REGULATORY BREACH NOTIFICATION FILING
STATE OF CALIFORNIA — OFFICE OF THE ATTORNEY GENERAL
Sample Copy of Consumer Notification Pursuant to California Civil Code § 1798.82(f)
Filed on Behalf of Quorum Insurance Holdings Corp. by Calderwood & Harkness LLP
August 16, 2023
Right-click to update Table of Contents
PART I: COVER LETTER TO THE CALIFORNIA ATTORNEY GENERAL
August 16, 2023
Calderwood & Harkness LLP 1700 K Street NW, Suite 900 Washington, D.C. 20006
Office of the Attorney General State of California Bureau of Privacy 300 South Spring Street, Suite 1702 Los Angeles, CA 90013
Re: Data Breach Notification Pursuant to California Civil Code § 1798.82 — Quorum Insurance Holdings Corp.
Dear Attorney General Bonta:
1.1 Introduction and Purpose of Filing
Calderwood & Harkness LLP respectfully submits this notification on behalf of its client, Quorum Insurance Holdings Corp. ("Quorum" or "QIH"), a Delaware corporation publicly traded on the Nasdaq Stock Market (ticker symbol: QIHC), with its principal executive offices located at 400 Constitution Plaza, Suite 2200, Hartford, Connecticut 06103. This filing is made pursuant to California Civil Code § 1798.82(f), which requires that any person or business required to issue a security breach notification to more than five hundred (500) California residents must electronically submit a single sample copy of the notification to the Attorney General.
As set forth in detail below, a data security incident involving a third-party vendor retained by Quorum resulted in the unauthorized acquisition of personal information belonging to certain Quorum policyholders and claimants. The investigation into this incident has determined that the personal information of thirty-eight thousand two hundred six (38,206) California residents was potentially compromised. Because the number of affected California residents exceeds the five hundred (500) person threshold established under Section 1798.82(f), Quorum is submitting this filing, together with sample copies of the consumer notification letters that are being mailed to affected California residents, to the Office of the Attorney General.
Quorum's Federal Employer Identification Number (EIN) is 06-4832197.
For any questions or inquiries regarding this filing or the underlying data security incident, the designated contact person is:
Kevin Ostrowski, Esq. Partner, Privacy & Data Security Practice Group Calderwood & Harkness LLP 1700 K Street NW, Suite 900 Washington, D.C. 20006 Telephone: (202) 555-4120
Email: kostrowski@calderwoodharkness.com
1.2 Description of the Reporting Entity
Quorum Insurance Holdings Corp. is a top-25 United States insurance holding company offering a diversified portfolio of insurance and financial products, including personal and commercial lines property and casualty insurance, specialty insurance (including professional liability, directors and officers liability, and cyber liability), life insurance, and annuity products. Quorum also operates a proprietary digital underwriting platform known as QuorumEdge, which leverages advanced data analytics and machine learning capabilities to support risk assessment and policy pricing across its business lines.
For fiscal year 2022, Quorum reported consolidated annual revenues of approximately $4.82 billion. The company employs approximately 11,400 individuals across its domestic and international operations. As of May 2023, Quorum's market capitalization was approximately $6.1 billion.
The following individuals serve in key leadership roles relevant to this filing:
• Chief Executive Officer: Margaret D. Calloway
• General Counsel: Thomas R. Whitfield
• Chief Privacy Officer: Jennifer Liang
• Chief Information Security Officer: David Naranjo
Quorum operates through various wholly owned subsidiaries licensed to conduct insurance business in all fifty states, the District of Columbia, and certain U.S. territories. Quorum maintains a significant presence in California, where it serves a substantial number of policyholders and claimants across its personal lines, commercial lines, specialty, life, and annuity business segments. Quorum's California-based insurance subsidiary, Quorum Insurance Company of California, is domiciled in California and regulated by the California Department of Insurance.
1.3 Description of the Incident
On or about March 14, 2023, a sophisticated threat actor gained unauthorized access to the computer network of Palomar Data Solutions, Inc. ("Palomar"), a third-party claims-processing vendor retained by Quorum pursuant to a Master Services Agreement dated November 12, 2019 (as subsequently amended on April 15, 2021 and January 8, 2023) (the "MSA"). Palomar is a Texas corporation headquartered at 7100 Greenville Avenue, Suite 450, Dallas, Texas 75231. Under the terms of the MSA, Palomar provides claims data processing, document management, data storage, and analytics services to Quorum and certain of its insurance carrier subsidiaries. As part of these services, Palomar receives, processes, and stores personal information of Quorum policyholders and claimants, including California residents.
