NOTIFICATION OF CYBERSECURITY EVENT
PURSUANT TO CONN. GEN. STAT. § 38a-999b
Filing Date: August 14, 2023
Filed by: Calderwood & Harkness LLP, as outside counsel to Quorum Insurance Holdings Corp.
Filed with: Connecticut Insurance Department, Financial Analysis Division, Cybersecurity Unit
Attention: Richard Nakamura, Examiner
Connecticut Insurance Department 153 Market Street Hartford, CT 06103
Filing Contact:
Kevin Ostrowski, Partner Privacy & Data Security Practice Group Calderwood & Harkness LLP 1700 K Street NW, Suite 900 Washington, D.C. 20006 Telephone: (202) 555-8100 Facsimile: (202) 555-8101
Email: kostrowski@calderwoodharkness.com
Calderwood & Harkness Matter No.: 1025-00006
I. COVER LETTER
August 14, 2023
Richard Nakamura, Examiner Financial Analysis Division, Cybersecurity Unit Connecticut Insurance Department 153 Market Street Hartford, CT 06103
Re: Notification of Cybersecurity Event Pursuant to Conn. Gen. Stat. § 38a-999b — Quorum Insurance Holdings Corp. Calderwood & Harkness Matter No.: 1025-00006
Dear Mr. Nakamura:
1.1 Purpose of Filing
Calderwood & Harkness LLP respectfully submits this notification on behalf of its client, Quorum Insurance Holdings Corp. ("Quorum" or the "Company"), a Delaware corporation publicly traded on the Nasdaq Stock Market under the ticker symbol "QIHC," with its principal place of business and corporate headquarters located at 400 Constitution Plaza, Suite 2200, Hartford, CT 06103. Quorum's Employer Identification Number is 06-4832197.
This filing is made pursuant to Section 38a-999b of the Connecticut General Statutes (the "Connecticut Insurance Data Security Law"), which requires licensees to notify the Commissioner of Insurance of a cybersecurity event no later than three business days after the licensee has made a determination that a cybersecurity event has occurred. This notification is being submitted within the statutory timeframe following Quorum's determination that the cybersecurity event described herein affects Quorum's policyholder and claimant data, including the personal information of 52,114 Connecticut residents.
As more fully described in the sections that follow, the cybersecurity event at issue originated not within Quorum's own network environment, but rather within the systems of Quorum's third-party claims-processing vendor, Palomar Data Solutions, Inc. ("Palomar"). Quorum has undertaken a thorough forensic investigation of the incident, has identified the affected individuals and data elements, and is in the process of providing notification to all affected consumers and to the appropriate state and federal regulatory authorities.
1.2 Counsel Identification
Calderwood & Harkness LLP represents Quorum Insurance Holdings Corp. in connection with this cybersecurity event, including the forensic investigation, regulatory notification obligations, consumer notification, vendor indemnification, and all related legal matters. The engagement team assigned to this matter is as follows:
• Kevin Ostrowski, Partner — Responsible Partner
• Rachel Bernstein, Partner — Billing Partner
• Alan Burke, Associate — Lead Associate
• Sara Hendricks, Associate — Working Associate
All inquiries and correspondence from the Connecticut Insurance Department regarding this filing and this matter should be directed to:
Kevin Ostrowski, Partner Alan Burke, Associate Calderwood & Harkness LLP 1700 K Street NW, Suite 900 Washington, D.C. 20006 Telephone: (202) 555-8100 Facsimile: (202) 555-8101
Email: kostrowski@calderwoodharkness.com / aburke@calderwoodharkness.com
The following individuals at Quorum are also available as contacts as needed, and may be reached through counsel in the first instance:
• Thomas R. Whitfield, Executive Vice President and General Counsel
• Jennifer Liang, Chief Privacy Officer
• David Naranjo, Chief Information Security Officer
1.3 Concurrent Filings
Quorum wishes to advise the Department that, in addition to this filing with the Connecticut Insurance Department, Quorum is concurrently filing notification with the Connecticut Attorney General's Office pursuant to Conn. Gen. Stat. § 36a-701b. That filing was submitted on August 14, 2023, the same date as this notification.
Additionally, Quorum is preparing to file notification with the U.S. Department of Health and Human Services, Office for Civil Rights ("HHS OCR"), pursuant to 45 C.F.R. § 164.408, in connection with the subset of 41,203 individuals whose protected health information ("PHI") was compromised in this cybersecurity event. That filing is scheduled for submission on August 15, 2023. Because the PHI component of this incident affects more than 500 individuals, Quorum understands that notification to HHS OCR must be provided without unreasonable delay and no later than sixty (60) calendar days after discovery of the breach, and this filing will be made well within that timeframe.
Additional state regulatory notifications are being filed on a rolling basis during the period of August 14 through August 25, 2023, across all twenty-nine (29) affected states and the District of Columbia. Quorum has developed a comprehensive regulatory notification schedule to ensure timely compliance with all applicable state breach notification statutes and insurance data security laws.
1.4 Enclosures. Accompanying this notification filing are the following enclosures, which are referenced at various points throughout this submission:
• Enclosure 1: Sample Consumer Notification Letter — General PII Version
• Enclosure 2: Sample Consumer Notification Letter — SSN + Financial Data Version
• Enclosure 3: Sample Consumer Notification Letter — PHI Version (HIPAA-Compliant)
• Enclosure 4: Incident Timeline Summary (key dates from March 14, 2023 through August 14, 2023)
• Enclosure 5: Description of Credit Monitoring and Identity Theft Protection Services Offered (24-month program through Clearfield Notification Services LLC)
Quorum respectfully requests that the Department review these enclosures in conjunction with the body of this notification.
