DATA BREACH NOTIFICATION PURSUANT TO CONN. GEN. STAT. § 36a-701b
August 14, 2023
Filing Entity: Quorum Insurance Holdings Corp.
Submitted to: Office of the Attorney General State of Connecticut Consumer Protection Division
Attn: Assistant Attorney General Diane Marchetti
165 Capitol Avenue Hartford, CT 06106
Submitted by: Calderwood & Harkness LLP Counsel to Quorum Insurance Holdings Corp. Kevin Ostrowski, Responsible Partner Privacy & Data Security Practice Group 1700 K Street NW, Suite 900 Washington, D.C. 20006 Telephone: (202) 887-4100
Email: kostrowski@calderwoodharkness.com
Calderwood & Harkness Matter No. 1025-00006
I. COVER LETTER
August 14, 2023
CALDERWOOD & HARKNESS LLP ATTORNEYS AT LAW 1700 K Street NW, Suite 900 Washington, D.C. 20006 Telephone: (202) 887-4100 Facsimile: (202) 887-4199 www.calderwoodharkness.com
Via First Class U.S. Mail and Electronic Submission
Assistant Attorney General Diane Marchetti Office of the Attorney General State of Connecticut Consumer Protection Division 165 Capitol Avenue Hartford, CT 06106
Re: Data Breach Notification on Behalf of Quorum Insurance Holdings Corp. Pursuant to Conn. Gen. Stat. § 36a-701b — Calderwood & Harkness Matter No. 1025-00006
Dear Assistant Attorney General Marchetti:
1.1 Introduction and Purpose
We write on behalf of our client, Quorum Insurance Holdings Corp. ("Quorum" or the "Company"), a Delaware corporation headquartered at 400 Constitution Plaza, Suite 2200, Hartford, CT 06103, and publicly traded on the Nasdaq Stock Market under ticker symbol QIHC. Calderwood & Harkness LLP serves as outside counsel to Quorum in connection with the data security incident described herein.
This letter and the accompanying notification form are submitted pursuant to Connecticut General Statutes § 36a-701b to report a breach of security involving the personal information of Connecticut residents. Based on the investigation described more fully below and in the enclosed notification form, Quorum has determined that the personal information of 52,114 Connecticut residents was compromised as a result of a security incident involving a third-party vendor, Palomar Data Solutions, Inc. ("Palomar"), that processes certain claims data on behalf of Quorum's personal lines division.
We note that, in addition to this filing with the Office of the Attorney General, Quorum is simultaneously filing a notification with the Connecticut Insurance Department pursuant to Connecticut General Statutes § 38a-999b, directed to the attention of Richard Nakamura of the Financial Analysis Division, Cybersecurity Unit. Quorum takes the privacy and security of the personal information entrusted to it with the utmost seriousness and has taken, and continues to take, significant steps to respond to this incident, protect affected individuals, and hold its vendor accountable for the security failures that gave rise to the breach.
1.2 Contact Information for Quorum
The following individuals serve as the designated contacts for Quorum in connection with this incident and this filing:
General Counsel: Thomas R. Whitfield Quorum Insurance Holdings Corp. 400 Constitution Plaza, Suite 2200 Hartford, CT 06103 Telephone: (860) 714-3200
Email: twhitfield@quoruminsurance.com
Chief Privacy Officer: Jennifer Liang Quorum Insurance Holdings Corp. 400 Constitution Plaza, Suite 2200 Hartford, CT 06103 Telephone: (860) 714-3215
Email: jliang@quoruminsurance.com
Outside Counsel (Designated Primary Contact for Purposes of This Filing): Kevin Ostrowski, Partner Calderwood & Harkness LLP 1700 K Street NW, Suite 900 Washington, D.C. 20006 Telephone: (202) 887-4100
Email: kostrowski@calderwoodharkness.com
For purposes of all communications from the Office of the Attorney General regarding this filing, we respectfully request that inquiries be directed to Mr. Ostrowski as the designated primary point of contact.
1.3 Enclosures
The following documents are enclosed with this filing:
Enclosure 1: Completed Connecticut Attorney General Data Breach Notification Form (Section II of this filing).
Enclosure 2: Copy of consumer notification letter — General PII Version. This version is being sent to the majority of affected Connecticut residents whose personally identifiable information (name, date of birth, Social Security number, and/or driver's license number) was compromised in the incident.
Enclosure 3: Copy of consumer notification letter — SSN + Financial Data Version. This version is being sent to the subset of affected Connecticut residents whose financial information (bank account numbers and/or payment card numbers) was also compromised, in addition to the PII elements described above. This letter includes enhanced guidance specific to monitoring financial accounts and contacting financial institutions.
Enclosure 4: Copy of consumer notification letter — PHI Version (HIPAA-Compliant). This version is being sent to the subset of affected Connecticut residents whose protected health information — including health conditions, diagnosis codes, and treatment information associated with workers' compensation and health-related insurance claims — was compromised. This letter satisfies the notification requirements set forth in 45 C.F.R. § 164.404(c).