Based on the forensic investigation described below, the threat actor gained initial access to Palomar's network by exploiting a known remote code execution vulnerability in Palomar's GoAnywhere Managed File Transfer (MFT) appliance. This vulnerability has been publicly catalogued as CVE-2023-0669 and was the subject of a security advisory issued by the software vendor, Westmark Data Systems, on February 1, 2023. The vulnerability allows an unauthenticated remote attacker to execute arbitrary code on affected systems. Despite the availability of a patch released by Severin Corporation on February 7, 2023, Palomar had not applied the remediation patch to its GoAnywhere MFT appliance at the time the threat actor exploited the vulnerability on or about March 14, 2023 — a delay of approximately thirty-five (35) days following the patch's availability and well outside the thirty (30) calendar day patching window required under Section 7.4(c) of the MSA.
Following the initial compromise, the threat actor conducted lateral movement within Palomar's network environment over an approximately thirty-five (35) day period from on or about March 14, 2023 through approximately April 18, 2023. During this period, the threat actor identified and exfiltrated structured data files from Palomar's claims processing databases and file servers. The exfiltrated data included files containing personal information of Quorum policyholders and claimants across multiple states.
On April 18, 2023, Palomar's Security Operations Center ("SOC") detected anomalous outbound data transfer activity during a routine review of network traffic logs. Palomar's SOC initiated containment procedures and engaged its own incident response resources to begin an initial assessment of the scope and nature of the unauthorized activity.
On April 21, 2023, Palomar formally notified Quorum of the security incident. The notification was transmitted via email from Derek Copeland, General Counsel of Palomar Data Solutions, Inc., to Thomas R. Whitfield, General Counsel of Quorum Insurance Holdings Corp., and David Naranjo, Chief Information Security Officer of Quorum Insurance Holdings Corp. Quorum notes that the MSA required Palomar to provide notice of any security incident "without unreasonable delay, and in any event within twenty-four (24) hours of discovery." Palomar's discovery of the anomalous activity occurred on April 18, 2023, and its formal notification to Quorum was not transmitted until April 21, 2023 — approximately seventy-two (72) hours after discovery, which constitutes an approximately twenty-four (24) hour delay beyond the contractually stipulated forty-eight (48) hour outer limit, accounting for the reasonable time needed for preliminary assessment.
Upon receipt of Palomar's notification, Quorum promptly activated its enterprise-wide incident response plan. On May 4, 2023, Quorum engaged Calderwood & Harkness LLP as outside counsel to provide legal advice regarding the incident, including regulatory compliance, consumer notification obligations, and vendor accountability. On May 5, 2023, at the direction and under the supervision of Calderwood & Harkness LLP, Quorum retained Graystone Forensics LLC ("Graystone") to conduct a comprehensive forensic investigation of the incident. The engagement of Graystone under the attorney-client privilege umbrella was designed to ensure that the forensic findings would be protected by the attorney work product doctrine and the attorney-client privilege to the maximum extent permitted by law.
The Graystone forensic investigation was led by Dr. Nolan Briggs, Managing Director, Incident Response, and Kendra Faulkner, Senior Forensic Analyst. Graystone issued a preliminary findings report on June 2, 2023, which confirmed that structured data files containing personal information of Quorum policyholders and claimants had been exfiltrated from Palomar's network during the intrusion period. The preliminary report identified the CVE-2023-0669 vulnerability as the initial attack vector, confirmed lateral movement within the Palomar network, and provided an initial estimate of the volume of data exfiltrated.
Graystone's final forensic report was issued on July 14, 2023. The final report confirmed the full scope of the data compromise, including the specific data elements acquired by the threat actor, the number of affected individuals, and the state-by-state distribution of affected persons. Following receipt of the final forensic report, Quorum engaged in an intensive data mining and individual identification process to match compromised records to specific individuals and their current mailing addresses. This data mining and identification process was completed on August 4, 2023.