II. IDENTIFICATION OF REPORTING ENTITY
2.1 Licensee Information
The reporting entity filing this notification is Quorum Insurance Holdings Corp. ("Quorum" or the "Company"). The following information is provided to identify the reporting entity:
Quorum is a Top-25 U.S. insurance holding company, as measured by annual direct premiums written. Quorum conducts its insurance operations through a network of operating subsidiaries that are licensed in all fifty (50) states, the District of Columbia, and several U.S. territories. Quorum's business encompasses three principal operating segments: (i) Property & Casualty, which includes personal lines (homeowners, automobile, umbrella) and commercial lines (general liability, commercial property, commercial automobile, workers' compensation); (ii) Specialty Lines, which includes professional liability, directors & officers, errors & omissions, cyber-liability, and surplus lines products; and (iii) Life & Annuity, which includes term life, whole life, universal life, and fixed and variable annuity products.
In addition to its traditional insurance operations, Quorum has invested significantly in its proprietary financial technology platform, QuorumEdge, which provides digital underwriting capabilities, automated claims intake, and data analytics tools to Quorum's operating subsidiaries and, on a limited basis, to select third-party insurance carriers under licensing agreements.
2.2 Nature of Licensee's Connecticut Operations
Quorum maintains its corporate headquarters in Hartford, Connecticut, and conducts substantial insurance operations within the State of Connecticut. Quorum's Connecticut-licensed operating subsidiaries offer personal and commercial lines products, specialty insurance products, and life and annuity products to Connecticut residents and businesses. Quorum employs approximately 2,800 individuals at its Hartford headquarters and at regional offices in Stamford and New Haven.
Quorum's Connecticut policyholder and claimant population is significant. As set forth more fully in Section IV below, 52,114 Connecticut residents have been identified as affected by the cybersecurity event that is the subject of this notification. These Connecticut residents include current and former policyholders, claimants, and individuals whose information was processed in connection with claims filed under Quorum's personal lines insurance products.
Quorum's personal lines division outsources certain claims data processing, document management, and analytics functions to a third-party vendor, Palomar Data Solutions, Inc. ("Palomar"), which is discussed at length in Section III of this notification. The outsourcing arrangement with Palomar is governed by a Master Services Agreement and associated data security exhibits, which are described in detail in Section VI below. The cybersecurity event at issue arose within Palomar's network environment, and Quorum's own network and systems were not directly compromised.
III. DESCRIPTION OF THE CYBERSECURITY EVENT
3.1 Summary of the Event
The cybersecurity event that is the subject of this notification originated at Quorum's third-party claims-processing vendor, Palomar Data Solutions, Inc. ("Palomar"), a Texas corporation with its principal place of business at 7100 Greenville Avenue, Suite 450, Dallas, TX 75231. Palomar provides claims data processing, document management, and analytics services to Quorum's personal lines division under a Master Services Agreement dated November 12, 2019 (the "MSA"), as amended by Amendment 1, dated March 3, 2021, and Amendment 2, dated September 15, 2022. The annual contract value under the MSA is approximately $16.3 million (as adjusted pursuant to Amendment 1). Quorum is understood to be Palomar's second-largest client by revenue, with the original annual contract value of approximately $14.2 million having been increased to $16.3 million upon execution of Amendment 1, which expanded the scope of services to include data processing related to Quorum's QuorumEdge digital underwriting platform.
In summary, a threat actor exploited a known but unpatched remote code execution vulnerability, designated CVE-2023-0669, in Palomar's GoAnywhere MFT (Managed File Transfer) appliance. This vulnerability allowed the threat actor to gain unauthorized access to Palomar's network environment, conduct lateral movement within that environment over a period of approximately thirty-five (35) days, and exfiltrate structured data files from Palomar's claims processing environment. Those structured data files contained personal information, financial information, and protected health information belonging to Quorum's policyholders and claimants, including 52,114 Connecticut residents.
It is important to note at the outset that the forensic investigation has confirmed that Quorum's own network, systems, and infrastructure were not compromised as a result of this incident. The unauthorized access and data exfiltration occurred entirely within Palomar's network environment.
3.2 Detailed Timeline of the Event
The following detailed timeline sets forth the key events and dates associated with this cybersecurity event. A summary version of this timeline is also included as Enclosure 4 to this filing.
On or about March 14, 2023 — Initial Unauthorized Access. A threat actor exploited CVE-2023-0669, a critical remote code execution vulnerability affecting Severin Corporation's GoAnywhere MFT file transfer appliance, to gain initial unauthorized access to Palomar's network environment. CVE-2023-0669 was publicly disclosed on February 1, 2023, and a patch was made available by the vendor, Severin Corporation (formerly Strathmore Industries), on February 7, 2023. As of the date of the threat actor's exploitation, Palomar had not applied the available patch, despite the vulnerability having been publicly known for approximately five weeks and despite the patch having been available for approximately five weeks.
March 14, 2023 through April 18, 2023 (approximately 35 days) — Lateral Movement and Exfiltration Period. Following the initial unauthorized access, the threat actor conducted lateral movement through Palomar's internal network, ultimately accessing Palomar's claims processing environment where Quorum policyholder and claimant data was stored and processed. During this approximately thirty-five (35) day window, the threat actor identified, staged, and exfiltrated structured data files containing Quorum policyholder and claimant data. The forensic investigation conducted by Graystone Forensics LLC (described in Section V.1 below) determined that the exfiltration occurred in multiple discrete events over this period, with the largest volume of data exfiltrated during the period of April 3 through April 16, 2023.
April 18, 2023 — Detection by Palomar. Palomar's Security Operations Center ("SOC") detected unusual outbound data transfer patterns indicative of unauthorized exfiltration activity. Upon identifying the anomalous activity, Palomar's SOC initiated its internal incident response protocols and took immediate steps to contain the intrusion, including isolating the affected GoAnywhere MFT appliance, terminating suspicious network connections, and engaging its internal cybersecurity team for further investigation. April 18, 2023 marks the end of the exfiltration window.
