1025-00006 · Graystone Forensics LLC · Regulatory Defense/Multistate AG

supplemental-submission-multistate-ag.docx DOCUMENT Data Privacy

69 / 88 ← → ✕

Contract analysis Extract to table

PRIVILEGED & CONFIDENTIAL

CALDERWOOD & HARKNESS LLP Attorneys at Law

1700 K Street NW, Suite 900 Washington, D.C. 20006

Telephone: (202) 555-7200 Facsimile: (202) 555-7201 www.calderwoodharkness.com

November 3, 2023

Via Electronic Mail and Certified Mail, Return Receipt Requested

Assistant Attorney General Diane Marchetti Consumer Protection Division Office of the Connecticut Attorney General 165 Capitol Avenue Hartford, CT 06106

Assistant Attorney General Mark Petrosian Bureau of Internet and Technology Office of the New York Attorney General 28 Liberty Street New York, NY 10005

Re: Supplemental Information in Response to Multistate Attorney General Coalition Inquiry Regarding Data Security Incident Involving Quorum Insurance Holdings Corp.

Reference: Multistate Investigation — Quorum Insurance Holdings Corp. Data Security Incident

Reference: Calderwood & Harkness LLP Matter No. 1025-00006

Dear Assistant Attorney General Marchetti and Assistant Attorney General Petrosian:

I. Introduction and Purpose

Calderwood & Harkness LLP submits this letter on behalf of our client, Quorum Insurance Holdings Corp. ("Quorum" or "QIH"), a Delaware corporation publicly traded on the Nasdaq Stock Market (ticker: QIHC), with its principal executive offices located at 400 Constitution Plaza, Suite 2200, Hartford, Connecticut 06103. This submission is made in response to the multistate coalition's request for supplemental information, as communicated to undersigned counsel by email correspondence dated October 20, 2023, following the coalition's review of Quorum's initial written response and the accompanying Exhibits A through D, which were submitted on October 13, 2023.

As the coalition is aware, the original joint demand letter that initiated this inquiry was issued on September 8, 2023, on behalf of a coalition of twenty-nine (29) state attorneys general (the "Multistate Coalition" or the "Coalition"). Quorum's initial response provided a detailed narrative of the data security incident, the timeline of Quorum's investigation and response, the scope and nature of the consumer data compromised, and the remediation measures undertaken to date. The Coalition's subsequent request for supplemental information identified three discrete categories of additional information that the Coalition requires in order to continue its evaluation of this matter. This submission addresses each of those three categories in turn:

1. Updated Credit Monitoring Enrollment Statistics and Consumer Remediation Update. The Coalition requested current data regarding the enrollment rates for complimentary credit monitoring and identity theft protection services offered to affected consumers, as well as an update on consumer complaint volume and any reports of confirmed consumer harm.

2. Confirmation of Palomar Data Solutions, Inc.'s Implementation of Enhanced Security Measures. The Coalition requested confirmation that the third-party vendor responsible for the data security incident—Palomar Data Solutions, Inc. ("Palomar")—has implemented or is in the process of implementing enhanced information security measures to address the root cause of the breach and reduce the risk of recurrence.

3. Summary of the Vendor Accountability Resolution Reached Between Quorum and Palomar. The Coalition requested a summary of the financial and contractual resolution reached between Quorum and Palomar on October 27, 2023, including the terms of financial recovery and the enhanced security obligations imposed upon Palomar as part of that resolution.

Quorum has cooperated fully with the Coalition's inquiry since its inception and remains committed to transparency and good-faith engagement with the Coalition throughout this process. Quorum appreciates the Coalition's diligence in protecting the interests of consumers across the affected jurisdictions and welcomes the opportunity to provide the supplemental information set forth herein.

The responsible partner on this matter is Kevin Ostrowski, Partner in the Privacy & Data Security practice group of Calderwood & Harkness LLP. The lead associate is Alan Burke. All communications regarding this submission should be directed to the undersigned.

II. Updated Credit Monitoring Enrollment Statistics and Consumer Remediation Update

A. Consumer Notification Summary

As described in Quorum's initial written response, Quorum undertook a comprehensive consumer notification effort following its determination that the data security incident resulted in unauthorized access to, and exfiltration of, personally identifiable information ("PII"), financial data, and protected health information ("PHI") pertaining to Quorum policyholders, claimants, and other affected individuals. Consumer notification letters were mailed to all 318,247 affected individuals across twenty-nine (29) states and the District of Columbia. The notification mailing process commenced on August 18, 2023 and was substantially completed by September 15, 2023, encompassing a mailing window of approximately twenty-eight (28) days. This timeline met or exceeded the notification deadlines imposed by all applicable state data breach notification statutes.

Three distinct versions of the notification letter were prepared and deployed, tailored to the specific categories of data compromised with respect to each affected individual:

(i) General PII Version. This version addressed individuals whose compromised data included names, dates of birth, Social Security numbers, and/or driver's license numbers. This version was sent to all 318,247 affected individuals, as each individual's compromised data included at least one element of general PII.

(ii) Enhanced Financial Data Version. This version included all disclosures contained in the General PII version and additionally addressed the compromise of bank account numbers and/or payment card numbers. This version was sent to the subset of 84,619 individuals whose compromised data included financial account information in addition to general PII.

(iii) PHI/HIPAA-Compliant Version. This version included all disclosures contained in the General PII version and additionally addressed the compromise of health conditions, diagnosis codes, and/or treatment information derived from workers' compensation claims and other health-related insurance claims administered by Quorum. This version was prepared in compliance with the notification requirements of the Health Insurance Portability and Accountability Act of 1996, as amended ("HIPAA"), and the Health Information Technology for Economic and Clinical Health Act ("HITECH Act"), and was sent to the subset of 41,203 individuals whose compromised data included PHI.

In addition to the three core versions described above, jurisdiction-specific versions were prepared for the states of California and Massachusetts to ensure compliance with the specific content, formatting, and procedural requirements imposed by those states' data breach notification statutes. The California-specific version was sent to the 38,206 affected individuals residing in California, and the Massachusetts-specific version was sent to the 10,217 affected individuals residing in Massachusetts. Both jurisdiction-specific versions incorporated all required disclosures and were submitted for review and approval by the relevant state regulatory authorities in accordance with applicable procedures.

All versions of the notification letter offered each affected individual twenty-four (24) months of complimentary credit monitoring and identity theft protection services, provided at no cost to the individual. The notification letter included clear instructions for enrollment, a unique activation code for each individual, a dedicated website URL, and a toll-free telephone number for assistance. The availability of these services was prominently featured in the notification letters to ensure maximum consumer awareness and uptake.

B. Credit Monitoring Enrollment Data (as of October 31, 2023)

Credit monitoring and identity theft protection services are being provided through Clearfield Notification Services LLC ("Clearfield"), located at 4500 Rockside Road, Suite 210, Independence, Ohio 44131. The designated account manager for the Quorum engagement at Clearfield is Jerome Tillman. Clearfield is an experienced provider of incident response notification and remediation services and has administered credit monitoring and identity theft protection programs in connection with numerous large-scale data security incidents.

The following table summarizes the current enrollment data as of October 31, 2023:

The enrollment take-rate of approximately forty percent (40%) is consistent with—and, in fact, exceeds—the typical enrollment rates observed in data security incidents of comparable scope and nature. Quorum notes that enrollment remains open and affected individuals may continue to enroll at any time during the twenty-four (24) month enrollment window. Quorum anticipates that additional enrollments will continue to be received over the coming months, and Quorum will continue to facilitate and encourage enrollment through the dedicated call center and website.

A detailed state-by-state breakdown of enrollment statistics is provided in Enclosure 1 to this submission.

C. Call Center Operations Summary

A dedicated toll-free call center was established and became operational on August 18, 2023, coinciding with the commencement of the notification mailing process. The call center is operated by Clearfield Notification Services LLC and is staffed by trained representatives capable of addressing consumer inquiries regarding the data security incident, the categories of data compromised, steps individuals can take to protect themselves, and the process for enrolling in credit monitoring and identity theft protection services.