Consumer notification mailings to all 52,114 affected Connecticut residents will commence on August 18, 2023 and are expected to be substantially completed by approximately September 15, 2023. Each affected Connecticut resident will receive the version of the notification letter corresponding to the specific categories of personal information compromised with respect to that individual.
We appreciate the Office's attention to this matter and remain available to provide any additional information that may be requested. Please do not hesitate to contact me directly at the telephone number or email address provided above.
Respectfully submitted,
CALDERWOOD & HARKNESS LLP
By: ________
Kevin Ostrowski Partner, Privacy & Data Security Practice Group 1700 K Street NW, Suite 900 Washington, D.C. 20006 Telephone: (202) 887-4100
Email: kostrowski@calderwoodharkness.com
Counsel to Quorum Insurance Holdings Corp.
II. NOTIFICATION FORM / SUBSTANTIVE FILING
CONNECTICUT ATTORNEY GENERAL — DATA BREACH NOTIFICATION FORM Pursuant to Conn. Gen. Stat. § 36a-701b
2.1 Reporting Entity Information
Quorum Insurance Holdings Corp. is a diversified insurance holding company that operates through multiple subsidiaries engaged in property and casualty insurance, specialty lines insurance, life and annuity products, and financial technology services, including a proprietary digital underwriting platform and insurtech analytics capabilities. Quorum has maintained its corporate headquarters in Hartford, Connecticut since its founding in 1997 and holds a significant policyholder base within the State of Connecticut.
2.2 Third-Party Vendor Information (Source of the Breach)
The security incident that is the subject of this filing did not originate from Quorum's own information technology systems or network environment. Rather, the breach originated entirely within the systems and network environment of a third-party vendor, Palomar Data Solutions, Inc. ("Palomar"), which provides data processing services to Quorum.
Nature of Vendor Relationship. Palomar provides claims data processing, document management, and analytics services to Quorum's personal lines division. This relationship is governed by a Master Services Agreement dated November 12, 2019, as subsequently amended (the "MSA"). Under the MSA, Palomar receives, processes, stores, and manages certain policyholder and claimant data on Quorum's behalf in connection with the administration of personal lines insurance claims. The MSA contains extensive data security provisions, including requirements relating to information security safeguards, vulnerability management, penetration testing, incident response, breach notification, and indemnification, as further described in Section 2.6.6 below.
2.3 Description of the Security Incident
2.3.1 Nature of the Breach
On or about March 14, 2023, a threat actor exploited a known but unpatched remote code execution vulnerability, identified as CVE-2023-0669, in Palomar Data Solutions' GoAnywhere MFT (Managed File Transfer) file transfer appliance. The GoAnywhere MFT appliance was used by Palomar to facilitate the secure transfer of data files between Palomar's processing environment and its clients, including Quorum. The CVE-2023-0669 vulnerability, which was publicly disclosed by the vendor (Ridgeway Software) in early February 2023 and for which a patch was made available on or about February 7, 2023, allowed a remote, unauthenticated attacker to execute arbitrary code on a vulnerable GoAnywhere MFT instance.
By exploiting this vulnerability, the threat actor gained an initial foothold within Palomar's network environment. Following this initial compromise, the threat actor conducted lateral movement through Palomar's internal network, ultimately accessing Palomar's claims processing systems that contained data belonging to multiple Palomar clients, including Quorum. During the period of unauthorized access, the threat actor identified, staged, and exfiltrated structured data files containing personal information of Quorum policyholders and claimants. The exfiltrated data files included policyholder and claimant records associated with Quorum's personal lines property and casualty, specialty, and health-related insurance claims.
The forensic investigation conducted by Graystone Forensics LLC, as described more fully in Section 2.3.3 and Section 2.6.1 below, confirmed the attack vector, the scope of lateral movement within Palomar's environment, the identification of the specific systems and data repositories accessed by the threat actor, and the methodology and timeline of data exfiltration.
2.3.2 Duration of Unauthorized Access
Based on the findings of the forensic investigation, the timeline of the unauthorized access and data exfiltration is as follows:
• Initial Unauthorized Access: On or about March 14, 2023, when the threat actor exploited CVE-2023-0669 to gain access to Palomar's GoAnywhere MFT appliance.
• Exfiltration Window: March 14, 2023 through April 18, 2023, a period of approximately thirty-five (35) days. During this window, the threat actor conducted reconnaissance, lateral movement, data staging, and exfiltration activities within Palomar's network environment.
• Detection and Containment: On April 18, 2023, Palomar's Security Operations Center ("SOC") detected anomalous outbound data transfers from its network environment. Upon detection of this anomalous activity, Palomar's SOC initiated containment procedures that effectively ended the active exfiltration of data. Palomar subsequently engaged its internal incident response team and commenced an internal investigation.
