1025-00006 · Graystone Forensics LLC · Regulatory Notifications

cover-transmittal-memo-remaining-states.docx DOCUMENT Data Privacy

71 / 88 ← → ✕

CALDERWOOD & HARKNESS LLP Attorneys at Law

1700 K Street NW, Suite 900 Washington, D.C. 20006 Telephone: (202) 555-4100 Facsimile: (202) 555-4101 www.calderwoodharkness.com

August 17, 2023

TEMPLATE — FOR INTERNAL USE ONLY CUSTOMIZE FOR EACH JURISDICTION BEFORE FILING

Matter No.: 1025-00006 Client: Quorum Insurance Holdings Corp.

MEMORANDUM

TO: Sara Hendricks, Working Associate, Privacy & Data Security Alan Burke, Lead Associate, Privacy & Data Security

FROM: Sara Hendricks (preparer); reviewed by Alan Burke and Kevin Ostrowski, Responsible Partner

RE: Template Transmittal Cover Letter for Remaining State Breach Notification Filings (24 States) — Quorum Insurance Holdings Corp. Data Security Incident

DATE: August 17, 2023

Right-click to update Table of Contents

Section 1: Purpose and Instructions

1.1 Purpose

This memorandum provides the standardized template cover letter for use in filing state regulatory breach notifications with the remaining twenty-four (24) state attorneys general and/or designated state regulators in connection with the Quorum Insurance Holdings Corp. data security incident involving its third-party claims-processing vendor, Palomar Data Solutions, Inc. The template is designed to ensure consistency across all filings while permitting state-by-state customization to comply with each jurisdiction's particular statutory requirements.

All filings using this template are to be made during the filing period of August 17 through August 25, 2023. The filing team should prioritize those jurisdictions with the shortest statutory deadlines or the largest number of affected residents, consistent with the filing schedule set forth in Section 3 below.

1.2 Prior Filings Completed

The following filings have already been completed and are not covered by this template. Each was prepared under a separate, jurisdiction-specific cover letter or filing protocol:

The Massachusetts Attorney General filing is proceeding concurrently on August 17, 2023, under a separate Massachusetts-specific cover letter because Massachusetts regulations impose unique content and formatting requirements under Mass. Gen. Laws ch. 93H, § 3, and 201 CMR 17.00, including a state-mandated notification form. That filing is being handled by Alan Burke and is not duplicated here.

1.3 Remaining 24 Jurisdictions

The remaining twenty-four (24) jurisdictions requiring notification under applicable state breach notification statutes are as follows:

1. Pennsylvania

2. New Jersey

3. Ohio

4. Illinois

5. Texas

6. Florida

7. Georgia

8. Virginia

9. Maryland

10. North Carolina

11. South Carolina

12. Michigan

13. Minnesota

14. Indiana

15. Wisconsin

16. Colorado

17. Arizona

18. Oregon

19. Washington

20. Tennessee

21. Missouri

22. Louisiana

23. Nevada

24. Iowa

In addition, the District of Columbia notification is included in this filing round where applicable. For purposes of this memorandum, references to "24 states" or "remaining states" include the District of Columbia unless otherwise specified. New Hampshire is also included in the master tracking for completeness and monitoring, although the number of affected residents is being finalized and the filing may extend beyond the August 25 window depending on the outcome of the final data reconciliation. The filing team should treat New Hampshire as a pending item and file as soon as the resident count is confirmed.

1.4 Customization Instructions

Each cover letter produced from this template must be customized before filing. The template contains bracketed placeholder fields, denoted by square brackets (e.g., "[State Name]," "[Filing Date]," "[Number]," "[State Statute Citation]"), that must be replaced with the applicable state-specific data.

The primary reference source for customization data is the State-by-State Notification Timeline & Content Requirements Matrix, dated August 1, 2023, prepared by Sara Hendricks and maintained in the matter file at Calderwood & Harkness Document Management System, Reference No. SCL-1025-00006-0047. The Matrix contains comprehensive information for each jurisdiction, including:

• The applicable statute citation

• The number of affected residents (drawn from the master data mining report finalized August 4, 2023)

• The proper addressee (name, title, office, and address of the attorney general or designated official)

• Required filing method (electronic portal, email, or U.S. mail)

• Whether a state-specific breach notification form is required

• Whether a secondary agency filing is required

• Any special content requirements unique to the jurisdiction

• The applicable statutory deadline for notification

Under no circumstances should a letter be filed using the template placeholders without state-specific customization. Each letter must be reviewed by the filing attorney for completeness and accuracy before submission.

1.5 Filing Method

For each jurisdiction, confirm the required filing method before submission:

• Electronic Filing Portal: Where the state provides an online breach notification portal, file through the portal and retain the confirmation number and screenshot of the submission confirmation page. Follow up with a hard copy mailed via U.S. certified mail if the state requires or recommends a supplemental mailing.

• Email Submission: Where the state accepts or requires email submission, send the cover letter and all enclosures as PDF attachments to the designated email address. Request a read receipt and retain the sent email in the matter file.

• U.S. Mail: Where the state requires filing by physical mail, send the cover letter and all enclosures via U.S. certified mail, return receipt requested, to the designated address. Retain the certified mail receipt and tracking number.

• Where Both Electronic and Mail Options Are Available: File electronically first and follow up with a hard copy mailed via U.S. certified mail where mandated or recommended by the jurisdiction.

1.6 Notifying Entity Information

All filings are to be made on behalf of:

Quorum Insurance Holdings Corp. 400 Constitution Plaza, Suite 2200 Hartford, CT 06103

State of Incorporation: Delaware Stock Exchange: Nasdaq (Ticker: QIHC) Employer Identification Number (EIN): 06-4832197

Quorum is the entity whose policyholder and claimant data was affected by the incident. Although the data exfiltration occurred within the network environment of Palomar Data Solutions, Inc. (a Texas corporation headquartered in Dallas, Texas), Quorum is the data owner and the entity with the direct relationship to the affected individuals. Accordingly, Quorum is filing as the notifying entity in each jurisdiction.

Section 2: Template Cover Letter

The following is the full text of the template cover letter. All bracketed placeholders must be customized for each jurisdiction before filing.

CALDERWOOD & HARKNESS LLP Attorneys at Law

1700 K Street NW, Suite 900 Washington, D.C. 20006 Telephone: (202) 555-4100 Facsimile: (202) 555-4101

[Filing Date — insert actual date of filing, August 17–25, 2023]

[Name and Title of State Attorney General or Designated Official] [Office / Division Name — e.g., Consumer Protection Division, Data Breach Notification Unit, etc.] [Street Address] [City, State, ZIP Code]

[If secondary agency filing required, insert secondary addressee block:] [Name and Title of Secondary Agency Official] [Office / Division Name] [Street Address] [City, State, ZIP Code]

Re: Data Breach Notification Pursuant to [State Statute Citation — e.g., 73 Pa. Stat. § 2303, N.J. Stat. Ann. § 56:8-163, etc.]

Notifying Entity: Quorum Insurance Holdings Corp.

Number of [State Name] Residents Affected: [Number — from state-by-state breakdown]

Dear [Title and Name of AG/Designated Official]:

2.5 — Opening Paragraph — Purpose of Notification

Calderwood & Harkness LLP represents Quorum Insurance Holdings Corp. ("Quorum"), a Delaware corporation headquartered at 400 Constitution Plaza, Suite 2200, Hartford, Connecticut 06103. Quorum's shares are publicly traded on the Nasdaq Stock Market under the ticker symbol QIHC. Quorum is a publicly traded insurance and financial technology company licensed to transact insurance business in all fifty states, the District of Columbia, and several U.S. territories, providing property and casualty insurance, workers' compensation coverage, and related financial technology services to individual and commercial policyholders nationwide.

This letter is submitted on behalf of Quorum pursuant to [State Statute Citation] to notify the [Office Title — e.g., Office of the Attorney General] of a data security incident involving the personally identifiable information of approximately [Number] residents of [State Name]. Quorum is providing this notification in its capacity as the entity whose policyholder and claimant data was affected by the incident. The incident originated at Quorum's third-party claims-processing vendor, Palomar Data Solutions, Inc. ("Palomar"), a Texas corporation headquartered at 2100 Ross Avenue, Suite 1400, Dallas, Texas 75201. Palomar provides claims data processing, document management, and data analytics services to Quorum under a Master Services Agreement dated November 8, 2019.