The call center was designed with a primary twelve (12) week operations window to cover the anticipated period of heaviest consumer inquiry volume immediately following the mailing of notification letters. During this initial twelve-week period—spanning from August 18, 2023 through approximately November 10, 2023—the call center operated with full staffing levels and extended hours of operation to ensure that affected individuals were able to reach a representative in a timely manner. Call volume during this period was highest in the first three weeks following the initial mailing and declined steadily thereafter, consistent with industry experience.

Following the conclusion of the primary twelve-week operations window, the call center will transition to a reduced-staffing model. The reduced-staffing call line will continue to accept calls and assist consumers with enrollment in credit monitoring services, address inquiries regarding the incident, and provide guidance to individuals who believe they may have experienced identity theft or fraud. The reduced-staffing line is expected to remain operational throughout the duration of the twenty-four (24) month credit monitoring enrollment period.

In addition to general inquiry handling, the call center has established escalation procedures for individuals who report suspected identity theft or financial fraud potentially related to the data security incident. Such reports are escalated to a senior representative, documented, and forwarded to Quorum's incident response team for tracking, investigation, and coordination with law enforcement as appropriate.

D. Consumer Complaints

Quorum has closely monitored consumer complaint volume throughout the notification and remediation process. As of October 31, 2023, the total volume of consumer complaints received by Quorum and Clearfield remains low relative to the total number of affected individuals. The majority of complaints received relate to general inquiries about the incident, requests for additional information regarding the scope of data compromised, and logistical questions regarding the credit monitoring enrollment process. A smaller number of complaints relate to delays in the receipt of notification letters, difficulties with the online enrollment process, or requests for additional remediation beyond the credit monitoring services offered.

Critically, as of October 31, 2023, Quorum has received no reports of confirmed identity theft or financial fraud that have been linked to the data security incident. While Quorum recognizes that the absence of confirmed harm to date does not eliminate the possibility of future harm—and, accordingly, Quorum remains vigilant in its monitoring and response efforts—the absence of confirmed harm is a meaningful indicator that the incident has not, to date, resulted in the type of downstream consumer injury that would be of greatest concern to the Coalition. Quorum will continue to track and document any reports of suspected or confirmed identity theft or fraud received through the call center, direct consumer correspondence, or other channels, and will promptly notify the Coalition should any such reports be confirmed.

III. Confirmation of Palomar Data Solutions Enhanced Security Measures

A. Background on the Vendor Relationship

As detailed in Quorum's initial written response, the data security incident originated not within Quorum's own network environment, but within the network environment of Quorum's third-party claims data processing vendor, Palomar Data Solutions, Inc. ("Palomar"). Palomar is a Texas corporation headquartered at 7100 Greenville Avenue, Suite 450, Dallas, Texas 75231. Palomar provides claims data processing, intake, and management services to Quorum pursuant to a Master Services Agreement dated November 12, 2019, as subsequently amended (the "MSA"). Palomar is Quorum's second-largest vendor by annual contract value, with an annual contract value of approximately $16.3 million per year following the execution of Amendment 1 to the MSA, which became effective on April 1, 2021.

The data breach was caused by the exploitation of CVE-2023-0669, a critical remote code execution vulnerability affecting the GoAnywhere MFT managed file transfer appliance deployed within Palomar's network infrastructure. GoAnywhere MFT is a widely used enterprise file transfer solution that Palomar utilized to receive, process, and transmit claims data files on behalf of Quorum and other clients. The exploitation of CVE-2023-0669 enabled the threat actor to gain unauthorized access to Palomar's file transfer environment and, through that access, to exfiltrate files containing PII, financial data, and PHI pertaining to Quorum policyholders and claimants.

Based on the forensic investigation conducted by Graystone Forensics LLC ("Graystone"), the unauthorized access commenced on approximately March 14, 2023 and continued through approximately April 18, 2023—a period of approximately thirty-five (35) days. Graystone's forensic analysis confirmed that the threat actor leveraged the CVE-2023-0669 vulnerability to establish a persistent foothold within Palomar's GoAnywhere MFT environment and to stage and exfiltrate data files over the course of the intrusion period.

B. Root Cause and Palomar's Contractual Obligations

The root cause of the data security incident was Palomar's failure to timely apply a vendor-issued security patch for CVE-2023-0669. A patch addressing CVE-2023-0669 was made available by the GoAnywhere MFT software vendor prior to the date on which the threat actor first exploited the vulnerability in Palomar's environment. Under the terms of the MSA—specifically, Exhibit D (Data Security Exhibit), as amended by Amendment 2 to the MSA dated September 15, 2022—Palomar was contractually required to apply patches for critical vulnerabilities within thirty (30) days of the vendor patch release date. Palomar failed to comply with this contractual obligation, and the unpatched vulnerability was exploited by the threat actor before Palomar remediated the vulnerability.

In addition to the patch management failure, Quorum's investigation determined that Palomar's notification to Quorum of the security incident was untimely under the terms of the MSA. Section 9.4 of the MSA requires Palomar to provide written notification to Quorum of any security incident affecting Quorum data within forty-eight (48) hours of Palomar's discovery of such incident. Palomar discovered the unauthorized access on or about April 19, 2023, but did not provide written notification to Quorum until April 21, 2023—approximately twenty-four (24) hours beyond the contractually mandated notification window. While this delay did not have a material impact on the ultimate scope of the incident (as the exfiltration had already concluded before Palomar's discovery), the late notification constituted a separate breach of Palomar's obligations under the MSA and underscored the need for enhanced incident notification protocols.

C. Enhanced Security Measures Implemented or Underway

As part of the broader resolution between Quorum and Palomar, the parties executed Amendment 3 to the MSA on October 27, 2023. Amendment 3 imposes a significantly enhanced set of data security requirements on Palomar, designed to address the specific root causes of the breach, strengthen Palomar's overall information security posture, and provide Quorum with greater visibility into Palomar's security practices on an ongoing basis. The key provisions of Amendment 3 are summarized below:

(i) Accelerated Patch Management. Palomar is now required to apply patches for critical vulnerabilities within fourteen (14) calendar days of the vendor patch release date. This requirement represents a significant acceleration from the prior thirty (30) day patching window and reflects the reality that sophisticated threat actors are increasingly exploiting newly disclosed vulnerabilities within days or even hours of public disclosure. By reducing the patching window to fourteen (14) days, the parties have aligned Palomar's obligations more closely with current industry best practices and the recommendations of the National Institute of Standards and Technology ("NIST") and the Cybersecurity and Infrastructure Security Agency ("CISA").

(ii) Mandatory Endpoint Detection and Response (EDR). Amendment 3 requires Palomar to deploy endpoint detection and response ("EDR") capabilities across its entire network environment, including all servers, workstations, and other endpoints that have access to, or may process, Quorum data. EDR solutions provide continuous monitoring and analysis of endpoint activity, enabling the rapid detection, investigation, and containment of suspicious or malicious activity. The deployment of EDR capabilities is intended to provide an additional layer of defense-in-depth security that would significantly improve Palomar's ability to detect and respond to unauthorized access in the future.

(iii) Quarterly Vulnerability Scanning. Palomar is required to conduct comprehensive vulnerability scans of its network environment on a quarterly basis. The results of each quarterly scan, including identified vulnerabilities and associated remediation plans and timelines, must be reported directly to Quorum's Vice President, Vendor Risk Management, Priya Deshmukh. This requirement provides Quorum with regular, structured visibility into the state of Palomar's vulnerability management practices and enables Quorum to identify and escalate potential security gaps in a timely manner.

(iv) Annual Independent Security Assessment. Palomar is required to engage an independent third-party security assessor, at Palomar's sole expense, to conduct a comprehensive annual security assessment of Palomar's information security program, policies, and controls. The scope of the annual assessment must include, at a minimum, an evaluation of Palomar's patch management processes, access controls, incident response procedures, encryption practices, and network segmentation. The findings of each annual assessment must be reported to Quorum in their entirety, and Palomar is required to develop and implement a remediation plan for any deficiencies identified, subject to Quorum's review and approval.

