1025-00006 · Graystone Forensics LLC · Regulatory Notifications

ma-ag-notification-filing.docx DOCUMENT Data Privacy

75 / 88 ← → ✕

DATA BREACH NOTIFICATION FILING PURSUANT TO MASS. GEN. LAWS CH. 93H, § 3

August 17, 2023

Filed By: Calderwood & Harkness LLP, on behalf of Quorum Insurance Holdings Corp.

Filed With:

Office of the Attorney General of the Commonwealth of Massachusetts Consumer Protection Division One Ashburton Place Boston, MA 02108

Massachusetts Department of Consumer Affairs and Business Regulation Office of the Director of Consumer Affairs 501 Boylston Street, Suite 5100 Boston, MA 02116

Submitted Via: Massachusetts online data breach notification portal and concurrent hard copy transmittal

From:

Kevin Ostrowski, Partner Calderwood & Harkness LLP 1700 K Street NW, Suite 900 Washington, D.C. 20006 Telephone: (202) 555-7140

Email: kostrowski@calderwoodharkness.com

On Behalf Of:

Quorum Insurance Holdings Corp. 400 Constitution Plaza, Suite 2200 Hartford, CT 06103

Reference: Data Breach Notification — Quorum Insurance Holdings Corp.

Calderwood & Harkness Matter No.: 1025-00006

I. COVER LETTER

1.1 Introductory Statement

Dear Attorney General Campbell and Director Galvin:

Calderwood & Harkness LLP represents Quorum Insurance Holdings Corp. ("Quorum" or "QIH"), a Delaware corporation publicly traded on the Nasdaq Stock Market under the ticker symbol QIHC, with its principal executive offices located at 400 Constitution Plaza, Suite 2200, Hartford, CT 06103. We submit this filing on behalf of Quorum in compliance with the notification requirements of Mass. Gen. Laws ch. 93H, § 3, which mandates that any person or entity that owns or licenses data that includes personal information about a resident of the Commonwealth of Massachusetts provide written notice to the Office of the Attorney General and the Office of the Director of Consumer Affairs and Business Regulation as soon as practicable and without unreasonable delay when such person or entity knows or has reason to know that a breach of security involving such personal information has occurred.

This notification concerns a data security incident involving unauthorized access to and exfiltration of personal information of Massachusetts residents. The personal information at issue was maintained by Quorum's third-party claims-processing vendor, Palomar Data Solutions, Inc. ("Palomar"), a Texas corporation headquartered at 7100 Greenville Avenue, Suite 450, Dallas, TX 75231. As described in detail below, a threat actor exploited a vulnerability in a file transfer application operated by Palomar, gained unauthorized access to Palomar's network environment, and exfiltrated data files containing personal information of Quorum policyholders and claimants. The breach occurred within Palomar's network infrastructure and did not directly compromise Quorum's own internal systems or network.

Based on the completed forensic investigation and data mining analysis, Quorum has determined that the personal information of 10,217 Massachusetts residents was involved in this incident. This filing provides a comprehensive description of the incident, the categories of personal information compromised, the remedial actions taken, and the steps being undertaken to assist affected individuals.

1.2 Contact Information for Quorum Insurance Holdings Corp.

The following contact information is provided for Quorum Insurance Holdings Corp. in connection with this filing:

Quorum is a top-25 U.S. insurance holding company by gross written premiums, with operating subsidiaries licensed and conducting business in all 50 states, the District of Columbia, Puerto Rico, and the U.S. Virgin Islands. Quorum provides a diversified range of insurance products and services across its property & casualty, specialty lines, and life & annuity segments, and also operates a growing financial technology platform serving insurance distribution partners.

