1025-00006 · Graystone Forensics LLC · Regulatory Notifications

hhs-ocr-breach-notification.docx DOCUMENT Data Privacy

74 / 88 ← → ✕

BREACH NOTIFICATION TO THE SECRETARY OF HEALTH AND HUMAN SERVICES

Pursuant to Section 13402 of the HITECH Act and 45 C.F.R. § 164.408

Date of Submission: August 15, 2023

Submitted To:

U.S. Department of Health and Human Services Office for Civil Rights, Region I (Boston) Government Center J.F.K. Federal Building, Room 1875 Boston, MA 02203

Submitted By / Covered Entity:

Quorum Insurance Holdings Corp. 400 Constitution Plaza, Suite 2200 Hartford, CT 06103 EIN: 06-4832197 Nasdaq: QIHC

Contact Person for this Notification:

Jennifer Liang Chief Privacy Officer Quorum Insurance Holdings Corp. 400 Constitution Plaza, Suite 2200 Hartford, CT 06103 Telephone: (860) 555-4200

Email: jliang@quorumholdings.com

Outside Counsel (preparing and submitting on behalf of Quorum Insurance Holdings Corp.):

Calderwood & Harkness LLP Kevin Ostrowski, Responsible Partner, Privacy & Data Security 1700 K Street NW, Suite 900 Washington, D.C. 20006 Telephone: (202) 555-8100

Email: kostrowski@calderwoodharkness.com

Matter Number: 1025-00006

Submission Method: This notification is being submitted electronically via the HHS-OCR Breach Portal, with a concurrent hard-copy transmittal letter sent via Severin Partners LLC overnight delivery to the Region I Office of the Office for Civil Rights in Boston, Massachusetts.

I. INTRODUCTORY STATEMENT AND PURPOSE

Quorum Insurance Holdings Corp. ("Quorum" or the "Company"), a covered entity under the Health Insurance Portability and Accountability Act of 1996, as amended ("HIPAA"), and its implementing regulations at 45 C.F.R. Parts 160 and 164, hereby submits this notification to the Secretary of Health and Human Services (the "Secretary") pursuant to Section 13402 of the Health Information Technology for Economic and Clinical Health Act (the "HITECH Act"), Pub. L. No. 111-5, Title XIII, and the Breach Notification Rule codified at 45 C.F.R. §§ 164.400–164.414.

This notification concerns a breach of unsecured protected health information ("PHI") affecting a total of 41,203 individuals who are policyholders or claimants under Quorum's workers' compensation and health-related insurance claims lines. The breach originated at Palomar Data Solutions, Inc. ("Palomar"), a business associate of Quorum, and involved the unauthorized access to and exfiltration of structured data files containing PHI from Palomar's network environment by a third-party threat actor during the period of approximately March 14, 2023 through April 18, 2023.

Because the breach affected more than 500 individuals, Quorum is providing this notification to the Secretary without unreasonable delay and in no event later than 60 calendar days following the discovery of the breach, in accordance with 45 C.F.R. § 164.408. As set forth in greater detail in Section IV below, while Quorum first received notification of the security incident from Palomar on April 21, 2023, the identification of specific individuals whose PHI was compromised was not completed until August 4, 2023, following the conclusion of a comprehensive forensic investigation and data mining process. This notification is being submitted within 60 days of the final identification of affected individuals, consistent with the requirements of 45 C.F.R. § 164.404(a)(2) and the guidance issued by the Office for Civil Rights.

Concurrent with this notification to the Secretary, Quorum is undertaking the following additional notification activities required by the Breach Notification Rule:

• Individual Notifications (45 C.F.R. § 164.404): Individual breach notification letters are being mailed to all 41,203 PHI-affected individuals (as part of a broader notification to 318,247 individuals whose personally identifiable information was compromised in the same incident). The consumer notification mailing commenced on August 18, 2023, with completion of all mailings targeted for no later than September 15, 2023.

• Media Notice (45 C.F.R. § 164.406): Because the breach involves more than 500 residents of certain individual states, Quorum is issuing media notices concurrently on August 15, 2023, to prominent media outlets serving those states, in accordance with 45 C.F.R. § 164.406.

• Substitute Notice: Quorum is also publishing a substitute notice on its corporate website (www.quorumholdings.com) to supplement the direct individual notifications.

This notification is intended to provide the Secretary with the information required by 45 C.F.R. § 164.408 and to demonstrate Quorum's commitment to full compliance with its obligations under the Breach Notification Rule.

II. IDENTIFICATION OF THE COVERED ENTITY

Full Legal Name: Quorum Insurance Holdings Corp.

Principal Business Address:

400 Constitution Plaza, Suite 2200 Hartford, CT 06103

Entity Type: Quorum is a Delaware corporation, incorporated under the laws of the State of Delaware and publicly traded on the Nasdaq Stock Market under the ticker symbol "QIHC." The Company is subject to reporting obligations under the Securities Exchange Act of 1934.

Nature of Business: Quorum is a diversified insurance holding company engaged in the underwriting and administration of property and casualty insurance, specialty lines insurance, and life and annuity products through its network of operating subsidiaries. In addition, Quorum operates a digital underwriting platform and insurtech analytics division that provides data-driven risk assessment and pricing solutions. For the fiscal year ended December 31, 2022, Quorum reported consolidated annual revenue of approximately $4.82 billion. As of August 2023, Quorum employs approximately 11,400 individuals across its corporate headquarters in Hartford, Connecticut, and its regional offices and operating subsidiaries throughout the United States.

HIPAA Role — Covered Entity Status: Quorum, through its insurance operating subsidiaries, functions as a "health plan" as defined in 45 C.F.R. § 160.103. Specifically, Quorum processes health-related insurance claims — including workers' compensation claims and health-related claims lines — that involve protected health information as defined in 45 C.F.R. § 160.103. Quorum's claims operations involve the receipt, processing, adjudication, and payment of claims that contain individually identifiable health information, including diagnosis codes, treatment information, and other clinical data related to covered individuals. As a health plan, Quorum is subject to the HIPAA Privacy Rule (45 C.F.R. Part 164, Subpart E), the HIPAA Security Rule (45 C.F.R. Part 164, Subpart C), and the Breach Notification Rule (45 C.F.R. Part 164, Subpart D).

Designated Privacy Officer:

Jennifer Liang Chief Privacy Officer Quorum Insurance Holdings Corp. 400 Constitution Plaza, Suite 2200 Hartford, CT 06103 Telephone: (860) 555-4200

Email: jliang@quorumholdings.com

Designated Security Officer:

David Naranjo Chief Information Security Officer Quorum Insurance Holdings Corp. 400 Constitution Plaza, Suite 2200 Hartford, CT 06103 Telephone: (860) 555-4215

Email: dnaranjo@quorumholdings.com

III. IDENTIFICATION OF THE BUSINESS ASSOCIATE INVOLVED

The breach at issue originated within the network environment of Quorum's business associate, Palomar Data Solutions, Inc. The following information identifies the business associate and describes the nature of the contractual relationship between Quorum and Palomar.

Business Associate Name: Palomar Data Solutions, Inc. ("Palomar")

Principal Business Address:

7100 Greenville Avenue, Suite 450 Dallas, TX 75231

Nature of Relationship: Palomar is a third-party claims data processing vendor that provides claims data processing, document management, and analytics services to Quorum. Palomar has served as a key vendor in Quorum's claims administration infrastructure since late 2019. In the course of providing these services, Palomar receives, processes, stores, and transmits PHI on behalf of Quorum in connection with claims administration for Quorum's personal lines division, including workers' compensation claims and health-related insurance claims lines.

Governing Agreements: The relationship between Quorum and Palomar is governed by a Master Services Agreement ("MSA") dated November 12, 2019, as amended by Amendment No. 1 dated March 3, 2021, and Amendment No. 2 dated September 15, 2022. The MSA contains comprehensive data security obligations, including a Data Security Exhibit (Exhibit D, as amended), which sets forth, among other requirements, Palomar's obligations with respect to vulnerability management, patch management, encryption, access controls, and incident response and notification.

Annual Contract Value: The annual contract value under the MSA, as adjusted by Amendment No. 1, is approximately $16,300,000.

Business Associate Agreement: A Business Associate Agreement ("BAA"), as required by 45 C.F.R. § 164.502(e) and 45 C.F.R. § 164.504(e), is incorporated into the MSA as a component thereof. Under the BAA, Palomar is obligated to, among other things: (a) use and disclose PHI only as permitted by the BAA and as required by law; (b) implement appropriate administrative, physical, and technical safeguards to protect the confidentiality, integrity, and availability of electronic PHI; (c) report any security incident or breach of unsecured PHI to Quorum without unreasonable delay; and (d) make its internal practices, books, and records relating to the use and disclosure of PHI available to the Secretary for purposes of determining compliance with the HIPAA Rules.

Palomar Key Contacts:

Marcus J. Trevino, Chief Executive Officer Derek Copeland, General Counsel Palomar Data Solutions, Inc. 7100 Greenville Avenue, Suite 450 Dallas, TX 75231

Palomar Outside Counsel:

Catherine Langford, Partner Mercer, Haight & Dunlop LLP 2100 Ross Avenue, Suite 3600 Dallas, TX 75201

IV. DESCRIPTION OF THE BREACH — NATURE AND CIRCUMSTANCES

A. Discovery and Timeline

The following timeline sets forth the key events associated with the breach, from the date of initial unauthorized access through the completion of the forensic investigation and identification of affected individuals:

Date Breach Treated as discovered for HIPAA Purposes: In accordance with 45 C.F.R. § 164.404(a)(2), the breach was treated as discovered by Quorum as of April 21, 2023, the date on which Palomar first notified Quorum of the security incident. However, the scope and nature of the compromised data — including the specific identification that PHI was involved and the determination of which individuals' PHI was affected — was not confirmed until the final forensic report was issued on July 14, 2023, and the individual-level identification process was completed on August 4, 2023. Quorum exercised reasonable diligence throughout the investigative process and is providing this notification to the Secretary within 60 days of the final identification of affected individuals, consistent with the requirements of 45 C.F.R. § 164.404(a)(2) and the Office for Civil Rights' guidance regarding the commencement of the notification clock when a breach investigation is ongoing.

B. Nature of the Breach

The breach originated at Palomar Data Solutions, Inc., Quorum's third-party claims data processing vendor and business associate under HIPAA. The breach did not originate within Quorum's own network, systems, or facilities. Quorum's internal information systems and network infrastructure were not compromised as a result of this incident.

The threat actor exploited CVE-2023-0669, a known pre-authentication remote code execution vulnerability in Severin Corporation's GoAnywhere MFT (Managed File Transfer) product, which was present in Palomar's GoAnywhere MFT file transfer appliance. This vulnerability was publicly disclosed in early February 2023, and a remedial patch (GoAnywhere MFT version 7.1.2) was released by the vendor, Severin Corporation (formerly Strathmore Industries), on or about February 7, 2023. The Cybersecurity and Infrastructure Security Agency ("CISA") added CVE-2023-0669 to its Known Exploited Vulnerabilities Catalog on February 10, 2023, and issued advisories warning of active exploitation by threat actors. Despite the availability of the patch and the public warnings of active exploitation, Palomar had not applied the patch to its GoAnywhere MFT appliance as of the date of initial compromise on or about March 14, 2023 — more than five weeks after the patch became available.