(v) Enhanced Incident Notification. The incident notification window has been reduced from forty-eight (48) hours to twenty-four (24) hours following Palomar's discovery of any security incident affecting Quorum data. This enhanced notification requirement ensures that Quorum receives timely notice of potential security incidents, enabling Quorum to initiate its own incident response procedures and coordinate with relevant stakeholders—including regulators and affected consumers—without unnecessary delay.

Palomar has committed to implementing the enhanced patch management program and deploying endpoint detection and response capabilities within ninety (90) days of the execution of Amendment 3 on October 27, 2023—that is, by approximately January 25, 2024. Palomar's Chief Technology Officer, Anita Raghavan, has confirmed to Quorum's Chief Information Security Officer, David Naranjo, via correspondence dated October 30, 2023, that the implementation of EDR and the transition to the accelerated fourteen (14) day patch management cycle are actively underway. Palomar has engaged a third-party implementation partner to assist with the EDR deployment, and Palomar has represented that the deployment is progressing on schedule.

The engagement of the independent third-party security assessor is expected to be finalized by year-end 2023. Palomar has indicated that it is currently evaluating proposals from qualified security assessment firms and expects to execute an engagement agreement by mid-December 2023. The first annual comprehensive security assessment is expected to be conducted in the first quarter of 2024.

D. Quorum's Ongoing Vendor Oversight

Quorum's vendor risk management program, which is overseen by Priya Deshmukh, Vice President, Vendor Risk Management, continues to actively monitor Palomar's compliance with the enhanced security obligations imposed by Amendment 3. Ms. Deshmukh's team has established a dedicated monitoring cadence for the Palomar relationship, including regular status updates on the EDR deployment and patch management transition, review of quarterly vulnerability scan reports as they become available, and ongoing dialogue with Palomar's security leadership regarding the implementation timeline and any challenges encountered.

Quorum retains the right to terminate the MSA for cause under Section 14.2 of the MSA in the event that Palomar fails to comply with the enhanced security requirements established by Amendment 3. This termination right provides Quorum with meaningful leverage to enforce Palomar's compliance and serves as an additional safeguard against the risk of recurrence.

IV. Summary of Vendor Accountability Resolution (October 27, 2023 Settlement)

A. Indemnification Claim

Following the completion of the forensic investigation and the determination that Palomar's failure to timely apply the CVE-2023-0669 patch constituted a breach of Palomar's data security obligations under the MSA, Quorum asserted a formal indemnification claim against Palomar under Section 12.2 of the MSA. Section 12.2 obligates Palomar to indemnify, defend, and hold harmless Quorum from and against all losses, damages, liabilities, costs, and expenses (including reasonable attorneys' fees) arising from or relating to Palomar's breach of its data security obligations under the MSA.

Quorum's indemnification claim sought recovery of total incident response costs of $8,230,250, comprising the following categories of expense:

Quorum notes that the total claimed amount of $8,230,250 is well within the contractual indemnification cap under the MSA, which is set at $32,600,000—calculated as two times (2×) the trailing twelve-month fees of $16,300,000. Accordingly, the full amount of Quorum's claim was within the scope of Palomar's indemnification obligations.

B. Negotiation and Settlement Terms

Quorum presented its indemnification demand to Palomar in writing on September 22, 2023. Palomar, through its outside counsel, Mercer, Haight & Dunlop LLP (Partner: Catherine Langford; Associate: Brian Soto), located at 2100 Ross Avenue, Suite 3600, Dallas, Texas 75201, initially disputed certain aspects of the claim, including questions of causation and the appropriate scope of recoverable costs. In its initial response, Palomar offered a goodwill credit of $1,500,000 as a gesture of its commitment to the business relationship. Quorum rejected this offer as inadequate in light of the clear contractual breach, the magnitude of the incident response costs incurred, and the demonstrable causal nexus between Palomar's failure to apply the available patch and the unauthorized access to Quorum data.

Following an extended period of negotiation spanning several weeks, during which the parties exchanged detailed position letters, supporting documentation, and counterproposals, the parties reached a comprehensive resolution. On October 27, 2023, Quorum and Palomar executed a Settlement Agreement and Mutual Release (the "Settlement Agreement"), the key terms of which are as follows:

(a) Cash Payment. Palomar agreed to pay Quorum the sum of $4,200,000 in cash within thirty (30) days of the execution of the Settlement Agreement. This payment is in partial satisfaction of Quorum's indemnification claim and is intended to reimburse Quorum for a substantial portion of the out-of-pocket incident response costs incurred by Quorum as a result of the breach.

(b) Fee Reduction. Palomar agreed to an eighteen (18) month reduction of eight percent (8%) on the annual contract value of $16,300,000, effective November 1, 2023. This fee reduction results in total savings to Quorum of approximately $1,956,000 over the eighteen-month period ($16,300,000 × 8% × 1.5 years = $1,956,000). The fee reduction provides Quorum with ongoing financial relief and serves as an additional form of compensation beyond the initial cash payment.

(c) Independent Security Assessor. As described in Section III.C above, Palomar agreed to engage an independent third-party security assessor, at Palomar's sole expense, to conduct enhanced annual security audits of Palomar's information security program. The cost of these assessments—which is expected to be significant given the scope and rigor of the audits contemplated—is borne entirely by Palomar and represents an additional financial commitment by Palomar beyond the direct monetary terms of the settlement.

(d) Enhanced Security Implementation. As described in Section III.C above, Palomar committed to implementing the enhanced patch management program and endpoint detection and response capabilities within ninety (90) days of the October 27, 2023 agreement.

(e) Mutual Release. The Settlement Agreement includes a mutual release of all claims between the parties arising from or relating to the data security incident. The mutual release enables both parties to move forward with their ongoing business relationship on a stable and constructive footing, while preserving Quorum's rights under the MSA (as amended by Amendment 3) with respect to Palomar's prospective data security obligations.

The effective total recovery by Quorum from Palomar under the settlement is $6,156,000, consisting of $4,200,000 in cash and $1,956,000 in fee reductions. This recovery represents approximately 74.8% of Quorum's total claimed incident response costs of $8,230,250. While the recovery does not represent full reimbursement of all costs incurred, Quorum determined, in the exercise of its business judgment and upon advice of counsel, that the settlement—when considered in its totality, including the significant enhanced security measures and the preservation of the ongoing vendor relationship—represents a reasonable and favorable resolution of the indemnification claim.

A summary of the key terms of the Settlement Agreement is provided in Enclosure 3 to this submission. The full executed Settlement Agreement is available upon request; a summary has been provided in lieu of the full agreement in order to protect commercially sensitive terms that are not directly relevant to the Coalition's inquiry.

C. Significance for Consumer Protection

Quorum respectfully submits that the vendor accountability resolution reached on October 27, 2023 is directly relevant to the Coalition's consumer protection interests in several important respects.

First, the settlement ensures meaningful financial accountability by the vendor whose security failures were the direct and proximate cause of the data security incident. Palomar's total financial commitment under the settlement—$6,156,000 in direct monetary recovery, plus the ongoing costs of independent security assessments and enhanced security implementations—sends a clear signal that vendors who fail to meet their contractual data security obligations will bear the financial consequences of that failure.

Second, the enhanced security measures negotiated through Amendment 3 to the MSA directly address the specific root causes of the breach—namely, the failure to timely apply a critical security patch and the delayed incident notification—and impose structural safeguards designed to significantly reduce the risk of recurrence. These measures, which include accelerated patch management, mandatory endpoint detection and response, quarterly vulnerability scanning, annual independent security assessments, and an enhanced incident notification window, go well beyond the minimum contractual requirements that were in place at the time of the breach and reflect current industry best practices.

Third, Quorum's assertive vendor accountability posture throughout this process—from its initial indemnification demand, through its rejection of Palomar's inadequate initial offer, to the negotiation of the comprehensive settlement and enhanced security measures—demonstrates Quorum's unwavering commitment to protecting policyholder data and holding third-party service providers to rigorous security standards. Quorum understands that the trust of its policyholders and the confidence of regulators depend not only on Quorum's own security practices, but also on Quorum's ability and willingness to enforce robust security requirements throughout its vendor ecosystem.