April 21, 2023 — Initial Notification from Palomar to Quorum. Palomar provided its initial notification of the security incident to Quorum via email communication from Derek Copeland, Palomar's General Counsel, to Thomas R. Whitfield, Quorum's General Counsel, and David Naranjo, Quorum's Chief Information Security Officer. This initial notification described the incident in general terms, advised that Palomar had detected unauthorized access to its network, and indicated that the scope of the incident was still being assessed. Quorum notes that Palomar's notification on April 21, 2023 — three calendar days after Palomar's internal discovery on April 18, 2023 — was approximately twenty-four (24) hours beyond the contractual forty-eight (48) hour notification requirement set forth in Section 9.4 of the MSA. The implications of this delay are discussed further in Section VI of this filing.
May 4, 2023 — Engagement of Outside Counsel. Quorum formally engaged Calderwood & Harkness LLP as outside counsel to manage the incident response, oversee the forensic investigation, and coordinate regulatory and consumer notification obligations. Prior to the formal engagement of Calderwood & Harkness, Quorum's internal legal team, led by General Counsel Thomas R. Whitfield and Chief Privacy Officer Jennifer Liang, had initiated preliminary assessment and response activities, including internal communications with Quorum's information security team and initial coordination with Palomar regarding the scope of the incident.
May 5, 2023 — Retention of Forensic Investigator. At the direction of Calderwood & Harkness LLP, and under the umbrella of the attorney-client privilege and work product doctrine, Quorum retained Graystone Forensics LLC ("Graystone"), a cybersecurity incident response and digital forensics firm headquartered at 1950 Old Gallows Road, Suite 600, Tysons Corner, VA 22182, to conduct a comprehensive forensic investigation of the cybersecurity event. The Graystone engagement was led by Dr. Nolan Briggs, Managing Director, Incident Response, with Kendra Faulkner, Senior Forensic Analyst, serving as the analyst lead. Graystone's engagement was structured under a letter agreement with Calderwood & Harkness to preserve the privileged nature of the investigation and its findings.
June 2, 2023 — Preliminary Forensic Findings. Graystone Forensics delivered its preliminary forensic findings report to Calderwood & Harkness LLP. The preliminary report confirmed the attack vector (exploitation of CVE-2023-0669 in Palomar's GoAnywhere MFT appliance), confirmed that structured data files containing Quorum policyholder and claimant data had been exfiltrated from Palomar's claims processing environment, and provided an initial assessment of the categories of data involved. The preliminary report indicated that further analysis was required to determine the full scope of affected individuals and the specific data elements compromised for each individual.
July 14, 2023 — Final Forensic Investigation Report. Graystone Forensics delivered its final forensic investigation report to Calderwood & Harkness LLP. The final report confirmed the full scope of compromised data, including the specific data types affected (PII, financial information, and PHI), and provided detailed findings regarding the number of affected individuals and the geographic distribution of those individuals across all affected states and the District of Columbia. The final report confirmed that a total of 318,247 unique individuals were affected by the cybersecurity event.
August 4, 2023 — Data Mining and Identification of Affected Individuals Completed. Following receipt of the final forensic report, Quorum engaged in a comprehensive data mining and affected-individual identification process to match the compromised data elements to specific individuals and to determine the applicable notification obligations for each affected individual based on the individual's state of residence and the specific data types compromised. This process was completed on August 4, 2023, at which point Quorum had identified all 318,247 affected individuals, including the 52,114 Connecticut residents, and had determined the appropriate notification letter version for each individual.
August 14, 2023 — Regulatory Filings. This notification filing is submitted to the Connecticut Insurance Department, and a concurrent filing is submitted to the Connecticut Attorney General's Office, on this date. Consumer notification letters are scheduled to commence mailing on August 18, 2023.
3.3 Nature of the Unauthorized Access
The forensic investigation conducted by Graystone Forensics LLC has confirmed the following findings regarding the nature of the unauthorized access:
Attack Vector. The threat actor exploited CVE-2023-0669, a critical remote code execution vulnerability in Severin Corporation's GoAnywhere MFT (Managed File Transfer) appliance, which was deployed within Palomar's network environment to facilitate secure file transfers. This vulnerability was publicly disclosed by Severin Corporation on February 1, 2023, and received a Common Vulnerability Scoring System ("CVSS") base score of 7.2, indicating a "High" severity rating. A security patch addressing the vulnerability was released by Severin Corporation on February 7, 2023. The vulnerability was subsequently added to the Cybersecurity and Infrastructure Security Agency's ("CISA") Known Exploited Vulnerabilities ("KEV") catalog on February 10, 2023, reflecting active exploitation in the wild.
Failure to Patch. As of the date of the threat actor's exploitation of the vulnerability on or about March 14, 2023, Palomar had not applied the available patch to its GoAnywhere MFT appliance. The patch had been available for approximately thirty-five (35) days at the time of exploitation. Palomar's failure to timely apply the patch is significant in the context of Palomar's contractual obligations to Quorum. Specifically, Exhibit D (Data Security Exhibit) of the MSA, as amended by Amendment 2 (September 15, 2022), requires Palomar to apply patches for critical vulnerabilities within thirty (30) days of the vendor's patch release. As described in Section VI of this filing, Palomar's failure to meet this contractual obligation is one of the identified vendor deficiencies that enabled the cybersecurity event.
Lateral Movement and Exfiltration. Following the initial compromise of the GoAnywhere MFT appliance, the threat actor conducted lateral movement through Palomar's internal network over the course of approximately thirty-five (35) days (March 14 through April 18, 2023). The threat actor gained access to Palomar's claims processing environment, identified and staged structured data files containing Quorum policyholder and claimant data, and exfiltrated those files from Palomar's network. The forensic investigation determined that the data was exfiltrated through encrypted channels to external infrastructure controlled by the threat actor. Graystone Forensics has assessed with moderate-to-high confidence that the threat actor's tactics, techniques, and procedures are consistent with those attributed to the Cl0p ransomware group, which was widely reported to have exploited CVE-2023-0669 across numerous organizations during the early months of 2023.