After gaining initial access to Palomar's environment through the GoAnywhere MFT appliance, the threat actor conducted lateral movement within Palomar's network over the course of approximately 35 days. During this period, the threat actor escalated privileges, identified Palomar's claims data processing servers containing Quorum policyholder and claimant data, and staged and exfiltrated structured data files to an external location under the threat actor's control. The forensic investigation confirmed that the threat actor used a combination of legitimate remote administration tools, credential harvesting techniques, and custom data compression and exfiltration scripts to accomplish the data theft.

The breach involved the unauthorized access to and acquisition of electronic protected health information that was not rendered unusable, unreadable, or indecipherable to unauthorized persons through the use of a technology or methodology specified in the guidance issued by the Secretary pursuant to 42 U.S.C. § 17932(h)(2). Specifically, the compromised PHI was stored in Palomar's claims data processing environment in a format that was not encrypted at rest or otherwise secured through encryption or destruction as contemplated by the Breach Notification Rule. Accordingly, the compromised PHI constitutes "unsecured protected health information" as defined in 45 C.F.R. § 164.402, and the unauthorized access to and acquisition of such PHI constitutes a "breach" as defined in 45 C.F.R. § 164.402.

Quorum has evaluated the breach in light of the four-factor risk assessment set forth in 45 C.F.R. § 164.402(2) and has determined that the unauthorized access to and acquisition of the PHI at issue compromises the security or privacy of the PHI and that the applicable exceptions to the definition of "breach" do not apply. Specifically:

(1) Nature and extent of the PHI involved: The PHI involved includes highly sensitive data elements, including names, dates of birth, Social Security numbers, diagnosis codes, and treatment information. The combination of these data elements creates a significant risk of identity theft, financial fraud, and unauthorized access to or use of health information.

(2) The unauthorized person who used the PHI or to whom the disclosure was made: The PHI was accessed and exfiltrated by an unknown external threat actor. The identity and location of the threat actor have not been conclusively determined, although the forensic investigation identified indicators consistent with a financially motivated threat actor group. The threat actor's intentions and any subsequent use or further disclosure of the PHI are not known.

(3) Whether the PHI was actually acquired or viewed: The forensic investigation confirmed that the structured data files containing PHI were exfiltrated from Palomar's environment, meaning the data was actually acquired by the threat actor. The forensic evidence supports the conclusion that the PHI was not merely viewed but was copied and transferred to an external location.

(4) The extent to which the risk to the PHI has been mitigated: Quorum and Palomar have taken steps to mitigate the risk, including containment of the vulnerability, engagement of law enforcement, monitoring for evidence of misuse, and provision of credit monitoring and identity theft protection services to affected individuals. However, given the exfiltration of the data to an external location controlled by the threat actor, the risk to the PHI cannot be fully mitigated.

Based on this risk assessment, Quorum has determined that the incident constitutes a breach of unsecured PHI requiring notification under the Breach Notification Rule.

C. Location of the Breach

The breach occurred within Palomar Data Solutions, Inc.'s network environment, located at Palomar's principal offices and data center facilities in Dallas, Texas. Specifically, the initial point of compromise was Palomar's GoAnywhere MFT file transfer appliance, which served as the entry point for the threat actor. Following the initial compromise, the threat actor moved laterally to Palomar's connected claims data processing servers, which housed the structured data files containing Quorum policyholder and claimant data, including PHI.

The breach did not occur within Quorum's own network, systems, data centers, or facilities. Quorum's internal information systems and network infrastructure, including its corporate headquarters in Hartford, Connecticut, and its regional offices and data centers, were not compromised as a result of this incident.

V. TYPES OF UNSECURED PROTECTED HEALTH INFORMATION INVOLVED

The PHI compromised in the breach pertains to 41,203 individuals who are policyholders or claimants under Quorum's workers' compensation and health-related insurance claims lines. These individuals' claims data was processed by Palomar Data Solutions, Inc. on behalf of Quorum in connection with claims administration for Quorum's personal lines division.

The types of unsecured protected health information involved in the breach include the following data elements:

• Names (first name, middle name or initial, and last name)

• Dates of birth

• Social Security numbers

• Driver's license numbers (state-issued)

• Health conditions and diagnoses (including ICD-10-CM diagnosis codes associated with workers' compensation and health-related insurance claims)

• Treatment information associated with workers' compensation and health-related insurance claims (including descriptions of medical treatments, procedures, and provider information linked to claims)

Not all data elements were present for every affected individual. The specific combination of data elements compromised varies by individual, depending on the nature and stage of the individual's claim and the data fields populated in the claims processing records maintained by Palomar.

In addition to the PHI data elements listed above, for certain individuals within the 41,203 PHI-affected population who are also part of the broader subset of 84,619 individuals whose financial data was compromised, the following additional data elements were also involved:

• Bank account numbers (including routing numbers and account numbers associated with claim payment disbursements)

• Payment card numbers (including credit or debit card numbers associated with premium payments or other financial transactions)

It is important to note that the PHI subset of 41,203 individuals is a component of the larger breach affecting a total of 318,247 individuals across 29 states and the District of Columbia whose personally identifiable information was compromised in the same incident. For all 318,247 affected individuals (including those whose data does not include PHI), the compromised data includes, at a minimum, names, dates of birth, Social Security numbers, and driver's license numbers. The 41,203 PHI-affected individuals represent those individuals for whom, in addition to the foregoing PII data elements, health conditions, diagnoses, and/or treatment information was also compromised, thereby constituting a breach of unsecured PHI subject to the HIPAA Breach Notification Rule.

VI. NUMBER OF INDIVIDUALS AFFECTED

Total number of individuals whose unsecured protected health information was breached: 41,203

These 41,203 PHI-affected individuals are a subset of the total population of 318,247 individuals across 29 states and the District of Columbia whose personally identifiable information was compromised in the breach.

Geographic Distribution: The PHI-affected individuals reside in multiple states across the United States. The PHI-affected population is distributed proportionally across the same 29 states and the District of Columbia as the broader affected population. A detailed state-by-state breakdown of PHI-affected individuals is available and will be provided to the Office for Civil Rights upon request.

For reference, the overall geographic distribution of the broader affected population of 318,247 individuals, by state, is as follows:

The 41,203 PHI-affected individuals are distributed proportionally across these states, with the largest concentrations in Connecticut, New York, California, Texas, and Florida, consistent with the geographic distribution of Quorum's workers' compensation and health-related insurance claims book of business.

VII. STEPS INDIVIDUALS SHOULD TAKE TO PROTECT THEMSELVES

Quorum is advising all affected individuals, including all 41,203 individuals whose PHI was compromised, to take the following steps to protect themselves from potential harm resulting from the breach:

1. Monitor Health-Related Statements and Records. Affected individuals should carefully review their explanation of benefits ("EOB") statements, medical records, and insurance claims for any unauthorized or suspicious activity, including claims for services or treatments they did not receive, unfamiliar provider names, or other irregularities that may indicate unauthorized use of their health information. Any suspicious activity should be reported immediately to their insurance carrier and healthcare provider(s).

2. Review Credit Reports. Affected individuals should obtain and carefully review their credit reports from each of the three major credit reporting agencies — Harborview Enterprises, Penrose Group, and Penmark Enterprises — for accuracy and for any evidence of unauthorized accounts, inquiries, or other activity. Under federal law, individuals are entitled to one free credit report from each of the three agencies every 12 months, which can be obtained at www.annualcreditreport.com or by calling 1-877-322-8228.

3. Consider Fraud Alerts or Security Freezes. Affected individuals should consider placing an initial fraud alert on their credit files with each of the three major credit reporting agencies. An initial fraud alert is free and lasts for one year, and it requires creditors to take reasonable steps to verify the identity of anyone seeking credit in the individual's name. Alternatively, individuals may consider placing a security freeze (also known as a credit freeze) on their credit files, which restricts access to their credit reports and prevents new accounts from being opened in their name without their express authorization. Security freezes are free under federal and state law.

4. Report Suspected Identity Theft. Affected individuals should report any suspected identity theft or unauthorized use of their personal or health information to their local law enforcement agency and to the Federal Trade Commission ("FTC"). Reports to the FTC can be filed online at www.identitytheft.gov or by calling 1-877-438-4338. Individuals may also report concerns to their state attorney general's office.

5. Enroll in Complimentary Credit Monitoring and Identity Theft Protection Services. Quorum is offering all affected individuals, including all 41,203 PHI-affected individuals, complimentary 24-month credit monitoring and identity theft protection services through Clearfield Notification Services LLC. Enrollment details and activation codes are included in the individual notification letters being mailed to affected individuals. A dedicated toll-free call center is available to assist with enrollment and to answer questions. Affected individuals are strongly encouraged to enroll in these services promptly.

6. Contact the HHS Office for Civil Rights. Affected individuals who believe that their health information privacy rights have been violated may file a complaint with the U.S. Department of Health and Human Services, Office for Civil Rights. Complaints may be filed online at www.hhs.gov/hipaa/filing-a-complaint, by mail to the Office for Civil Rights at the appropriate regional office, or by calling (800) 368-1019.

7. Remain Vigilant for Unsolicited Communications. Affected individuals should remain vigilant for any unsolicited communications — whether by mail, email, telephone, or text message — that request personal, financial, or health information. Such communications may be attempts at phishing, social engineering, or other forms of fraud. Individuals should not provide personal or health information in response to unsolicited requests and should verify the identity and legitimacy of any requestor before responding.

VIII. STEPS QUORUM HAS TAKEN IN RESPONSE TO THE BREACH

A. Investigation and Forensic Response

Immediately upon receiving notification from Palomar Data Solutions on April 21, 2023, Quorum activated its incident response plan and convened its Incident Response Team, consisting of senior representatives from the Legal, Information Security, Privacy, Compliance, and Communications departments. The Incident Response Team, under the leadership of General Counsel Thomas R. Whitfield, Chief Privacy Officer Jennifer Liang, and CISO David Naranjo, took immediate steps to assess the scope and severity of the incident and to coordinate Quorum's response.

On May 4, 2023, Quorum engaged the law firm of Calderwood & Harkness LLP, under the direction of Kevin Ostrowski, Partner in the firm's Privacy & Data Security practice, to serve as outside counsel for the breach response. Calderwood & Harkness LLP was retained to manage all aspects of the breach response, including coordination of the forensic investigation, assessment of regulatory notification obligations under HIPAA, state breach notification statutes, and other applicable laws, preparation and submission of regulatory filings, oversight of consumer notification activities, and coordination with law enforcement.