V. Additional Remediation and Forward-Looking Measures by Quorum

In addition to the vendor-specific remediation measures described in Sections III and IV above, Quorum has undertaken a comprehensive review and enhancement of its own information security program in the wake of the data security incident. While the incident originated within the network environment of a third-party vendor—and not within Quorum's own systems—Quorum recognizes that the incident has highlighted opportunities to further strengthen its own security posture, particularly with respect to third-party risk management. The following summarizes the key post-incident enhancements that Quorum has implemented or is in the process of implementing:

Strengthened Vendor Due Diligence and Onboarding Procedures. Quorum has updated its vendor due diligence and onboarding procedures to incorporate more rigorous security assessments of prospective vendors prior to engagement. These updated procedures include enhanced security questionnaires, requirements for independent security certifications (such as SOC 2 Type II reports), and on-site or virtual security assessments for vendors that will have access to sensitive Quorum data. The updated procedures apply to all new vendor engagements and will be applied to existing critical vendor relationships at the time of contract renewal.

Enhanced Vendor Risk Monitoring and Contractual Security Requirements. Quorum has updated its standard vendor contract templates to incorporate enhanced data security requirements, including accelerated patch management obligations, mandatory endpoint detection and response, quarterly vulnerability scanning and reporting, and enhanced incident notification timelines. These updated contractual requirements are being rolled out across Quorum's vendor portfolio as contracts come up for renewal or amendment. Additionally, Quorum's vendor risk management team has implemented a continuous monitoring program that leverages third-party security rating services and threat intelligence feeds to identify potential security risks within Quorum's vendor ecosystem on a real-time basis.

Updated Incident Response Plan. Quorum has updated its enterprise incident response plan to incorporate lessons learned from the Palomar-related data security incident. The updated plan includes refined escalation procedures, enhanced communication protocols for vendor-originated incidents, updated contact information for regulatory notification authorities across all applicable jurisdictions, and streamlined decision-making procedures for consumer notification and remediation.

Tabletop Exercise Program. Quorum has established a formal tabletop exercise program for data breach scenarios, to be conducted at least semi-annually. These exercises bring together members of Quorum's information security, legal, compliance, privacy, communications, and senior leadership teams to rehearse incident response procedures in a simulated environment. The first tabletop exercise under this program was conducted on October 18, 2023 and included a scenario modeled on a vendor-originated data breach.

Review and Enhancement of Data Minimization Practices. Quorum has undertaken a comprehensive review of its data sharing practices with third-party vendors to identify opportunities to minimize the volume and sensitivity of data shared with vendors. This review is being led by Quorum's Chief Privacy Officer, Jennifer Liang, in coordination with Quorum's information security and business operations teams. The objective of this initiative is to ensure that Quorum shares only the minimum amount of data necessary for each vendor to perform its contracted services, thereby reducing the potential scope of any future data security incident involving a third-party vendor.

Quorum's information security program is overseen by David Naranjo, Chief Information Security Officer, and Jennifer Liang, Chief Privacy Officer. Board-level oversight of Quorum's information security and data privacy programs is provided through the Audit Committee of the Board of Directors, which is chaired by Franklin Reeves. Mr. Naranjo and Ms. Liang provide regular reports to the Audit Committee regarding the status of Quorum's information security program, the results of security assessments and audits, and the progress of post-incident remediation and enhancement initiatives.

VI. Conclusion

Quorum respectfully submits that the information set forth in this submission, together with the information previously provided in Quorum's initial written response and Exhibits A through D, demonstrates Quorum's comprehensive, prompt, and good-faith response to the vendor-originated data security incident. Specifically, Quorum's response has included:

• Timely and Compliant Consumer and Regulatory Notifications. Quorum completed notifications to all 318,247 affected individuals across all twenty-nine (29) affected states and the District of Columbia within a twenty-eight (28) day mailing window, meeting or exceeding all applicable statutory notification deadlines. Three tailored notification letter versions were prepared to address the specific data types compromised for each individual, and jurisdiction-specific versions were prepared for California and Massachusetts.

• Robust Consumer Remediation. Quorum offered all affected individuals twenty-four (24) months of complimentary credit monitoring and identity theft protection services, and approximately forty percent (40%) of eligible individuals have enrolled to date. A dedicated toll-free call center remains operational to assist consumers with enrollment and address inquiries. No reports of confirmed identity theft or financial fraud linked to the incident have been received as of October 31, 2023.

• Meaningful Vendor Financial Accountability. Quorum asserted a comprehensive indemnification claim against Palomar and negotiated a total recovery of $6,156,000, consisting of $4,200,000 in cash and $1,956,000 in fee reductions, representing approximately 74.8% of total claimed incident response costs.

• Enforceable Enhanced Security Measures. Through the execution of Amendment 3 to the MSA, Quorum has imposed significantly enhanced data security obligations on Palomar, including accelerated patch management, mandatory endpoint detection and response, quarterly vulnerability scanning, annual independent security assessments, and an enhanced incident notification window. These measures directly address the root causes of the breach and are designed to substantially reduce the risk of recurrence.

• Proactive Enhancement of Quorum's Own Security Program. Quorum has undertaken a comprehensive review and enhancement of its own information security and vendor risk management programs, including strengthened vendor due diligence, enhanced contractual security requirements, an updated incident response plan, a tabletop exercise program, and a data minimization review.

Quorum remains available and willing to provide any additional information that the Multistate Coalition may require and to respond to any further inquiries from the Coalition's member offices. Quorum's counsel is available to arrange a call or meeting at the Coalition's convenience to discuss any aspect of this submission or the underlying incident.

In light of the vendor-originated nature of the data security incident, Quorum's prompt and comprehensive response, the meaningful vendor accountability resolution achieved, and the absence of confirmed consumer harm, Quorum respectfully requests that the Coalition consider this matter for closure without enforcement action. Quorum believes that its response to this incident—from its initial investigation and notification through its vendor accountability efforts and forward-looking security enhancements—demonstrates the type of responsible, consumer-focused approach that the Coalition's inquiry is designed to promote and encourage.

Quorum appreciates the Coalition's attention to this matter and its commitment to the protection of consumers across the affected jurisdictions. We look forward to the Coalition's response.

Respectfully submitted,

CALDERWOOD & HARKNESS LLP

By: ________

Kevin Ostrowski Partner, Privacy & Data Security Calderwood & Harkness LLP 1700 K Street NW, Suite 900 Washington, D.C. 20006 Telephone: (202) 555-7214

Email: kostrowski@calderwoodharkness.com

On behalf of Quorum Insurance Holdings Corp.

cc (via electronic mail):

Thomas R. Whitfield, General Counsel, Quorum Insurance Holdings Corp.

Jennifer Liang, Chief Privacy Officer, Quorum Insurance Holdings Corp.

Alan Burke, Lead Associate, Calderwood & Harkness LLP

Sara Hendricks, Associate, Calderwood & Harkness LLP

Enclosures:

Enclosure 1: Updated Credit Monitoring Enrollment Statistics Table (as of October 31, 2023)

Enclosure 2: Summary of MSA Amendment 3 — Enhanced Data Security and Audit Provisions (executed October 27, 2023)

Enclosure 3: Settlement Agreement and Mutual Release — Summary of Key Terms (October 27, 2023) (Note: Full executed agreement available upon request; summary provided to protect commercially sensitive terms.)