1.3 Purpose and Statutory Basis

This notification is filed in compliance with Mass. Gen. Laws ch. 93H, § 3, which provides, in relevant part, that any person or entity that owns or licenses data that includes personal information about a resident of the Commonwealth shall provide notice to the Attorney General and the Director of Consumer Affairs and Business Regulation as soon as practicable and without unreasonable delay when such person or entity knows or has reason to know of a breach of security or when such person or entity knows or has reason to know that the personal information of such resident was acquired or used by an unauthorized person or used for an unauthorized purpose. This filing satisfies both the Attorney General notification and the Director of Consumer Affairs and Business Regulation notification requirements under the statute.

Concurrent with this filing, individual consumer notification letters are being mailed to all 10,217 affected Massachusetts residents. The initial mailing commenced on August 18, 2023, the day following the date of this filing, in accordance with the statutory requirement that such notice be provided as soon as practicable and without unreasonable delay. A copy of the Massachusetts-specific consumer notification letter is enclosed with this filing as Exhibit A.

Quorum has acted diligently and in good faith throughout the investigation of this incident. The timeline between the initial discovery of the breach by Palomar, Quorum's receipt of notice from Palomar, Quorum's engagement of outside counsel and forensic investigators, the completion of the forensic investigation, the completion of the data mining and individual identification process, and the commencement of notifications reflects a sustained and reasonable effort to investigate the full scope and nature of the incident and to provide accurate and meaningful notice to all affected individuals and regulators.

II. DESCRIPTION OF THE INCIDENT

2.1 Nature of the Breach

On or about March 14, 2023, a threat actor exploited a known but unpatched remote code execution vulnerability, identified as CVE-2023-0669, in a GoAnywhere MFT (Managed File Transfer) file transfer appliance operated by Palomar Data Solutions, Inc., Quorum's third-party claims data processing vendor. The CVE-2023-0669 vulnerability is a pre-authentication deserialization vulnerability in the GoAnywhere MFT application, versions prior to 7.1.2, which allows a remote attacker to execute arbitrary code on the affected system without valid credentials. This vulnerability was publicly disclosed and a patch was made available by the vendor, Severin Corporation (formerly Strathmore Industries), in February 2023. Palomar had not applied the available patch to its GoAnywhere MFT appliance at the time of the exploitation.

Following the initial exploitation of the vulnerability, the threat actor gained unauthorized access to Palomar's network environment. The forensic investigation conducted by Graystone Forensics LLC ("Graystone") determined that the threat actor engaged in lateral movement within Palomar's network, ultimately accessing file servers and databases containing structured data files that included personal information of Quorum's policyholders and claimants. The threat actor staged the targeted data and conducted data exfiltration over an approximately thirty-five (35) day window, from March 14, 2023 through April 18, 2023.

The forensic evidence indicates that the threat actor utilized encrypted channels and obfuscation techniques to transfer data from Palomar's environment to external infrastructure. Graystone's analysis confirmed that the exfiltrated data included structured files in comma-separated value (CSV) and database extract formats containing personal information fields corresponding to Quorum policyholder and claimant records.

It is important to note that the breach occurred entirely within Palomar's network and systems. Quorum's own internal corporate network, information technology infrastructure, and data repositories were not directly compromised in this incident. The personal information at issue was in the custody and control of Palomar at the time of the unauthorized access, pursuant to the services Palomar provides to Quorum under the parties' Master Services Agreement.

2.2 discovery and Notification Timeline

The following timeline sets forth the key dates related to the discovery, investigation, and notification process:

April 18, 2023 — Detection by Palomar. Palomar's Security Operations Center ("SOC") detected anomalous outbound data transfers from its network environment during routine monitoring and alerting. Upon detection, Palomar's SOC initiated incident containment procedures, including isolation of the affected GoAnywhere MFT appliance and affected network segments. This date also represents the end of the active exfiltration window, as determined by the forensic investigation.

April 21, 2023 — Initial Notification from Palomar to Quorum. Derek Copeland, General Counsel of Palomar Data Solutions, Inc., notified Thomas R. Whitfield, General Counsel of Quorum Insurance Holdings Corp., and David Naranjo, Chief Information Security Officer ("CISO") of Quorum, of the security incident via email. The notification indicated that Palomar had experienced a cybersecurity event that may have involved data belonging to Quorum and that Palomar was conducting an investigation.