The forensic evidence reviewed by Graystone Forensics LLC indicates that the threat actor had persistent access to portions of Palomar's network throughout the approximately 35-day exfiltration window. During this period, the threat actor accessed and exfiltrated data on multiple occasions, rather than in a single exfiltration event.
2.3.3 discovery and Notification Timeline
The following timeline sets forth the key dates relevant to the discovery, investigation, and notification process:
April 18, 2023: Palomar's Security Operations Center discovered anomalous outbound data transfers from its network environment. Palomar initiated internal incident response and containment procedures, which effectively terminated the active exfiltration of data.
April 21, 2023: Palomar notified Quorum of the security incident. Notification was provided via email from Derek Copeland, Palomar's General Counsel, to Thomas R. Whitfield, Quorum's General Counsel, and David Naranjo, Quorum's Chief Information Security Officer. The notification stated that Palomar had experienced a security incident that may have affected data belonging to Quorum and other Palomar clients and that Palomar's investigation was ongoing. As discussed in Section 2.6.6 below, this notification was provided approximately seventy-two (72) hours after Palomar's internal discovery of the incident, which was approximately twenty-four (24) hours late relative to the forty-eight (48) hour contractual notification requirement contained in Section 9.4 of the MSA.
May 4, 2023: Quorum engaged Calderwood & Harkness LLP as outside counsel to manage the incident response, including the forensic investigation, regulatory notification process, consumer notification process, and related legal matters.
May 5, 2023: Calderwood & Harkness LLP, on behalf of Quorum, retained Graystone Forensics LLC ("Graystone"), an incident response and digital forensics firm headquartered in Tysons Corner, Virginia, to conduct a comprehensive forensic investigation of the security incident. Graystone was retained under the attorney-client privilege umbrella, pursuant to an engagement agreement between Calderwood & Harkness and Graystone, to ensure that the forensic investigation was conducted at the direction of counsel and that the results would be protected by attorney-client privilege and the work product doctrine. The investigation was led by Dr. Nolan Briggs, Managing Director of Incident Response at Graystone, and Kendra Faulkner, Senior Forensic Analyst.
June 2, 2023: Graystone Forensics delivered its preliminary forensic findings to Calderwood & Harkness and Quorum. The preliminary findings confirmed that structured data files had been exfiltrated from Palomar's claims processing environment; identified the attack vector as the exploitation of CVE-2023-0669 in Palomar's GoAnywhere MFT appliance; confirmed the approximate exfiltration window of March 14, 2023 through April 18, 2023; and identified the general categories of data that were at risk. The preliminary findings further indicated that additional analysis — including data mining and affected individual identification — would be required to determine the full scope of compromised personal information and the specific individuals affected.
July 14, 2023: Graystone Forensics delivered its final forensic report to Calderwood & Harkness and Quorum. The final report confirmed the full scope of compromised data, identified the specific data elements at risk for each category of affected individual, and provided the basis for the subsequent data mining and affected individual identification process.
August 4, 2023: The data mining and affected individual identification process was completed. This process, which involved the review and analysis of the specific data files confirmed by Graystone Forensics to have been exfiltrated, resulted in the identification of 318,247 affected individuals across 29 states and the District of Columbia, including 52,114 Connecticut residents. The completion of this process on August 4, 2023 constitutes the date on which Quorum determined the scope of the breach and the identity of affected Connecticut residents for purposes of calculating the statutory notification timeline under Conn. Gen. Stat. § 36a-701b.
2.4 Types of Personal Information Compromised
2.4.1 Total Affected Population
The total number of individuals affected by this security incident, across all jurisdictions, is 318,247 individuals residing in twenty-nine (29) states and the District of Columbia. The State of Connecticut has the largest number of affected residents, which is consistent with Quorum's Hartford, Connecticut headquarters, its historical presence in the Connecticut insurance market, and its significant Connecticut policyholder and claimant base.
The breakdown of affected individuals by the most significantly impacted jurisdictions is as follows:
2.4.2 Categories of Information Compromised for Connecticut Residents
The forensic investigation and subsequent data mining process identified the following categories of personal information that were compromised with respect to affected Connecticut residents:
Personally Identifiable Information (PII): The personal information compromised for all 52,114 affected Connecticut residents includes one or more of the following data elements: full names, dates of birth, Social Security numbers, and driver's license numbers. These data elements were contained within the policyholder and claimant records maintained by Palomar in connection with Quorum's personal lines claims administration.
Financial Information: For a subset of the affected Connecticut residents, the compromised data also included financial information, specifically bank account numbers and/or payment card numbers. Across all affected jurisdictions, the subset of individuals whose financial information was compromised comprises 84,619 individuals. The Connecticut-specific subset is proportional to the overall Connecticut share of the affected population.