2.6 — Description of the Incident

On or about March 14, 2023, a threat actor exploited a known remote code execution vulnerability, identified as CVE-2023-0669, in a file transfer appliance operated by Palomar Data Solutions, Inc. within Palomar's network environment. The vulnerability, which had been publicly disclosed and for which a vendor patch had been made available prior to the exploitation, allowed the threat actor to execute arbitrary commands on the file transfer appliance and gain an initial foothold within Palomar's network infrastructure.

Following the initial compromise, the threat actor engaged in lateral movement within Palomar's network and, over an approximately thirty-five (35)-day period from March 14, 2023 through April 18, 2023, located and exfiltrated structured data files containing Quorum policyholder and claimant information. The exfiltrated data had been stored on Palomar's systems in connection with Palomar's claims-processing services for Quorum.

On April 18, 2023, Palomar's security operations center detected anomalous outbound data transfers originating from the compromised file transfer appliance and immediately initiated containment measures, including isolating the affected systems, revoking the threat actor's access, and engaging Palomar's own incident response team.

Palomar notified Quorum of the security incident on April 21, 2023, three days after initial detection, in accordance with the notification provisions of the Master Services Agreement between the parties.

Upon receiving notice of the incident, Quorum promptly engaged its outside counsel, Calderwood & Harkness LLP, to coordinate the legal aspects of the incident response. Calderwood & Harkness LLP, acting under the direction of Quorum's General Counsel, Thomas R. Whitfield, retained the digital forensics firm Graystone Forensics LLC ("Graystone") to conduct a privileged forensic investigation of the incident. The engagement of Graystone was made under the protection of the attorney-client privilege and work-product doctrine to ensure that the forensic investigation could support anticipated legal proceedings and regulatory compliance efforts.

The forensic investigation conducted by Graystone confirmed, on July 14, 2023, that structured data files containing personally identifiable information of Quorum policyholders and claimants had been exfiltrated from Palomar's environment during the period of unauthorized access. The investigation further determined that the threat actor had targeted specific database repositories and file shares containing policyholder records, claims files, and related documentation.

Following confirmation of the data exfiltration, Quorum engaged a specialized data mining firm to review the exfiltrated data files, identify all affected individuals, and determine the specific types of personal information compromised for each individual. This data mining and affected individual identification process was completed on August 4, 2023, at which time Quorum was able to compile the final list of affected individuals organized by state of residence.

2.7 — Information Involved

Based on the completed forensic investigation and data mining process, Quorum has determined that the types of personal information involved in the incident vary by individual but may include one or more of the following data elements:

• Full name (first name, middle name or initial, and last name)

• Date of birth

• Social Security number

• Driver's license number or state identification card number

In addition, the following categories of information were affected for certain subsets of individuals:

• Financial information (affecting approximately 84,619 individuals nationally): Bank account numbers, bank routing numbers, and/or payment card numbers (credit or debit card numbers, together with expiration dates and/or security codes where stored), related to premium payment records and claims disbursement information.

• Protected health information ("PHI") (affecting approximately 41,203 individuals nationally): Health conditions, medical diagnosis codes (ICD-10), treatment information, prescription information, and health insurance identification numbers, related to workers' compensation claims and health-related insurance claims processed by Palomar on behalf of Quorum.

The total number of [State Name] residents whose personal information was affected by this incident is [Number].

[Note to filing attorney: For states with specific data element reporting requirements — i.e., states whose breach notification statutes define "personal information" or "personally identifiable information" in a manner that requires reporting of specific categories — customize the data types listed above to match the state's statutory definition. Refer to the State-by-State Notification Timeline & Content Requirements Matrix for guidance on each state's definition. Remove this bracketed note before filing.]

2.8 — Number of Affected Residents

The total number of residents of [State Name] affected by this incident is [Number].

[Note to filing attorney: Insert the correct figure for the filing state from the master state-by-state breakdown set forth in Section 3 of the accompanying memorandum and the State-by-State Notification Timeline & Content Requirements Matrix. Remove this bracketed note before filing.]

2.9 — Steps Taken in Response

Quorum has taken the following steps in response to the incident to protect affected individuals, remediate the vulnerability, and prevent future incidents:

1. Engagement of Outside Counsel. Quorum engaged Calderwood & Harkness LLP as outside counsel to coordinate all legal aspects of the incident response, including regulatory notifications, consumer notifications, vendor accountability, and potential litigation management.

2. Privileged Forensic Investigation. Calderwood & Harkness LLP retained Graystone Forensics LLC under the attorney-client privilege and work-product doctrine to conduct a comprehensive forensic investigation of the incident, including root cause analysis, scope determination, and attribution analysis.

3. Insurance Claim. Quorum filed a claim under its cyber-liability insurance program with Atlas Mutual Insurance Company, Policy No. CYB-2023-00482, to offset the costs of incident response, consumer notification, credit monitoring services, and related expenses.

4. Containment and Remediation. Quorum worked closely with Palomar to ensure prompt containment and remediation of the vulnerability exploited in the attack. Palomar has confirmed that the CVE-2023-0669 vulnerability has been patched, the compromised file transfer appliance has been replaced, and additional network segmentation and monitoring controls have been implemented within Palomar's environment.

5. Data Mining and Individual Identification. Quorum engaged a specialized data mining firm to conduct a comprehensive review of the exfiltrated data files in order to identify all affected individuals and determine the specific types of personal information compromised for each individual. This process was completed on August 4, 2023.

6. Consumer Notification and Support Services. Quorum has engaged Clearfield Notification Services LLC ("Clearfield") to manage all aspects of consumer notification, including the preparation and mailing of individual written notification letters to all affected individuals, the operation of a dedicated toll-free call center staffed by trained representatives to respond to inquiries from affected individuals, and the provision of twenty-four (24) months of complimentary credit monitoring and identity theft protection services to all affected individuals at no cost.

7. Crisis Communications. Quorum engaged BrightPath Consulting Group Inc. to provide crisis communications support and to assist with the development of external communications to policyholders, stakeholders, and the media.

8. Vendor Accountability. Quorum has pursued vendor accountability measures against Palomar, including formal contractual indemnification demands under the Master Services Agreement, demands for enhanced data security requirements and third-party security audits, and reservation of all rights and remedies available to Quorum under the agreement and applicable law.

9. Enhanced Vendor Risk Management. Quorum has undertaken a comprehensive review and enhancement of its vendor risk management program, including the implementation of enhanced due diligence procedures for third-party vendors with access to personal information, updated contractual data security requirements, mandatory annual security assessments for critical vendors, and revised incident response protocols to ensure more rapid detection and response to vendor-related security incidents.

2.10 — Consumer Notification

Quorum is notifying all affected [State Name] residents via individual written notification letters sent by first-class U.S. mail. Consumer notification mailings are expected to commence on August 18, 2023, and to be completed by September 15, 2023. The notification letters describe the incident, the types of information involved, the steps Quorum has taken in response, and the steps individuals can take to protect themselves, including instructions for enrolling in the complimentary credit monitoring and identity theft protection services.

Quorum is offering all affected individuals twenty-four (24) months of complimentary credit monitoring and identity theft protection services through Clearfield Notification Services LLC. The services include credit monitoring with alerts, identity theft insurance coverage, and access to identity restoration specialists.

A dedicated toll-free call center has been established at 1-888-555-0192 and will be operational during regular business hours (Monday through Friday, 9:00 a.m. to 9:00 p.m. Eastern Time) for a period of twelve (12) weeks following the commencement of the consumer notification mailings. The call center is staffed by trained representatives who can answer questions about the incident, assist individuals with enrollment in the credit monitoring services, and provide general guidance on identity theft prevention.

[If the state requires substitute notice or website posting, insert the following paragraph: In addition to individual written notification, Quorum has posted a notice regarding the data security incident on its corporate website at www.quoruminsurance.com/security-notice, in accordance with the substitute notice provisions of [State Statute Citation]. The website notice contains a description of the incident, the types of information involved, and instructions for affected individuals to obtain additional information and enroll in complimentary credit monitoring services.]

[Note to filing attorney: Verify whether the applicable state requires substitute notice, website posting, or media notice in addition to individual written notification. Remove this bracketed note before filing.]

