the vendor risk tiering methodology.
5. Employee Training: Description of the security awareness training program, including frequency, content, and completion tracking.
6. Post-Incident Enhancements: Summary of the program enhancements undertaken in response to this incident, cross-referencing the preventive measures described in the narrative response.
VII. Privilege and Confidentiality Considerations
The protection of privileged materials is a critical concern throughout the preparation and submission of the AG response. We address the key privilege considerations below.
Graystone Forensics Investigation. The forensic investigation conducted by Graystone Forensics, LLC (Dr. Nolan Briggs, Lead Forensic Examiner; Kendra Faulkner, Senior Analyst) was initiated at the direction of Calderwood & Harkness LLP for the purpose of providing legal advice to Quorum in connection with the data security incident. The engagement letter with Graystone was executed between Calderwood & Harkness and Graystone, with Calderwood & Harkness identified as the client for purposes of the engagement and the direction of the forensic work. The preliminary findings report dated June 2, 2023, and the final forensic report dated July 14, 2023, constitute privileged attorney work product prepared in anticipation of litigation and at the direction of counsel.
The AG response should present the factual findings regarding the incident — the identity of the threat actor's attack vector, the timeline of unauthorized access, the scope of compromised data, and the root cause of the breach — through Quorum's own narrative, based on information known to Quorum through its own investigation and its receipt of factual briefings from counsel. The response should not produce, attach, quote from, or specifically reference the Graystone reports. Factual information about the breach can be conveyed in Quorum's own words without privilege waiver, provided the response does not disclose the mental impressions, conclusions, opinions, or legal theories of counsel or the forensic experts acting at counsel's direction.
Internal Legal Analysis and Strategy. All internal legal analyses, strategy memoranda (including this memorandum), communications between Calderwood & Harkness and Quorum, and communications among the Calderwood & Harkness engagement team are protected by the attorney-client privilege and/or the work product doctrine. None of these materials should be produced or referenced in the AG response.
Common Interest Agreement with Atlas Mutual Insurance Company. On May 10, 2023, Quorum and Atlas Mutual Insurance Company executed a Common Interest Agreement (the "CIA") to protect the confidentiality and privilege of information shared between the parties in connection with the insurance claim arising from the Palomar data breach (Policy No. CYB-2023-041587, Claim No. CYB-CLM-2023-05892). The CIA establishes that information shared between Quorum and Atlas Mutual in furtherance of their common legal interest in defending against claims arising from the breach remains protected by the attorney-client privilege and work product doctrine. We must ensure that no communications with or materials shared with Atlas Mutual are inadvertently disclosed in the AG response.
Privilege Assertion if Forensic Report Demanded. If the Coalition demands production of the Graystone forensic report, we should assert the attorney-client privilege and work product protection and offer, as an alternative, to provide a factual summary of the investigation's findings through Quorum's own narrative. This approach is consistent with the well-established principle that a party may disclose the facts learned during a privileged investigation without waiving privilege over the investigator's report, analysis, or conclusions, provided the disclosure is made through the party's own account of the facts rather than through production of the privileged document itself. We should be prepared to provide legal authority supporting this position if the assertion is challenged.
Confidentiality Marking on Submissions. All submissions to the Multistate AG Coalition should be marked as "Confidential — Submitted Pursuant to Investigation; Not a Public Record" to the extent permissible under each participating state's Freedom of Information Act or public records law. While we cannot guarantee that such markings will prevent disclosure in all circumstances — as state FOIA laws vary and some provide limited exemptions for investigative materials — the marking will put the Coalition on notice of Quorum's confidentiality expectations and provide a basis for objecting to any public records requests seeking disclosure of the submission.
VIII. Coordination with Parallel Regulatory Tracks
A. Connecticut Insurance Department
In addition to the Multistate AG inquiry, Quorum is subject to a separate inquiry from the Connecticut Insurance Department, Financial Analysis Division, Cybersecurity Unit, conducted by Richard Nakamura. This inquiry is being conducted under the authority of Conne

STRATEGY MEMORANDUM

MATTER NO.: 1025-00006

Record

Parties

Dates

Amounts