On May 5, 2023, at the direction of Calderwood & Harkness LLP, Graystone Forensics LLC was retained to conduct a comprehensive forensic investigation of the breach. The engagement was led by Dr. Nolan Briggs, Managing Director of Incident Response, and Kendra Faulkner, Senior Forensic Analyst, both of Graystone Forensics LLC. The forensic engagement was structured under the attorney-client privilege and work product doctrine umbrella, with Graystone retained by and reporting to Calderwood & Harkness LLP to preserve applicable legal protections.

Graystone Forensics LLC conducted an exhaustive forensic analysis over a period of approximately ten weeks, working in coordination with Palomar's internal IT security team and Palomar's own incident response resources. The forensic investigation involved the analysis of system and application logs, network traffic captures and flow data, endpoint forensic images, file access and modification records, and data transfer logs. The investigation confirmed: (a) the attack vector, specifically the exploitation of CVE-2023-0669 in Palomar's unpatched GoAnywhere MFT appliance; (b) the exfiltration timeline, spanning approximately 35 days from on or about March 14, 2023 through April 18, 2023; (c) the lateral movement techniques employed by the threat actor within Palomar's network; and (d) the full scope of data files that were accessed, staged, and exfiltrated by the threat actor, including structured data files containing PHI associated with Quorum policyholders and claimants.

Graystone Forensics LLC provided its preliminary findings on June 2, 2023, and its final forensic report on July 14, 2023. Following receipt of the final forensic report, a comprehensive data mining effort was undertaken to identify the specific individuals whose data was compromised and to determine the specific data elements involved for each individual. This data mining process, conducted by Clearfield Notification Services LLC in coordination with Calderwood & Harkness LLP and Quorum's internal data teams, was completed on August 4, 2023.

B. Notification Activities

Quorum is undertaking the following notification activities in compliance with the HIPAA Breach Notification Rule and applicable state breach notification statutes:

Individual Breach Notification Letters (45 C.F.R. § 164.404): Individual breach notification letters are being mailed via first-class U.S. mail to all 41,203 PHI-affected individuals, as part of the broader notification to 318,247 individuals whose personally identifiable information was compromised. The notification letters are HIPAA-compliant and contain all elements required by 45 C.F.R. § 164.404(c), including:

(i) a brief description of the breach, including the date of the breach and the date of discovery;

(ii) a description of the types of unsecured protected health information that were involved in the breach;

(iii) the steps individuals should take to protect themselves from potential harm resulting from the breach;

(iv) a brief description of what Quorum is doing to investigate the breach, mitigate losses, and protect against any further breaches; and

(v) contact procedures, including a toll-free telephone number, an email address, a postal address, and a website address where affected individuals can obtain additional information and assistance.

The PHI-specific version of the notification letter includes additional language specifically addressing the compromise of health-related information and the steps individuals should take to monitor their health records and insurance claims for unauthorized activity.

The consumer notification mailing commenced on August 18, 2023, with completion of all mailings targeted for no later than September 15, 2023. Returned mail will be tracked, and reasonable efforts will be made to obtain updated addresses for individuals whose notification letters are returned as undeliverable.

Media Notice (45 C.F.R. § 164.406): Because the breach involves more than 500 residents of certain individual states, Quorum is issuing media notices on August 15, 2023, to prominent media outlets serving those states, in accordance with 45 C.F.R. § 164.406. The media notice includes a general description of the breach, the types of information involved, steps individuals can take to protect themselves, and contact information for Quorum's toll-free call center.

Substitute Notice: Quorum is also publishing a substitute notice on its corporate website (www.quorumholdings.com) to supplement the direct individual notifications, in accordance with 45 C.F.R. § 164.404(d)(2). The website posting provides information about the breach and directs affected individuals to the toll-free call center for assistance.

C. Credit Monitoring and Identity Theft Protection

Quorum is offering all affected individuals, including all 41,203 PHI-affected individuals, 24 months of complimentary credit monitoring and identity theft protection services through Clearfield Notification Services LLC, a nationally recognized provider of breach response and notification services. The credit monitoring and identity theft protection package includes:

• Three-bureau credit monitoring (Harborview Enterprises, Penrose Group, and Penmark Enterprises)

• Automated alerts for key changes to credit files

• Identity theft insurance coverage (up to $1,000,000 per individual)

• Dark web monitoring for compromised credentials

• Identity restoration assistance

Enrollment details and unique activation codes are included in the individual notification letters being mailed to affected individuals. Based on industry benchmarks and historical experience, Quorum estimates an enrollment take-rate of approximately 40%, which would result in approximately 127,299 enrollees across the full affected population of 318,247 individuals.

A dedicated toll-free call center, operated by Clearfield Notification Services LLC, has been established to assist affected individuals with enrollment in the credit monitoring and identity theft protection services and to answer questions about the breach and the notification process. The call center is staffed with trained representatives who are knowledgeable about the incident and the services being offered. The call center will be available for a period of 12 weeks commencing with the start of the notification mailing.

D. Vendor Accountability and Remediation

Quorum has taken the following steps with respect to its business associate, Palomar Data Solutions, to address the circumstances that gave rise to the breach and to seek accountability under the governing contractual agreements:

Contractual Indemnification Claims: Quorum has formally asserted contractual indemnification claims against Palomar under Section 12.2 of the Master Services Agreement, which provides for indemnification by Palomar of all losses, damages, costs, and expenses (including reasonable attorneys' fees and costs of regulatory defense and compliance) arising from or related to Palomar's breach of its data security obligations under the MSA and the Data Security Exhibit (Exhibit D). The contractual liability cap applicable to Palomar's indemnification obligations under Section 12.2 is $32,600,000, calculated as two times (2×) the trailing twelve-month fees paid under the MSA. Quorum's indemnification claims encompass, among other categories of loss, costs of forensic investigation, regulatory notification and compliance, consumer notification, credit monitoring and identity theft protection services, crisis communications, regulatory defense, and any fines, penalties, or settlement costs arising from the breach.

Root Cause Identification: The forensic investigation conducted by Graystone Forensics LLC identified Palomar's failure to patch the known CVE-2023-0669 vulnerability within the 30-day patch management window required by the MSA's Data Security Exhibit (Exhibit D, as amended by Amendment No. 2, dated September 15, 2022) as the root cause enabling the breach. Under Exhibit D, Section 4.3 (Vulnerability and Patch Management), Palomar was required to apply critical security patches to all internet-facing systems and applications within 30 calendar days of the patch becoming available from the vendor. The patch for CVE-2023-0669 was released on or about February 7, 2023. As of March 14, 2023, the date of initial compromise — more than 35 days after the patch release — Palomar had not applied the patch. This failure constitutes a material breach of Palomar's contractual obligations under the MSA and the Data Security Exhibit.

Enhanced Security Measures: Quorum is working with Palomar to implement enhanced security measures within Palomar's environment to prevent the recurrence of similar incidents. These measures include, but are not limited to:

• Enhanced patch management protocols, including automated vulnerability scanning, accelerated patching timelines for critical and high-severity vulnerabilities (reduced from 30 days to 14 days), and mandatory executive-level reporting on patch compliance status;

• Deployment of advanced endpoint detection and response ("EDR") tools across all Palomar systems and endpoints involved in processing Quorum data;

• Implementation of enhanced network segmentation to limit lateral movement within Palomar's environment;

• Engagement of an independent third-party security assessor approved by Quorum to conduct enhanced annual security audits of Palomar's environment, with audit results to be shared with Quorum; and

• Implementation of enhanced logging and monitoring capabilities, including extended log retention periods and real-time alerting for anomalous data transfer activity.

MSA Amendments: The data security provisions of the MSA are being amended to impose more stringent requirements on Palomar, including accelerated patching timelines, enhanced audit rights for Quorum, mandatory penetration testing, and strengthened incident response and notification obligations.

E. Internal Remediation and Program Enhancements

In addition to the vendor-specific remediation measures described above, Quorum has undertaken significant internal remediation and program enhancement efforts to strengthen its own vendor risk management and data security oversight capabilities:

Vendor Risk Management Program Enhancement: Quorum has commenced a comprehensive review of its vendor risk management program, overseen by Priya Deshmukh, Vice President of Vendor Risk Management. This review encompasses an assessment of Quorum's processes for evaluating, onboarding, monitoring, and auditing third-party vendors and business associates that process PHI or other sensitive data on behalf of Quorum. The review is expected to result in enhanced vendor risk assessment questionnaires, more frequent and rigorous vendor security assessments, tiered vendor risk classifications with corresponding oversight requirements, and enhanced contractual data security and breach notification provisions.

Enhanced Breach Notification Timing Requirements: Quorum is revising its standard Business Associate Agreement template and its contractual data security exhibits to reduce the required breach notification window from 48 hours to 24 hours. This accelerated notification requirement will apply to all new and renewed business associate agreements and will be implemented through amendments to existing agreements with critical vendors, including Palomar.

Incident Response Program Enhancements: Quorum's information security program, overseen by David Naranjo (CISO) and Jennifer Liang (CPO), is being enhanced with additional third-party risk assessment procedures, updated incident response playbooks addressing business associate breaches, and an expanded schedule of incident response tabletop exercises that will include scenarios involving third-party vendor compromises. Quorum plans to conduct at least two tabletop exercises per year involving cross-functional participation from Legal, Information Security, Privacy, Compliance, Communications, and senior executive leadership.

F. Insurance Notification

On May 8, 2023, Quorum filed a claim under its primary cyber-liability insurance policy with its insurer, Atlas Mutual Insurance Company. The relevant policy and claim details are as follows:

• Insurer: Atlas Mutual Insurance Company

• Policy Number: CYB-2023-041587

• Claim Number: CYB-CLM-2023-05892

• Date of Claim Filing: May 8, 2023

Quorum's cyber-liability insurance coverage is responding to covered costs arising from the breach, including the costs of the forensic investigation, regulatory notification and compliance, consumer notification, credit monitoring and identity theft protection services, crisis communications, and regulatory defense costs. Quorum is working cooperatively with Atlas Mutual Insurance Company and its designated claims adjusters and coverage counsel to ensure that all covered costs are properly documented and submitted for reimbursement under the applicable policy terms and conditions.

IX. CONTACT INFORMATION

Quorum's Designated Contact for this Notification:

Jennifer Liang Chief Privacy Officer Quorum Insurance Holdings Corp. 400 Constitution Plaza, Suite 2200 Hartford, CT 06103 Telephone: (860) 555-4200

Email: jliang@quorumholdings.com

Outside Counsel Contact:

Kevin Ostrowski, Partner Calderwood & Harkness LLP Privacy & Data Security Practice Group 1700 K Street NW, Suite 900 Washington, D.C. 20006 Telephone: (202) 555-8100

Email: kostrowski@calderwoodharkness.com

Affected Individual Inquiry Contact:

Quorum Insurance Holdings Corp. Breach Response Call Center Operated by Clearfield Notification Services LLC Toll-Free Number: 1-888-555-0143 Hours of Operation: Monday through Friday, 8:00 a.m. to 8:00 p.m. Eastern Time; Saturday, 9:00 a.m. to 5:00 p.m. Eastern Time Available for a 12-week window commencing with the start of the notification mailing (August 18, 2023 through November 10, 2023)

All inquiries from the Office for Civil Rights regarding this notification should be directed to Jennifer Liang, Chief Privacy Officer, or Kevin Ostrowski, Calderwood & Harkness LLP, at the contact information provided above.