2.11 — Contact Information

For questions from the [Office Title] regarding this notification or any aspect of Quorum's response to the incident, please contact any of the following individuals:

Kevin Ostrowski, Partner Calderwood & Harkness LLP 1700 K Street NW, Suite 900 Washington, D.C. 20006 Telephone: (202) 555-4118

Email: kostrowski@calderwoodharkness.com

Thomas R. Whitfield, General Counsel Quorum Insurance Holdings Corp. 400 Constitution Plaza, Suite 2200 Hartford, CT 06103 Telephone: (860) 555-7200

Email: twhitfield@quoruminsurance.com

Jennifer Liang, Chief Privacy Officer Quorum Insurance Holdings Corp. 400 Constitution Plaza, Suite 2200 Hartford, CT 06103 Telephone: (860) 555-7245

Email: jliang@quoruminsurance.com

2.12 — Enclosures

The following enclosures are submitted with this notification:

1. Copy of sample consumer notification letter (version applicable to [State Name] residents — [indicate version: general PII version / financial data version / PHI version / state-specific version, as appropriate])

2. [If the state requires: Copy of substitute notice / website posting text]

3. [If the state requires: Completed state-specific breach notification form (e.g., [State Name] Breach Notification Report Form)]

[Note to filing attorney: For states requiring specific forms (e.g., states with mandatory online portals or standardized breach notification report forms), attach the completed state form in addition to this cover letter. Refer to the State-by-State Notification Timeline & Content Requirements Matrix for the list of states requiring specific forms and the location of the blank forms in the matter file. Remove this bracketed note before filing.]

2.13 — Closing

Quorum takes this matter very seriously and is committed to cooperating fully with the [Office Title] in connection with this notification and any inquiries the [Office Title] may have regarding the incident or Quorum's response. Quorum has devoted significant resources to investigating the incident, notifying affected individuals, and implementing measures to prevent similar incidents in the future.

Calderwood & Harkness LLP is available to provide any additional information the [Office Title] may require. Please do not hesitate to contact the undersigned or any of the individuals listed above with any questions or requests for additional information.

Respectfully submitted,

CALDERWOOD & HARKNESS LLP

By: ________

Sara Hendricks, Associate Calderwood & Harkness LLP 1700 K Street NW, Suite 900 Washington, D.C. 20006 Telephone: (202) 555-4133

Email: shendricks@calderwoodharkness.com

Counsel for Quorum Insurance Holdings Corp.

cc: Kevin Ostrowski, Partner, Calderwood & Harkness LLP Alan Burke, Associate, Calderwood & Harkness LLP Thomas R. Whitfield, General Counsel, Quorum Insurance Holdings Corp. Jennifer Liang, Chief Privacy Officer, Quorum Insurance Holdings Corp.

Enclosures

[END OF TEMPLATE COVER LETTER]

Section 3: State-Specific Customization Reference Table

The following quick-reference table is provided to facilitate customization of the template cover letter for each of the remaining twenty-four (24) jurisdictions (plus the District of Columbia). The filing team should use this table in conjunction with the comprehensive State-by-State Notification Timeline & Content Requirements Matrix (dated August 1, 2023, prepared by Sara Hendricks, SCL Document Reference No. SCL-1025-00006-0047) for complete details, including full addressee information, portal URLs, login credentials, and detailed content requirements.

The affected resident counts for the six high-volume states (Pennsylvania, New Jersey, Ohio, Illinois, Texas, and Florida) are individually reported below. The remaining nineteen (19) states and the District of Columbia collectively account for 56,216 affected residents; the individual breakdowns are provided based on the master data mining report finalized August 4, 2023.

Total affected residents across all 24 states + D.C. listed above: 169,879

Note: The figures above are drawn from the master data mining report finalized August 4, 2023, and may be subject to minor adjustments upon final reconciliation. Cross-reference with the comprehensive State-by-State Notification Timeline & Content Requirements Matrix (dated August 1, 2023, prepared by Sara Hendricks, SCL Document Reference No. SCL-1025-00006-0047) for full detail on each jurisdiction, including complete addressee information, portal URLs, login credentials, and detailed statutory content requirements. Where discrepancies exist between this table and the Matrix, the Matrix controls.

Section 4: Filing Checklist

The following pre-filing checklist must be completed for each state filing before submission. The filing attorney should initial each item upon completion and retain the completed checklist in the matter file.

State: ____________________ Filing Attorney: ____________________ Date: ____________________

Additional Notes:

________________________________________

The filing attorney should retain a copy of this completed checklist, together with copies of all filed documents and confirmation of receipt, in the state-specific sub-folder within the matter file at Calderwood & Harkness Document Management System, under Matter No. 1025-00006.

Section 5: Filing Log Template

The following filing log template is to be completed for each state as the filing is made. Upon completion of all filings, the information from this log will be transferred to the master Regulatory Notification Tracker maintained by Sara Hendricks. The Tracker is to be finalized no later than August 25, 2023, and a final version is to be provided to Kevin Ostrowski for review and to Thomas R. Whitfield and Jennifer Liang at Quorum for their records.

Filing Log — State Regulatory Breach Notifications Matter No. 1025-00006 — Quorum Insurance Holdings Corp.

[Duplicate this log entry for each state. A total of 25 log entries (24 states + D.C.) should be completed upon conclusion of all filings.]

The filing team should ensure that all log entries are completed contemporaneously with each filing — do not rely on after-the-fact reconstruction. Accuracy and completeness of the filing log are essential to demonstrate compliance with statutory notification deadlines in the event of any subsequent regulatory inquiry or litigation.

Upon completion of all filings, Sara Hendricks will compile the log entries into the master Regulatory Notification Tracker and circulate the final version to the following individuals for review and confirmation:

• Kevin Ostrowski, Partner, Calderwood & Harkness LLP

• Alan Burke, Lead Associate, Calderwood & Harkness LLP

• Thomas R. Whitfield, General Counsel, Quorum Insurance Holdings Corp.

• Jennifer Liang, Chief Privacy Officer, Quorum Insurance Holdings Corp.

The master Regulatory Notification Tracker will be maintained in the matter file at Calderwood & Harkness Document Management System, Matter No. 1025-00006, and will serve as the authoritative record of all state regulatory breach notification filings made in connection with the Palomar Data Solutions security incident.

CONFIDENTIAL AND PRIVILEGED — ATTORNEY-CLIENT COMMUNICATION / ATTORNEY WORK PRODUCT

This memorandum and the attached template cover letter have been prepared by Calderwood & Harkness LLP in the course of providing legal advice to Quorum Insurance Holdings Corp. in connection with the Palomar Data Solutions security incident. This document is protected by the attorney-client privilege and the work-product doctrine. It is intended solely for the use of the named recipients and should not be disclosed to any third party without the prior written consent of Calderwood & Harkness LLP and Quorum Insurance Holdings Corp.

Calderwood & Harkness LLP — Matter No. 1025-00006 Quorum Insurance Holdings Corp. — Palomar Data Solutions Security Incident