Protected Health Information (PHI): For a separate subset of affected Connecticut residents, the compromised data also included protected health information within the meaning of the Health Insurance Portability and Accountability Act of 1996 ("HIPAA") and its implementing regulations. Specifically, the compromised PHI includes health conditions, diagnosis codes (ICD-10 codes), and treatment information associated with workers' compensation claims and health-related insurance claims processed by Palomar on behalf of Quorum. Across all affected jurisdictions, the subset of individuals whose PHI was compromised comprises 41,203 individuals. The Connecticut-specific subset is proportional to the overall Connecticut share of the affected population.
Each affected Connecticut resident will receive a notification letter corresponding to the specific categories of personal information compromised with respect to that individual. As described in Section 1.3 of the cover letter, three versions of the notification letter have been prepared: a General PII version, an SSN + Financial Data version, and a PHI version.
2.4.3 Source of the Data
The compromised data originated from Quorum's personal lines claims files that were transmitted to and processed by Palomar Data Solutions under the terms of the Master Services Agreement. These claims files included policyholder and claimant records associated with property and casualty insurance claims, specialty lines insurance claims, and health-related insurance claims, including workers' compensation claims. The data was maintained by Palomar in its claims processing environment and was accessed and exfiltrated by the threat actor during the period of unauthorized access described in Section 2.3.2 above.
It is important to note that no electronic medical records, pharmacy records, or clinical treatment notes were compromised in this incident. The compromised PHI was limited to the health-related information contained within insurance claims records, such as diagnosis codes, descriptions of health conditions relevant to the claims, and treatment information as reported in connection with the claims adjudication process.
2.5 Number of Connecticut Residents Affected
The total number of Connecticut residents whose personal information was compromised in this security incident is 52,114. Connecticut is the state with the single largest number of affected residents, which is consistent with Quorum's longstanding presence as a Hartford-headquartered insurance company with a substantial Connecticut policyholder and claimant base.
2.6 Actions Taken in Response to the Breach
Quorum has taken, and continues to take, comprehensive steps to respond to this security incident, to protect the interests of affected individuals, and to mitigate the risk of harm resulting from the breach. The principal actions taken are described below.
2.6.1 Forensic Investigation
As described in Section 2.3.3 above, Quorum, through its outside counsel Calderwood & Harkness LLP, retained Graystone Forensics LLC to conduct a comprehensive forensic investigation of the security incident. Graystone Forensics is a nationally recognized incident response and digital forensics firm with extensive experience in investigating data security breaches in the insurance, financial services, and healthcare sectors. The forensic investigation was conducted under the attorney-client privilege umbrella, at the direction of Calderwood & Harkness, to ensure the protection of privileged communications and attorney work product.
The forensic investigation addressed the following key areas:
(a) Identification and confirmation of the attack vector, specifically the exploitation of the CVE-2023-0669 vulnerability in Palomar's GoAnywhere MFT appliance;
(b) Analysis of the threat actor's lateral movement within Palomar's network environment, including identification of the systems and data repositories accessed;
(c) Determination of the data exfiltration methodology, including the staging and transfer of structured data files;
(d) Establishment of the exfiltration timeline (March 14, 2023 through April 18, 2023);
(e) Identification of the specific data files exfiltrated and the categories of personal information contained therein; and
(f) Assessment of whether Quorum's own network and systems were accessed or compromised (the investigation confirmed that they were not).
Graystone Forensics delivered its preliminary forensic findings on June 2, 2023 and its final forensic report on July 14, 2023. The data mining and affected individual identification process, which was conducted based on the findings of the final forensic report, was completed on August 4, 2023.
2.6.2 Consumer Notification
Quorum will provide written notification to all 52,114 affected Connecticut residents by first-class U.S. mail. Consumer notification mailings will commence on August 18, 2023 and are expected to be substantially completed by approximately September 15, 2023.
Three versions of the consumer notification letter have been prepared to ensure that each affected individual receives notification that accurately describes the specific categories of personal information compromised with respect to that individual:
(a) General PII Version: This letter is being sent to affected Connecticut residents whose personally identifiable information (name, date of birth, Social Security number, and/or driver's license number) was compromised. This is the version that will be sent to the majority of affected Connecticut residents. A copy of this letter is enclosed as Enclosure 2.
(b) SSN + Financial Data Version: This letter is being sent to the subset of affected Connecticut residents whose financial information (bank account numbers and/or payment card numbers) was also compromised, in addition to the PII elements described above. This version includes enhanced guidance on monitoring financial accounts, contacting financial institutions to place alerts on accounts, and additional protective steps specific to financial information. A copy of this letter is enclosed as Enclosure 3.
(c) PHI Version (HIPAA-Compliant): This letter is being sent to the subset of affected Connecticut residents whose protected health information (health conditions, diagnosis codes, and treatment information from workers' compensation and health-related insurance claims) was compromised. This version satisfies all applicable notification requirements under HIPAA, including 45 C.F.R. § 164.404(c). A copy of this letter is enclosed as Enclosure 4.
Copies of all three versions of the consumer notification letter are enclosed with this filing as Enclosures 2, 3, and 4, respectively.