Scope of Compromise — Confined to Palomar. The forensic investigation has confirmed that there was no direct compromise of Quorum's own network, systems, or infrastructure as a result of this cybersecurity event. The unauthorized access and data exfiltration occurred entirely within Palomar's environment. Quorum has conducted enhanced monitoring of its own network environment since being notified of the incident and has found no evidence of any unauthorized access to Quorum's systems.
IV. DESCRIPTION OF INFORMATION INVOLVED
4.1 Types of Personal Information Compromised
The forensic investigation has confirmed that the following categories of personal information were compromised in this cybersecurity event:
Personally Identifiable Information (PII). The compromised data includes the following PII elements: full names (first and last), dates of birth, Social Security numbers, and driver's license numbers. These PII elements were compromised for all 318,247 affected individuals. This information was maintained by Palomar in connection with its claims data processing services for Quorum's personal lines division and was used for purposes of claims intake, identity verification, and claims adjudication.
Financial Information. For a subset of 84,619 affected individuals, the compromised data also includes financial information, specifically bank account numbers (including routing numbers) and/or payment card numbers. This financial information was collected and processed by Palomar in connection with claims payment processing, including direct deposit instructions and electronic funds transfer authorizations provided by claimants in the course of the claims resolution process.
Protected Health Information (PHI). For a subset of 41,203 affected individuals, the compromised data also includes protected health information as defined under the Health Insurance Portability and Accountability Act of 1996 ("HIPAA") and its implementing regulations. Specifically, the compromised PHI includes health conditions, diagnosis codes (ICD-10-CM codes), and treatment information derived from workers' compensation claims and health-related insurance claims processed by Palomar on behalf of Quorum. Quorum is a covered entity under HIPAA with respect to certain of its insurance products, and Palomar operates as a business associate of Quorum with respect to the processing of PHI.
4.2 Scope of Affected Individuals
The data mining and affected-individual identification process completed on August 4, 2023 determined that the cybersecurity event affects a total of 318,247 unique individuals across twenty-nine (29) states and the District of Columbia.
The geographic distribution of affected individuals is set forth in the table below:
Connecticut represents the single largest affected population, reflecting Quorum's substantial operations and policyholder base in its home state.
4.3 Source of Compromised Data
The compromised data was held by Palomar Data Solutions, Inc. in its capacity as Quorum's claims data processing vendor for the personal lines division. The data was processed by Palomar pursuant to the Master Services Agreement dated November 12, 2019, as amended by Amendment 1 (March 3, 2021) and Amendment 2 (September 15, 2022). The scope of data processed by Palomar included claims data related to Quorum's traditional personal lines insurance products as well as data related to the QuorumEdge digital underwriting platform, which was added to the scope of Palomar's services pursuant to Amendment 1 in March 2021.
The data processed by Palomar included both active and historical claims data. Palomar's data retention practices, as specified in the MSA, permitted Palomar to retain claims data for up to seven (7) years following the closure of a claim. As a result, the affected data includes information associated with claims dating back to approximately 2016, as well as claims that were open and active at the time of the cybersecurity event.
V. ACTIONS TAKEN IN RESPONSE TO THE CYBERSECURITY EVENT
5.1 Forensic Investigation
Upon being notified of the security incident by Palomar on April 21, 2023, Quorum took immediate steps to assess the nature and scope of the incident and to engage appropriate external resources. Following an internal preliminary assessment, Quorum engaged Calderwood & Harkness LLP as outside counsel on May 4, 2023, and Calderwood & Harkness subsequently retained Graystone Forensics LLC ("Graystone") on May 5, 2023, to conduct a comprehensive forensic investigation.
Graystone Forensics LLC is a nationally recognized cybersecurity incident response and digital forensics firm headquartered at 1950 Old Gallows Road, Suite 600, Tysons Corner, VA 22182. Graystone specializes in cybersecurity incident response, digital forensics, threat intelligence, and expert witness services, and has conducted forensic investigations in connection with numerous high-profile data security incidents across the insurance, financial services, healthcare, and technology sectors. The Graystone engagement for this matter was led by Dr. Nolan Briggs, Managing Director, Incident Response, with Kendra Faulkner, Senior Forensic Analyst, serving as the analyst lead.
Graystone's engagement was structured as a retention by Calderwood & Harkness LLP, acting as counsel to Quorum, for the purpose of providing expert forensic services to assist counsel in rendering legal advice to Quorum regarding the cybersecurity event. This structure was adopted to preserve the attorney-client privilege and work product doctrine protections applicable to the forensic investigation and its findings.
The forensic investigation encompassed the following principal activities: (i) analysis of available log data and network artifacts from Palomar's environment (in coordination with Palomar's internal security team and Palomar's own forensic consultants); (ii) identification and analysis of the attack vector, including confirmation of the exploitation of CVE-2023-0669; (iii) determination of the scope of the threat actor's access within Palomar's network; (iv) identification of the specific data files accessed and exfiltrated; (v) analysis of the content of the exfiltrated data files to determine the categories of personal information compromised; and (vi) assessment of the number and identity of affected individuals.
Graystone Forensics delivered its preliminary forensic findings report to Calderwood & Harkness LLP on June 2, 2023. The preliminary report confirmed the attack vector, confirmed that structured data files containing Quorum policyholder and claimant data had been exfiltrated, and provided an initial assessment of the data categories involved. Graystone Forensics delivered its final forensic investigation report on July 14, 2023, which confirmed the full scope of compromised data, the specific data types affected, and the total number of affected individuals.