Metric	Value
Total Eligible Individuals	318,247
Total Enrolled (as of October 31, 2023)	127,299
Enrollment Take-Rate	Approximately 40%
Enrollment Window	24 months from date of individual notification
Enrollment Window Close (earliest)	August 18, 2025
Enrollment Window Close (latest)	September 15, 2025
Cost Category	Provider	Amount
Forensic Investigation	Graystone Forensics LLC	$1,847,000
Notification, Call Center, and Credit Monitoring Services	Clearfield Notification Services LLC	$3,214,500
Crisis Communications	BrightPath Consulting Group Inc.	$385,000
Legal Fees	Calderwood & Harkness LLP	$2,163,750
Internal Costs (IT remediation, employee overtime)	Quorum Insurance Holdings Corp.	$620,000
Total	$8,230,250

PRIVILEGED & CONFIDENTIAL
CALDERWOOD & HARKNESS LLP Attorneys at Law
1700 K Street NW, Suite 900 Washington, D.C. 20006
Telephone: (202) 555-7200 Facsimile: (202) 555-7201 www.calderwoodharkness.com
November 3, 2023
Via Electronic Mail and Certified Mail, Return Receipt Requested
Assistant Attorney General Diane Marchetti Consumer Protection Division Office of the Connecticut Attorney General 165 Capitol Avenue Hartford, CT 06106
Assistant Attorney General Mark Petrosian Bureau of Internet and Technology Office of the New York Attorney General 28 Liberty Street New York, NY 10005
Re: Supplemental Information in Response to Multistate Attorney General Coalition Inquiry Regarding Data Security Incident Involving Quorum Insurance Holdings Corp.
Reference: Multistate Investigation — Quorum Insurance Holdings Corp. Data Security Incident
Reference: Calderwood & Harkness LLP Matter No. 1025-00006
Dear Assistant Attorney General Marchetti and Assistant Attorney General Petrosian:
I. Introduction and Purpose
Calderwood & Harkness LLP submits this letter on behalf of our client, Quorum Insurance Holdings Corp. ("Quorum" or "QIH"), a Delaware corporation publicly traded on the Nasdaq Stock Market (ticker: QIHC), with its principal executive offices located at 400 Constitution Plaza, Suite 2200, Hartford, Connecticut 06103. This submission is made in response to the multistate coalition's request for supplemental information, as communicated to undersigned counsel by email correspondence dated October 20, 2023, following the coalition's review of Quorum's initial written response and the accompanying Exhibits A through D, which were submitted on October 13, 2023.
As the coalition is aware, the original joint demand letter that initiated this inquiry was issued on September 8, 2023, on behalf of a coalition of twenty-nine (29) state attorneys general (the "Multistate Coalition" or the "Coalition"). Quorum's initial response provided a detailed narrative of the data security incident, the timeline of Quorum's investigation and response, the scope and nature of the consumer data compromised, and the remediation measures undertaken to date. The Coalition's subsequent request for supplemental information identified three discrete categories of additional information that the Coalition requires in order to continue its evaluation of this matter. This submission addresses each of those three categories in turn:
1. Updated Credit Monitoring Enrollment Statistics and Consumer Remediation Update. The Coalition requested current data regarding the enrollment rates for complimentary credit monitoring and identity theft protection services offered to affected consumers, as well as an update on consumer complaint volume and any reports of confirmed consumer harm.
2. Confirmation of Palomar Data Solutions, Inc.'s Implementation of Enhanced Security Measures. The Coalition requested confirmation that the third-party vendor responsible for the data security incident—Palomar Data Solutions, Inc. ("Palomar")—has implemented or is in the process of implementing enhanced information security measures to address the root cause of the breach and reduce the risk of recurrence.
3. Summary of the Vendor Accountability Resolution Reached Between Quorum and Palomar. The Coalition requested a summary of the financial and contractual resolution reached between Quorum and Palomar on October 27, 2023, including the terms of financial recovery and the enhanced security obligations imposed upon Palomar as part of that resolution.
Quorum has cooperated fully with the Coalition's inquiry since its inception and remains committed to transparency and good-faith engagement with the Coalition throughout this process. Quorum appreciates the Coalition's diligence in protecting the interests of consumers across the affected jurisdictions and welcomes the opportunity to provide the supplemental information set forth herein.
The responsible partner on this matter is Kevin Ostrowski, Partner in the Privacy & Data Security practice group of Calderwood & Harkness LLP. The lead associate is Alan Burke. All communications regarding this submission should be directed to the undersigned.
II. Updated Credit Monitoring Enrollment Statistics and Consumer Remediation Update
A. Consumer Notification Summary
As described in Quorum's initial written response, Quorum undertook a comprehensive consumer notification effort following its determination that the data security incident resulted in unauthorized access to, and exfiltration of, personally identifiable information ("PII"), financial data, and protected health information ("PHI") pertaining to Quorum policyholders, claimants, and other affected individuals. Consumer notification letters were mailed to all 318,247 affected individuals across twenty-nine (29) states and the District of Columbia. The notification mailing process commenced on August 18, 2023 and was substantially completed by September 15, 2023, encompassing a mailing window of approximately twenty-eight (28) days. This timeline met or exceeded the notification deadlines imposed by all applicable state data breach notification statutes.
Three distinct versions of the notification letter were prepared and deployed, tailored to the specific categories of data compromised with respect to each affected individual:
(i) General PII Version. This version addressed individuals whose compromised data included names, dates of birth, Social Security numbers, and/or driver's license numbers. This version was sent to all 318,247 affected individuals, as each individual's compromised data included at least one element of general PII.
(ii) Enhanced Financial Data Version. This version included all disclosures contained in the General PII version and additionally addressed the compromise of bank account numbers and/or payment card numbers. This version was sent to the subset of 84,619 individuals whose compromised data included financial account information in addition to general PII.
(iii) PHI/HIPAA-Compliant Version. This version included all disclosures contained in the General PII version and additionally addressed the compromise of health conditions, diagnosis codes, and/or treatment information derived from workers' compensation claims and other health-related insurance claims administered by Quorum. This version was prepared in compliance with the notification requirements of the Health Insurance Portability and Accountability Act of 1996, as amended ("HIPAA"), and the Health Information Technology for Economic and Clinical Health Act ("HITECH Act"), and was sent to the subset of 41,203 individuals whose compromised data included PHI.
In addition to the three core versions described above, jurisdiction-specific versions were prepared for the states of California and Massachusetts to ensure compliance with the specific content, formatting, and procedural requirements imposed by those states' data breach notification statutes. The California-specific version was sent to the 38,206 affected individuals residing in California, and the Massachusetts-specific version was sent to the 10,217 affected individuals residing in Massachusetts. Both jurisdiction-specific versions incorporated all required disclosures and were submitted for review and approval by the relevant state regulatory authorities in accordance with applicable procedures.
All versions of the notification letter offered each affected individual twenty-four (24) months of complimentary credit monitoring and identity theft protection services, provided at no cost to the individual. The notification letter included clear instructions for enrollment, a unique activation code for each individual, a dedicated website URL, and a toll-free telephone number for assistance. The availability of these services was prominently featured in the notification letters to ensure maximum consumer awareness and uptake.
B. Credit Monitoring Enrollment Data (as of October 31, 2023)
Credit monitoring and identity theft protection services are being provided through Clearfield Notification Services LLC ("Clearfield"), located at 4500 Rockside Road, Suite 210, Independence, Ohio 44131. The designated account manager for the Quorum engagement at Clearfield is Jerome Tillman. Clearfield is an experienced provider of incident response notification and remediation services and has administered credit monitoring and identity theft protection programs in connection with numerous large-scale data security incidents.
The following table summarizes the current enrollment data as of October 31, 2023:
The enrollment take-rate of approximately forty percent (40%) is consistent with—and, in fact, exceeds—the typical enrollment rates observed in data security incidents of comparable scope and nature. Quorum notes that enrollment remains open and affected individuals may continue to enroll at any time during the twenty-four (24) month enrollment window. Quorum anticipates that additional enrollments will continue to be received over the coming months, and Quorum will continue to facilitate and encourage enrollment through the dedicated call center and website.
A detailed state-by-state breakdown of enrollment statistics is provided in Enclosure 1 to this submission.
C. Call Center Operations Summary