Each notification letter includes the following information: (i) a clear description of the security incident, including that the breach originated at Palomar Data Solutions; (ii) the specific types of personal information involved for that individual; (iii) a description of the steps Quorum has taken and is taking in response to the incident; (iv) recommended steps that individuals can take to protect themselves, including monitoring credit reports, reviewing financial account statements, and placing fraud alerts or credit freezes with the major credit bureaus; (v) an offer of twenty-four (24) months of complimentary credit monitoring and identity theft protection services, with enrollment instructions; and (vi) a dedicated toll-free call center number for affected individuals to obtain additional information and assistance.
2.6.3 Credit Monitoring and Identity Theft Protection
Quorum is offering all affected individuals — including all 52,114 affected Connecticut residents — twenty-four (24) months of complimentary credit monitoring and identity theft protection services. These services are being provided through Clearfield Notification Services LLC, a breach notification and identity protection services firm located in Independence, Ohio. The Clearfield engagement is managed by Jerome Tillman, Account Director.
The credit monitoring and identity theft protection services being offered include: three-bureau credit monitoring with alerts; identity theft insurance coverage; dark web monitoring; and identity restoration assistance.
In addition to the credit monitoring services, Quorum has established a dedicated toll-free call center, operated by Clearfield Notification Services, to answer questions from affected individuals and to assist with enrollment in the credit monitoring and identity theft protection program. The call center is staffed by trained representatives who are familiar with the details of the incident and can provide guidance on protective steps. The call center will operate for a period of twelve (12) weeks following the commencement of notification mailings (i.e., from approximately August 18, 2023 through approximately November 10, 2023). The toll-free call center number is included in all versions of the consumer notification letter.
2.6.4 Substitute Notice / Website Posting
In addition to the direct written notification described above, Quorum will publish a notice on its corporate website (www.quoruminsurance.com) describing the security incident, the types of personal information involved, and the steps that individuals can take to protect themselves, including instructions for enrolling in the complimentary credit monitoring and identity theft protection services. The website posting will be maintained for a period of not less than ninety (90) days following the commencement of consumer notification mailings.
2.6.5 Crisis Communications
Quorum retained BrightPath Consulting Group Inc., a crisis communications and public affairs advisory firm headquartered in New York, New York, to manage external and internal communications related to the security incident. The BrightPath engagement is led by Meredith Ashford, Managing Director. BrightPath has assisted Quorum with the development of public statements, media inquiries, employee communications, policyholder-facing communications, and stakeholder engagement in connection with the incident. BrightPath's involvement has been coordinated with Calderwood & Harkness to ensure that all external communications are consistent with the legal and regulatory response strategy.
2.6.6 Vendor Accountability
Quorum has taken significant steps to hold Palomar Data Solutions accountable for the security failures that caused this breach. These steps include, but are not limited to, the following:
Contractual Breach and Indemnification Demand. Calderwood & Harkness LLP, on behalf of Quorum, has issued a formal breach of contract and indemnification demand to Palomar Data Solutions. This demand is based on Palomar's failure to comply with its contractual data security obligations under the Master Services Agreement, as detailed below.
Contractual Security Obligations. The Master Services Agreement between Quorum and Palomar, dated November 12, 2019, as amended, contains comprehensive data security requirements in Exhibit D (Information Security Requirements), including, among other provisions:
(a) A requirement that Palomar maintain commercially reasonable administrative, technical, and physical safeguards to protect the confidentiality, integrity, and availability of Quorum data in Palomar's possession or control;
(b) A requirement that Palomar apply security patches to critical vulnerabilities within thirty (30) days of vendor patch release, and to high-severity vulnerabilities within sixty (60) days of vendor patch release;
(c) A requirement that Palomar conduct annual penetration testing of its network environment and applications that process Quorum data, performed by a qualified independent third party;
(d) A requirement that Palomar maintain a current SOC 2 Type II report, as audited by an independent certified public accounting firm. Palomar's most recent SOC 2 Type II report was audited by Kessler, Park & Associates CPA, PLLC, Dallas, Texas, and covered the period ending September 30, 2022; and
(e) A requirement in Section 9.4 of the MSA that Palomar notify Quorum of any actual or suspected security incident affecting Quorum data within forty-eight (48) hours of Palomar's discovery of such incident.
Palomar's Failures. The forensic investigation has established that Palomar failed to timely apply the security patch for CVE-2023-0669, which was publicly disclosed and for which a vendor patch was made available on or about February 7, 2023. The threat actor exploited this unpatched vulnerability on or about March 14, 2023 — approximately thirty-five (35) days after the patch was released and five (5) days beyond the thirty (30) day contractual patching deadline set forth in Exhibit D of the MSA. Palomar's failure to timely patch this critical vulnerability constituted a breach of its contractual data security obligations.
Additionally, Palomar's notification to Quorum of the security incident on April 21, 2023 — approximately seventy-two (72) hours after Palomar's internal discovery of the incident on April 18, 2023 — was approximately twenty-four (24) hours late relative to the forty-eight (48) hour contractual notification requirement in Section 9.4 of the MSA.