5.2 Internal Response Measures by Quorum
In addition to the retention of outside counsel and forensic investigators, Quorum undertook the following internal response measures:
Activation of Incident Response Plan. Quorum activated its formal incident response plan on May 4, 2023. The incident response plan, which is maintained and periodically updated under the oversight of David Naranjo, Chief Information Security Officer, establishes protocols for the assessment, containment, investigation, and remediation of cybersecurity events, as well as for internal and external communications. Activation of the plan triggered the convening of Quorum's Incident Response Team, which includes representatives from the Information Security, Legal, Privacy, Claims Operations, Communications, and Executive Leadership functions.
Legal Hold. Quorum's legal department issued a legal hold notice on May 4, 2023, directed to the Information Technology and Claims Operations departments. The legal hold was communicated to David Naranjo, Chief Information Security Officer, and Robert Wentworth, Senior Vice President, Claims Operations, and instructed all affected personnel to preserve all documents, data, and communications related to the cybersecurity event, the vendor relationship with Palomar, and the Company's incident response activities.
Heightened Network Monitoring. Quorum's information security team engaged in heightened monitoring of Quorum's own network environment to confirm that no compromise of Quorum's internal systems had occurred and to detect any potential secondary or follow-on threats. This enhanced monitoring, which has included the deployment of additional endpoint detection and response ("EDR") tools and increased threat hunting activities, has confirmed that Quorum's own network and systems were not compromised as a result of this incident.
Crisis Communications. Quorum engaged BrightPath Consulting Group Inc. ("BrightPath"), a crisis communications and public affairs consulting firm based in New York, NY, to assist with the development and execution of internal and external communications related to the cybersecurity event. The BrightPath engagement is led by Meredith Ashford, Managing Director. BrightPath has assisted Quorum with the development of employee communications, investor communications, media holding statements, and the framing of consumer notification messaging.
Internal Remediation Costs. Quorum estimates that its internal remediation costs associated with this cybersecurity event total approximately $620,000 to date. These costs include expenses related to IT remediation and enhanced monitoring, employee overtime for the Incident Response Team and supporting personnel, and related administrative and operational expenses. This figure is exclusive of external vendor costs (e.g., Graystone Forensics, Clearfield Notification Services, BrightPath Consulting, and Calderwood & Harkness legal fees), which are accounted for separately.
5.3 Consumer Notification
Quorum is providing written notification to all 318,247 affected individuals, including the 52,114 affected Connecticut residents, in accordance with the applicable notification requirements under the Connecticut Insurance Data Security Law (Conn. Gen. Stat. § 38a-999b), the Connecticut breach notification statute (Conn. Gen. Stat. § 36a-701b), and the breach notification laws of all other affected jurisdictions.
Notification Mailing. Consumer notification mailing is scheduled to commence on August 18, 2023, and is expected to be completed by approximately September 15, 2023, a mailing window of approximately twenty-eight (28) days. The mailing will be administered by Clearfield Notification Services LLC ("Clearfield"), as described below.
Tailored Notification Letters. Quorum has developed three versions of consumer notification letters, tailored to the specific categories of data compromised for each individual recipient:
(a) General PII Version — for individuals whose compromised data is limited to names, dates of birth, Social Security numbers, and/or driver's license numbers. This version is applicable to all 318,247 affected individuals and serves as the base notification letter. A sample of this letter is attached as Enclosure 1.
(b) SSN + Financial Data Version — for the subset of 84,619 individuals whose compromised data includes, in addition to PII elements, bank account numbers and/or payment card numbers. This version includes additional guidance regarding monitoring of financial accounts and the steps individuals can take to protect against fraudulent financial activity. A sample of this letter is attached as Enclosure 2.
(c) PHI Version (HIPAA-Compliant) — for the subset of 41,203 individuals whose compromised data includes protected health information (health conditions, diagnosis codes, and treatment information). This version includes the additional content elements required by the HIPAA Breach Notification Rule (45 C.F.R. § 164.404), including a description of the types of PHI involved, a description of the steps individuals should take to protect themselves, a description of what Quorum is doing to investigate the breach and mitigate harm, and contact information for the individual to ask questions or obtain additional information. A sample of this letter is attached as Enclosure 3.
Each notification letter, regardless of version, includes the following information: (i) a description of the cybersecurity event, including the approximate date of the event and the date of discovery; (ii) a description of the types of personal information that were involved; (iii) a description of the steps Quorum is taking in response to the event; (iv) a description of the steps that affected individuals can take to protect themselves from potential harm, including guidance on placing fraud alerts and credit freezes; and (v) information about the complimentary credit monitoring and identity theft protection services being offered by Quorum.
Credit Monitoring and Identity Theft Protection. Quorum is offering all 318,247 affected individuals twenty-four (24) months of complimentary credit monitoring and identity theft protection services. These services are being provided through Clearfield Notification Services LLC, located at 4500 Rockside Road, Suite 210, Independence, OH 44131, under the management of Jerome Tillman, Account Manager. The credit monitoring services include three-bureau credit monitoring, identity theft detection alerts, dark web monitoring, and a $1,000,000 identity theft insurance policy for each enrolled individual. Based on industry benchmarks and Clearfield's historical experience with similar notification events, Quorum estimates an enrollment take-rate of approximately forty percent (40%), which would result in approximately 127,299 enrollees.
A description of the credit monitoring and identity theft protection services being offered is included as Enclosure 5.
Dedicated Call Center. Clearfield Notification Services is also operating a dedicated toll-free call center for affected individuals. The call center is staffed by trained representatives who can answer questions about the cybersecurity event, assist individuals with enrolling in credit monitoring services, and provide guidance on identity theft prevention measures. The call center will operate for a twelve (12) week window commencing on August 18, 2023 (the date of the first notification mailing) and will be available during extended business hours (Monday through Saturday, 8:00 a.m. to 10:00 p.m. Eastern Time).