Jurisdiction	Filing Date	Agency	Status
Connecticut — Attorney General	August 14, 2023	Office of the Attorney General, Consumer Protection Section	Filed and confirmed
Connecticut — Insurance Department	August 14, 2023	Connecticut Insurance Department, Legal and Enforcement Division	Filed and confirmed
U.S. Department of Health & Human Services — Office for Civil Rights	August 15, 2023	HHS-OCR (HIPAA Breach Notification)	Filed via HHS breach portal
New York — Attorney General	August 16, 2023	Office of the Attorney General, Bureau of Internet and Technology	Filed via online portal
California — Attorney General	August 16, 2023	Office of the Attorney General, Privacy Enforcement Section	Filed via online portal
Massachusetts — Attorney General	August 17, 2023	Office of the Attorney General, Data Privacy and Security Division	Proceeding under separate Massachusetts-specific cover
State	Statute Citation	No. of Affected Residents	Filing Addressee	Required Filing Method	Planned Filing Date	State Form Req'd?	Secondary Agency?	Special Content Requirements / Notes
Pennsylvania	73 Pa. Stat. § 2303	18,640	PA Office of the Attorney General, Bureau of Consumer Protection	Portal & Mail	Aug. 17, 2023	N	N	Must notify AG "prior to or simultaneous with" consumer notice; file before consumer mailings commence
New Jersey	N.J. Stat. Ann. § 56:8-163	14,388	NJ Division of Law, Office of the Attorney General; NJ State Police, Cyber Crimes Unit	Portal (AG); Mail (State Police)	Aug. 17, 2023	N	Y — NJ State Police	Must notify both AG and State Police; notification must occur before consumer notice
Ohio	Ohio Rev. Code § 1349.19	11,743	OH Office of the Attorney General, Consumer Protection Section	Mail	Aug. 18, 2023	N	N	AG notification must be made "in the most expedient time possible"; no specific form required
Illinois	815 ILCS 530/10	16,502	IL Office of the Attorney General, Consumer Fraud Bureau	Portal	Aug. 18, 2023	Y	N	Illinois requires use of online Data Breach Notification Form; include total number of IL residents affected
Texas	Tex. Bus. & Com. Code § 521.053	29,477	TX Office of the Attorney General, Consumer Protection Division	Portal	Aug. 17, 2023	Y	N	AG notification required if 250+ TX residents affected; use TX AG online form; 60-day statutory deadline from determination of breach
Florida	Fla. Stat. § 501.171	22,913	FL Office of the Attorney General, Department of Legal Affairs; FL Department of Agriculture & Consumer Services	Portal (AG); Portal (DACS)	Aug. 18, 2023	Y	Y — FL DACS	FL requires notification within 30 days; must include specific information per § 501.171(3); notification to DACS also required
Georgia	Ga. Code Ann. § 10-1-912	4,817	GA Office of the Attorney General, Consumer Protection Division	Mail	Aug. 21, 2023	N	N	AG notification required for breaches affecting GA residents; no specific form
Virginia	Va. Code Ann. § 18.2-186.6	5,612	VA Office of the Attorney General, Consumer Protection Section	Email & Mail	Aug. 21, 2023	N	N	Must notify AG "without unreasonable delay"; notification must occur prior to or simultaneous with consumer notice
Maryland	Md. Code Ann., Com. Law § 14-3504	4,293	MD Office of the Attorney General, Consumer Protection Division	Mail	Aug. 21, 2023	Y	N	MD requires written notification to AG with specific content; use MD-specific form; 45-day statutory deadline
North Carolina	N.C. Gen. Stat. § 75-65	3,988	NC Office of the Attorney General, Consumer Protection Division	Email & Mail	Aug. 22, 2023	N	N	AG notification required; must include description of incident, types of PII, number of residents, steps taken
South Carolina	S.C. Code Ann. § 39-1-90	2,741	SC Department of Consumer Affairs	Mail	Aug. 22, 2023	N	Y — SC SLED (if SSN or financial data involved)	Must notify DCA; if SSNs or financial data involved, also notify SC Law Enforcement Division (SLED)
Michigan	Mich. Comp. Laws § 445.72	3,645	MI Office of the Attorney General, Consumer Protection Division	Email	Aug. 22, 2023	N	N	Must notify AG; notice must include information "necessary to assess the nature and scope of the breach"
Minnesota	Minn. Stat. § 325E.61	2,290	MN Office of the Attorney General, Consumer Protection Division	Mail	Aug. 23, 2023	N	N	Must notify AG as part of notification obligations; no specific form
Indiana	Ind. Code § 24-4.9-3-1	3,117	IN Office of the Attorney General, Consumer Protection Division	Portal	Aug. 23, 2023	Y	N	Must notify AG; use Indiana AG online breach notification portal and form
Wisconsin	Wis. Stat. § 134.98	2,182	WI Department of Agriculture, Trade and Consumer Protection (DATCP)	Mail	Aug. 23, 2023	N	N	Must notify DATCP (not AG); include description of breach and number of WI residents affected
Colorado	Colo. Rev. Stat. § 6-1-716	3,455	CO Office of the Attorney General, Consumer Protection Section	Email & Mail	Aug. 21, 2023	N	N	Must notify AG within 30 days of determination; must include specific content per statute; CPA amendments effective Aug. 2023 — verify current requirements
Arizona	Ariz. Rev. Stat. § 18-552	2,876	AZ Office of the Attorney General, Consumer Protection and Advocacy Section	Portal	Aug. 23, 2023	Y	N	Must notify AG within 45 days; use AZ AG online breach notification form

Oregon	Or. Rev. Stat. § 646A.604	2,501	OR Office of the Attorney General, Financial Fraud / Consumer Protection Section	Email	Aug. 24, 2023	N	N	Must notify AG if 250+ OR residents affected; notification must include specific content per § 646A.604(4)
Washington	Wash. Rev. Code § 19.255.010	3,890	WA Office of the Attorney General, Consumer Protection Division	Portal	Aug. 22, 2023	Y	N	Must notify AG within 30 days; electronic submission required through WA AG portal; must include specific content per statute
Tennessee	Tenn. Code Ann. § 47-18-2107	2,655	TN Office of the Attorney General, Consumer Protection Division	Mail	Aug. 24, 2023	N	N	Must notify AG; notification "in the most expedient time possible and without unreasonable delay"
Missouri	Mo. Rev. Stat. § 407.1500	2,188	MO Office of the Attorney General, Consumer Protection Division	Email & Mail	Aug. 24, 2023	N	N	Must notify AG; no specific form but must include required statutory content
Louisiana	La. Rev. Stat. Ann. § 51:3074	1,843	LA Office of the Attorney General, Consumer Protection Section	Mail	Aug. 24, 2023	N	N	Must notify AG; notification must occur within 60 days of discovery; include specific content
Nevada	Nev. Rev. Stat. § 603A.220	1,412	NV Office of the Attorney General, Bureau of Consumer Protection	Mail	Aug. 25, 2023	N	N	Must notify AG; no specific form; verify whether online submission is available
Iowa	Iowa Code § 715C.2	1,890	IA Office of the Attorney General, Consumer Protection Division	Mail	Aug. 25, 2023	N	N	Must notify AG within 5 business days of notifying consumers; coordinate timing with consumer mailing
New Hampshire	N.H. Rev. Stat. Ann. § 359-C:20	1,761	NH Office of the Attorney General, Consumer Protection and Antitrust Bureau	Mail	Aug. 25, 2023	N	N	Must notify AG "as soon as possible" and prior to consumer notice; resident count subject to final reconciliation
District of Columbia	D.C. Code § 28-3852	1,040	DC Office of the Attorney General, Public Advocacy Division	Email & Mail	Aug. 25, 2023	N	N	Must notify AG; notification must be "in the most expedient time possible and without unreasonable delay"
No.	Checklist Item	Completed (Initial/Date)
1.	Confirm that the state-specific statute citation inserted in the cover letter is correct and current. Verify against Westmark Data Systems or Calderon Systems for any recent amendments effective before the filing date.	____
2.	Insert the correct number of affected residents for the filing state. Verify the figure against the master data mining report (finalized August 4, 2023) and the State-by-State Notification Timeline & Content Requirements Matrix.	____
3.	Insert the correct addressee name, title, office/division name, street address, city, state, and ZIP code. Confirm current information by checking the state AG's website or calling the office to verify mailing address and point of contact.	____
4.	Verify the required filing method for the jurisdiction (electronic portal, email, U.S. mail, or combination). Obtain any necessary login credentials for electronic portals. Test portal access before the planned filing date.	____
5.	Attach the correct version(s) of the consumer notification letter applicable to the filing state. Determine which version applies — general PII version, financial data version, PHI version, or state-specific version — based on the types of personal information affected for residents of that state.	____
6.	Determine whether the state requires a state-mandated breach notification form and, if so, complete the form in full. Refer to the Matrix for the applicable form and form location in the matter file.	____
7.	Confirm whether a secondary agency filing is required for the jurisdiction (e.g., state police, department of consumer affairs, insurance department). If so, prepare and submit the secondary filing concurrently.	____
8.	Confirm that the filing will be made within the state's statutory deadline for regulatory notification. Calculate the applicable deadline based on the state's statutory trigger date (typically the date of discovery or the date the investigation is complete) and verify compliance with any specific day-count requirements.	____
9.	Obtain confirmation of receipt for the filing. For electronic portal submissions, retain the confirmation number and screenshot. For email submissions, request and retain a read receipt. For U.S. mail submissions, retain the certified mail receipt and USPS tracking number.	____
10.	Log the completed filing in the Regulatory Notification Tracker maintained by Sara Hendricks (to be finalized by August 25, 2023). Enter all required information, including filing date, filing method, confirmation number or tracking number, and any notes or special circumstances.	____
Field	Entry
State:	________
Filing Date:	________
Filing Method:	Electronic Portal Email U.S. Mail Other: __
Confirmation Number / Tracking:	________

Filed By:	________
Enclosures Included:	Cover Letter Consumer Notification Letter State Form Substitute Notice Other: __
Secondary Agency Filing Made?	Yes No N/A — If Yes: Agency: __ Method: __ Confirmation: __
Notes / Special Circumstances:	________