May 4, 2023 — Engagement of Outside Counsel. Quorum engaged Calderwood & Harkness LLP as outside counsel to manage the legal aspects of the incident response, including overseeing the forensic investigation, assessing regulatory notification obligations, managing communications, and advising on remediation.

May 5, 2023 — Engagement of Forensic Investigators. Graystone Forensics LLC ("Graystone"), a Virginia-based cybersecurity forensics firm, was retained under the direction and at the request of counsel to conduct a comprehensive forensic investigation into the nature, scope, and cause of the breach. The engagement was led by Dr. Nolan Briggs, Managing Director of Incident Response at Graystone, and Kendra Faulkner, Senior Forensic Analyst. Graystone's engagement was structured to preserve the attorney-client privilege and work product protection applicable to its forensic findings and analysis.

June 2, 2023 — Preliminary Forensic Findings Report. Graystone issued a preliminary forensic findings report to Calderwood & Harkness LLP confirming the exfiltration of structured data files containing Quorum policyholder and claimant information from Palomar's environment. The preliminary report confirmed the attack vector (CVE-2023-0669 exploitation of the GoAnywhere MFT appliance), the general timeline of unauthorized access and exfiltration, and the categories of data that were likely involved. However, the preliminary report did not yet provide a definitive accounting of the specific individuals affected or the complete list of data elements compromised for each individual.

July 14, 2023 — Final Forensic Report. Graystone issued its final forensic report to Calderwood & Harkness LLP, confirming the full scope of compromised data. The final report identified all categories of personal information that were exfiltrated, provided a comprehensive inventory of the affected data files, and confirmed the approximate number of individuals whose personal information was involved across all jurisdictions.

August 4, 2023 — Completion of Data Mining and Individual Identification. Following receipt of the final forensic report, Quorum, through its vendor Clearfield Notification Services LLC and under the direction of Calderwood & Harkness LLP, undertook a comprehensive data mining and analysis process to identify the specific individuals whose personal information was involved, determine the specific data elements compromised for each individual, and identify the state of residence of each affected individual. This process was completed on August 4, 2023, at which point Quorum was able to confirm that 10,217 Massachusetts residents were among the 318,247 individuals whose personal information was involved in the incident.

August 17, 2023 — Regulatory Notification (This Filing). This notification is being filed with the Massachusetts Attorney General and the Massachusetts Director of Consumer Affairs and Business Regulation.

August 18, 2023 — Consumer Notification Mailing Commences. Individual written notification letters are being mailed to all 10,217 affected Massachusetts residents via first-class U.S. mail beginning August 18, 2023.

2.3 Vendor Relationship Context

Palomar Data Solutions, Inc. provides claims data processing, document management, and data analytics services to Quorum Insurance Holdings Corp. under a Master Services Agreement ("MSA") originally executed on November 12, 2019. The MSA has been subsequently amended on two occasions: Amendment No. 1, dated March 3, 2021, which expanded the scope of services to include additional data processing functions; and Amendment No. 2, dated September 15, 2022, which updated certain data security requirements and service level commitments.

Under the MSA and its amendments, Palomar processes personal information of Quorum's policyholders and claimants in connection with Quorum's personal lines claims operations. The personal information processed by Palomar includes, among other data elements, policyholder and claimant names, Social Security numbers, dates of birth, driver's license numbers, financial account information, and health-related information associated with workers' compensation and health-related insurance claims. The MSA contains data security obligations, breach notification provisions, and indemnification obligations applicable to Palomar.