Status of Vendor Accountability Efforts. As of the filing date of this notification (August 14, 2023), Quorum's indemnification demand and vendor accountability negotiations with Palomar are ongoing. Palomar has, through its outside counsel, Mercer, Haight & Dunlop LLP, acknowledged receipt of the indemnification demand and indicated a willingness to engage in discussions regarding the allocation of breach-related costs. However, these discussions have not yet resulted in a resolution.
2.6.7 Quorum's Own Security Measures
It is important to note that the breach originated entirely within Palomar Data Solutions' network environment. The forensic investigation conducted by Graystone Forensics confirmed that Quorum's own network and information technology systems were not accessed or compromised as a result of this incident. The threat actor's unauthorized access was confined to Palomar's environment.
Quorum maintains its own comprehensive information security program, which is overseen by David Naranjo, Chief Information Security Officer, and Jennifer Liang, Chief Privacy Officer. Quorum's information security program includes, among other elements, enterprise risk management processes, network and endpoint security controls, access management protocols, encryption standards, vulnerability management procedures, security awareness training, and incident response planning.
Quorum also maintains a vendor risk management program, overseen by Priya Deshmukh, Vice President, Vendor Risk Management. This program includes vendor due diligence assessments conducted prior to onboarding, contractual security requirements (as reflected in the MSA with Palomar), periodic vendor security assessments, review of SOC 2 Type II reports and other third-party audit reports, and ongoing monitoring of vendor security posture.
In response to this incident, Quorum is conducting a thorough review of its vendor risk management practices and protocols and will implement enhancements to its vendor oversight program as appropriate based on the findings of that review. These enhancements may include, among other measures, increased frequency of vendor security assessments, enhanced contractual provisions relating to patch management and vulnerability remediation timelines, and expanded continuous monitoring capabilities for critical third-party vendors.
2.7 Law Enforcement Involvement
Quorum, through its outside counsel Calderwood & Harkness LLP, has been in contact with the Federal Bureau of Investigation ("FBI") regarding this security incident. On May 12, 2023, Calderwood & Harkness provided notification to the FBI's Cyber Division. Law enforcement has not requested a delay of notification to affected individuals in connection with this incident. Quorum continues to cooperate with law enforcement as appropriate and will continue to do so as requested.
Palomar Data Solutions has separately reported the security incident to the FBI, and the FBI's investigation into the broader CVE-2023-0669 exploitation campaign, which has affected multiple organizations, is ongoing.
2.8 Regulatory Notifications to Other Jurisdictions
In addition to this filing with the Connecticut Office of the Attorney General, Quorum is filing or will file data breach notifications with regulatory authorities in the following jurisdictions, as required by applicable law:
The total number of jurisdictions with affected residents is twenty-nine (29) states plus the District of Columbia, comprising a total of 318,247 affected individuals across all jurisdictions.
2.9 Insurance Coverage
Quorum maintains a cyber-liability insurance program, which was placed by Whitmore Risk Advisors Inc., an insurance brokerage firm located in New York, New York. The placement was managed by Sandra Whitmore-Kim, Lead Broker at Whitmore Risk Advisors. The cyber-liability insurance program consists of the following layers:
Primary Cyber-Liability Policy: Issuing Carrier: Atlas Mutual Insurance Company, Chicago, Illinois Policy Number: CYB-2023-041587 Per-Occurrence Limit: $15,000,000 Self-Insured Retention (SIR): $2,500,000 Policy Period: January 1, 2023 through January 1, 2024
Excess Cyber-Liability Policy: Issuing Carrier: Pinnacle Surplus Lines Insurance Corp., Boston, Massachusetts Policy Number: XS-CYB-2023-7812 Excess Coverage: $25,000,000 (excess of the $15,000,000 primary layer) Total Insurance Tower: $40,000,000 Policy Period: January 1, 2023 through January 1, 2024
Quorum filed an insurance claim with Atlas Mutual Insurance Company on May 8, 2023, under Claim Number CYB-CLM-2023-05892. Atlas Mutual has acknowledged the claim and coverage review is ongoing as of the date of this filing. The insurance program is expected to respond to covered breach-related costs, which may include forensic investigation costs, notification and credit monitoring expenses, legal fees, regulatory response costs, and certain other covered loss categories, subject to the terms and conditions of the applicable policies and the depletion of the self-insured retention.
2.10 Statutory Compliance
This notification is filed in compliance with Connecticut General Statutes § 36a-701b, which requires any person who conducts business in Connecticut and who, in the ordinary course of such person's business, owns, licenses, or maintains computerized data that includes personal information, to provide notice of a breach of security following discovery of the breach to any Connecticut resident whose personal information was, or is reasonably believed to have been, accessed by an unauthorized person.