X. REGULATORY NOTIFICATIONS TO OTHER ENTITIES

In addition to this notification to the Secretary of Health and Human Services, Quorum has filed or is in the process of filing breach notifications with the following state regulatory authorities, in accordance with the applicable state breach notification statutes:

All notifications to state regulatory authorities are being made in accordance with the requirements of the applicable state breach notification statutes, including any state-specific content, timing, and format requirements. Where applicable, notifications are also being made to state insurance regulators pursuant to state insurance data security laws and regulations.

Quorum will provide additional details regarding specific state filings to the Office for Civil Rights upon request.

XI. ENCLOSURES AND SUPPORTING MATERIALS

The following documents are enclosed with this notification for the Office for Civil Rights' review:

Enclosure A: Copy of the HIPAA-compliant consumer notification letter (PHI version) being mailed to the 41,203 individuals whose protected health information was compromised in the breach. This letter contains all elements required by 45 C.F.R. § 164.404(c), including a description of the breach, the types of unsecured PHI involved, steps individuals should take to protect themselves, a description of Quorum's response and remediation efforts, and contact procedures including the toll-free call center number and enrollment information for the complimentary credit monitoring and identity theft protection services.

Enclosure B: Copy of the media notice being issued pursuant to 45 C.F.R. § 164.406 to prominent media outlets serving states where the breach affected more than 500 residents. The media notice includes a general description of the breach, the types of information involved, steps individuals can take to protect themselves, and contact information for affected individuals.

Enclosure C: Copy of the substitute notice and website posting language being published on Quorum's corporate website (www.quorumholdings.com) in accordance with 45 C.F.R. § 164.404(d)(2). The website posting provides a summary of the breach, describes the steps Quorum is taking in response, and directs affected individuals to the toll-free call center for assistance.

XII. CERTIFICATION AND SIGNATURE

The undersigned hereby certifies, on behalf of Quorum Insurance Holdings Corp., that the information provided in this notification is true, complete, and accurate to the best of the undersigned's knowledge, information, and belief, formed after reasonable inquiry. Quorum Insurance Holdings Corp. acknowledges its continuing obligation to cooperate with the Office for Civil Rights and to provide any additional information that may be requested in connection with this notification and any related investigation.

QUORUM INSURANCE HOLDINGS CORP.

By: ________

Name: Jennifer Liang

Title: Chief Privacy Officer

Date: August 15, 2023

Prepared and submitted on behalf of Quorum Insurance Holdings Corp. by:

CALDERWOOD & HARKNESS LLP

By: ________

Name: Kevin Ostrowski

Title: Partner, Privacy & Data Security

Calderwood & Harkness LLP 1700 K Street NW, Suite 900 Washington, D.C. 20006 Matter Number: 1025-00006

Date: August 15, 2023

This notification, including all enclosures, is submitted to the U.S. Department of Health and Human Services, Office for Civil Rights, in compliance with 45 C.F.R. § 164.408. Nothing in this notification constitutes a waiver of any rights, privileges, or defenses available to Quorum Insurance Holdings Corp. under applicable law, including the attorney-client privilege and the work product doctrine. Quorum reserves all such rights, privileges, and defenses.

Date	Event
On or about March 14, 2023	Initial Unauthorized Access. A threat actor exploited a known but unpatched remote code execution vulnerability, identified as CVE-2023-0669, in Palomar's GoAnywhere MFT (Managed File Transfer) file transfer appliance to gain unauthorized access to Palomar's network environment. CVE-2023-0669 is a pre-authentication command injection vulnerability in Severin Corporation's GoAnywhere MFT product, which was publicly disclosed in early February 2023 and for which a patch (version 7.1.2) was made available by the vendor on or about February 7, 2023. Despite the availability of this patch and the publication of active exploitation warnings by the Cybersecurity and Infrastructure Security Agency ("CISA"), Palomar had not applied the patch to its GoAnywhere MFT appliance as of the date of initial compromise.
March 14, 2023 – April 18, 2023 (approximately 35 days)	Exfiltration Window. During this approximately 35-day period, the threat actor engaged in lateral movement within Palomar's network, escalated privileges, identified and accessed Palomar's claims data processing servers, staged structured data files containing Quorum policyholder and claimant data, and exfiltrated those files to an external location controlled by the threat actor. The forensic investigation conducted by Graystone Forensics LLC confirmed that the threat actor used a combination of legitimate administrative tools and custom scripts to move laterally through Palomar's environment and to identify, compress, and exfiltrate targeted data files.
April 18, 2023	discovery by Palomar. Palomar's security operations center ("SOC") detected unusual outbound data transfers from its claims data processing environment. The anomalous network traffic triggered automated alerts, and Palomar's SOC analysts confirmed that the outbound transfers were not consistent with normal business operations. Palomar initiated an internal investigation and engaged its own incident response resources to contain the incident.
April 21, 2023	Notification from Palomar to Quorum. Derek Copeland, General Counsel of Palomar, notified Thomas R. Whitfield, General Counsel of Quorum, and David Naranjo, Chief Information Security Officer of Quorum, via email and follow-up telephone call, of the security incident. Palomar's initial notification indicated that a security incident had occurred involving potential unauthorized access to Palomar's network environment and that data associated with Quorum's claims processing operations may have been affected. Palomar's notification was provided within the 48-hour notification window required by the BAA incorporated into the MSA.
April 21 – May 3, 2023	Initial Assessment and Internal Escalation. Upon receiving Palomar's notification, Quorum activated its incident response plan and convened its Incident Response Team, which includes representatives from the Legal, Information Security, Privacy, Compliance, and Communications departments. Quorum's CISO, David Naranjo, coordinated with Palomar's security team to obtain preliminary information regarding the scope of the incident. Quorum's General Counsel, Thomas R. Whitfield, and Chief Privacy Officer, Jennifer Liang, assessed the potential regulatory notification obligations and determined that outside counsel should be retained to manage the breach response.
May 4, 2023	Engagement of Outside Counsel. Quorum engaged Calderwood & Harkness LLP, under the direction of Kevin Ostrowski, Partner in the firm's Privacy & Data Security practice, to manage the breach response, including coordination of the forensic investigation, assessment of regulatory notification obligations, preparation of regulatory filings, and oversight of consumer notification activities.
May 5, 2023	Retention of Forensic Investigator. At the direction of Calderwood & Harkness LLP, Graystone Forensics LLC was retained under the attorney-client privilege and work product doctrine umbrella to conduct a thorough forensic investigation of the breach. The forensic engagement was led by Dr. Nolan Briggs, Managing Director, Incident Response, and Kendra Faulkner, Senior Forensic Analyst, both of Graystone Forensics LLC. The engagement was structured to ensure that the forensic investigation and resulting reports would be protected by the attorney-client privilege and the work product doctrine.
May 5 – June 2, 2023	Forensic Investigation — Phase I. Graystone Forensics LLC conducted a comprehensive forensic analysis of the compromised Palomar environment, including analysis of system logs, network traffic captures, endpoint forensic images, and file access and transfer records. Graystone worked in coordination with Palomar's internal IT security team and Palomar's own incident response vendors to obtain the necessary forensic artifacts.
June 2, 2023	Preliminary Forensic Findings. Graystone Forensics LLC provided preliminary findings to Calderwood & Harkness LLP confirming: (a) the attack vector (exploitation of CVE-2023-0669 in Palomar's unpatched GoAnywhere MFT appliance); (b) the exfiltration of structured data files from Palomar's claims processing environment; and (c) the likelihood that the exfiltrated data files contained personally identifiable information and potentially PHI associated with Quorum policyholders and claimants.
June 2 – July 14, 2023	Forensic Investigation — Phase II and Data Analysis. Graystone Forensics LLC continued its investigation to determine the full scope of compromised data, including a detailed analysis of the specific data files that were accessed and exfiltrated by the threat actor. This analysis involved the reconstruction of the threat actor's activities within the Palomar environment and the identification of all data files that were staged and exfiltrated.
July 14, 2023	Final Forensic Report. Graystone Forensics LLC issued its final forensic report to Calderwood & Harkness LLP, confirming the full scope of compromised data, including the identification of PHI among the exfiltrated data files. The final report confirmed that the exfiltrated data included structured data files containing names, dates of birth, Social Security numbers, driver's license numbers, health conditions and diagnoses (diagnosis codes), treatment information associated with workers' compensation and health-related insurance claims, and, for certain individuals, bank account numbers and/or payment card numbers.
July 15 – August 4, 2023	Data Mining and Affected Individual Identification. Following receipt of the final forensic report, Calderwood & Harkness LLP, in coordination with Quorum and Clearfield Notification Services LLC, undertook a comprehensive data mining effort to identify the specific individuals whose data was compromised and to determine which individuals' PHI was involved. This process involved the de-duplication, normalization, and cross-referencing of the compromised data files against Quorum's policyholder and claimant databases.
August 4, 2023	Identification of Affected Individuals Completed. Data mining and affected individual identification was completed. A total of 318,247 individuals were identified as having had their personally identifiable information compromised. Of that total, 41,203 individuals were identified as having had their PHI compromised.
August 15, 2023	Notification to HHS-OCR (this notification).
August 18, 2023 (commenced)	Individual Notification Mailing Commences. Consumer notification letters are being mailed to all affected individuals, with completion targeted for September 15, 2023.
State	Total Affected Individuals
Connecticut	52,114
New York	47,831
California	38,206
Texas	29,477
Florida	22,913
Pennsylvania	18,640
Illinois	16,502
New Jersey	14,388

Ohio	11,743
Massachusetts	10,217
19 Additional States and D.C.	56,216 (combined)
Total	318,247
Regulatory Authority	Date Filed	Applicable Statute	Affected Residents
Connecticut Attorney General's Office	August 14, 2023	Conn. Gen. Stat. § 36a-701b	52,114
Connecticut Insurance Department	August 14, 2023	Conn. Gen. Stat. § 38a-999b	52,114
New York Attorney General's Office	August 16, 2023	N.Y. Gen. Bus. Law § 899-aa	47,831
California Attorney General's Office	August 16, 2023	Cal. Civ. Code § 1798.82	38,206
Massachusetts Attorney General's Office	August 17, 2023	Mass. Gen. Laws ch. 93H, § 3	10,217
Attorneys General and/or Regulators in 24 Additional States	August 17–25, 2023	Various state breach notification statutes	Varies by state