A dedicated toll-free call center was established and became operational on August 18, 2023, coinciding with the commencement of the notification mailing process. The call center is operated by Clearfield Notification Services LLC and is staffed by trained representatives capable of addressing consumer inquiries regarding the data security incident, the categories of data compromised, steps individuals can take to protect themselves, and the process for enrolling in credit monitoring and identity theft protection services.
The call center was designed with a primary twelve (12) week operations window to cover the anticipated period of heaviest consumer inquiry volume immediately following the mailing of notification letters. During this initial twelve-week period—spanning from August 18, 2023 through approximately November 10, 2023—the call center operated with full staffing levels and extended hours of operation to ensure that affected individuals were able to reach a representative in a timely manner. Call volume during this period was highest in the first three weeks following the initial mailing and declined steadily thereafter, consistent with industry experience.
Following the conclusion of the primary twelve-week operations window, the call center will transition to a reduced-staffing model. The reduced-staffing call line will continue to accept calls and assist consumers with enrollment in credit monitoring services, address inquiries regarding the incident, and provide guidance to individuals who believe they may have experienced identity theft or fraud. The reduced-staffing line is expected to remain operational throughout the duration of the twenty-four (24) month credit monitoring enrollment period.
In addition to general inquiry handling, the call center has established escalation procedures for individuals who report suspected identity theft or financial fraud potentially related to the data security incident. Such reports are escalated to a senior representative, documented, and forwarded to Quorum's incident response team for tracking, investigation, and coordination with law enforcement as appropriate.
D. Consumer Complaints
Quorum has closely monitored consumer complaint volume throughout the notification and remediation process. As of October 31, 2023, the total volume of consumer complaints received by Quorum and Clearfield remains low relative to the total number of affected individuals. The majority of complaints received relate to general inquiries about the incident, requests for additional information regarding the scope of data compromised, and logistical questions regarding the credit monitoring enrollment process. A smaller number of complaints relate to delays in the receipt of notification letters, difficulties with the online enrollment process, or requests for additional remediation beyond the credit monitoring services offered.
Critically, as of October 31, 2023, Quorum has received no reports of confirmed identity theft or financial fraud that have been linked to the data security incident. While Quorum recognizes that the absence of confirmed harm to date does not eliminate the possibility of future harm—and, accordingly, Quorum remains vigilant in its monitoring and response efforts—the absence of confirmed harm is a meaningful indicator that the incident has not, to date, resulted in the type of downstream consumer injury that would be of greatest concern to the Coalition. Quorum will continue to track and document any reports of suspected or confirmed identity theft or fraud received through the call center, direct consumer correspondence, or other channels, and will promptly notify the Coalition should any such reports be confirmed.
III. Confirmation of Palomar Data Solutions Enhanced Security Measures
A. Background on the Vendor Relationship
As detailed in Quorum's initial written response, the data security incident originated not within Quorum's own network environment, but within the network environment of Quorum's third-party claims data processing vendor, Palomar Data Solutions, Inc. ("Palomar"). Palomar is a Texas corporation headquartered at 7100 Greenville Avenue, Suite 450, Dallas, Texas 75231. Palomar provides claims data processing, intake, and management services to Quorum pursuant to a Master Services Agreement dated November 12, 2019, as subsequently amended (the "MSA"). Palomar is Quorum's second-largest vendor by annual contract value, with an annual contract value of approximately $16.3 million per year following the execution of Amendment 1 to the MSA, which became effective on April 1, 2021.
The data breach was caused by the exploitation of CVE-2023-0669, a critical remote code execution vulnerability affecting the GoAnywhere MFT managed file transfer appliance deployed within Palomar's network infrastructure. GoAnywhere MFT is a widely used enterprise file transfer solution that Palomar utilized to receive, process, and transmit claims data files on behalf of Quorum and other clients. The exploitation of CVE-2023-0669 enabled the threat actor to gain unauthorized access to Palomar's file transfer environment and, through that access, to exfiltrate files containing PII, financial data, and PHI pertaining to Quorum policyholders and claimants.
Based on the forensic investigation conducted by Graystone Forensics LLC ("Graystone"), the unauthorized access commenced on approximately March 14, 2023 and continued through approximately April 18, 2023—a period of approximately thirty-five (35) days. Graystone's forensic analysis confirmed that the threat actor leveraged the CVE-2023-0669 vulnerability to establish a persistent foothold within Palomar's GoAnywhere MFT environment and to stage and exfiltrate data files over the course of the intrusion period.
B. Root Cause and Palomar's Contractual Obligations
The root cause of the data security incident was Palomar's failure to timely apply a vendor-issued security patch for CVE-2023-0669. A patch addressing CVE-2023-0669 was made available by the GoAnywhere MFT software vendor prior to the date on which the threat actor first exploited the vulnerability in Palomar's environment. Under the terms of the MSA—specifically, Exhibit D (Data Security Exhibit), as amended by Amendment 2 to the MSA dated September 15, 2022—Palomar was contractually required to apply patches for critical vulnerabilities within thirty (30) days of the vendor patch release date. Palomar failed to comply with this contractual obligation, and the unpatched vulnerability was exploited by the threat actor before Palomar remediated the vulnerability.
In addition to the patch management failure, Quorum's investigation determined that Palomar's notification to Quorum of the security incident was untimely under the terms of the MSA. Section 9.4 of the MSA requires Palomar to provide written notification to Quorum of any security incident affecting Quorum data within forty-eight (48) hours of Palomar's discovery of such incident. Palomar discovered the unauthorized access on or about April 19, 2023, but did not provide written notification to Quorum until April 21, 2023—approximately twenty-four (24) hours beyond the contractually mandated notification window. While this delay did not have a material impact on the ultimate scope of the incident (as the exfiltration had already concluded before Palomar's discovery), the late notification constituted a separate breach of Palomar's obligations under the MSA and underscored the need for enhanced incident notification protocols.
C. Enhanced Security Measures Implemented or Underway
As part of the broader resolution between Quorum and Palomar, the parties executed Amendment 3 to the MSA on October 27, 2023. Amendment 3 imposes a significantly enhanced set of data security requirements on Palomar, designed to address the specific root causes of the breach, strengthen Palomar's overall information security posture, and provide Quorum with greater visibility into Palomar's security practices on an ongoing basis. The key provisions of Amendment 3 are summarized below:
(i) Accelerated Patch Management. Palomar is now required to apply patches for critical vulnerabilities within fourteen (14) calendar days of the vendor patch release date. This requirement represents a significant acceleration from the prior thirty (30) day patching window and reflects the reality that sophisticated threat actors are increasingly exploiting newly disclosed vulnerabilities within days or even hours of public disclosure. By reducing the patching window to fourteen (14) days, the parties have aligned Palomar's obligations more closely with current industry best practices and the recommendations of the National Institute of Standards and Technology ("NIST") and the Cybersecurity and Infrastructure Security Agency ("CISA").
(ii) Mandatory Endpoint Detection and Response (EDR). Amendment 3 requires Palomar to deploy endpoint detection and response ("EDR") capabilities across its entire network environment, including all servers, workstations, and other endpoints that have access to, or may process, Quorum data. EDR solutions provide continuous monitoring and analysis of endpoint activity, enabling the rapid detection, investigation, and containment of suspicious or malicious activity. The deployment of EDR capabilities is intended to provide an additional layer of defense-in-depth security that would significantly improve Palomar's ability to detect and respond to unauthorized access in the future.
(iii) Quarterly Vulnerability Scanning. Palomar is required to conduct comprehensive vulnerability scans of its network environment on a quarterly basis. The results of each quarterly scan, including identified vulnerabilities and associated remediation plans and timelines, must be reported directly to Quorum's Vice President, Vendor Risk Management, Priya Deshmukh. This requirement provides Quorum with regular, structured visibility into the state of Palomar's vulnerability management practices and enables Quorum to identify and escalate potential security gaps in a timely manner.
(iv) Annual Independent Security Assessment. Palomar is required to engage an independent third-party security assessor, at Palomar's sole expense, to conduct a comprehensive annual security assessment of Palomar's information security program, policies, and controls. The scope of the annual assessment must include, at a minimum, an evaluation of Palomar's patch management processes, access controls, incident response procedures, encryption practices, and network segmentation. The findings of each annual assessment must be reported to Quorum in their entirety, and Palomar is required to develop and implement a remediation plan for any deficiencies identified, subject to Quorum's review and approval.