Quorum conducts business in Connecticut and, in the ordinary course of its business, owns and maintains computerized data that includes personal information of Connecticut residents. As set forth in this filing, Quorum has determined that a breach of security, originating in the network environment of its third-party vendor Palomar Data Solutions, resulted in the unauthorized access to and exfiltration of personal information belonging to 52,114 Connecticut residents.
Determination Date. Quorum determined the scope of the breach and the identity of affected Connecticut residents on or about August 4, 2023, following the completion of the data mining and affected individual identification process based on the final forensic report dated July 14, 2023. This date — August 4, 2023 — constitutes the date on which Quorum became aware of the breach for purposes of calculating the statutory notification timeline.
Attorney General Notification. This filing is being submitted to the Office of the Attorney General on August 14, 2023, which is ten (10) days following the determination date of August 4, 2023. This filing is made well within the statutory timeframe required by Conn. Gen. Stat. § 36a-701b.
Consumer Notification. Written notification to affected Connecticut residents will be mailed commencing August 18, 2023, which is fourteen (14) days following the determination date. Consumer notification mailings are expected to be substantially completed by approximately September 15, 2023. This notification timeline is within the statutory timeframe, which requires notification without unreasonable delay but not later than sixty (60) days after the discovery of the breach.
Quorum has not requested and does not intend to request a delay of notification from law enforcement or any other authority. No law enforcement agency has requested that Quorum delay notification to affected individuals.
III. ENCLOSURE 1: CONSUMER NOTIFICATION LETTER — GENERAL PII VERSION
[QUORUM INSURANCE HOLDINGS CORP. LETTERHEAD] 400 Constitution Plaza, Suite 2200 Hartford, CT 06103
August 10, 2023
[Recipient Name] [Recipient Address] [City, State ZIP]
Re: Notice of Data Breach
Dear [Recipient Name]:
We are writing to inform you of a security incident involving a third-party vendor that may have affected some of your personal information. We take the privacy and security of the information entrusted to us very seriously, and we are providing this notice to explain the incident, the steps we have taken in response, and the steps you can take to protect yourself.
What Happened?
Quorum Insurance Holdings Corp. ("Quorum") uses a third-party vendor, Palomar Data Solutions, Inc. ("Palomar"), to assist with processing certain insurance claims data. On or about March 14, 2023, an unauthorized individual exploited a software vulnerability in Palomar's file transfer system to gain access to Palomar's network environment. The unauthorized individual accessed and removed certain data files from Palomar's systems between approximately March 14, 2023 and April 18, 2023, when Palomar's security team detected the unauthorized activity and took steps to contain it.
Palomar notified Quorum of the incident on April 21, 2023. Quorum immediately engaged outside counsel and a leading forensic investigation firm to investigate the matter. The forensic investigation has confirmed that certain files containing personal information of Quorum policyholders and claimants, including yours, were accessed and removed from Palomar's systems.
What Information Was Involved?
Based on our investigation, the personal information involved in this incident for you includes your name, date of birth, Social Security number, and/or driver's license number.
What We Are Doing.
Upon learning of this incident, Quorum took immediate steps to investigate and respond. We engaged Calderwood & Harkness LLP as outside counsel and retained a nationally recognized forensic investigation firm to conduct a comprehensive investigation. We have worked closely with Palomar to understand the full scope of the incident and to confirm that the vulnerability has been remediated. We have notified the appropriate regulatory authorities, including the Connecticut Attorney General's Office and the Federal Bureau of Investigation. We have also taken steps to hold Palomar accountable for this incident, including through the exercise of our contractual rights. Additionally, we are reviewing and enhancing our vendor oversight practices.
What You Can Do.
We recommend that you take the following steps to help protect your personal information:
• Monitor your credit reports. You are entitled to one free credit report annually from each of the three major credit reporting agencies. To request your free credit report, visit www.annualcreditreport.com or call 1-877-322-8228.
• Review your financial account statements. Carefully review all account statements and explanation of benefits forms for any unauthorized or suspicious activity.
• Consider placing a fraud alert on your credit files. A fraud alert tells creditors to verify your identity before opening any new accounts in your name. To place a fraud alert, contact any one of the three major credit reporting agencies: Harborview Enterprises (1-800-525-6285), Penrose Group (1-888-397-3742), or Penmark Enterprises (1-800-680-7289). The agency you contact will notify the other two.
• Consider placing a credit freeze on your credit files. A credit freeze restricts access to your credit report, making it more difficult for new accounts to be opened in your name. You can place a credit freeze by contacting each of the three major credit reporting agencies directly. Under Connecticut law, you may place, temporarily lift, or permanently remove a credit freeze at no charge.
• Be vigilant for signs of identity theft. If you believe you are a victim of identity theft, you should file a report with your local law enforcement agency, the Federal Trade Commission (www.identitytheft.gov or 1-877-438-4338), and the Connecticut Attorney General's Office.
Complimentary Credit Monitoring and Identity Theft Protection Services.