BREACH NOTIFICATION TO THE SECRETARY OF HEALTH AND HUMAN SERVICES
Pursuant to Section 13402 of the HITECH Act and 45 C.F.R. § 164.408
Date of Submission: August 15, 2023
Submitted To:
U.S. Department of Health and Human Services Office for Civil Rights, Region I (Boston) Government Center J.F.K. Federal Building, Room 1875 Boston, MA 02203
Submitted By / Covered Entity:
Quorum Insurance Holdings Corp. 400 Constitution Plaza, Suite 2200 Hartford, CT 06103 EIN: 06-4832197 Nasdaq: QIHC
Contact Person for this Notification:
Jennifer Liang Chief Privacy Officer Quorum Insurance Holdings Corp. 400 Constitution Plaza, Suite 2200 Hartford, CT 06103 Telephone: (860) 555-4200
Email: jliang@quorumholdings.com
Outside Counsel (preparing and submitting on behalf of Quorum Insurance Holdings Corp.):
Calderwood & Harkness LLP Kevin Ostrowski, Responsible Partner, Privacy & Data Security 1700 K Street NW, Suite 900 Washington, D.C. 20006 Telephone: (202) 555-8100
Email: kostrowski@calderwoodharkness.com
Matter Number: 1025-00006
Submission Method: This notification is being submitted electronically via the HHS-OCR Breach Portal, with a concurrent hard-copy transmittal letter sent via Severin Partners LLC overnight delivery to the Region I Office of the Office for Civil Rights in Boston, Massachusetts.
I. INTRODUCTORY STATEMENT AND PURPOSE
Quorum Insurance Holdings Corp. ("Quorum" or the "Company"), a covered entity under the Health Insurance Portability and Accountability Act of 1996, as amended ("HIPAA"), and its implementing regulations at 45 C.F.R. Parts 160 and 164, hereby submits this notification to the Secretary of Health and Human Services (the "Secretary") pursuant to Section 13402 of the Health Information Technology for Economic and Clinical Health Act (the "HITECH Act"), Pub. L. No. 111-5, Title XIII, and the Breach Notification Rule codified at 45 C.F.R. §§ 164.400–164.414.
This notification concerns a breach of unsecured protected health information ("PHI") affecting a total of 41,203 individuals who are policyholders or claimants under Quorum's workers' compensation and health-related insurance claims lines. The breach originated at Palomar Data Solutions, Inc. ("Palomar"), a business associate of Quorum, and involved the unauthorized access to and exfiltration of structured data files containing PHI from Palomar's network environment by a third-party threat actor during the period of approximately March 14, 2023 through April 18, 2023.
Because the breach affected more than 500 individuals, Quorum is providing this notification to the Secretary without unreasonable delay and in no event later than 60 calendar days following the discovery of the breach, in accordance with 45 C.F.R. § 164.408. As set forth in greater detail in Section IV below, while Quorum first received notification of the security incident from Palomar on April 21, 2023, the identification of specific individuals whose PHI was compromised was not completed until August 4, 2023, following the conclusion of a comprehensive forensic investigation and data mining process. This notification is being submitted within 60 days of the final identification of affected individuals, consistent with the requirements of 45 C.F.R. § 164.404(a)(2) and the guidance issued by the Office for Civil Rights.
Concurrent with this notification to the Secretary, Quorum is undertaking the following additional notification activities required by the Breach Notification Rule:
•  Individual Notifications (45 C.F.R. § 164.404): Individual breach notification letters are being mailed to all 41,203 PHI-affected individuals (as part of a broader notification to 318,247 individuals whose personally identifiable information was compromised in the same incident). The consumer notification mailing commenced on August 18, 2023, with completion of all mailings targeted for no later than September 15, 2023.
•  Media Notice (45 C.F.R. § 164.406): Because the breach involves more than 500 residents of certain individual states, Quorum is issuing media notices concurrently on August 15, 2023, to prominent media outlets serving those states, in accordance with 45 C.F.R. § 164.406.
•  Substitute Notice: Quorum is also publishing a substitute notice on its corporate website (www.quorumholdings.com) to supplement the direct individual notifications.
This notification is intended to provide the Secretary with the information required by 45 C.F.R. § 164.408 and to demonstrate Quorum's commitment to full compliance with its obligations under the Breach Notification Rule.
II. IDENTIFICATION OF THE COVERED ENTITY
Full Legal Name: Quorum Insurance Holdings Corp.
Principal Business Address:
400 Constitution Plaza, Suite 2200 Hartford, CT 06103
Entity Type: Quorum is a Delaware corporation, incorporated under the laws of the State of Delaware and publicly traded on the Nasdaq Stock Market under the ticker symbol "QIHC." The Company is subject to reporting obligations under the Securities Exchange Act of 1934.
Nature of Business: Quorum is a diversified insurance holding company engaged in the underwriting and administration of property and casualty insurance, specialty lines insurance, and life and annuity products through its network of operating subsidiaries. In addition, Quorum operates a digital underwriting platform and insurtech analytics division that provides data-driven risk assessment and pricing solutions. For the fiscal year ended December 31, 2022, Quorum reported consolidated annual revenue of approximately $4.82 billion. As of August 2023, Quorum employs approximately 11,400 individuals across its corporate headquarters in Hartford, Connecticut, and its regional offices and operating subsidiaries throughout the United States.
HIPAA Role — Covered Entity Status: Quorum, through its insurance operating subsidiaries, functions as a "health plan" as defined in 45 C.F.R. § 160.103. Specifically, Quorum processes health-related insurance claims — including workers' compensation claims and health-related claims lines — that involve protected health information as defined in 45 C.F.R. § 160.103. Quorum's claims operations involve the receipt, processing, adjudication, and payment of claims that contain individually identifiable health information, including diagnosis codes, treatment information, and other clinical data related to covered individuals. As a health plan, Quorum is subject to the HIPAA Privacy Rule (45 C.F.R. Part 164, Subpart E), the HIPAA Security Rule (45 C.F.R. Part 164, Subpart C), and the Breach Notification Rule (45 C.F.R. Part 164, Subpart D).
Designated Privacy Officer:
Jennifer Liang Chief Privacy Officer Quorum Insurance Holdings Corp. 400 Constitution Plaza, Suite 2200 Hartford, CT 06103 Telephone: (860) 555-4200
Email: jliang@quorumholdings.com
Designated Security Officer:
David Naranjo Chief Information Security Officer Quorum Insurance Holdings Corp. 400 Constitution Plaza, Suite 2200 Hartford, CT 06103 Telephone: (860) 555-4215
Email: dnaranjo@quorumholdings.com
III. IDENTIFICATION OF THE BUSINESS ASSOCIATE INVOLVED
The breach at issue originated within the network environment of Quorum's business associate, Palomar Data Solutions, Inc. The following information identifies the business associate and describes the nature of the contractual relationship between Quorum and Palomar.
Business Associate Name: Palomar Data Solutions, Inc. ("Palomar")
Principal Business Address:
7100 Greenville Avenue, Suite 450 Dallas, TX 75231
Nature of Relationship: Palomar is a third-party claims data processing vendor that provides claims data processing, document management, and analytics services to Quorum. Palomar has served as a key vendor in Quorum's claims administration infrastructure since late 2019. In the course of providing these services, Palomar receives, processes, stores, and transmits PHI on behalf of Quorum in connection with claims administration for Quorum's personal lines division, including workers' compensation claims and health-related insurance claims lines.
Governing Agreements: The relationship between Quorum and Palomar is governed by a Master Services Agreement ("MSA") dated November 12, 2019, as amended by Amendment No. 1 dated March 3, 2021, and Amendment No. 2 dated September 15, 2022. The MSA contains comprehensive data security obligations, including a Data Security Exhibit (Exhibit D, as amended), which sets forth, among other requirements, Palomar's obligations with respect to vulnerability management, patch management, encryption, access controls, and incident response and notification.
Annual Contract Value: The annual contract value under the MSA, as adjusted by Amendment No. 1, is approximately $16,300,000.
Business Associate Agreement: A Business Associate Agreement ("BAA"), as required by 45 C.F.R. § 164.502(e) and 45 C.F.R. § 164.504(e), is incorporated into the MSA as a component thereof. Under the BAA, Palomar is obligated to, among other things: (a) use and disclose PHI only as permitted by the BAA and as required by law; (b) implement appropriate administrative, physical, and technical safeguards to protect the confidentiality, integrity, and availability of electronic PHI; (c) report any security incident or breach of unsecured PHI to Quorum without unreasonable delay; and (d) make its internal practices, books, and records relating to the use and disclosure of PHI available to the Secretary for purposes of determining compliance with the HIPAA Rules.
Palomar Key Contacts:
Marcus J. Trevino, Chief Executive Officer Derek Copeland, General Counsel Palomar Data Solutions, Inc. 7100 Greenville Avenue, Suite 450 Dallas, TX 75231
Palomar Outside Counsel:
Catherine Langford, Partner Mercer, Haight & Dunlop LLP 2100 Ross Avenue, Suite 3600 Dallas, TX 75201
IV. DESCRIPTION OF THE BREACH — NATURE AND CIRCUMSTANCES
A. Discovery and Timeline
The following timeline sets forth the key events associated with the breach, from the date of initial unauthorized access through the completion of the forensic investigation and identification of affected individuals:
Date Breach Treated as discovered for HIPAA Purposes: In accordance with 45 C.F.R. § 164.404(a)(2), the breach was treated as discovered by Quorum as of April 21, 2023, the date on which Palomar first notified Quorum of the security incident. However, the scope and nature of the compromised data — including the specific identification that PHI was involved and the determination of which individuals' PHI was affected — was not confirmed until the final forensic report was issued on July 14, 2023, and the individual-level identification process was completed on August 4, 2023. Quorum exercised reasonable diligence throughout the investigative process and is providing this notification to the Secretary within 60 days of the final identification of affected individuals, consistent with the requirements of 45 C.F.R. § 164.404(a)(2) and the Office for Civil Rights' guidance regarding the commencement of the notification clock when a breach investigation is ongoing.
B. Nature of the Breach
The breach originated at Palomar Data Solutions, Inc., Quorum's third-party claims data processing vendor and business associate under HIPAA. The breach did not originate within Quorum's own network, systems, or facilities. Quorum's internal information systems and network infrastructure were not compromised as a result of this incident.
The threat actor exploited CVE-2023-0669, a known pre-authentication remote code execution vulnerability in Severin Corporation's GoAnywhere MFT (Managed File Transfer) product, which was present in Palomar's GoAnywhere MFT file transfer appliance. This vulnerability was publicly disclosed in early February 2023, and a remedial patch (GoAnywhere MFT version 7.1.2) was released by the vendor, Severin Corporation (formerly Strathmore Industries), on or about February 7, 2023. The Cybersecurity and Infrastructure Security Agency ("CISA") added CVE-2023-0669 to its Known Exploited Vulnerabilities Catalog on February 10, 2023, and issued advisories warning of active exploitation by threat actors. Despite the availability of the patch and the public warnings of active exploitation, Palomar had not applied the patch to its GoAnywhere MFT appliance as of the date of initial compromise on or about March 14, 2023 — more than five weeks after the patch became available.
After gaining initial access to Palomar's environment through the GoAnywhere MFT appliance, the threat actor conducted lateral movement within Palomar's network over the course of approximately 35 days. During this period, the threat actor escalated privileges, identified Palomar's claims data processing servers containing Quorum policyholder and claimant data, and staged and exfiltrated structured data files to an external location under the threat actor's control. The forensic investigation confirmed that the threat actor used a combination of legitimate remote administration tools, credential harvesting techniques, and custom data compression and exfiltration scripts to accomplish the data theft.