1.4 Information Compromised
Based on the findings of the Graystone forensic investigation and the subsequent data mining and identification process, Quorum has determined that the following categories of personal information pertaining to California residents were contained in the files potentially acquired by the unauthorized threat actor:
Personally Identifiable Information (PII): Full legal names, dates of birth, Social Security numbers, and driver's license numbers. This category of information was present for all 38,206 California residents identified in the compromised data set.
Financial Information: Bank account numbers and/or payment card numbers (including debit card numbers associated with checking or savings accounts). This category of information was compromised for a subset of the 38,206 affected California residents. Nationally, 84,619 individuals across all affected states had financial information exposed in the breach, and a proportional subset of those individuals reside in California.
Medical/Health Information: Health conditions, diagnosis codes (including ICD-10 codes), and treatment information derived from workers' compensation claims and health-related insurance claims processed by Palomar on behalf of Quorum. This category of information was compromised for a subset of the 38,206 affected California residents. Nationally, 41,203 individuals across all affected states had protected health information ("PHI") exposed in the breach, and a proportional subset of those individuals reside in California. This information constitutes both "medical information" as defined under the California Confidentiality of Medical Information Act ("CMIA"), California Civil Code § 56 et seq., and "protected health information" as defined under the Health Insurance Portability and Accountability Act of 1996 ("HIPAA"), 45 C.F.R. § 160.103.
In total, the breach compromised personal information pertaining to 318,247 individuals across twenty-nine (29) states and the District of Columbia. Of those individuals, 38,206 are California residents.
1.5 Total Number of California Residents Affected
As noted above, a total of thirty-eight thousand two hundred six (38,206) California residents are being notified of this breach. California represents the third-largest affected state population, after Connecticut (52,114 affected individuals) and New York (47,831 affected individuals). This total is based on the comprehensive data mining and individual identification process completed on August 4, 2023, and may be subject to minor adjustments as returned mail is processed and address verification is completed.
1.6 Timing of Notification
Consumer notification letters to affected California residents are scheduled to begin mailing on August 18, 2023. The full mailing for all 318,247 affected individuals nationwide, including all California residents, will be completed by approximately September 15, 2023. Notifications are being printed, assembled, and mailed by Clearfield Notification Services LLC ("Clearfield"), a professional breach notification and remediation services vendor engaged by Quorum specifically for this purpose. Clearfield has extensive experience managing large-scale consumer breach notification projects and has been retained to ensure the timely, accurate, and compliant delivery of all notification letters.
This Attorney General notification is being filed on August 16, 2023, two (2) days in advance of the commencement of the consumer mailing, to ensure that the Office of the Attorney General receives the sample notification prior to or contemporaneously with the mailing of notices to affected California residents.
1.7 Description of the Notification Process
Affected California residents are being notified by means of written notification sent via first-class U.S. mail to their last known mailing address, as identified through Quorum's records, supplemented by address verification services provided by Clearfield.
The notification letters have been tailored to reflect the specific categories of personal information compromised for each affected individual. Three distinct letter variants have been prepared for California residents:
1. General PII Version — for California residents whose full name, date of birth, Social Security number, and/or driver's license number were compromised, but whose financial or medical/health information was not compromised.
2. Financial Data Variant — for California residents whose general PII was compromised along with bank account numbers and/or payment card numbers.
3. PHI/CMIA Variant — for California residents whose general PII was compromised along with medical/health information (health conditions, diagnosis codes, and/or treatment information). This variant includes content elements required under both HIPAA and the California Confidentiality of Medical Information Act.
A California-specific version of each notification letter variant has been prepared to comply with the content and format requirements of California Civil Code § 1798.82(d), including the prescribed headings and content sections. Sample copies of each variant are enclosed with this filing as Enclosures 1, 2, and 3.
For affected California residents whose PHI was compromised, the notification letter also includes content elements required under the HIPAA Breach Notification Rule, 45 C.F.R. § 164.404(c), as well as language addressing the recipient's rights under the CMIA.
In addition to the individual written notifications, Quorum has prepared a substitute notice and website posting that will be published on Quorum's corporate website (www.quoruminsurance.com/dataincident) to provide general information about the incident and the steps Quorum is taking in response. This website posting will remain accessible for a minimum of ninety (90) days following the commencement of the consumer mailing.