Total Clearfield Contract Value. The total contract value for the Clearfield Notification Services engagement is $3,214,500, broken down as follows:
• Notification mailing (printing, postage, address verification, and mailing services for 318,247 letters): $636,000
• Call center operations (12-week operations window, staffing, training, and toll-free line): $478,500
• Credit monitoring and identity theft protection services (24-month program, negotiated flat fee based on estimated enrollment): $2,100,000
Substitute Notice. In addition to direct mail notification, Quorum is preparing a substitute notice for publication on its corporate website (www.quoruminsurance.com). The website notice will include a summary of the cybersecurity event, information about the types of data involved, steps individuals can take to protect themselves, and information about how affected individuals can enroll in the complimentary credit monitoring services.
5.4 Regulatory Notifications
Quorum is filing regulatory notifications with all applicable state and federal regulatory authorities in accordance with the following schedule:
• Connecticut Insurance Department: This filing, submitted August 14, 2023, pursuant to Conn. Gen. Stat. § 38a-999b.
• Connecticut Attorney General's Office: Filing submitted August 14, 2023 (concurrent with this filing), pursuant to Conn. Gen. Stat. § 36a-701b.
• HHS Office for Civil Rights: Filing to be submitted August 15, 2023, pursuant to 45 C.F.R. § 164.408, in connection with the 41,203 individuals whose PHI was compromised. Because the PHI component of this incident affects more than 500 individuals, Quorum is required to provide notification to HHS OCR without unreasonable delay and in no case later than sixty (60) calendar days after discovery of the breach.
• New York Attorney General and California Attorney General: Filings planned for August 16, 2023.
• Massachusetts Attorney General: Filing planned for August 17, 2023.
• Remaining state filings (25 additional states and the District of Columbia): August 17 through August 25, 2023, on a rolling basis.
All filings will be completed within the applicable statutory deadlines for each jurisdiction. Quorum has developed a comprehensive regulatory filing calendar, managed by Calderwood & Harkness LLP and Quorum's Privacy Office, to track and ensure compliance with all notification deadlines.
5.5 Insurance Coverage
Quorum maintains a cyber-liability insurance program that has been placed on notice in connection with this cybersecurity event. The relevant insurance coverages are as follows:
Primary Cyber-Liability Policy. Atlas Mutual Insurance Company, Policy No. CYB-2023-041587. The policy provides a per-occurrence limit of $15,000,000, subject to a self-insured retention ("SIR") of $2,500,000. Quorum filed a claim under the policy on May 8, 2023, under Claim No. CYB-CLM-2023-05892. Atlas Mutual has acknowledged receipt of the claim and has assigned a claims adjuster to the matter. As of the date of this filing, Atlas Mutual has acknowledged coverage under the policy, subject to its standard reservation of rights, and has not disputed coverage.
Excess Cyber-Liability Policy. Pinnacle Surplus Lines Insurance Corp., Policy No. XS-CYB-2023-7812. The excess policy provides $25,000,000 in coverage excess of the $15,000,000 primary layer, for a total insurance tower of $40,000,000. The excess policy follows form to the primary Atlas Mutual policy. Pinnacle has been placed on notice of the claim.
Cyber-Insurance Broker. Quorum's cyber-liability insurance program was placed through Whitmore Risk Advisors Inc., with Sandra Whitmore-Kim serving as the Lead Broker. Whitmore Risk Advisors is coordinating with Quorum and Calderwood & Harkness LLP regarding claims submissions and insurer communications.
Based on the current estimate of total incident response costs of $8,230,250, Quorum anticipates that the SIR of $2,500,000 will be satisfied, and Quorum expects to recover a substantial portion of the costs in excess of the SIR under the primary policy. Quorum does not currently anticipate that the excess layer will be implicated.
VI. VENDOR ACCOUNTABILITY MEASURES
6.1 Contractual Framework and Vendor Obligations
The relationship between Quorum and Palomar Data Solutions, Inc. is governed by a Master Services Agreement dated November 12, 2019 (the "MSA"), as amended by Amendment 1, dated March 3, 2021, and Amendment 2, dated September 15, 2022. The MSA establishes the terms and conditions under which Palomar provides claims data processing, document management, and analytics services to Quorum's personal lines division.
The data security obligations imposed on Palomar under the MSA are set forth primarily in Exhibit D (Data Security Exhibit), which was substantively updated and enhanced pursuant to Amendment 2 (September 15, 2022). The key data security provisions of the MSA, as currently in effect, include the following:
(a) Administrative, Technical, and Physical Safeguards (Exhibit D, Section 1.1). Palomar is required to implement and maintain "commercially reasonable" administrative, technical, and physical safeguards designed to protect the confidentiality, integrity, and availability of Quorum data, consistent with industry standards and applicable legal and regulatory requirements.
(b) Vulnerability and Patch Management (Exhibit D, Section 3.2). Palomar is required to maintain a vulnerability and patch management program that includes, at a minimum, the application of patches for critical vulnerabilities within thirty (30) days of the vendor's release of such patch. Vulnerabilities rated "critical" or "high" under the Common Vulnerability Scoring System (CVSS) are subject to this requirement.
(c) Penetration Testing (Exhibit D, Section 4.1). Palomar is required to undergo annual penetration testing of its network and application environments, conducted by a qualified independent third-party, with results and remediation plans to be shared with Quorum upon request.
(d) SOC 2 Type II Audit (Exhibit D, Section 5.1, as added by Amendment 2). Palomar is required to obtain and provide to Quorum an annual SOC 2 Type II audit report covering the Trust Services Criteria for Security, Availability, Processing Integrity, Confidentiality, and Privacy. Palomar's SOC 2 auditor is Kessler, Park & Associates CPA, PLLC, of Dallas, TX, with Vivian Park serving as the Engagement Partner.