The breach involved the unauthorized access to and acquisition of electronic protected health information that was not rendered unusable, unreadable, or indecipherable to unauthorized persons through the use of a technology or methodology specified in the guidance issued by the Secretary pursuant to 42 U.S.C. § 17932(h)(2). Specifically, the compromised PHI was stored in Palomar's claims data processing environment in a format that was not encrypted at rest or otherwise secured through encryption or destruction as contemplated by the Breach Notification Rule. Accordingly, the compromised PHI constitutes "unsecured protected health information" as defined in 45 C.F.R. § 164.402, and the unauthorized access to and acquisition of such PHI constitutes a "breach" as defined in 45 C.F.R. § 164.402.
Quorum has evaluated the breach in light of the four-factor risk assessment set forth in 45 C.F.R. § 164.402(2) and has determined that the unauthorized access to and acquisition of the PHI at issue compromises the security or privacy of the PHI and that the applicable exceptions to the definition of "breach" do not apply. Specifically:
(1) Nature and extent of the PHI involved: The PHI involved includes highly sensitive data elements, including names, dates of birth, Social Security numbers, diagnosis codes, and treatment information. The combination of these data elements creates a significant risk of identity theft, financial fraud, and unauthorized access to or use of health information.
(2) The unauthorized person who used the PHI or to whom the disclosure was made: The PHI was accessed and exfiltrated by an unknown external threat actor. The identity and location of the threat actor have not been conclusively determined, although the forensic investigation identified indicators consistent with a financially motivated threat actor group. The threat actor's intentions and any subsequent use or further disclosure of the PHI are not known.
(3) Whether the PHI was actually acquired or viewed: The forensic investigation confirmed that the structured data files containing PHI were exfiltrated from Palomar's environment, meaning the data was actually acquired by the threat actor. The forensic evidence supports the conclusion that the PHI was not merely viewed but was copied and transferred to an external location.
(4) The extent to which the risk to the PHI has been mitigated: Quorum and Palomar have taken steps to mitigate the risk, including containment of the vulnerability, engagement of law enforcement, monitoring for evidence of misuse, and provision of credit monitoring and identity theft protection services to affected individuals. However, given the exfiltration of the data to an external location controlled by the threat actor, the risk to the PHI cannot be fully mitigated.
Based on this risk assessment, Quorum has determined that the incident constitutes a breach of unsecured PHI requiring notification under the Breach Notification Rule.
C. Location of the Breach
The breach occurred within Palomar Data Solutions, Inc.'s network environment, located at Palomar's principal offices and data center facilities in Dallas, Texas. Specifically, the initial point of compromise was Palomar's GoAnywhere MFT file transfer appliance, which served as the entry point for the threat actor. Following the initial compromise, the threat actor moved laterally to Palomar's connected claims data processing servers, which housed the structured data files containing Quorum policyholder and claimant data, including PHI.
The breach did not occur within Quorum's own network, systems, data centers, or facilities. Quorum's internal information systems and network infrastructure, including its corporate headquarters in Hartford, Connecticut, and its regional offices and data centers, were not compromised as a result of this incident.
V. TYPES OF UNSECURED PROTECTED HEALTH INFORMATION INVOLVED
The PHI compromised in the breach pertains to 41,203 individuals who are policyholders or claimants under Quorum's workers' compensation and health-related insurance claims lines. These individuals' claims data was processed by Palomar Data Solutions, Inc. on behalf of Quorum in connection with claims administration for Quorum's personal lines division.
The types of unsecured protected health information involved in the breach include the following data elements:
•  Names (first name, middle name or initial, and last name)
•  Dates of birth
•  Social Security numbers
•  Driver's license numbers (state-issued)
•  Health conditions and diagnoses (including ICD-10-CM diagnosis codes associated with workers' compensation and health-related insurance claims)
•  Treatment information associated with workers' compensation and health-related insurance claims (including descriptions of medical treatments, procedures, and provider information linked to claims)
Not all data elements were present for every affected individual. The specific combination of data elements compromised varies by individual, depending on the nature and stage of the individual's claim and the data fields populated in the claims processing records maintained by Palomar.
In addition to the PHI data elements listed above, for certain individuals within the 41,203 PHI-affected population who are also part of the broader subset of 84,619 individuals whose financial data was compromised, the following additional data elements were also involved:
•  Bank account numbers (including routing numbers and account numbers associated with claim payment disbursements)
•  Payment card numbers (including credit or debit card numbers associated with premium payments or other financial transactions)
It is important to note that the PHI subset of 41,203 individuals is a component of the larger breach affecting a total of 318,247 individuals across 29 states and the District of Columbia whose personally identifiable information was compromised in the same incident. For all 318,247 affected individuals (including those whose data does not include PHI), the compromised data includes, at a minimum, names, dates of birth, Social Security numbers, and driver's license numbers. The 41,203 PHI-affected individuals represent those individuals for whom, in addition to the foregoing PII data elements, health conditions, diagnoses, and/or treatment information was also compromised, thereby constituting a breach of unsecured PHI subject to the HIPAA Breach Notification Rule.
VI. NUMBER OF INDIVIDUALS AFFECTED
Total number of individuals whose unsecured protected health information was breached: 41,203
These 41,203 PHI-affected individuals are a subset of the total population of 318,247 individuals across 29 states and the District of Columbia whose personally identifiable information was compromised in the breach.
Geographic Distribution: The PHI-affected individuals reside in multiple states across the United States. The PHI-affected population is distributed proportionally across the same 29 states and the District of Columbia as the broader affected population. A detailed state-by-state breakdown of PHI-affected individuals is available and will be provided to the Office for Civil Rights upon request.
For reference, the overall geographic distribution of the broader affected population of 318,247 individuals, by state, is as follows:
The 41,203 PHI-affected individuals are distributed proportionally across these states, with the largest concentrations in Connecticut, New York, California, Texas, and Florida, consistent with the geographic distribution of Quorum's workers' compensation and health-related insurance claims book of business.
VII. STEPS INDIVIDUALS SHOULD TAKE TO PROTECT THEMSELVES
Quorum is advising all affected individuals, including all 41,203 individuals whose PHI was compromised, to take the following steps to protect themselves from potential harm resulting from the breach:
1.  Monitor Health-Related Statements and Records. Affected individuals should carefully review their explanation of benefits ("EOB") statements, medical records, and insurance claims for any unauthorized or suspicious activity, including claims for services or treatments they did not receive, unfamiliar provider names, or other irregularities that may indicate unauthorized use of their health information. Any suspicious activity should be reported immediately to their insurance carrier and healthcare provider(s).
2.  Review Credit Reports. Affected individuals should obtain and carefully review their credit reports from each of the three major credit reporting agencies — Harborview Enterprises, Penrose Group, and Penmark Enterprises — for accuracy and for any evidence of unauthorized accounts, inquiries, or other activity. Under federal law, individuals are entitled to one free credit report from each of the three agencies every 12 months, which can be obtained at www.annualcreditreport.com or by calling 1-877-322-8228.
3.  Consider Fraud Alerts or Security Freezes. Affected individuals should consider placing an initial fraud alert on their credit files with each of the three major credit reporting agencies. An initial fraud alert is free and lasts for one year, and it requires creditors to take reasonable steps to verify the identity of anyone seeking credit in the individual's name. Alternatively, individuals may consider placing a security freeze (also known as a credit freeze) on their credit files, which restricts access to their credit reports and prevents new accounts from being opened in their name without their express authorization. Security freezes are free under federal and state law.
4.  Report Suspected Identity Theft. Affected individuals should report any suspected identity theft or unauthorized use of their personal or health information to their local law enforcement agency and to the Federal Trade Commission ("FTC"). Reports to the FTC can be filed online at www.identitytheft.gov or by calling 1-877-438-4338. Individuals may also report concerns to their state attorney general's office.
5.  Enroll in Complimentary Credit Monitoring and Identity Theft Protection Services. Quorum is offering all affected individuals, including all 41,203 PHI-affected individuals, complimentary 24-month credit monitoring and identity theft protection services through Clearfield Notification Services LLC. Enrollment details and activation codes are included in the individual notification letters being mailed to affected individuals. A dedicated toll-free call center is available to assist with enrollment and to answer questions. Affected individuals are strongly encouraged to enroll in these services promptly.
6.  Contact the HHS Office for Civil Rights. Affected individuals who believe that their health information privacy rights have been violated may file a complaint with the U.S. Department of Health and Human Services, Office for Civil Rights. Complaints may be filed online at www.hhs.gov/hipaa/filing-a-complaint, by mail to the Office for Civil Rights at the appropriate regional office, or by calling (800) 368-1019.
7.  Remain Vigilant for Unsolicited Communications. Affected individuals should remain vigilant for any unsolicited communications — whether by mail, email, telephone, or text message — that request personal, financial, or health information. Such communications may be attempts at phishing, social engineering, or other forms of fraud. Individuals should not provide personal or health information in response to unsolicited requests and should verify the identity and legitimacy of any requestor before responding.
VIII. STEPS QUORUM HAS TAKEN IN RESPONSE TO THE BREACH
A. Investigation and Forensic Response
Immediately upon receiving notification from Palomar Data Solutions on April 21, 2023, Quorum activated its incident response plan and convened its Incident Response Team, consisting of senior representatives from the Legal, Information Security, Privacy, Compliance, and Communications departments. The Incident Response Team, under the leadership of General Counsel Thomas R. Whitfield, Chief Privacy Officer Jennifer Liang, and CISO David Naranjo, took immediate steps to assess the scope and severity of the incident and to coordinate Quorum's response.
On May 4, 2023, Quorum engaged the law firm of Calderwood & Harkness LLP, under the direction of Kevin Ostrowski, Partner in the firm's Privacy & Data Security practice, to serve as outside counsel for the breach response. Calderwood & Harkness LLP was retained to manage all aspects of the breach response, including coordination of the forensic investigation, assessment of regulatory notification obligations under HIPAA, state breach notification statutes, and other applicable laws, preparation and submission of regulatory filings, oversight of consumer notification activities, and coordination with law enforcement.
On May 5, 2023, at the direction of Calderwood & Harkness LLP, Graystone Forensics LLC was retained to conduct a comprehensive forensic investigation of the breach. The engagement was led by Dr. Nolan Briggs, Managing Director of Incident Response, and Kendra Faulkner, Senior Forensic Analyst, both of Graystone Forensics LLC. The forensic engagement was structured under the attorney-client privilege and work product doctrine umbrella, with Graystone retained by and reporting to Calderwood & Harkness LLP to preserve applicable legal protections.