A toll-free call center, operated by Clearfield Notification Services LLC, is available to affected individuals to answer questions about the incident and the services being offered. The call center will operate during the hours of 8:00 a.m. to 8:00 p.m. Eastern Time, Monday through Saturday, for a twelve (12) week operational window commencing on August 18, 2023.
All affected individuals, regardless of which categories of personal information were compromised, are being offered twenty-four (24) months of complimentary credit monitoring and identity theft protection services through IDVault360, a nationally recognized identity protection services provider. Enrollment instructions and an individualized activation code are included in each notification letter. There is no cost to the affected individual for these services.
1.8 Steps Taken in Response to the Breach
Quorum has taken the following steps in response to the data security incident:
Incident Response Activation. Quorum immediately activated its enterprise-wide incident response plan upon learning of the breach on April 21, 2023. The incident response plan is maintained by Quorum's Office of the CISO under the oversight of the Chief Information Security Officer, David Naranjo, and is reviewed and updated on an annual basis. Activation of the plan triggered a cross-functional response team including representatives from Quorum's Legal, Information Security, Privacy, Compliance, Communications, and Insurance Operations departments.
Engagement of Outside Counsel. On May 4, 2023, Quorum engaged Calderwood & Harkness LLP as outside counsel to provide legal advice and guidance regarding the incident, including regulatory compliance obligations, consumer notification requirements, vendor accountability, and litigation risk assessment.
Engagement of Forensic Investigators. On May 5, 2023, at the direction of Calderwood & Harkness LLP, Quorum retained Graystone Forensics LLC to conduct a comprehensive forensic investigation of the incident. Graystone was retained under the attorney-client privilege umbrella to ensure the protection of the forensic findings to the maximum extent permitted by law.
Engagement of Notification and Remediation Services Vendor. Quorum engaged Clearfield Notification Services LLC to manage the consumer notification process, including printing and mailing of notification letters, operation of a toll-free call center, and administration of the complimentary credit monitoring enrollment program.
Engagement of Crisis Communications Firm. Quorum engaged BrightPath Consulting Group Inc. to assist with crisis communications planning and execution, including media relations, internal employee communications, and stakeholder management.
Cyber Insurance Claim. On May 8, 2023, Quorum filed a cyber insurance claim with Atlas Mutual Insurance Company under its cyber liability insurance policy (Policy No. CYB-2023-041587). The claim was assigned Claim No. CYB-CLM-2023-05892. Quorum's cyber insurance policy provides coverage for breach response costs, including forensic investigation expenses, consumer notification costs, credit monitoring services, and regulatory defense costs, subject to the terms, conditions, and limits of the policy.
Contractual Remedies Against Palomar Data Solutions. Quorum has pursued contractual remedies against Palomar Data Solutions, Inc. arising from Palomar's failure to meet its data security obligations under the MSA. Specifically, Quorum has asserted claims against Palomar for: (a) Palomar's failure to timely apply the security patch for CVE-2023-0669 within the thirty (30) calendar day patching window required under Section 7.4(c) of the MSA; (b) Palomar's failure to maintain adequate intrusion detection and prevention capabilities as required under Section 7.2 of the MSA; and (c) Palomar's approximately twenty-four (24) hour delay in providing breach notification to Quorum beyond the contractually required timeframe under Section 8.1 of the MSA. Quorum has demanded full indemnification from Palomar for all costs, expenses, losses, and liabilities arising from or related to the incident, as provided under Article 10 of the MSA.
Vendor Security Enhancements. Quorum has required Palomar to implement enhanced data security measures as a condition of the continued business relationship, including: (i) implementation of an enhanced and automated patch management program with validation testing; (ii) deployment of next-generation endpoint detection and response (EDR) technology across all systems that process or store Quorum data; (iii) implementation of network segmentation and micro-segmentation to limit lateral movement in the event of future intrusions; (iv) engagement of an independent third-party security firm to conduct comprehensive penetration testing and security assessments on a quarterly basis; and (v) implementation of enhanced logging and monitoring with a minimum twelve (12) month log retention period.