In addition to the data security obligations set forth in Exhibit D, the MSA includes the following provisions relevant to this cybersecurity event:
(e) Breach Notification (Section 9.4). Palomar is required to notify Quorum in writing within forty-eight (48) hours of discovering or becoming aware of any security incident affecting Quorum data. The notification must include a description of the incident, the categories of data affected, and the actions taken or proposed by Palomar to investigate and remediate the incident.
(f) Indemnification (Section 12.2). Palomar agrees to indemnify, defend, and hold harmless Quorum and its affiliates, officers, directors, employees, and agents from and against any and all losses, damages, liabilities, costs, and expenses (including reasonable attorneys' fees) arising from or relating to Palomar's breach of its data security obligations under the MSA, subject to a liability cap equal to two times (2×) the trailing twelve-month fees paid by Quorum to Palomar. Based on the current annual contract value of $16.3 million, the applicable liability cap is $32,600,000.
(g) Insurance Requirements (Exhibit E). Palomar is required to maintain, at a minimum, a cyber-liability insurance policy with a per-occurrence limit of not less than $10,000,000, and to name Quorum as an additional insured thereunder.
6.2 Identified Vendor Deficiencies
Based on the forensic investigation and Quorum's review of Palomar's performance under the MSA, Quorum has identified the following deficiencies in Palomar's compliance with its contractual obligations:
Failure to Timely Patch Critical Vulnerability. CVE-2023-0669 was publicly disclosed on February 1, 2023, and a patch was released by the vendor (Severin Corporation) on February 7, 2023. As noted in Section III.3 above, the vulnerability received a CVSS base score of 7.2, classifying it as a "High" severity vulnerability. Under Exhibit D, Section 3.2 of the MSA, Palomar was required to apply the patch within thirty (30) days of the vendor's release — i.e., by approximately March 9, 2023. The threat actor exploited the vulnerability on or about March 14, 2023, at which point the patch had been available for thirty-five (35) days. Palomar's failure to timely apply the available patch constitutes a breach of the thirty-day patching requirement under Exhibit D, Section 3.2 of the MSA, and was the proximate cause of the threat actor's initial unauthorized access to Palomar's network.
Failure to Comply with Contractual Notification Timeline. As described in Section III.2 above, Palomar's SOC detected the unauthorized activity on April 18, 2023, but Palomar did not provide notification to Quorum until April 21, 2023 — approximately seventy-two (72) hours after discovery, which was approximately twenty-four (24) hours beyond the contractual forty-eight (48) hour notification window established in Section 9.4 of the MSA. While the notification delay did not materially affect the ultimate scope of the compromised data (because the exfiltration had ceased prior to detection), the delay is a breach of Palomar's contractual obligation and delayed Quorum's ability to commence its own incident response activities.
6.3 Indemnification and Remediation Actions
In light of the vendor deficiencies identified above, Quorum has taken the following actions with respect to Palomar:
Formal Indemnification Demand. Quorum, through Calderwood & Harkness LLP, served a formal indemnification demand on Palomar on June 20, 2023. The demand was served on Palomar's outside counsel, Mercer, Haight & Dunlop LLP, located in Dallas, TX, attention Catherine Langford, Partner. The indemnification demand was made pursuant to Section 12.2 of the MSA and encompasses all incident response costs incurred or to be incurred by Quorum in connection with the cybersecurity event. The total amount of the indemnification demand, as of the date of this filing, is $8,230,250, consisting of the following components:
The total demand amount falls well within the contractual liability cap of $32,600,000 (2× trailing twelve-month fees).
Negotiation Status. Negotiations with Palomar and its counsel, Mercer, Haight & Dunlop LLP, are ongoing as of the date of this filing. Palomar has acknowledged receipt of the indemnification demand and has engaged in initial discussions regarding the scope and quantum of the demand. No formal dispute or litigation has been initiated at this time, and Quorum is pursuing resolution of the indemnification claim through negotiation in the first instance.
Enhanced Contractual Security Requirements. Quorum is evaluating enhanced contractual security requirements to be imposed on Palomar via a further amendment to the MSA. These enhanced requirements may include, among other things, shortened patching deadlines for critical vulnerabilities, expanded audit rights, more frequent SOC 2 reporting, enhanced incident response cooperation obligations, and reduced breach notification timelines.
Enhanced Vendor Risk Management Review. Quorum's Vendor Risk Management program, overseen by Priya Deshmukh, Vice President, Vendor Risk Management, is conducting an enhanced review of Palomar's current security posture, including a reassessment of Palomar's compliance with the data security requirements of the MSA. In addition, Quorum's Vendor Risk Management program is conducting a broader review of all critical vendor relationships across the enterprise to assess the adequacy of existing contractual data security protections and to identify any areas for enhancement.
VII. QUORUM'S INFORMATION SECURITY PROGRAM
7.1 Governance Structure
Quorum maintains a comprehensive information security program designed to protect the confidentiality, integrity, and availability of the Company's information assets and the personal information of its policyholders, claimants, employees, and other stakeholders. The information security program is structured with executive-level oversight and is integrated into the Company's broader enterprise risk management framework.
The following individuals hold key leadership roles within Quorum's security and privacy governance structure:
• David Naranjo, Chief Information Security Officer (CISO) — responsible for the development, implementation, and management of Quorum's information security program, including security operations, vulnerability management, incident response, and security architecture.
• Jennifer Liang, Chief Privacy Officer (CPO) — responsible for Quorum's privacy program, including compliance with applicable federal and state privacy and data protection laws and regulations, privacy impact assessments, data subject rights management, and privacy training.
• Priya Deshmukh, Vice President, Vendor Risk Management — responsible for Quorum's vendor risk management program, including pre-engagement due diligence, contractual data security requirements, ongoing vendor monitoring, and vendor risk assessments.
Board-level oversight of Quorum's information security and data privacy programs is provided through the Audit Committee of Quorum's Board of Directors. The Audit Committee is chaired by Franklin Reeves and receives regular reports from the CISO and CPO regarding the state of the Company's information security program, emerging threats and risks, significant security incidents, and the results of internal and external audits and assessments.