Graystone Forensics LLC conducted an exhaustive forensic analysis over a period of approximately ten weeks, working in coordination with Palomar's internal IT security team and Palomar's own incident response resources. The forensic investigation involved the analysis of system and application logs, network traffic captures and flow data, endpoint forensic images, file access and modification records, and data transfer logs. The investigation confirmed: (a) the attack vector, specifically the exploitation of CVE-2023-0669 in Palomar's unpatched GoAnywhere MFT appliance; (b) the exfiltration timeline, spanning approximately 35 days from on or about March 14, 2023 through April 18, 2023; (c) the lateral movement techniques employed by the threat actor within Palomar's network; and (d) the full scope of data files that were accessed, staged, and exfiltrated by the threat actor, including structured data files containing PHI associated with Quorum policyholders and claimants.
Graystone Forensics LLC provided its preliminary findings on June 2, 2023, and its final forensic report on July 14, 2023. Following receipt of the final forensic report, a comprehensive data mining effort was undertaken to identify the specific individuals whose data was compromised and to determine the specific data elements involved for each individual. This data mining process, conducted by Clearfield Notification Services LLC in coordination with Calderwood & Harkness LLP and Quorum's internal data teams, was completed on August 4, 2023.
B. Notification Activities
Quorum is undertaking the following notification activities in compliance with the HIPAA Breach Notification Rule and applicable state breach notification statutes:
Individual Breach Notification Letters (45 C.F.R. § 164.404): Individual breach notification letters are being mailed via first-class U.S. mail to all 41,203 PHI-affected individuals, as part of the broader notification to 318,247 individuals whose personally identifiable information was compromised. The notification letters are HIPAA-compliant and contain all elements required by 45 C.F.R. § 164.404(c), including:
(i) a brief description of the breach, including the date of the breach and the date of discovery;
(ii) a description of the types of unsecured protected health information that were involved in the breach;
(iii) the steps individuals should take to protect themselves from potential harm resulting from the breach;
(iv) a brief description of what Quorum is doing to investigate the breach, mitigate losses, and protect against any further breaches; and
(v) contact procedures, including a toll-free telephone number, an email address, a postal address, and a website address where affected individuals can obtain additional information and assistance.
The PHI-specific version of the notification letter includes additional language specifically addressing the compromise of health-related information and the steps individuals should take to monitor their health records and insurance claims for unauthorized activity.
The consumer notification mailing commenced on August 18, 2023, with completion of all mailings targeted for no later than September 15, 2023. Returned mail will be tracked, and reasonable efforts will be made to obtain updated addresses for individuals whose notification letters are returned as undeliverable.
Media Notice (45 C.F.R. § 164.406): Because the breach involves more than 500 residents of certain individual states, Quorum is issuing media notices on August 15, 2023, to prominent media outlets serving those states, in accordance with 45 C.F.R. § 164.406. The media notice includes a general description of the breach, the types of information involved, steps individuals can take to protect themselves, and contact information for Quorum's toll-free call center.
Substitute Notice: Quorum is also publishing a substitute notice on its corporate website (www.quorumholdings.com) to supplement the direct individual notifications, in accordance with 45 C.F.R. § 164.404(d)(2). The website posting provides information about the breach and directs affected individuals to the toll-free call center for assistance.
C. Credit Monitoring and Identity Theft Protection
Quorum is offering all affected individuals, including all 41,203 PHI-affected individuals, 24 months of complimentary credit monitoring and identity theft protection services through Clearfield Notification Services LLC, a nationally recognized provider of breach response and notification services. The credit monitoring and identity theft protection package includes:
•  Three-bureau credit monitoring (Harborview Enterprises, Penrose Group, and Penmark Enterprises)
•  Automated alerts for key changes to credit files
•  Identity theft insurance coverage (up to $1,000,000 per individual)
•  Dark web monitoring for compromised credentials
•  Identity restoration assistance
Enrollment details and unique activation codes are included in the individual notification letters being mailed to affected individuals. Based on industry benchmarks and historical experience, Quorum estimates an enrollment take-rate of approximately 40%, which would result in approximately 127,299 enrollees across the full affected population of 318,247 individuals.
A dedicated toll-free call center, operated by Clearfield Notification Services LLC, has been established to assist affected individuals with enrollment in the credit monitoring and identity theft protection services and to answer questions about the breach and the notification process. The call center is staffed with trained representatives who are knowledgeable about the incident and the services being offered. The call center will be available for a period of 12 weeks commencing with the start of the notification mailing.
D. Vendor Accountability and Remediation
Quorum has taken the following steps with respect to its business associate, Palomar Data Solutions, to address the circumstances that gave rise to the breach and to seek accountability under the governing contractual agreements:
Contractual Indemnification Claims: Quorum has formally asserted contractual indemnification claims against Palomar under Section 12.2 of the Master Services Agreement, which provides for indemnification by Palomar of all losses, damages, costs, and expenses (including reasonable attorneys' fees and costs of regulatory defense and compliance) arising from or related to Palomar's breach of its data security obligations under the MSA and the Data Security Exhibit (Exhibit D). The contractual liability cap applicable to Palomar's indemnification obligations under Section 12.2 is $32,600,000, calculated as two times (2×) the trailing twelve-month fees paid under the MSA. Quorum's indemnification claims encompass, among other categories of loss, costs of forensic investigation, regulatory notification and compliance, consumer notification, credit monitoring and identity theft protection services, crisis communications, regulatory defense, and any fines, penalties, or settlement costs arising from the breach.
Root Cause Identification: The forensic investigation conducted by Graystone Forensics LLC identified Palomar's failure to patch the known CVE-2023-0669 vulnerability within the 30-day patch management window required by the MSA's Data Security Exhibit (Exhibit D, as amended by Amendment No. 2, dated September 15, 2022) as the root cause enabling the breach. Under Exhibit D, Section 4.3 (Vulnerability and Patch Management), Palomar was required to apply critical security patches to all internet-facing systems and applications within 30 calendar days of the patch becoming available from the vendor. The patch for CVE-2023-0669 was released on or about February 7, 2023. As of March 14, 2023, the date of initial compromise — more than 35 days after the patch release — Palomar had not applied the patch. This failure constitutes a material breach of Palomar's contractual obligations under the MSA and the Data Security Exhibit.
Enhanced Security Measures: Quorum is working with Palomar to implement enhanced security measures within Palomar's environment to prevent the recurrence of similar incidents. These measures include, but are not limited to:
•  Enhanced patch management protocols, including automated vulnerability scanning, accelerated patching timelines for critical and high-severity vulnerabilities (reduced from 30 days to 14 days), and mandatory executive-level reporting on patch compliance status;
•  Deployment of advanced endpoint detection and response ("EDR") tools across all Palomar systems and endpoints involved in processing Quorum data;
•  Implementation of enhanced network segmentation to limit lateral movement within Palomar's environment;
•  Engagement of an independent third-party security assessor approved by Quorum to conduct enhanced annual security audits of Palomar's environment, with audit results to be shared with Quorum; and
•  Implementation of enhanced logging and monitoring capabilities, including extended log retention periods and real-time alerting for anomalous data transfer activity.
MSA Amendments: The data security provisions of the MSA are being amended to impose more stringent requirements on Palomar, including accelerated patching timelines, enhanced audit rights for Quorum, mandatory penetration testing, and strengthened incident response and notification obligations.
E. Internal Remediation and Program Enhancements
In addition to the vendor-specific remediation measures described above, Quorum has undertaken significant internal remediation and program enhancement efforts to strengthen its own vendor risk management and data security oversight capabilities:
Vendor Risk Management Program Enhancement: Quorum has commenced a comprehensive review of its vendor risk management program, overseen by Priya Deshmukh, Vice President of Vendor Risk Management. This review encompasses an assessment of Quorum's processes for evaluating, onboarding, monitoring, and auditing third-party vendors and business associates that process PHI or other sensitive data on behalf of Quorum. The review is expected to result in enhanced vendor risk assessment questionnaires, more frequent and rigorous vendor security assessments, tiered vendor risk classifications with corresponding oversight requirements, and enhanced contractual data security and breach notification provisions.
Enhanced Breach Notification Timing Requirements: Quorum is revising its standard Business Associate Agreement template and its contractual data security exhibits to reduce the required breach notification window from 48 hours to 24 hours. This accelerated notification requirement will apply to all new and renewed business associate agreements and will be implemented through amendments to existing agreements with critical vendors, including Palomar.
Incident Response Program Enhancements: Quorum's information security program, overseen by David Naranjo (CISO) and Jennifer Liang (CPO), is being enhanced with additional third-party risk assessment procedures, updated incident response playbooks addressing business associate breaches, and an expanded schedule of incident response tabletop exercises that will include scenarios involving third-party vendor compromises. Quorum plans to conduct at least two tabletop exercises per year involving cross-functional participation from Legal, Information Security, Privacy, Compliance, Communications, and senior executive leadership.
F. Insurance Notification
On May 8, 2023, Quorum filed a claim under its primary cyber-liability insurance policy with its insurer, Atlas Mutual Insurance Company. The relevant policy and claim details are as follows:
•  Insurer: Atlas Mutual Insurance Company
•  Policy Number: CYB-2023-041587
•  Claim Number: CYB-CLM-2023-05892
•  Date of Claim Filing: May 8, 2023
Quorum's cyber-liability insurance coverage is responding to covered costs arising from the breach, including the costs of the forensic investigation, regulatory notification and compliance, consumer notification, credit monitoring and identity theft protection services, crisis communications, and regulatory defense costs. Quorum is working cooperatively with Atlas Mutual Insurance Company and its designated claims adjusters and coverage counsel to ensure that all covered costs are properly documented and submitted for reimbursement under the applicable policy terms and conditions.
IX. CONTACT INFORMATION
Quorum's Designated Contact for this Notification:
Jennifer Liang Chief Privacy Officer Quorum Insurance Holdings Corp. 400 Constitution Plaza, Suite 2200 Hartford, CT 06103 Telephone: (860) 555-4200
Email: jliang@quorumholdings.com
Outside Counsel Contact:
Kevin Ostrowski, Partner Calderwood & Harkness LLP Privacy & Data Security Practice Group 1700 K Street NW, Suite 900 Washington, D.C. 20006 Telephone: (202) 555-8100
Email: kostrowski@calderwoodharkness.com
Affected Individual Inquiry Contact:
Quorum Insurance Holdings Corp. Breach Response Call Center Operated by Clearfield Notification Services LLC Toll-Free Number: 1-888-555-0143 Hours of Operation: Monday through Friday, 8:00 a.m. to 8:00 p.m. Eastern Time; Saturday, 9:00 a.m. to 5:00 p.m. Eastern Time Available for a 12-week window commencing with the start of the notification mailing (August 18, 2023 through November 10, 2023)