Regulatory Notifications. Quorum is filing concurrent notifications with the attorneys general and/or applicable regulators in all twenty-nine (29) affected states and the District of Columbia, in accordance with the breach notification requirements of each jurisdiction. In addition, Quorum has filed or is in the process of filing the following specific notifications:
• Connecticut Attorney General — filed August 14, 2023
• Connecticut Insurance Department — filed August 14, 2023
• U.S. Department of Health and Human Services, Office for Civil Rights (for the HIPAA-covered PHI component) — filed August 15, 2023
• New York Attorney General — filed August 16, 2023
• California Attorney General — this filing, August 16, 2023
• Massachusetts Attorney General — to be filed August 17, 2023
• All remaining affected states' attorneys general — to be filed August 17–25, 2023
1.9 Enclosed Materials
The following materials are enclosed with this filing:
Enclosure 1: Sample copy of the California-specific consumer notification letter — General PII Version. This is the notification being sent to California residents whose full name, date of birth, Social Security number, and/or driver's license number were compromised, but whose financial or medical/health information was not compromised.
Enclosure 2: Sample copy of the California-specific consumer notification letter — Financial Data Variant. This is the notification being sent to California residents whose general PII was compromised along with bank account numbers and/or payment card numbers.
Enclosure 3: Sample copy of the California-specific consumer notification letter — PHI/CMIA Variant. This is the notification being sent to California residents whose general PII was compromised along with medical/health information (health conditions, diagnosis codes, and/or treatment information). This variant includes content elements required under HIPAA and the California Confidentiality of Medical Information Act.
Each enclosed sample letter is representative of the notices being sent to affected California residents in that category and reflects the final, approved content that will be printed and mailed commencing August 18, 2023.
1.10 Contact Information
Should the Office of the Attorney General have any questions or require additional information regarding this filing, the data security incident, or the consumer notification process, please contact any of the following individuals:
Outside Counsel: Kevin Ostrowski, Esq. Partner, Privacy & Data Security Practice Group Calderwood & Harkness LLP 1700 K Street NW, Suite 900 Washington, D.C. 20006 Telephone: (202) 555-4120
Email: kostrowski@calderwoodharkness.com
General Counsel: Thomas R. Whitfield, Esq. Executive Vice President and General Counsel Quorum Insurance Holdings Corp. 400 Constitution Plaza, Suite 2200 Hartford, CT 06103 Telephone: (860) 555-7200
Email: twhitfield@quoruminsurance.com
Chief Privacy Officer: Jennifer Liang Senior Vice President and Chief Privacy Officer Quorum Insurance Holdings Corp. 400 Constitution Plaza, Suite 2200 Hartford, CT 06103 Telephone: (860) 555-7245
Email: jliang@quoruminsurance.com
1.11 Signature block
We appreciate the Office of the Attorney General's attention to this matter. Please do not hesitate to contact the undersigned should you require any additional information.
Respectfully submitted,
CALDERWOOD & HARKNESS LLP
By: ________
Kevin Ostrowski Partner, Privacy & Data Security Practice Group Calderwood & Harkness LLP 1700 K Street NW, Suite 900 Washington, D.C. 20006
On Behalf of Quorum Insurance Holdings Corp.
Dated: August 16, 2023
Enclosures (3) cc: Thomas R. Whitfield, Esq., General Counsel, Quorum Insurance Holdings Corp. Jennifer Liang, Chief Privacy Officer, Quorum Insurance Holdings Corp. David Naranjo, Chief Information Security Officer, Quorum Insurance Holdings Corp.
PART II: ENCLOSURE 1 — SAMPLE CALIFORNIA-SPECIFIC CONSUMER NOTIFICATION LETTER (GENERAL PII VERSION)
2.1 Header and Return Address
Quorum Insurance Holdings Corp. 400 Constitution Plaza, Suite 2200 Hartford, CT 06103
[Mailing Date — on or after August 18, 2023]
[Name of Affected Individual] [Street Address] [City, State ZIP Code]
NOTICE OF DATA BREACH
Dear [Name of Affected Individual]:
2.2 What Happened
Quorum Insurance Holdings Corp. ("Quorum") is writing to inform you about a data security incident that may affect the security of some of your personal information. We take the protection of your personal information very seriously, and we are providing this notice to explain the incident, describe the types of information involved, and outline the steps we are taking and the steps you can take in response.