III. INFORMATION INVOLVED IN THE BREACH

3.1 Types of Personal Information Compromised (Massachusetts Residents)

Based on the completed forensic investigation and data mining analysis, the personal information involved in this incident with respect to affected Massachusetts residents includes the following categories, as defined under Mass. Gen. Laws ch. 93H, § 1:

• Full names (first name and last name, or first initial and last name)

• Social Security numbers

• Dates of birth

• Driver's license numbers

These four categories of personal information were involved for all 10,217 affected Massachusetts residents.

In addition, for a subset of the 10,217 affected Massachusetts residents, the following additional categories of personal information were also involved:

• Financial account information, including bank account numbers and payment card numbers (with associated routing numbers or expiration dates, as applicable). Approximately 2,814 Massachusetts residents had financial account information compromised.

• Protected health information ("PHI"), including health conditions, medical diagnosis codes (ICD-10), treatment information, and related clinical data associated with workers' compensation claims and health-related insurance claims submitted to Quorum. Approximately 1,347 Massachusetts residents had protected health information compromised.

The consumer notification letters being sent to affected Massachusetts residents are tailored to identify the specific categories of personal information that were compromised for each individual recipient.

3.2 Overall Scope of the Breach (All Jurisdictions)

The total number of affected individuals across all jurisdictions is 318,247, spanning 29 states and the District of Columbia. Of the total affected population:

• Approximately 84,619 individuals had financial account information (bank account numbers and/or payment card numbers) compromised.

• Approximately 41,203 individuals had protected health information compromised.

Massachusetts, with 10,217 affected residents, represents one of the states with more than 10,000 affected individuals. Quorum is concurrently filing notifications with regulators in all affected jurisdictions, as described in Section VII below.

IV. ACTIONS TAKEN IN RESPONSE TO THE BREACH

4.1 Forensic Investigation

Upon receiving notification from Palomar on April 21, 2023, Quorum promptly initiated its internal incident response procedures. On May 4, 2023, Quorum engaged Calderwood & Harkness LLP as outside counsel, and on May 5, 2023, Graystone Forensics LLC was retained under the direction of counsel to conduct a comprehensive forensic investigation.

The forensic investigation was designed to determine the full scope, nature, and root cause of the breach. Graystone's investigation confirmed the following key findings:

• Attack Vector: The threat actor exploited CVE-2023-0669, a pre-authentication remote code execution vulnerability in Palomar's GoAnywhere MFT file transfer appliance. The vulnerability had been publicly disclosed and a patch had been made available by Severin Corporation in February 2023. Palomar had not applied the patch at the time of the exploitation.

• Timeline of Unauthorized Access: The threat actor maintained unauthorized access to Palomar's network environment for approximately 35 days, from March 14, 2023 through April 18, 2023.

• Lateral Movement: Following initial access through the GoAnywhere MFT appliance, the threat actor conducted lateral movement within Palomar's network, escalating privileges and accessing file servers and database systems that housed structured data files containing Quorum policyholder and claimant information.

• Data Staging and Exfiltration: The threat actor staged targeted data files on intermediate systems within Palomar's network and exfiltrated the data using encrypted channels to external infrastructure controlled by the threat actor.

• Exfiltrated Data: The exfiltrated data included structured files in CSV and database extract formats containing personal information fields including names, Social Security numbers, dates of birth, driver's license numbers, financial account information, and protected health information of Quorum policyholders and claimants.

Graystone issued a preliminary forensic findings report on June 2, 2023, and a final forensic report on July 14, 2023. Following receipt of the final forensic report, the data mining and individual identification process was completed on August 4, 2023.

4.2 Consumer Notification

Individual written notification letters are being mailed to all 10,217 affected Massachusetts residents via first-class U.S. mail. The mailing commenced on August 18, 2023, and is expected to be completed by approximately September 15, 2023, taking into account the time required for address verification, printing, and postal delivery.

The notification letters comply with the requirements of Mass. Gen. Laws ch. 93H, § 3, and include all statutorily required elements, including:

• A description of the incident and the nature of the breach;

• The types of personal information that were the subject of the breach;

• The steps Quorum has taken or plans to take in response to the incident;

• The right of the individual to obtain a police report;

• How to request a security freeze and the necessary information to do so;

• Contact information for the filer and for the toll-free call center.