CALDERWOOD & HARKNESS LLP Attorneys at Law
1700 K Street NW, Suite 900 Washington, D.C. 20006 Telephone: (202) 555-4100 Facsimile: (202) 555-4101 www.calderwoodharkness.com
August 17, 2023
TEMPLATE — FOR INTERNAL USE ONLY CUSTOMIZE FOR EACH JURISDICTION BEFORE FILING
Matter No.: 1025-00006 Client: Quorum Insurance Holdings Corp.
MEMORANDUM
TO: Sara Hendricks, Working Associate, Privacy & Data Security Alan Burke, Lead Associate, Privacy & Data Security
FROM: Sara Hendricks (preparer); reviewed by Alan Burke and Kevin Ostrowski, Responsible Partner
RE: Template Transmittal Cover Letter for Remaining State Breach Notification Filings (24 States) — Quorum Insurance Holdings Corp. Data Security Incident
DATE: August 17, 2023
Right-click to update Table of Contents
Section 1: Purpose and Instructions
1.1 Purpose
This memorandum provides the standardized template cover letter for use in filing state regulatory breach notifications with the remaining twenty-four (24) state attorneys general and/or designated state regulators in connection with the Quorum Insurance Holdings Corp. data security incident involving its third-party claims-processing vendor, Palomar Data Solutions, Inc. The template is designed to ensure consistency across all filings while permitting state-by-state customization to comply with each jurisdiction's particular statutory requirements.
All filings using this template are to be made during the filing period of August 17 through August 25, 2023. The filing team should prioritize those jurisdictions with the shortest statutory deadlines or the largest number of affected residents, consistent with the filing schedule set forth in Section 3 below.
1.2 Prior Filings Completed
The following filings have already been completed and are not covered by this template. Each was prepared under a separate, jurisdiction-specific cover letter or filing protocol:
The Massachusetts Attorney General filing is proceeding concurrently on August 17, 2023, under a separate Massachusetts-specific cover letter because Massachusetts regulations impose unique content and formatting requirements under Mass. Gen. Laws ch. 93H, § 3, and 201 CMR 17.00, including a state-mandated notification form. That filing is being handled by Alan Burke and is not duplicated here.
1.3 Remaining 24 Jurisdictions
The remaining twenty-four (24) jurisdictions requiring notification under applicable state breach notification statutes are as follows:
1. Pennsylvania
2. New Jersey
3. Ohio
4. Illinois
5. Texas
6. Florida
7. Georgia
8. Virginia
9. Maryland
10. North Carolina
11. South Carolina
12. Michigan
13. Minnesota
14. Indiana
15. Wisconsin
16. Colorado
17. Arizona
18. Oregon
19. Washington
20. Tennessee
21. Missouri
22. Louisiana
23. Nevada
24. Iowa
In addition, the District of Columbia notification is included in this filing round where applicable. For purposes of this memorandum, references to "24 states" or "remaining states" include the District of Columbia unless otherwise specified. New Hampshire is also included in the master tracking for completeness and monitoring, although the number of affected residents is being finalized and the filing may extend beyond the August 25 window depending on the outcome of the final data reconciliation. The filing team should treat New Hampshire as a pending item and file as soon as the resident count is confirmed.
1.4 Customization Instructions
Each cover letter produced from this template must be customized before filing. The template contains bracketed placeholder fields, denoted by square brackets (e.g., "[State Name]," "[Filing Date]," "[Number]," "[State Statute Citation]"), that must be replaced with the applicable state-specific data.
The primary reference source for customization data is the State-by-State Notification Timeline & Content Requirements Matrix, dated August 1, 2023, prepared by Sara Hendricks and maintained in the matter file at Calderwood & Harkness Document Management System, Reference No. SCL-1025-00006-0047. The Matrix contains comprehensive information for each jurisdiction, including:
• The applicable statute citation
• The number of affected residents (drawn from the master data mining report finalized August 4, 2023)
• The proper addressee (name, title, office, and address of the attorney general or designated official)
• Required filing method (electronic portal, email, or U.S. mail)
• Whether a state-specific breach notification form is required
• Whether a secondary agency filing is required
• Any special content requirements unique to the jurisdiction
• The applicable statutory deadline for notification
Under no circumstances should a letter be filed using the template placeholders without state-specific customization. Each letter must be reviewed by the filing attorney for completeness and accuracy before submission.
1.5 Filing Method
For each jurisdiction, confirm the required filing method before submission:
• Electronic Filing Portal: Where the state provides an online breach notification portal, file through the portal and retain the confirmation number and screenshot of the submission confirmation page. Follow up with a hard copy mailed via U.S. certified mail if the state requires or recommends a supplemental mailing.
• Email Submission: Where the state accepts or requires email submission, send the cover letter and all enclosures as PDF attachments to the designated email address. Request a read receipt and retain the sent email in the matter file.
• U.S. Mail: Where the state requires filing by physical mail, send the cover letter and all enclosures via U.S. certified mail, return receipt requested, to the designated address. Retain the certified mail receipt and tracking number.
• Where Both Electronic and Mail Options Are Available: File electronically first and follow up with a hard copy mailed via U.S. certified mail where mandated or recommended by the jurisdiction.
1.6 Notifying Entity Information
All filings are to be made on behalf of:
Quorum Insurance Holdings Corp. 400 Constitution Plaza, Suite 2200 Hartford, CT 06103
State of Incorporation: Delaware Stock Exchange: Nasdaq (Ticker: QIHC) Employer Identification Number (EIN): 06-4832197
Quorum is the entity whose policyholder and claimant data was affected by the incident. Although the data exfiltration occurred within the network environment of Palomar Data Solutions, Inc. (a Texas corporation headquartered in Dallas, Texas), Quorum is the data owner and the entity with the direct relationship to the affected individuals. Accordingly, Quorum is filing as the notifying entity in each jurisdiction.
Section 2: Template Cover Letter
The following is the full text of the template cover letter. All bracketed placeholders must be customized for each jurisdiction before filing.
CALDERWOOD & HARKNESS LLP Attorneys at Law
1700 K Street NW, Suite 900 Washington, D.C. 20006 Telephone: (202) 555-4100 Facsimile: (202) 555-4101
[Filing Date — insert actual date of filing, August 17–25, 2023]
[Name and Title of State Attorney General or Designated Official] [Office / Division Name — e.g., Consumer Protection Division, Data Breach Notification Unit, etc.] [Street Address] [City, State, ZIP Code]
[If secondary agency filing required, insert secondary addressee block:] [Name and Title of Secondary Agency Official] [Office / Division Name] [Street Address] [City, State, ZIP Code]
Re: Data Breach Notification Pursuant to [State Statute Citation — e.g., 73 Pa. Stat. § 2303, N.J. Stat. Ann. § 56:8-163, etc.]
Notifying Entity: Quorum Insurance Holdings Corp.
Number of [State Name] Residents Affected: [Number — from state-by-state breakdown]
Dear [Title and Name of AG/Designated Official]:
2.5 — Opening Paragraph — Purpose of Notification
Calderwood & Harkness LLP represents Quorum Insurance Holdings Corp. ("Quorum"), a Delaware corporation headquartered at 400 Constitution Plaza, Suite 2200, Hartford, Connecticut 06103. Quorum's shares are publicly traded on the Nasdaq Stock Market under the ticker symbol QIHC. Quorum is a publicly traded insurance and financial technology company licensed to transact insurance business in all fifty states, the District of Columbia, and several U.S. territories, providing property and casualty insurance, workers' compensation coverage, and related financial technology services to individual and commercial policyholders nationwide.
This letter is submitted on behalf of Quorum pursuant to [State Statute Citation] to notify the [Office Title — e.g., Office of the Attorney General] of a data security incident involving the personally identifiable information of approximately [Number] residents of [State Name]. Quorum is providing this notification in its capacity as the entity whose policyholder and claimant data was affected by the incident. The incident originated at Quorum's third-party claims-processing vendor, Palomar Data Solutions, Inc. ("Palomar"), a Texas corporation headquartered at 2100 Ross Avenue, Suite 1400, Dallas, Texas 75201. Palomar provides claims data processing, document management, and data analytics services to Quorum under a Master Services Agreement dated November 8, 2019.
2.6 — Description of the Incident
On or about March 14, 2023, a threat actor exploited a known remote code execution vulnerability, identified as CVE-2023-0669, in a file transfer appliance operated by Palomar Data Solutions, Inc. within Palomar's network environment. The vulnerability, which had been publicly disclosed and for which a vendor patch had been made available prior to the exploitation, allowed the threat actor to execute arbitrary commands on the file transfer appliance and gain an initial foothold within Palomar's network infrastructure.