On or about March 14, 2023, an unauthorized third party gained access to the computer network of Palomar Data Solutions, Inc. ("Palomar"), a third-party vendor that provides claims data processing and document management services to Quorum. Palomar's systems contained files with personal information belonging to certain Quorum policyholders and claimants, including you.
The unauthorized access was discovered by Palomar's security team on April 18, 2023, when anomalous data transfer activity was detected on Palomar's network. Palomar notified Quorum of the security incident on April 21, 2023. Upon receiving notification, Quorum immediately launched a thorough investigation with the assistance of a leading cybersecurity forensic investigation firm retained under the direction of outside legal counsel.
The investigation determined that an unauthorized actor accessed and acquired files from Palomar's network over a period from approximately March 14, 2023 through April 18, 2023. Those files contained personal information of certain Quorum policyholders and claimants, including your information. The investigation into the scope of the compromise was completed on August 4, 2023, at which time Quorum was able to identify the specific individuals whose information was affected.
2.3 What Information Was Involved
Based on our investigation, the personal information that was potentially acquired by the unauthorized actor includes the following information related to you:
• Your full name
• Your date of birth
• Your Social Security number
• Your driver's license number
We want to be transparent with you about the information involved so that you can take appropriate steps to protect yourself.
2.4 What We Are Doing
Quorum takes the security and privacy of the personal information entrusted to us very seriously, and we deeply regret that this incident occurred. Upon learning of the incident, we took immediate steps to respond, including:
• Retaining a leading cybersecurity forensic investigation firm to conduct a comprehensive investigation of the incident and determine the nature and scope of the compromise;
• Notifying applicable law enforcement authorities;
• Notifying applicable state attorneys general and other regulatory authorities as required by law;
• Demanding that Palomar Data Solutions implement enhanced data security measures to prevent future incidents, including improved patch management processes, advanced endpoint detection and response technology, and independent third-party security assessments;
• Evaluating and enhancing our own vendor risk management and oversight programs; and
• Providing this notice and the services described below to affected individuals.
To help protect your identity and provide you with peace of mind, we are offering you twenty-four (24) months of complimentary credit monitoring and identity theft protection services through IDVault360, at no cost to you. These services include credit monitoring, identity theft detection alerts, identity restoration assistance, and up to $1,000,000 in identity theft insurance coverage. Your enrollment in these services is voluntary, but we strongly encourage you to take advantage of this offer.
To enroll, please follow the instructions on the enclosed enrollment form. Your personalized activation code is printed on the form. You must enroll by November 18, 2023 to activate your complimentary twenty-four (24) month membership. These credit monitoring and identity theft protection services are being administered by Clearfield Notification Services LLC on behalf of Quorum.
2.5 What You Can Do
While we have no evidence at this time that your personal information has been misused as a result of this incident, we encourage you to take the following steps to help protect yourself:
Enroll in Complimentary Credit Monitoring. We strongly encourage you to enroll in the complimentary twenty-four (24) month credit monitoring and identity theft protection service being offered to you at no cost. Please use the enclosed activation code and follow the enrollment instructions provided.
Place a Fraud Alert on Your Credit File. You may place an initial one-year fraud alert on your credit file by contacting any one of the three major credit reporting agencies listed below. The agency you contact is required to notify the other two agencies. A fraud alert tells creditors to take extra steps to verify your identity before opening a new account in your name.
• Harborview Enterprises: P.O. Box 105069, Atlanta, GA 30348-5069; 1-800-525-6285; www.Harborview Enterprises.com
• Penrose Group: P.O. Box 2002, Allen, TX 75013; 1-888-397-3742; www.Penrose Group.com
• Penmark Enterprises: P.O. Box 2000, Chester, PA 19016; 1-800-680-7289; www.Penmark Enterprises.com
Place a Security Freeze on Your Credit File. You have the right to place a security freeze on your credit file at no cost. A security freeze prohibits a credit reporting agency from releasing any information from your credit report without your written authorization. Please be aware that placing a security freeze on your credit report may delay, interfere with, or prevent the timely approval of any requests you make for new loans, credit, mortgage, employment, housing, or other services. To place a security freeze, contact each of the three credit reporting agencies listed above. You may need to provide your name, address, date of birth, Social Security number, and other personal information.