Quorum's external auditor is Halstead & Monroe LLP, a nationally recognized accounting firm located at 1600 Market Street, Suite 2800, Philadelphia, PA 19103, with Gregory Chin serving as the Engagement Partner. Halstead & Monroe provides audit and attestation services to Quorum, including review of internal controls over financial reporting, and the information security program is within the scope of Halstead & Monroe's assessment of internal controls.
7.2 Vendor Risk Management
Quorum maintains a formal vendor risk management program that includes the following core elements:
• Pre-Engagement Due Diligence: All prospective vendors that will access, process, or store Quorum data are subject to a comprehensive security assessment prior to engagement, including review of the vendor's security policies, technical controls, certifications (e.g., SOC 2, ISO 27001), insurance coverage, and incident response capabilities.
• Contractual Data Security Requirements: All vendor agreements involving access to Quorum data include comprehensive data security provisions, including requirements for administrative, technical, and physical safeguards; vulnerability and patch management; breach notification; indemnification; and insurance coverage minimums.
• Ongoing Monitoring: Quorum conducts ongoing monitoring of critical vendor relationships, including annual review of SOC 2 Type II audit reports, periodic security questionnaires, and risk-based assessments triggered by changes in the vendor's business, technology environment, or risk profile.
With respect to Palomar specifically, Quorum notes that MSA Amendment 2, executed on September 15, 2022, updated and strengthened the data security exhibit (Exhibit D), added the requirement for Palomar to obtain and provide a SOC 2 Type II audit report, and updated the cyber insurance coverage minimums applicable to Palomar. These enhancements were implemented as part of Quorum's ongoing vendor risk management activities and reflected an evolution in Quorum's security expectations for critical vendors.
7.3 Post-Incident Enhancements (Planned)
In response to this cybersecurity event, and in addition to the vendor-specific remediation measures described in Section VI above, Quorum is planning the following enhancements to its information security and vendor risk management programs:
• Enhanced Vendor Security Due Diligence Procedures. Quorum will implement enhanced pre-engagement and ongoing due diligence procedures for vendors that access, process, or store personal information, including more rigorous assessment of vendors' vulnerability management practices, patching cadence, and incident response capabilities.
• Shortened Contractual Notification Windows. Quorum will adopt a standard contractual requirement for vendor breach notification within twenty-four (24) hours of discovery (reduced from the current standard of forty-eight (48) hours), and will seek to negotiate this shortened window into existing vendor agreements upon renewal or amendment.
• Expanded Third-Party Audit Requirements. Quorum will expand its requirements for third-party audit reports from critical vendors, including requiring quarterly vulnerability scan reports and bi-annual penetration testing (in addition to the existing annual SOC 2 Type II audit requirement).
• Additional Tabletop Exercises. Quorum will conduct additional tabletop exercises focused on third-party vendor incident response scenarios, including exercises involving the Company's executive leadership, legal team, privacy office, information security team, and vendor risk management team. These exercises will be conducted at least semi-annually.
• Review of Data Minimization Practices. Quorum will conduct a comprehensive review of the data shared with and retained by third-party vendors, with the objective of minimizing the volume and sensitivity of data provided to vendors to the extent consistent with operational requirements. This review will include an assessment of data retention periods, de-identification and tokenization opportunities, and the feasibility of implementing additional technical controls (such as encryption at the field level) for sensitive data elements processed by vendors.
VIII. CONCLUSION AND COOPERATION COMMITMENT
Quorum Insurance Holdings Corp. respectfully submits this notification to the Connecticut Insurance Department in compliance with Section 38a-999b of the Connecticut General Statutes. Quorum takes the protection of its policyholders' and claimants' personal information with the utmost seriousness and deeply regrets the impact of this cybersecurity event on the individuals whose data was compromised.
As set forth in this notification, Quorum has taken comprehensive steps to investigate the cybersecurity event, identify all affected individuals, notify those individuals of the incident and the steps they can take to protect themselves, provide complimentary credit monitoring and identity theft protection services, pursue indemnification from the responsible vendor, and strengthen its information security and vendor risk management programs to reduce the risk of similar events in the future.
Quorum is committed to full cooperation with the Connecticut Insurance Department's review of this matter. Quorum understands that the Department may have questions or may request additional information regarding the cybersecurity event, Quorum's response, or the remediation measures being implemented. Quorum will promptly respond to any such inquiries and will provide supplemental information to the Department as this matter develops, including updates on the following:
• Completion of consumer notification mailing (expected by approximately September 15, 2023);
• Resolution of the vendor indemnification demand with Palomar Data Solutions, Inc.;
• Implementation of planned post-incident security and vendor risk management enhancements;
• Any material developments in the forensic investigation or related matters; and
• Final accounting of total incident response costs and insurance recovery.
Quorum respectfully requests that all correspondence and communications from the Department regarding this filing and this matter be directed to:
Kevin Ostrowski, Partner Alan Burke, Associate Calderwood & Harkness LLP 1700 K Street NW, Suite 900 Washington, D.C. 20006 Telephone: (202) 555-8100 Facsimile: (202) 555-8101
Email: kostrowski@calderwoodharkness.com / aburke@calderwoodharkness.com
Quorum appreciates the Department's attention to this matter and looks forward to working cooperatively with the Department as this process continues.
IX. SIGNATURE
Respectfully submitted,
CALDERWOOD & HARKNESS LLP
By: ________
Kevin Ostrowski, Partner Privacy & Data Security Practice Group Calderwood & Harkness LLP 1700 K Street NW, Suite 900 Washington, D.C. 20006 Telephone: (202) 555-8100 Facsimile: (202) 555-8101
Email: kostrowski@calderwoodharkness.com
On behalf of Quorum Insurance Holdings Corp.
Date: August 14, 2023