Following the initial compromise, the threat actor engaged in lateral movement within Palomar's network and, over an approximately thirty-five (35)-day period from March 14, 2023 through April 18, 2023, located and exfiltrated structured data files containing Quorum policyholder and claimant information. The exfiltrated data had been stored on Palomar's systems in connection with Palomar's claims-processing services for Quorum.
On April 18, 2023, Palomar's security operations center detected anomalous outbound data transfers originating from the compromised file transfer appliance and immediately initiated containment measures, including isolating the affected systems, revoking the threat actor's access, and engaging Palomar's own incident response team.
Palomar notified Quorum of the security incident on April 21, 2023, three days after initial detection, in accordance with the notification provisions of the Master Services Agreement between the parties.
Upon receiving notice of the incident, Quorum promptly engaged its outside counsel, Calderwood & Harkness LLP, to coordinate the legal aspects of the incident response. Calderwood & Harkness LLP, acting under the direction of Quorum's General Counsel, Thomas R. Whitfield, retained the digital forensics firm Graystone Forensics LLC ("Graystone") to conduct a privileged forensic investigation of the incident. The engagement of Graystone was made under the protection of the attorney-client privilege and work-product doctrine to ensure that the forensic investigation could support anticipated legal proceedings and regulatory compliance efforts.
The forensic investigation conducted by Graystone confirmed, on July 14, 2023, that structured data files containing personally identifiable information of Quorum policyholders and claimants had been exfiltrated from Palomar's environment during the period of unauthorized access. The investigation further determined that the threat actor had targeted specific database repositories and file shares containing policyholder records, claims files, and related documentation.
Following confirmation of the data exfiltration, Quorum engaged a specialized data mining firm to review the exfiltrated data files, identify all affected individuals, and determine the specific types of personal information compromised for each individual. This data mining and affected individual identification process was completed on August 4, 2023, at which time Quorum was able to compile the final list of affected individuals organized by state of residence.
2.7 — Information Involved
Based on the completed forensic investigation and data mining process, Quorum has determined that the types of personal information involved in the incident vary by individual but may include one or more of the following data elements:
• Full name (first name, middle name or initial, and last name)
• Date of birth
• Social Security number
• Driver's license number or state identification card number
In addition, the following categories of information were affected for certain subsets of individuals:
• Financial information (affecting approximately 84,619 individuals nationally): Bank account numbers, bank routing numbers, and/or payment card numbers (credit or debit card numbers, together with expiration dates and/or security codes where stored), related to premium payment records and claims disbursement information.
• Protected health information ("PHI") (affecting approximately 41,203 individuals nationally): Health conditions, medical diagnosis codes (ICD-10), treatment information, prescription information, and health insurance identification numbers, related to workers' compensation claims and health-related insurance claims processed by Palomar on behalf of Quorum.
The total number of [State Name] residents whose personal information was affected by this incident is [Number].
[Note to filing attorney: For states with specific data element reporting requirements — i.e., states whose breach notification statutes define "personal information" or "personally identifiable information" in a manner that requires reporting of specific categories — customize the data types listed above to match the state's statutory definition. Refer to the State-by-State Notification Timeline & Content Requirements Matrix for guidance on each state's definition. Remove this bracketed note before filing.]
2.8 — Number of Affected Residents
The total number of residents of [State Name] affected by this incident is [Number].
[Note to filing attorney: Insert the correct figure for the filing state from the master state-by-state breakdown set forth in Section 3 of the accompanying memorandum and the State-by-State Notification Timeline & Content Requirements Matrix. Remove this bracketed note before filing.]
2.9 — Steps Taken in Response
Quorum has taken the following steps in response to the incident to protect affected individuals, remediate the vulnerability, and prevent future incidents:
1. Engagement of Outside Counsel. Quorum engaged Calderwood & Harkness LLP as outside counsel to coordinate all legal aspects of the incident response, including regulatory notifications, consumer notifications, vendor accountability, and potential litigation management.
2. Privileged Forensic Investigation. Calderwood & Harkness LLP retained Graystone Forensics LLC under the attorney-client privilege and work-product doctrine to conduct a comprehensive forensic investigation of the incident, including root cause analysis, scope determination, and attribution analysis.
3. Insurance Claim. Quorum filed a claim under its cyber-liability insurance program with Atlas Mutual Insurance Company, Policy No. CYB-2023-00482, to offset the costs of incident response, consumer notification, credit monitoring services, and related expenses.
4. Containment and Remediation. Quorum worked closely with Palomar to ensure prompt containment and remediation of the vulnerability exploited in the attack. Palomar has confirmed that the CVE-2023-0669 vulnerability has been patched, the compromised file transfer appliance has been replaced, and additional network segmentation and monitoring controls have been implemented within Palomar's environment.
5. Data Mining and Individual Identification. Quorum engaged a specialized data mining firm to conduct a comprehensive review of the exfiltrated data files in order to identify all affected individuals and determine the specific types of personal information compromised for each individual. This process was completed on August 4, 2023.
6. Consumer Notification and Support Services. Quorum has engaged Clearfield Notification Services LLC ("Clearfield") to manage all aspects of consumer notification, including the preparation and mailing of individual written notification letters to all affected individuals, the operation of a dedicated toll-free call center staffed by trained representatives to respond to inquiries from affected individuals, and the provision of twenty-four (24) months of complimentary credit monitoring and identity theft protection services to all affected individuals at no cost.
7. Crisis Communications. Quorum engaged BrightPath Consulting Group Inc. to provide crisis communications support and to assist with the development of external communications to policyholders, stakeholders, and the media.
8. Vendor Accountability. Quorum has pursued vendor accountability measures against Palomar, including formal contractual indemnification demands under the Master Services Agreement, demands for enhanced data security requirements and third-party security audits, and reservation of all rights and remedies available to Quorum under the agreement and applicable law.
9. Enhanced Vendor Risk Management. Quorum has undertaken a comprehensive review and enhancement of its vendor risk management program, including the implementation of enhanced due diligence procedures for third-party vendors with access to personal information, updated contractual data security requirements, mandatory annual security assessments for critical vendors, and revised incident response protocols to ensure more rapid detection and response to vendor-related security incidents.
2.10 — Consumer Notification
Quorum is notifying all affected [State Name] residents via individual written notification letters sent by first-class U.S. mail. Consumer notification mailings are expected to commence on August 18, 2023, and to be completed by September 15, 2023. The notification letters describe the incident, the types of information involved, the steps Quorum has taken in response, and the steps individuals can take to protect themselves, including instructions for enrolling in the complimentary credit monitoring and identity theft protection services.
Quorum is offering all affected individuals twenty-four (24) months of complimentary credit monitoring and identity theft protection services through Clearfield Notification Services LLC. The services include credit monitoring with alerts, identity theft insurance coverage, and access to identity restoration specialists.
A dedicated toll-free call center has been established at 1-888-555-0192 and will be operational during regular business hours (Monday through Friday, 9:00 a.m. to 9:00 p.m. Eastern Time) for a period of twelve (12) weeks following the commencement of the consumer notification mailings. The call center is staffed by trained representatives who can answer questions about the incident, assist individuals with enrollment in the credit monitoring services, and provide general guidance on identity theft prevention.