Monitor Your Financial Accounts. We recommend that you remain vigilant by regularly reviewing your bank account statements, credit card statements, and explanation of benefits statements for any unauthorized activity. If you detect any suspicious transactions, report them immediately to your financial institution.
Obtain Free Credit Reports. Under federal law, you are entitled to one free credit report every twelve months from each of the three major credit reporting agencies. To obtain your free annual credit report, visit www.annualcreditreport.com, call 1-877-322-8228, or write to: Annual Credit Report Request Service, P.O. Box 105281, Atlanta, GA 30348-5281.
Be Vigilant Against Phishing and Social Engineering. Be cautious of unsolicited phone calls, emails, text messages, or letters requesting personal information. Quorum will not contact you by phone or email to ask for your Social Security number, account passwords, or other sensitive information in connection with this incident.
File a Report with the FTC. You may file a complaint with the Federal Trade Commission ("FTC") about identity theft. The FTC can be reached at: Federal Trade Commission, 600 Pennsylvania Avenue NW, Washington, D.C. 20580; www.identitytheft.gov; 1-877-438-4338. The FTC's website provides detailed information and resources to help you address identity theft.
File a Police Report. If you believe you are a victim of identity theft, you may file a report with your local law enforcement agency. You may also obtain a copy of the police report and provide it to creditors and others who may require proof of the crime.
2.6 For More Information
We understand that you may have questions about this incident and the steps you can take to protect yourself. For your convenience, we have established a dedicated toll-free call center to assist you. Please call 1-844-555-0198 if you have any questions. Call center representatives are available Monday through Saturday, 8:00 a.m. to 8:00 p.m. Eastern Time, for a twelve (12) week period commencing August 18, 2023.
You may also visit our dedicated incident response web page at www.quoruminsurance.com/dataincident for additional information and updates.
If you prefer to submit inquiries in writing, please send correspondence to:
Quorum Insurance Holdings Corp.
Attn: Data Incident Response Team
400 Constitution Plaza, Suite 2200 Hartford, CT 06103
2.7 California-Specific Rights Notice
Under California law, you have the right to contact the California Attorney General's Office to obtain additional information about your rights regarding data breaches and identity theft. The California Attorney General may be contacted at:
Office of the Attorney General California Department of Justice
Attn: Public Inquiry Unit
P.O. Box 944255 Sacramento, CA 94244-2550 Telephone: (800) 952-5225 Website: www.oag.ca.gov
Additionally, under the California Consumer Privacy Act ("CCPA"), California Civil Code § 1798.100 et seq., California residents have certain rights with respect to their personal information, including the right to know what personal information is collected, the right to request deletion of personal information, and the right to opt out of the sale of personal information. For more information about how Quorum handles your personal information and your rights under the CCPA, please visit our Privacy Policy at www.quoruminsurance.com/privacy.
2.8 Closing and Signature
We sincerely regret any inconvenience or concern this incident may cause you. Protecting the personal information of our policyholders and claimants is a responsibility we take very seriously, and we are committed to continuing to take steps to safeguard your information. We encourage you to take advantage of the complimentary credit monitoring and identity theft protection services being offered and to remain vigilant in monitoring your financial accounts and credit reports.
Sincerely,
QUORUM INSURANCE HOLDINGS CORP.
By: ________
Thomas R. Whitfield Executive Vice President and General Counsel
Jennifer Liang Senior Vice President and Chief Privacy Officer
Enclosure: Credit Monitoring Enrollment Instructions and Activation Code
PART III: ENCLOSURE 2 — SAMPLE CALIFORNIA-SPECIFIC CONSUMER NOTIFICATION LETTER (FINANCIAL DATA VARIANT)
3.1 Structure
This letter follows the same overall structure as the General PII Version set forth in Enclosure 1, with modifications to the "What Information Was Involved" and "What You Can Do" sections to reflect the additional compromise of financial information. All other sections — including the header, return address, opening paragraph, "What We Are Doing," "For More Information," "California-Specific Rights Notice," and closing — are identical to Enclosure 1 and are reproduced here in full for completeness.