Each notification letter is customized to identify the specific categories of personal information that were compromised for the individual recipient.

The notification process is being managed by Clearfield Notification Services LLC, with Jerome Tillman serving as the designated Account Manager. Clearfield Notification Services LLC is located at 4500 Rockside Road, Suite 210, Independence, OH 44131. Clearfield is a nationally recognized provider of data breach notification, call center, and credit monitoring administration services, and has been engaged to manage the end-to-end notification logistics for this incident.

A copy of the Massachusetts-specific consumer notification letter is enclosed with this filing as Exhibit A.

4.3 Credit Monitoring and Identity Theft Protection Services

All 10,217 affected Massachusetts residents are being offered twenty-four (24) months of complimentary credit monitoring and identity theft protection services at no cost to the affected individuals. These services are being provided through a reputable, nationally recognized identity theft protection provider and include the following features:

• Credit monitoring with alerts for key changes to the individual's credit file;

• Identity theft insurance coverage;

• Dark web monitoring for compromised personal information;

• Identity restoration assistance from trained specialists.

Enrollment information and detailed instructions for activating the complimentary services are included in the consumer notification letter. Affected individuals will have a 90-day enrollment window from the date of the notification letter to activate their complimentary services, after which the enrollment code will expire.

Based on Quorum's historical experience with breach notification events, and consistent with industry benchmarks, Quorum estimates an approximate take-rate of 40% for enrollment in the credit monitoring and identity theft protection services. Nationally, across the total population of 318,247 affected individuals, this translates to an estimated 127,299 enrollees. The proportional Massachusetts subset is expected to be approximately 4,087 enrollees, although actual enrollment will depend on individual choices.

4.4 Toll-Free Call Center

A dedicated toll-free call center has been established specifically for affected individuals to obtain additional information and assistance regarding this incident. The call center is operated by Clearfield Notification Services LLC and is staffed by trained representatives who can answer questions about the incident, the notification letter, the credit monitoring enrollment process, and the steps individuals can take to protect themselves.

The toll-free call center number is 1-855-491-0327 and is operational Monday through Friday, 9:00 a.m. to 9:00 p.m. Eastern Time. The call center will remain operational for a twelve (12) week window from the date of the initial mailing, through approximately November 10, 2023.

4.5 Remediation and Vendor Accountability

Quorum has taken comprehensive steps to address the root causes of this incident and to hold Palomar Data Solutions accountable for the breach. These measures include the following:

Contractual Remedies. Quorum has formally asserted its contractual indemnification rights under Article 9 of the Master Services Agreement and related amendments. Quorum has demanded that Palomar indemnify, defend, and hold harmless Quorum for all costs, expenses, losses, and liabilities arising out of the breach, including without limitation the costs of the forensic investigation, notification, credit monitoring, call center operations, regulatory compliance, and any resulting litigation or regulatory proceedings. Calderwood & Harkness LLP transmitted a formal demand letter to Palomar's outside counsel on June 19, 2023.

Enhanced Security Requirements for Palomar. Quorum has required Palomar to implement enhanced security measures as a condition of the continued business relationship. These measures include, but are not limited to:

• Implementation of an enhanced patch management program with defined timelines for the application of critical security patches (within 48 hours of vendor release for critical vulnerabilities, within 14 days for high-severity vulnerabilities);

• Deployment of an enterprise-grade endpoint detection and response ("EDR") solution across all Palomar systems and endpoints;

• Implementation of enhanced network segmentation and micro-segmentation to limit the potential for lateral movement in the event of a future compromise;

• Engagement of an independent, nationally recognized third-party cybersecurity firm to conduct a comprehensive security assessment of Palomar's information technology environment, including penetration testing and vulnerability assessment, with findings and remediation plans to be shared with Quorum;

• Enhanced logging, monitoring, and alerting capabilities, including implementation of a security information and event management ("SIEM") platform with 24/7 monitoring.