To help protect you against the potential misuse of your information, we are offering you 24 months of complimentary credit monitoring and identity theft protection services through Clearfield Notification Services LLC. These services include three-bureau credit monitoring with alerts, identity theft insurance coverage, dark web monitoring, and identity restoration assistance.
To enroll, please visit [enrollment website URL] and use the activation code provided below, or call our dedicated toll-free number at 1-833-XXX-XXXX. You must enroll by November 18, 2023 to take advantage of this complimentary offer.
Your Activation Code: [Unique Code]
For More Information.
If you have any questions about this incident or need assistance, please call our dedicated toll-free call center at 1-833-XXX-XXXX. Representatives are available Monday through Friday, 9:00 a.m. to 9:00 p.m. Eastern Time, and Saturday, 10:00 a.m. to 7:00 p.m. Eastern Time.
We sincerely regret that this incident occurred and apologize for any inconvenience or concern it may cause you. We are committed to protecting the information entrusted to us and are taking every step we can to prevent something like this from happening again.
Sincerely,
Thomas R. Whitfield General Counsel Quorum Insurance Holdings Corp. 400 Constitution Plaza, Suite 2200 Hartford, CT 06103
This notification letter was prepared by Calderwood & Harkness LLP (Alan Burke and Sara Hendricks) on behalf of Quorum Insurance Holdings Corp.
IV. ENCLOSURE 2: CONSUMER NOTIFICATION LETTER — SSN + FINANCIAL DATA VERSION
[QUORUM INSURANCE HOLDINGS CORP. LETTERHEAD] 400 Constitution Plaza, Suite 2200 Hartford, CT 06103
August 10, 2023
[Recipient Name] [Recipient Address] [City, State ZIP]
Re: Notice of Data Breach — Financial Information
Dear [Recipient Name]:
We are writing to inform you of a security incident involving a third-party vendor that may have affected some of your personal information, including certain financial information. We take the privacy and security of the information entrusted to us very seriously, and we are providing this notice to explain the incident, the steps we have taken in response, and the steps you can take to protect yourself.
What Happened?
Quorum Insurance Holdings Corp. ("Quorum") uses a third-party vendor, Palomar Data Solutions, Inc. ("Palomar"), to assist with processing certain insurance claims data. On or about March 14, 2023, an unauthorized individual exploited a software vulnerability in Palomar's file transfer system to gain access to Palomar's network environment. The unauthorized individual accessed and removed certain data files from Palomar's systems between approximately March 14, 2023 and April 18, 2023, when Palomar's security team detected the unauthorized activity and took steps to contain it.
Palomar notified Quorum of the incident on April 21, 2023. Quorum immediately engaged outside counsel and a leading forensic investigation firm to investigate the matter. The forensic investigation has confirmed that certain files containing personal information of Quorum policyholders and claimants, including yours, were accessed and removed from Palomar's systems.
What Information Was Involved?
Based on our investigation, the personal information involved in this incident for you includes your name, date of birth, Social Security number, and/or driver's license number. In addition, your financial information — specifically your bank account number and/or payment card number — was also included in the compromised data files. This financial information was contained in records related to your insurance claims with Quorum.
What We Are Doing.
Upon learning of this incident, Quorum took immediate steps to investigate and respond. We engaged Calderwood & Harkness LLP as outside counsel and retained a nationally recognized forensic investigation firm to conduct a comprehensive investigation. We have worked closely with Palomar to understand the full scope of the incident and to confirm that the vulnerability has been remediated. We have notified the appropriate regulatory authorities, including the Connecticut Attorney General's Office and the Federal Bureau of Investigation. We have also taken steps to hold Palomar accountable for this incident, including through the exercise of our contractual rights. Additionally, we are reviewing and enhancing our vendor oversight practices.
What You Can Do.
Because your financial information was involved in this incident, we recommend that you take the following steps in addition to the general protective measures described below:
• Contact your bank or financial institution. If your bank account number was involved, you should contact your bank or financial institution to discuss options for protecting your account, which may include closing the account and opening a new one, placing alerts on your account, or monitoring your account for unauthorized transactions.
• Contact your payment card issuer. If your payment card number was involved, you should contact the card issuer to report the potential compromise and request a replacement card. Review your card statements carefully for any unauthorized transactions. Most card issuers have zero-liability policies for unauthorized charges, but prompt reporting is important.
• Monitor your credit reports. You are entitled to one free credit report annually from each of the three major credit reporting agencies. To request your free credit report, visit www.annualcreditreport.com or call 1-877-322-8228.
• Review all financial account statements. Carefully review all bank account statements, payment card statements, and explanation of benefits forms for any unauthorized or suspicious activity. Report any suspicious activity to your financial institution immediately.
• Consider placing a fraud alert on your credit files. A fraud alert tells creditors to verify your identity before opening any new accounts in your name. To place a fraud alert, contact any one of the three major credit reporting agencies: Harborview Enterprises (1-800-525-6285), Penrose Group (1-888-397-3742), or Penmark Enterprises (1-800-680-7289). The agency you contact will notify the other two.