Quorum Insurance Holdings Corp. 400 Constitution Plaza, Suite 2200 Hartford, CT 06103
[Mailing Date — on or after August 18, 2023]
[Name of Affected Individual] [Street Address] [City, State ZIP Code]
NOTICE OF DATA BREACH
Dear [Name of Affected Individual]:
What Happened. Quorum Insurance Holdings Corp. ("Quorum") is writing to inform you about a data security incident that may affect the security of some of your personal information. We take the protection of your personal information very seriously, and we are providing this notice to explain the incident, describe the types of information involved, and outline the steps we are taking and the steps you can take in response.
On or about March 14, 2023, an unauthorized third party gained access to the computer network of Palomar Data Solutions, Inc. ("Palomar"), a third-party vendor that provides claims data processing and document management services to Quorum. Palomar's systems contained files with personal information belonging to certain Quorum policyholders and claimants, including you.
The unauthorized access was discovered by Palomar's security team on April 18, 2023, when anomalous data transfer activity was detected on Palomar's network. Palomar notified Quorum of the security incident on April 21, 2023. Upon receiving notification, Quorum immediately launched a thorough investigation with the assistance of a leading cybersecurity forensic investigation firm retained under the direction of outside legal counsel.
The investigation determined that an unauthorized actor accessed and acquired files from Palomar's network over a period from approximately March 14, 2023 through April 18, 2023. Those files contained personal information of certain Quorum policyholders and claimants, including your information. The investigation into the scope of the compromise was completed on August 4, 2023, at which time Quorum was able to identify the specific individuals whose information was affected.
3.2 What Information Was Involved (Modified)
Based on our investigation, the personal information that was potentially acquired by the unauthorized actor includes the following information related to you:
• Your full name
• Your date of birth
• Your Social Security number
• Your driver's license number
• Your bank account number(s) and/or payment card number(s)
The compromise of financial account information in addition to the other categories of personal information described above may increase the risk of unauthorized financial transactions or fraud. We want to be transparent with you about the information involved so that you can take appropriate steps to protect yourself, including the additional financial monitoring steps described below.
What We Are Doing
Quorum takes the security and privacy of the personal information entrusted to us very seriously, and we deeply regret that this incident occurred. Upon learning of the incident, we took immediate steps to respond, including:
• Retaining a leading cybersecurity forensic investigation firm to conduct a comprehensive investigation of the incident and determine the nature and scope of the compromise;
• Notifying applicable law enforcement authorities;
• Notifying applicable state attorneys general and other regulatory authorities as required by law;
• Demanding that Palomar Data Solutions implement enhanced data security measures to prevent future incidents, including improved patch management processes, advanced endpoint detection and response technology, and independent third-party security assessments;
• Evaluating and enhancing our own vendor risk management and oversight programs; and
• Providing this notice and the services described below to affected individuals.
To help protect your identity and provide you with peace of mind, we are offering you twenty-four (24) months of complimentary credit monitoring and identity theft protection services through IDVault360, at no cost to you. These services include credit monitoring, identity theft detection alerts, identity restoration assistance, and up to $1,000,000 in identity theft insurance coverage. Your enrollment in these services is voluntary, but we strongly encourage you to take advantage of this offer.
To enroll, please follow the instructions on the enclosed enrollment form. Your personalized activation code is printed on the form. You must enroll by November 18, 2023 to activate your complimentary twenty-four (24) month membership. These credit monitoring and identity theft protection services are being administered by Clearfield Notification Services LLC on behalf of Quorum.
3.3 What You Can Do (Modified — Enhanced Financial Monitoring Guidance)
While we have no evidence at this time that your personal information has been misused as a result of this incident, we encourage you to take the following steps to help protect yourself. Because your financial account information was involved in this incident, we have included additional recommendations specific to protecting your financial accounts.
Enroll in Complimentary Credit Monitoring. We strongly encourage you to enroll in the complimentary twenty-four (24) month credit monitoring and identity theft protection service being offered to you at no cost. Please use the enclosed activation code and follow the enrollment instructions provided.
Contact Your Financial Institutions. We recommend that you promptly contact the financial institution(s) associated with any bank account number(s) or payment card number(s) that may have been compromised. You should inform them of this incident and ask them to monitor your account(s) for suspicious or unauthorized activity. Your financial institution may recommend additional protective steps, including:
• Closing the affected account and opening a new account with a new account number;
• Requesting replacement payment cards (debit or credit cards) with new card numbers;
• Placing enhanced fraud monitoring or transaction alerts on your accounts;