[If the state requires substitute notice or website posting, insert the following paragraph: In addition to individual written notification, Quorum has posted a notice regarding the data security incident on its corporate website at www.quoruminsurance.com/security-notice, in accordance with the substitute notice provisions of [State Statute Citation]. The website notice contains a description of the incident, the types of information involved, and instructions for affected individuals to obtain additional information and enroll in complimentary credit monitoring services.]
[Note to filing attorney: Verify whether the applicable state requires substitute notice, website posting, or media notice in addition to individual written notification. Remove this bracketed note before filing.]
2.11 — Contact Information
For questions from the [Office Title] regarding this notification or any aspect of Quorum's response to the incident, please contact any of the following individuals:
Kevin Ostrowski, Partner Calderwood & Harkness LLP 1700 K Street NW, Suite 900 Washington, D.C. 20006 Telephone: (202) 555-4118
Email: kostrowski@calderwoodharkness.com
Thomas R. Whitfield, General Counsel Quorum Insurance Holdings Corp. 400 Constitution Plaza, Suite 2200 Hartford, CT 06103 Telephone: (860) 555-7200
Email: twhitfield@quoruminsurance.com
Jennifer Liang, Chief Privacy Officer Quorum Insurance Holdings Corp. 400 Constitution Plaza, Suite 2200 Hartford, CT 06103 Telephone: (860) 555-7245
Email: jliang@quoruminsurance.com
2.12 — Enclosures
The following enclosures are submitted with this notification:
1. Copy of sample consumer notification letter (version applicable to [State Name] residents — [indicate version: general PII version / financial data version / PHI version / state-specific version, as appropriate])
2. [If the state requires: Copy of substitute notice / website posting text]
3. [If the state requires: Completed state-specific breach notification form (e.g., [State Name] Breach Notification Report Form)]
[Note to filing attorney: For states requiring specific forms (e.g., states with mandatory online portals or standardized breach notification report forms), attach the completed state form in addition to this cover letter. Refer to the State-by-State Notification Timeline & Content Requirements Matrix for the list of states requiring specific forms and the location of the blank forms in the matter file. Remove this bracketed note before filing.]
2.13 — Closing
Quorum takes this matter very seriously and is committed to cooperating fully with the [Office Title] in connection with this notification and any inquiries the [Office Title] may have regarding the incident or Quorum's response. Quorum has devoted significant resources to investigating the incident, notifying affected individuals, and implementing measures to prevent similar incidents in the future.
Calderwood & Harkness LLP is available to provide any additional information the [Office Title] may require. Please do not hesitate to contact the undersigned or any of the individuals listed above with any questions or requests for additional information.
Respectfully submitted,
CALDERWOOD & HARKNESS LLP
By: ________
Sara Hendricks, Associate Calderwood & Harkness LLP 1700 K Street NW, Suite 900 Washington, D.C. 20006 Telephone: (202) 555-4133
Email: shendricks@calderwoodharkness.com
Counsel for Quorum Insurance Holdings Corp.
cc: Kevin Ostrowski, Partner, Calderwood & Harkness LLP Alan Burke, Associate, Calderwood & Harkness LLP Thomas R. Whitfield, General Counsel, Quorum Insurance Holdings Corp. Jennifer Liang, Chief Privacy Officer, Quorum Insurance Holdings Corp.
Enclosures
[END OF TEMPLATE COVER LETTER]
Section 3: State-Specific Customization Reference Table
The following quick-reference table is provided to facilitate customization of the template cover letter for each of the remaining twenty-four (24) jurisdictions (plus the District of Columbia). The filing team should use this table in conjunction with the comprehensive State-by-State Notification Timeline & Content Requirements Matrix (dated August 1, 2023, prepared by Sara Hendricks, SCL Document Reference No. SCL-1025-00006-0047) for complete details, including full addressee information, portal URLs, login credentials, and detailed content requirements.
The affected resident counts for the six high-volume states (Pennsylvania, New Jersey, Ohio, Illinois, Texas, and Florida) are individually reported below. The remaining nineteen (19) states and the District of Columbia collectively account for 56,216 affected residents; the individual breakdowns are provided based on the master data mining report finalized August 4, 2023.
Total affected residents across all 24 states + D.C. listed above: 169,879
Note: The figures above are drawn from the master data mining report finalized August 4, 2023, and may be subject to minor adjustments upon final reconciliation. Cross-reference with the comprehensive State-by-State Notification Timeline & Content Requirements Matrix (dated August 1, 2023, prepared by Sara Hendricks, SCL Document Reference No. SCL-1025-00006-0047) for full detail on each jurisdiction, including complete addressee information, portal URLs, login credentials, and detailed statutory content requirements. Where discrepancies exist between this table and the Matrix, the Matrix controls.
Section 4: Filing Checklist
The following pre-filing checklist must be completed for each state filing before submission. The filing attorney should initial each item upon completion and retain the completed checklist in the matter file.
State: ____________________ Filing Attorney: ____________________ Date: ____________________
Additional Notes:
________________________________________
________________________________________
________________________________________
The filing attorney should retain a copy of this completed checklist, together with copies of all filed documents and confirmation of receipt, in the state-specific sub-folder within the matter file at Calderwood & Harkness Document Management System, under Matter No. 1025-00006.
Section 5: Filing Log Template
The following filing log template is to be completed for each state as the filing is made. Upon completion of all filings, the information from this log will be transferred to the master Regulatory Notification Tracker maintained by Sara Hendricks. The Tracker is to be finalized no later than August 25, 2023, and a final version is to be provided to Kevin Ostrowski for review and to Thomas R. Whitfield and Jennifer Liang at Quorum for their records.
Filing Log — State Regulatory Breach Notifications Matter No. 1025-00006 — Quorum Insurance Holdings Corp.
[Duplicate this log entry for each state. A total of 25 log entries (24 states + D.C.) should be completed upon conclusion of all filings.]
The filing team should ensure that all log entries are completed contemporaneously with each filing — do not rely on after-the-fact reconstruction. Accuracy and completeness of the filing log are essential to demonstrate compliance with statutory notification deadlines in the event of any subsequent regulatory inquiry or litigation.
Upon completion of all filings, Sara Hendricks will compile the log entries into the master Regulatory Notification Tracker and circulate the final version to the following individuals for review and confirmation:
• Kevin Ostrowski, Partner, Calderwood & Harkness LLP
• Alan Burke, Lead Associate, Calderwood & Harkness LLP
• Thomas R. Whitfield, General Counsel, Quorum Insurance Holdings Corp.
• Jennifer Liang, Chief Privacy Officer, Quorum Insurance Holdings Corp.
The master Regulatory Notification Tracker will be maintained in the matter file at Calderwood & Harkness Document Management System, Matter No. 1025-00006, and will serve as the authoritative record of all state regulatory breach notification filings made in connection with the Palomar Data Solutions security incident.
CONFIDENTIAL AND PRIVILEGED — ATTORNEY-CLIENT COMMUNICATION / ATTORNEY WORK PRODUCT
This memorandum and the attached template cover letter have been prepared by Calderwood & Harkness LLP in the course of providing legal advice to Quorum Insurance Holdings Corp. in connection with the Palomar Data Solutions security incident. This document is protected by the attorney-client privilege and the work-product doctrine. It is intended solely for the use of the named recipients and should not be disclosed to any third party without the prior written consent of Calderwood & Harkness LLP and Quorum Insurance Holdings Corp.
Calderwood & Harkness LLP — Matter No. 1025-00006 Quorum Insurance Holdings Corp. — Palomar Data Solutions Security Incident
Jurisdiction | Filing Date | Agency | Status
Connecticut — Attorney General | August 14, 2023 | Office of the Attorney General, Consumer Protection Section | Filed and confirmed
Connecticut — Insurance Department | August 14, 2023 | Connecticut Insurance Department, Legal and Enforcement Division | Filed and confirmed
U.S. Department of Health & Human Services — Office for Civil Rights | August 15, 2023 | HHS-OCR (HIPAA Breach Notification) | Filed via HHS breach portal
New York — Attorney General | August 16, 2023 | Office of the Attorney General, Bureau of Internet and Technology | Filed via online portal
California — Attorney General | August 16, 2023 | Office of the Attorney General, Privacy Enforcement Section | Filed via online portal
Massachusetts — Attorney General | August 17, 2023 | Office of the Attorney General, Data Privacy and Security Division | Proceeding under separate Massachusetts-specific cover
State | Statute Citation | No. of Affected Residents | Filing Addressee | Required Filing Method | Planned Filing Date | State Form Req'd? | Secondary Agency? | Special Content Requirements / Notes