Quorum's Internal Enhancements. In addition to the requirements imposed on Palomar, Quorum has taken steps to enhance its own vendor risk management program and internal incident response capabilities. These enhancements include:

• Revision and strengthening of Quorum's Third-Party Risk Management Policy and Procedures, including enhanced due diligence requirements for vendors that process personal information;

• Implementation of a continuous monitoring program for critical third-party vendors, including periodic review of security posture, patch management compliance, and incident response readiness;

• Enhancement of Quorum's Incident Response Plan, including updated escalation procedures, refined roles and responsibilities, and the conduct of tabletop exercises simulating vendor-related breach scenarios;

• Additional training for Quorum's information security, legal, and compliance teams on vendor risk management and incident response best practices.

4.6 Law Enforcement

Quorum has cooperated with law enforcement authorities in connection with this incident. Palomar Data Solutions reported the breach to the Federal Bureau of Investigation ("FBI") on April 25, 2023, and has been cooperating with the FBI's investigation. Quorum has made itself available to law enforcement and has provided information as requested to support the investigation. No law enforcement authority has requested a delay in notification to affected individuals.

4.7 Substitute Notice

In addition to direct mail notification to all affected Massachusetts residents for whom Quorum has a valid mailing address, Quorum is also providing substitute notice via a prominent posting on Quorum's corporate website (www.quoruminsurance.com/security-incident) to supplement the direct mail notification. The website posting includes a description of the incident, the types of personal information involved, the steps Quorum is taking in response, and information about the credit monitoring services and toll-free call center. This substitute notice is provided out of an abundance of caution and is not intended to replace the direct individual written notification being provided to each affected individual.

V. STEPS INDIVIDUALS CAN TAKE TO PROTECT THEMSELVES

Quorum is recommending that affected Massachusetts residents take the following steps to protect themselves from potential misuse of their personal information:

1. Enroll in Complimentary Credit Monitoring and Identity Theft Protection Services. Affected individuals should promptly enroll in the 24-month complimentary credit monitoring and identity theft protection services being offered by Quorum. Enrollment information, including a unique activation code and instructions, is included in the consumer notification letter. Individuals should enroll within 90 days of the date of the notification letter.

2. Monitor Financial Account Statements. Affected individuals should carefully review their bank account statements, credit card statements, and other financial account statements for any unauthorized transactions or suspicious activity. Any unauthorized charges or withdrawals should be reported immediately to the applicable financial institution.

3. Review Credit Reports. Affected individuals are encouraged to obtain and review free copies of their credit reports from the three major credit reporting agencies — Harborview Enterprises, Penrose Group, and Penmark Enterprises — at www.annualcreditreport.com or by calling 1-877-322-8228. Under federal law, individuals are entitled to one free credit report from each of the three credit reporting agencies every twelve months.

4. Place Fraud Alerts. Affected individuals may place an initial fraud alert on their credit files by contacting any one of the three major credit reporting agencies. An initial fraud alert lasts for one year and requires potential creditors to take steps to verify the identity of the applicant before extending credit. The contact information for each agency is as follows:

• Harborview Enterprises: P.O. Box 105069, Atlanta, GA 30348-5069; 1-800-525-6285; www.Harborview Enterprises.com

• Penrose Group: P.O. Box 2002, Allen, TX 75013; 1-888-397-3742; www.Penrose Group.com

• Penmark Enterprises: P.O. Box 2000, Chester, PA 19016; 1-800-680-7289; www.Penmark Enterprises.com

5. Place Security Freezes. Affected individuals have the right to place a security freeze on their credit files at no cost. A security freeze prohibits the credit reporting agency from releasing any information from the individual's credit file without the individual's express authorization. A security freeze may delay or interfere with the timely approval of any subsequent request or application the individual makes regarding a new loan, credit, mortgage, or any other account involving the extension of credit. To place a security freeze, individuals should contact each of the three credit reporting agencies listed above.