(v) Enhanced Incident Notification. The incident notification window has been reduced from forty-eight (48) hours to twenty-four (24) hours following Palomar's discovery of any security incident affecting Quorum data. This enhanced notification requirement ensures that Quorum receives timely notice of potential security incidents, enabling Quorum to initiate its own incident response procedures and coordinate with relevant stakeholders—including regulators and affected consumers—without unnecessary delay.
Palomar has committed to implementing the enhanced patch management program and deploying endpoint detection and response capabilities within ninety (90) days of the execution of Amendment 3 on October 27, 2023—that is, by approximately January 25, 2024. Palomar's Chief Technology Officer, Anita Raghavan, has confirmed to Quorum's Chief Information Security Officer, David Naranjo, via correspondence dated October 30, 2023, that the implementation of EDR and the transition to the accelerated fourteen (14) day patch management cycle are actively underway. Palomar has engaged a third-party implementation partner to assist with the EDR deployment, and Palomar has represented that the deployment is progressing on schedule.
The engagement of the independent third-party security assessor is expected to be finalized by year-end 2023. Palomar has indicated that it is currently evaluating proposals from qualified security assessment firms and expects to execute an engagement agreement by mid-December 2023. The first annual comprehensive security assessment is expected to be conducted in the first quarter of 2024.
D. Quorum's Ongoing Vendor Oversight
Quorum's vendor risk management program, which is overseen by Priya Deshmukh, Vice President, Vendor Risk Management, continues to actively monitor Palomar's compliance with the enhanced security obligations imposed by Amendment 3. Ms. Deshmukh's team has established a dedicated monitoring cadence for the Palomar relationship, including regular status updates on the EDR deployment and patch management transition, review of quarterly vulnerability scan reports as they become available, and ongoing dialogue with Palomar's security leadership regarding the implementation timeline and any challenges encountered.
Quorum retains the right to terminate the MSA for cause under Section 14.2 of the MSA in the event that Palomar fails to comply with the enhanced security requirements established by Amendment 3. This termination right provides Quorum with meaningful leverage to enforce Palomar's compliance and serves as an additional safeguard against the risk of recurrence.
IV. Summary of Vendor Accountability Resolution (October 27, 2023 Settlement)
A. Indemnification Claim
Following the completion of the forensic investigation and the determination that Palomar's failure to timely apply the CVE-2023-0669 patch constituted a breach of Palomar's data security obligations under the MSA, Quorum asserted a formal indemnification claim against Palomar under Section 12.2 of the MSA. Section 12.2 obligates Palomar to indemnify, defend, and hold harmless Quorum from and against all losses, damages, liabilities, costs, and expenses (including reasonable attorneys' fees) arising from or relating to Palomar's breach of its data security obligations under the MSA.
Quorum's indemnification claim sought recovery of total incident response costs of $8,230,250, comprising the following categories of expense:
Quorum notes that the total claimed amount of $8,230,250 is well within the contractual indemnification cap under the MSA, which is set at $32,600,000—calculated as two times (2×) the trailing twelve-month fees of $16,300,000. Accordingly, the full amount of Quorum's claim was within the scope of Palomar's indemnification obligations.
B. Negotiation and Settlement Terms
Quorum presented its indemnification demand to Palomar in writing on September 22, 2023. Palomar, through its outside counsel, Mercer, Haight & Dunlop LLP (Partner: Catherine Langford; Associate: Brian Soto), located at 2100 Ross Avenue, Suite 3600, Dallas, Texas 75201, initially disputed certain aspects of the claim, including questions of causation and the appropriate scope of recoverable costs. In its initial response, Palomar offered a goodwill credit of $1,500,000 as a gesture of its commitment to the business relationship. Quorum rejected this offer as inadequate in light of the clear contractual breach, the magnitude of the incident response costs incurred, and the demonstrable causal nexus between Palomar's failure to apply the available patch and the unauthorized access to Quorum data.
Following an extended period of negotiation spanning several weeks, during which the parties exchanged detailed position letters, supporting documentation, and counterproposals, the parties reached a comprehensive resolution. On October 27, 2023, Quorum and Palomar executed a Settlement Agreement and Mutual Release (the "Settlement Agreement"), the key terms of which are as follows:
(a) Cash Payment. Palomar agreed to pay Quorum the sum of $4,200,000 in cash within thirty (30) days of the execution of the Settlement Agreement. This payment is in partial satisfaction of Quorum's indemnification claim and is intended to reimburse Quorum for a substantial portion of the out-of-pocket incident response costs incurred by Quorum as a result of the breach.
(b) Fee Reduction. Palomar agreed to an eighteen (18) month reduction of eight percent (8%) on the annual contract value of $16,300,000, effective November 1, 2023. This fee reduction results in total savings to Quorum of approximately $1,956,000 over the eighteen-month period ($16,300,000 × 8% × 1.5 years = $1,956,000). The fee reduction provides Quorum with ongoing financial relief and serves as an additional form of compensation beyond the initial cash payment.
(c) Independent Security Assessor. As described in Section III.C above, Palomar agreed to engage an independent third-party security assessor, at Palomar's sole expense, to conduct enhanced annual security audits of Palomar's information security program. The cost of these assessments—which is expected to be significant given the scope and rigor of the audits contemplated—is borne entirely by Palomar and represents an additional financial commitment by Palomar beyond the direct monetary terms of the settlement.
(d) Enhanced Security Implementation. As described in Section III.C above, Palomar committed to implementing the enhanced patch management program and endpoint detection and response capabilities within ninety (90) days of the October 27, 2023 agreement.
(e) Mutual Release. The Settlement Agreement includes a mutual release of all claims between the parties arising from or relating to the data security incident. The mutual release enables both parties to move forward with their ongoing business relationship on a stable and constructive footing, while preserving Quorum's rights under the MSA (as amended by Amendment 3) with respect to Palomar's prospective data security obligations.
The effective total recovery by Quorum from Palomar under the settlement is $6,156,000, consisting of $4,200,000 in cash and $1,956,000 in fee reductions. This recovery represents approximately 74.8% of Quorum's total claimed incident response costs of $8,230,250. While the recovery does not represent full reimbursement of all costs incurred, Quorum determined, in the exercise of its business judgment and upon advice of counsel, that the settlement—when considered in its totality, including the significant enhanced security measures and the preservation of the ongoing vendor relationship—represents a reasonable and favorable resolution of the indemnification claim.
A summary of the key terms of the Settlement Agreement is provided in Enclosure 3 to this submission. The full executed Settlement Agreement is available upon request; a summary has been provided in lieu of the full agreement in order to protect commercially sensitive terms that are not directly relevant to the Coalition's inquiry.
C. Significance for Consumer Protection
Quorum respectfully submits that the vendor accountability resolution reached on October 27, 2023 is directly relevant to the Coalition's consumer protection interests in several important respects.
First, the settlement ensures meaningful financial accountability by the vendor whose security failures were the direct and proximate cause of the data security incident. Palomar's total financial commitment under the settlement—$6,156,000 in direct monetary recovery, plus the ongoing costs of independent security assessments and enhanced security implementations—sends a clear signal that vendors who fail to meet their contractual data security obligations will bear the financial consequences of that failure.
Second, the enhanced security measures negotiated through Amendment 3 to the MSA directly address the specific root causes of the breach—namely, the failure to timely apply a critical security patch and the delayed incident notification—and impose structural safeguards designed to significantly reduce the risk of recurrence. These measures, which include accelerated patch management, mandatory endpoint detection and response, quarterly vulnerability scanning, annual independent security assessments, and an enhanced incident notification window, go well beyond the minimum contractual requirements that were in place at the time of the breach and reflect current industry best practices.
Third, Quorum's assertive vendor accountability posture throughout this process—from its initial indemnification demand, through its rejection of Palomar's inadequate initial offer, to the negotiation of the comprehensive settlement and enhanced security measures—demonstrates Quorum's unwavering commitment to protecting policyholder data and holding third-party service providers to rigorous security standards. Quorum understands that the trust of its policyholders and the confidence of regulators depend not only on Quorum's own security practices, but also on Quorum's ability and willingness to enforce robust security requirements throughout its vendor ecosystem.