Pennsylvania | 73 Pa. Stat. § 2303 | 18,640 | PA Office of the Attorney General, Bureau of Consumer Protection | Portal & Mail | Aug. 17, 2023 | N | N | Must notify AG "prior to or simultaneous with" consumer notice; file before consumer mailings commence
New Jersey | N.J. Stat. Ann. § 56:8-163 | 14,388 | NJ Division of Law, Office of the Attorney General; NJ State Police, Cyber Crimes Unit | Portal (AG); Mail (State Police) | Aug. 17, 2023 | N | Y — NJ State Police | Must notify both AG and State Police; notification must occur before consumer notice
Ohio | Ohio Rev. Code § 1349.19 | 11,743 | OH Office of the Attorney General, Consumer Protection Section | Mail | Aug. 18, 2023 | N | N | AG notification must be made "in the most expedient time possible"; no specific form required
Illinois | 815 ILCS 530/10 | 16,502 | IL Office of the Attorney General, Consumer Fraud Bureau | Portal | Aug. 18, 2023 | Y | N | Illinois requires use of online Data Breach Notification Form; include total number of IL residents affected
Texas | Tex. Bus. & Com. Code § 521.053 | 29,477 | TX Office of the Attorney General, Consumer Protection Division | Portal | Aug. 17, 2023 | Y | N | AG notification required if 250+ TX residents affected; use TX AG online form; 60-day statutory deadline from determination of breach
Florida | Fla. Stat. § 501.171 | 22,913 | FL Office of the Attorney General, Department of Legal Affairs; FL Department of Agriculture & Consumer Services | Portal (AG); Portal (DACS) | Aug. 18, 2023 | Y | Y — FL DACS | FL requires notification within 30 days; must include specific information per § 501.171(3); notification to DACS also required
Georgia | Ga. Code Ann. § 10-1-912 | 4,817 | GA Office of the Attorney General, Consumer Protection Division | Mail | Aug. 21, 2023 | N | N | AG notification required for breaches affecting GA residents; no specific form
Virginia | Va. Code Ann. § 18.2-186.6 | 5,612 | VA Office of the Attorney General, Consumer Protection Section | Email & Mail | Aug. 21, 2023 | N | N | Must notify AG "without unreasonable delay"; notification must occur prior to or simultaneous with consumer notice
Maryland | Md. Code Ann., Com. Law § 14-3504 | 4,293 | MD Office of the Attorney General, Consumer Protection Division | Mail | Aug. 21, 2023 | Y | N | MD requires written notification to AG with specific content; use MD-specific form; 45-day statutory deadline
North Carolina | N.C. Gen. Stat. § 75-65 | 3,988 | NC Office of the Attorney General, Consumer Protection Division | Email & Mail | Aug. 22, 2023 | N | N | AG notification required; must include description of incident, types of PII, number of residents, steps taken
South Carolina | S.C. Code Ann. § 39-1-90 | 2,741 | SC Department of Consumer Affairs | Mail | Aug. 22, 2023 | N | Y — SC SLED (if SSN or financial data involved) | Must notify DCA; if SSNs or financial data involved, also notify SC Law Enforcement Division (SLED)
Michigan | Mich. Comp. Laws § 445.72 | 3,645 | MI Office of the Attorney General, Consumer Protection Division | Email | Aug. 22, 2023 | N | N | Must notify AG; notice must include information "necessary to assess the nature and scope of the breach"
Minnesota | Minn. Stat. § 325E.61 | 2,290 | MN Office of the Attorney General, Consumer Protection Division | Mail | Aug. 23, 2023 | N | N | Must notify AG as part of notification obligations; no specific form
Indiana | Ind. Code § 24-4.9-3-1 | 3,117 | IN Office of the Attorney General, Consumer Protection Division | Portal | Aug. 23, 2023 | Y | N | Must notify AG; use Indiana AG online breach notification portal and form
Wisconsin | Wis. Stat. § 134.98 | 2,182 | WI Department of Agriculture, Trade and Consumer Protection (DATCP) | Mail | Aug. 23, 2023 | N | N | Must notify DATCP (not AG); include description of breach and number of WI residents affected
Colorado | Colo. Rev. Stat. § 6-1-716 | 3,455 | CO Office of the Attorney General, Consumer Protection Section | Email & Mail | Aug. 21, 2023 | N | N | Must notify AG within 30 days of determination; must include specific content per statute; CPA amendments effective Aug. 2023 — verify current requirements
Arizona | Ariz. Rev. Stat. § 18-552 | 2,876 | AZ Office of the Attorney General, Consumer Protection and Advocacy Section | Portal | Aug. 23, 2023 | Y | N | Must notify AG within 45 days; use AZ AG online breach notification form
Oregon | Or. Rev. Stat. § 646A.604 | 2,501 | OR Office of the Attorney General, Financial Fraud / Consumer Protection Section | Email | Aug. 24, 2023 | N | N | Must notify AG if 250+ OR residents affected; notification must include specific content per § 646A.604(4)
Washington | Wash. Rev. Code § 19.255.010 | 3,890 | WA Office of the Attorney General, Consumer Protection Division | Portal | Aug. 22, 2023 | Y | N | Must notify AG within 30 days; electronic submission required through WA AG portal; must include specific content per statute
Tennessee | Tenn. Code Ann. § 47-18-2107 | 2,655 | TN Office of the Attorney General, Consumer Protection Division | Mail | Aug. 24, 2023 | N | N | Must notify AG; notification "in the most expedient time possible and without unreasonable delay"
Missouri | Mo. Rev. Stat. § 407.1500 | 2,188 | MO Office of the Attorney General, Consumer Protection Division | Email & Mail | Aug. 24, 2023 | N | N | Must notify AG; no specific form but must include required statutory content
Louisiana | La. Rev. Stat. Ann. § 51:3074 | 1,843 | LA Office of the Attorney General, Consumer Protection Section | Mail | Aug. 24, 2023 | N | N | Must notify AG; notification must occur within 60 days of discovery; include specific content
Nevada | Nev. Rev. Stat. § 603A.220 | 1,412 | NV Office of the Attorney General, Bureau of Consumer Protection | Mail | Aug. 25, 2023 | N | N | Must notify AG; no specific form; verify whether online submission is available
Iowa | Iowa Code § 715C.2 | 1,890 | IA Office of the Attorney General, Consumer Protection Division | Mail | Aug. 25, 2023 | N | N | Must notify AG within 5 business days of notifying consumers; coordinate timing with consumer mailing
New Hampshire | N.H. Rev. Stat. Ann. § 359-C:20 | 1,761 | NH Office of the Attorney General, Consumer Protection and Antitrust Bureau | Mail | Aug. 25, 2023 | N | N | Must notify AG "as soon as possible" and prior to consumer notice; resident count subject to final reconciliation
District of Columbia | D.C. Code § 28-3852 | 1,040 | DC Office of the Attorney General, Public Advocacy Division | Email & Mail | Aug. 25, 2023 | N | N | Must notify AG; notification must be "in the most expedient time possible and without unreasonable delay"
No. | Checklist Item | Completed (Initial/Date)
1. | Confirm that the state-specific statute citation inserted in the cover letter is correct and current. Verify against Westmark Data Systems or Calderon Systems for any recent amendments effective before the filing date. | ____
2. | Insert the correct number of affected residents for the filing state. Verify the figure against the master data mining report (finalized August 4, 2023) and the State-by-State Notification Timeline & Content Requirements Matrix. | ____
3. | Insert the correct addressee name, title, office/division name, street address, city, state, and ZIP code. Confirm current information by checking the state AG's website or calling the office to verify mailing address and point of contact. | ____
4. | Verify the required filing method for the jurisdiction (electronic portal, email, U.S. mail, or combination). Obtain any necessary login credentials for electronic portals. Test portal access before the planned filing date. | ____
5. | Attach the correct version(s) of the consumer notification letter applicable to the filing state. Determine which version applies — general PII version, financial data version, PHI version, or state-specific version — based on the types of personal information affected for residents of that state. | ____
6. | Determine whether the state requires a state-mandated breach notification form and, if so, complete the form in full. Refer to the Matrix for the applicable form and form location in the matter file. | ____
7. | Confirm whether a secondary agency filing is required for the jurisdiction (e.g., state police, department of consumer affairs, insurance department). If so, prepare and submit the secondary filing concurrently. | ____
8. | Confirm that the filing will be made within the state's statutory deadline for regulatory notification. Calculate the applicable deadline based on the state's statutory trigger date (typically the date of discovery or the date the investigation is complete) and verify compliance with any specific day-count requirements. | ____
9. | Obtain confirmation of receipt for the filing. For electronic portal submissions, retain the confirmation number and screenshot. For email submissions, request and retain a read receipt. For U.S. mail submissions, retain the certified mail receipt and USPS tracking number. | ____
10. | Log the completed filing in the Regulatory Notification Tracker maintained by Sara Hendricks (to be finalized by August 25, 2023). Enter all required information, including filing date, filing method, confirmation number or tracking number, and any notes or special circumstances. | ____
Field | Entry
State: | ________
Filing Date: | ________
Filing Method: | Electronic Portal Email U.S. Mail Other: __
Confirmation Number / Tracking: | ________
Filed By: | ________
Enclosures Included: | Cover Letter Consumer Notification Letter State Form Substitute Notice Other: __
Secondary Agency Filing Made? | Yes No N/A — If Yes: Agency: __ Method: __ Confirmation: __
Notes / Special Circumstances: | ________

CALDERWOOD & HARKNESS LLP Attorneys at Law

MEMORANDUM

CALDERWOOD & HARKNESS LLP

Record

Parties

Dates

Amounts