All inquiries from the Office for Civil Rights regarding this notification should be directed to Jennifer Liang, Chief Privacy Officer, or Kevin Ostrowski, Calderwood & Harkness LLP, at the contact information provided above.
X. REGULATORY NOTIFICATIONS TO OTHER ENTITIES
In addition to this notification to the Secretary of Health and Human Services, Quorum has filed or is in the process of filing breach notifications with the following state regulatory authorities, in accordance with the applicable state breach notification statutes:
All notifications to state regulatory authorities are being made in accordance with the requirements of the applicable state breach notification statutes, including any state-specific content, timing, and format requirements. Where applicable, notifications are also being made to state insurance regulators pursuant to state insurance data security laws and regulations.
Quorum will provide additional details regarding specific state filings to the Office for Civil Rights upon request.
XI. ENCLOSURES AND SUPPORTING MATERIALS
The following documents are enclosed with this notification for the Office for Civil Rights' review:
Enclosure A: Copy of the HIPAA-compliant consumer notification letter (PHI version) being mailed to the 41,203 individuals whose protected health information was compromised in the breach. This letter contains all elements required by 45 C.F.R. § 164.404(c), including a description of the breach, the types of unsecured PHI involved, steps individuals should take to protect themselves, a description of Quorum's response and remediation efforts, and contact procedures including the toll-free call center number and enrollment information for the complimentary credit monitoring and identity theft protection services.
Enclosure B: Copy of the media notice being issued pursuant to 45 C.F.R. § 164.406 to prominent media outlets serving states where the breach affected more than 500 residents. The media notice includes a general description of the breach, the types of information involved, steps individuals can take to protect themselves, and contact information for affected individuals.
Enclosure C: Copy of the substitute notice and website posting language being published on Quorum's corporate website (www.quorumholdings.com) in accordance with 45 C.F.R. § 164.404(d)(2). The website posting provides a summary of the breach, describes the steps Quorum is taking in response, and directs affected individuals to the toll-free call center for assistance.
XII. CERTIFICATION AND SIGNATURE
The undersigned hereby certifies, on behalf of Quorum Insurance Holdings Corp., that the information provided in this notification is true, complete, and accurate to the best of the undersigned's knowledge, information, and belief, formed after reasonable inquiry. Quorum Insurance Holdings Corp. acknowledges its continuing obligation to cooperate with the Office for Civil Rights and to provide any additional information that may be requested in connection with this notification and any related investigation.
QUORUM INSURANCE HOLDINGS CORP.
By: ________
Name: Jennifer Liang
Title: Chief Privacy Officer
Date: August 15, 2023
Prepared and submitted on behalf of Quorum Insurance Holdings Corp. by:
CALDERWOOD & HARKNESS LLP
By: ________
Name: Kevin Ostrowski
Title: Partner, Privacy & Data Security
Calderwood & Harkness LLP 1700 K Street NW, Suite 900 Washington, D.C. 20006 Matter Number: 1025-00006
Date: August 15, 2023
This notification, including all enclosures, is submitted to the U.S. Department of Health and Human Services, Office for Civil Rights, in compliance with 45 C.F.R. § 164.408. Nothing in this notification constitutes a waiver of any rights, privileges, or defenses available to Quorum Insurance Holdings Corp. under applicable law, including the attorney-client privilege and the work product doctrine. Quorum reserves all such rights, privileges, and defenses.
Date | Event
On or about March 14, 2023 | Initial Unauthorized Access. A threat actor exploited a known but unpatched remote code execution vulnerability, identified as CVE-2023-0669, in Palomar's GoAnywhere MFT (Managed File Transfer) file transfer appliance to gain unauthorized access to Palomar's network environment. CVE-2023-0669 is a pre-authentication command injection vulnerability in Severin Corporation's GoAnywhere MFT product, which was publicly disclosed in early February 2023 and for which a patch (version 7.1.2) was made available by the vendor on or about February 7, 2023. Despite the availability of this patch and the publication of active exploitation warnings by the Cybersecurity and Infrastructure Security Agency ("CISA"), Palomar had not applied the patch to its GoAnywhere MFT appliance as of the date of initial compromise.
March 14, 2023 – April 18, 2023 (approximately 35 days) | Exfiltration Window. During this approximately 35-day period, the threat actor engaged in lateral movement within Palomar's network, escalated privileges, identified and accessed Palomar's claims data processing servers, staged structured data files containing Quorum policyholder and claimant data, and exfiltrated those files to an external location controlled by the threat actor. The forensic investigation conducted by Graystone Forensics LLC confirmed that the threat actor used a combination of legitimate administrative tools and custom scripts to move laterally through Palomar's environment and to identify, compress, and exfiltrate targeted data files.
April 18, 2023 | discovery by Palomar. Palomar's security operations center ("SOC") detected unusual outbound data transfers from its claims data processing environment. The anomalous network traffic triggered automated alerts, and Palomar's SOC analysts confirmed that the outbound transfers were not consistent with normal business operations. Palomar initiated an internal investigation and engaged its own incident response resources to contain the incident.
April 21, 2023 | Notification from Palomar to Quorum. Derek Copeland, General Counsel of Palomar, notified Thomas R. Whitfield, General Counsel of Quorum, and David Naranjo, Chief Information Security Officer of Quorum, via email and follow-up telephone call, of the security incident. Palomar's initial notification indicated that a security incident had occurred involving potential unauthorized access to Palomar's network environment and that data associated with Quorum's claims processing operations may have been affected. Palomar's notification was provided within the 48-hour notification window required by the BAA incorporated into the MSA.
April 21 – May 3, 2023 | Initial Assessment and Internal Escalation. Upon receiving Palomar's notification, Quorum activated its incident response plan and convened its Incident Response Team, which includes representatives from the Legal, Information Security, Privacy, Compliance, and Communications departments. Quorum's CISO, David Naranjo, coordinated with Palomar's security team to obtain preliminary information regarding the scope of the incident. Quorum's General Counsel, Thomas R. Whitfield, and Chief Privacy Officer, Jennifer Liang, assessed the potential regulatory notification obligations and determined that outside counsel should be retained to manage the breach response.
May 4, 2023 | Engagement of Outside Counsel. Quorum engaged Calderwood & Harkness LLP, under the direction of Kevin Ostrowski, Partner in the firm's Privacy & Data Security practice, to manage the breach response, including coordination of the forensic investigation, assessment of regulatory notification obligations, preparation of regulatory filings, and oversight of consumer notification activities.
May 5, 2023 | Retention of Forensic Investigator. At the direction of Calderwood & Harkness LLP, Graystone Forensics LLC was retained under the attorney-client privilege and work product doctrine umbrella to conduct a thorough forensic investigation of the breach. The forensic engagement was led by Dr. Nolan Briggs, Managing Director, Incident Response, and Kendra Faulkner, Senior Forensic Analyst, both of Graystone Forensics LLC. The engagement was structured to ensure that the forensic investigation and resulting reports would be protected by the attorney-client privilege and the work product doctrine.
May 5 – June 2, 2023 | Forensic Investigation — Phase I. Graystone Forensics LLC conducted a comprehensive forensic analysis of the compromised Palomar environment, including analysis of system logs, network traffic captures, endpoint forensic images, and file access and transfer records. Graystone worked in coordination with Palomar's internal IT security team and Palomar's own incident response vendors to obtain the necessary forensic artifacts.
June 2, 2023 | Preliminary Forensic Findings. Graystone Forensics LLC provided preliminary findings to Calderwood & Harkness LLP confirming: (a) the attack vector (exploitation of CVE-2023-0669 in Palomar's unpatched GoAnywhere MFT appliance); (b) the exfiltration of structured data files from Palomar's claims processing environment; and (c) the likelihood that the exfiltrated data files contained personally identifiable information and potentially PHI associated with Quorum policyholders and claimants.
June 2 – July 14, 2023 | Forensic Investigation — Phase II and Data Analysis. Graystone Forensics LLC continued its investigation to determine the full scope of compromised data, including a detailed analysis of the specific data files that were accessed and exfiltrated by the threat actor. This analysis involved the reconstruction of the threat actor's activities within the Palomar environment and the identification of all data files that were staged and exfiltrated.
July 14, 2023 | Final Forensic Report. Graystone Forensics LLC issued its final forensic report to Calderwood & Harkness LLP, confirming the full scope of compromised data, including the identification of PHI among the exfiltrated data files. The final report confirmed that the exfiltrated data included structured data files containing names, dates of birth, Social Security numbers, driver's license numbers, health conditions and diagnoses (diagnosis codes), treatment information associated with workers' compensation and health-related insurance claims, and, for certain individuals, bank account numbers and/or payment card numbers.
July 15 – August 4, 2023 | Data Mining and Affected Individual Identification. Following receipt of the final forensic report, Calderwood & Harkness LLP, in coordination with Quorum and Clearfield Notification Services LLC, undertook a comprehensive data mining effort to identify the specific individuals whose data was compromised and to determine which individuals' PHI was involved. This process involved the de-duplication, normalization, and cross-referencing of the compromised data files against Quorum's policyholder and claimant databases.
August 4, 2023 | Identification of Affected Individuals Completed. Data mining and affected individual identification was completed. A total of 318,247 individuals were identified as having had their personally identifiable information compromised. Of that total, 41,203 individuals were identified as having had their PHI compromised.
August 15, 2023 | Notification to HHS-OCR (this notification).
August 18, 2023 (commenced) | Individual Notification Mailing Commences. Consumer notification letters are being mailed to all affected individuals, with completion targeted for September 15, 2023.
State | Total Affected Individuals
Connecticut | 52,114
New York | 47,831
California | 38,206
Texas | 29,477
Florida | 22,913
Pennsylvania | 18,640
Illinois | 16,502
New Jersey | 14,388
Ohio | 11,743
Massachusetts | 10,217
19 Additional States and D.C. | 56,216 (combined)
Total | 318,247
Regulatory Authority | Date Filed | Applicable Statute | Affected Residents
Connecticut Attorney General's Office | August 14, 2023 | Conn. Gen. Stat. § 36a-701b | 52,114
Connecticut Insurance Department | August 14, 2023 | Conn. Gen. Stat. § 38a-999b | 52,114
New York Attorney General's Office | August 16, 2023 | N.Y. Gen. Bus. Law § 899-aa | 47,831
California Attorney General's Office | August 16, 2023 | Cal. Civ. Code § 1798.82 | 38,206
Massachusetts Attorney General's Office | August 17, 2023 | Mass. Gen. Laws ch. 93H, § 3 | 10,217
Attorneys General and/or Regulators in 24 Additional States | August 17–25, 2023 | Various state breach notification statutes | Varies by state

BREACH NOTIFICATION TO THE SECRETARY OF HEALTH AND HUMAN SERVICES

I. INTRODUCTORY STATEMENT AND PURPOSE

II. IDENTIFICATION OF THE COVERED ENTITY

III. IDENTIFICATION OF THE BUSINESS ASSOCIATE INVOLVED

V. TYPES OF UNSECURED PROTECTED HEALTH INFORMATION INVOLVED

VI. NUMBER OF INDIVIDUALS AFFECTED

VII. STEPS INDIVIDUALS SHOULD TAKE TO PROTECT THEMSELVES

VIII. STEPS QUORUM HAS TAKEN IN RESPONSE TO THE BREACH

IX. CONTACT INFORMATION

X. REGULATORY NOTIFICATIONS TO OTHER ENTITIES

XI. ENCLOSURES AND SUPPORTING MATERIALS

XII. CERTIFICATION AND SIGNATURE

QUORUM INSURANCE HOLDINGS CORP.

CALDERWOOD & HARKNESS LLP

Record

Parties

Dates

Amounts