V. Additional Remediation and Forward-Looking Measures by Quorum
In addition to the vendor-specific remediation measures described in Sections III and IV above, Quorum has undertaken a comprehensive review and enhancement of its own information security program in the wake of the data security incident. While the incident originated within the network environment of a third-party vendor—and not within Quorum's own systems—Quorum recognizes that the incident has highlighted opportunities to further strengthen its own security posture, particularly with respect to third-party risk management. The following summarizes the key post-incident enhancements that Quorum has implemented or is in the process of implementing:
Strengthened Vendor Due Diligence and Onboarding Procedures. Quorum has updated its vendor due diligence and onboarding procedures to incorporate more rigorous security assessments of prospective vendors prior to engagement. These updated procedures include enhanced security questionnaires, requirements for independent security certifications (such as SOC 2 Type II reports), and on-site or virtual security assessments for vendors that will have access to sensitive Quorum data. The updated procedures apply to all new vendor engagements and will be applied to existing critical vendor relationships at the time of contract renewal.
Enhanced Vendor Risk Monitoring and Contractual Security Requirements. Quorum has updated its standard vendor contract templates to incorporate enhanced data security requirements, including accelerated patch management obligations, mandatory endpoint detection and response, quarterly vulnerability scanning and reporting, and enhanced incident notification timelines. These updated contractual requirements are being rolled out across Quorum's vendor portfolio as contracts come up for renewal or amendment. Additionally, Quorum's vendor risk management team has implemented a continuous monitoring program that leverages third-party security rating services and threat intelligence feeds to identify potential security risks within Quorum's vendor ecosystem on a real-time basis.
Updated Incident Response Plan. Quorum has updated its enterprise incident response plan to incorporate lessons learned from the Palomar-related data security incident. The updated plan includes refined escalation procedures, enhanced communication protocols for vendor-originated incidents, updated contact information for regulatory notification authorities across all applicable jurisdictions, and streamlined decision-making procedures for consumer notification and remediation.
Tabletop Exercise Program. Quorum has established a formal tabletop exercise program for data breach scenarios, to be conducted at least semi-annually. These exercises bring together members of Quorum's information security, legal, compliance, privacy, communications, and senior leadership teams to rehearse incident response procedures in a simulated environment. The first tabletop exercise under this program was conducted on October 18, 2023 and included a scenario modeled on a vendor-originated data breach.
Review and Enhancement of Data Minimization Practices. Quorum has undertaken a comprehensive review of its data sharing practices with third-party vendors to identify opportunities to minimize the volume and sensitivity of data shared with vendors. This review is being led by Quorum's Chief Privacy Officer, Jennifer Liang, in coordination with Quorum's information security and business operations teams. The objective of this initiative is to ensure that Quorum shares only the minimum amount of data necessary for each vendor to perform its contracted services, thereby reducing the potential scope of any future data security incident involving a third-party vendor.
Quorum's information security program is overseen by David Naranjo, Chief Information Security Officer, and Jennifer Liang, Chief Privacy Officer. Board-level oversight of Quorum's information security and data privacy programs is provided through the Audit Committee of the Board of Directors, which is chaired by Franklin Reeves. Mr. Naranjo and Ms. Liang provide regular reports to the Audit Committee regarding the status of Quorum's information security program, the results of security assessments and audits, and the progress of post-incident remediation and enhancement initiatives.
VI. Conclusion
Quorum respectfully submits that the information set forth in this submission, together with the information previously provided in Quorum's initial written response and Exhibits A through D, demonstrates Quorum's comprehensive, prompt, and good-faith response to the vendor-originated data security incident. Specifically, Quorum's response has included:
• Timely and Compliant Consumer and Regulatory Notifications. Quorum completed notifications to all 318,247 affected individuals across all twenty-nine (29) affected states and the District of Columbia within a twenty-eight (28) day mailing window, meeting or exceeding all applicable statutory notification deadlines. Three tailored notification letter versions were prepared to address the specific data types compromised for each individual, and jurisdiction-specific versions were prepared for California and Massachusetts.
• Robust Consumer Remediation. Quorum offered all affected individuals twenty-four (24) months of complimentary credit monitoring and identity theft protection services, and approximately forty percent (40%) of eligible individuals have enrolled to date. A dedicated toll-free call center remains operational to assist consumers with enrollment and address inquiries. No reports of confirmed identity theft or financial fraud linked to the incident have been received as of October 31, 2023.
• Meaningful Vendor Financial Accountability. Quorum asserted a comprehensive indemnification claim against Palomar and negotiated a total recovery of $6,156,000, consisting of $4,200,000 in cash and $1,956,000 in fee reductions, representing approximately 74.8% of total claimed incident response costs.
• Enforceable Enhanced Security Measures. Through the execution of Amendment 3 to the MSA, Quorum has imposed significantly enhanced data security obligations on Palomar, including accelerated patch management, mandatory endpoint detection and response, quarterly vulnerability scanning, annual independent security assessments, and an enhanced incident notification window. These measures directly address the root causes of the breach and are designed to substantially reduce the risk of recurrence.
• Proactive Enhancement of Quorum's Own Security Program. Quorum has undertaken a comprehensive review and enhancement of its own information security and vendor risk management programs, including strengthened vendor due diligence, enhanced contractual security requirements, an updated incident response plan, a tabletop exercise program, and a data minimization review.
Quorum remains available and willing to provide any additional information that the Multistate Coalition may require and to respond to any further inquiries from the Coalition's member offices. Quorum's counsel is available to arrange a call or meeting at the Coalition's convenience to discuss any aspect of this submission or the underlying incident.
In light of the vendor-originated nature of the data security incident, Quorum's prompt and comprehensive response, the meaningful vendor accountability resolution achieved, and the absence of confirmed consumer harm, Quorum respectfully requests that the Coalition consider this matter for closure without enforcement action. Quorum believes that its response to this incident—from its initial investigation and notification through its vendor accountability efforts and forward-looking security enhancements—demonstrates the type of responsible, consumer-focused approach that the Coalition's inquiry is designed to promote and encourage.
Quorum appreciates the Coalition's attention to this matter and its commitment to the protection of consumers across the affected jurisdictions. We look forward to the Coalition's response.
Respectfully submitted,
CALDERWOOD & HARKNESS LLP
By: ________
Kevin Ostrowski Partner, Privacy & Data Security Calderwood & Harkness LLP 1700 K Street NW, Suite 900 Washington, D.C. 20006 Telephone: (202) 555-7214
Email: kostrowski@calderwoodharkness.com
On behalf of Quorum Insurance Holdings Corp.
cc (via electronic mail):
Thomas R. Whitfield, General Counsel, Quorum Insurance Holdings Corp.
Jennifer Liang, Chief Privacy Officer, Quorum Insurance Holdings Corp.
Alan Burke, Lead Associate, Calderwood & Harkness LLP
Sara Hendricks, Associate, Calderwood & Harkness LLP
Enclosures:
Enclosure 1: Updated Credit Monitoring Enrollment Statistics Table (as of October 31, 2023)
Enclosure 2: Summary of MSA Amendment 3 — Enhanced Data Security and Audit Provisions (executed October 27, 2023)
Enclosure 3: Settlement Agreement and Mutual Release — Summary of Key Terms (October 27, 2023) (Note: Full executed agreement available upon request; summary provided to protect commercially sensitive terms.)
Metric | Value
Total Eligible Individuals | 318,247
Total Enrolled (as of October 31, 2023) | 127,299
Enrollment Take-Rate | Approximately 40%
Enrollment Window | 24 months from date of individual notification
Enrollment Window Close (earliest) | August 18, 2025
Enrollment Window Close (latest) | September 15, 2025
Cost Category | Provider | Amount
Forensic Investigation | Graystone Forensics LLC | $1,847,000
Notification, Call Center, and Credit Monitoring Services | Clearfield Notification Services LLC | $3,214,500
Crisis Communications | BrightPath Consulting Group Inc. | $385,000
Legal Fees | Calderwood & Harkness LLP | $2,163,750
Internal Costs (IT remediation, employee overtime) | Quorum Insurance Holdings Corp. | $620,000
Total | $8,230,250

PRIVILEGED & CONFIDENTIAL

CALDERWOOD & HARKNESS LLP

Record

Parties

Dates

Amounts