6. Review Explanation of Benefits Statements. For affected individuals whose protected health information was involved, Quorum recommends carefully reviewing Explanation of Benefits ("EOB") statements received from health insurers for any unauthorized medical services, prescriptions, or other healthcare activity. Any suspicious or unauthorized medical activity should be reported to the applicable health insurer immediately.

7. File Identity Theft Reports. If an affected individual detects any suspicious activity or believes that his or her personal information has been misused, the individual should file an identity theft report with the Federal Trade Commission ("FTC") at www.identitytheft.gov or by calling 1-877-438-4338, and should also file a report with local law enforcement.

8. Contact the Dedicated Toll-Free Call Center. Affected individuals may contact the dedicated toll-free call center at 1-855-491-0327, Monday through Friday, 9:00 a.m. to 9:00 p.m. Eastern Time, for additional information and assistance.

VI. INFORMATION REQUIRED BY MASSACHUSETTS STATUTE

6.1 Statutory Checklist (Mass. Gen. Laws ch. 93H, § 3)

In compliance with Mass. Gen. Laws ch. 93H, § 3, the following information is provided:

6.2 Compliance with 201 CMR 17.00

Quorum Insurance Holdings Corp. maintains a comprehensive written information security program ("WISP") consistent with the requirements of 201 CMR 17.00, the Standards for the Protection of Personal Information of Residents of the Commonwealth. Quorum's WISP is designed to protect the security and confidentiality of personal information of Massachusetts residents and includes administrative, technical, and physical safeguards appropriate to the size, scope, and type of business of Quorum, the amount of resources available to Quorum, the amount of stored data, and the need for security and confidentiality of both consumer and employee information.

Quorum's administrative safeguards include, among other measures, designation of a Chief Privacy Officer and a Chief Information Security Officer with responsibility for the information security program; ongoing employee training on information security policies and procedures; regular risk assessments; and vendor due diligence and oversight processes designed to ensure that third-party service providers maintain appropriate security measures.

Quorum's technical safeguards include, among other measures, encryption of personal information in transit and at rest; access controls and authentication mechanisms, including multi-factor authentication; intrusion detection and prevention systems; firewalls and network segmentation; endpoint protection; regular vulnerability scanning and penetration testing; and security information and event management (SIEM) capabilities.

Quorum's physical safeguards include, among other measures, physical access controls at facilities where personal information is stored or processed; secure disposal procedures for physical and electronic media; and environmental controls.

In the wake of this incident, Quorum has undertaken post-incident enhancements to its information security program and vendor oversight procedures, as described in Section IV.5 above. These enhancements are designed to further strengthen Quorum's defenses against future incidents and to improve the organization's ability to detect, respond to, and recover from data security events, particularly those involving third-party vendors. Quorum is committed to continuous improvement of its information security practices and to ongoing compliance with 201 CMR 17.00 and all other applicable data protection requirements.

VII. OTHER REGULATORY FILINGS

Quorum Insurance Holdings Corp. is concurrently filing data breach notifications with regulators in all 29 affected states and the District of Columbia, in accordance with the applicable breach notification statutes and regulations of each jurisdiction. The following is a summary of the principal regulatory filings being made:

The filing with the U.S. Department of Health and Human Services, Office for Civil Rights, relates specifically to the subset of 41,203 individuals nationwide whose protected health information was compromised in the incident, and is being made pursuant to the breach notification requirements of the Health Insurance Portability and Accountability Act of 1996 ("HIPAA") and the Health Information Technology for Economic and Clinical Health Act ("HITECH Act"), as implemented through 45 C.F.R. §§ 164.400–164.414.

Quorum is also evaluating whether additional regulatory notifications are required under insurance-specific data security regulations, including the National Association of Insurance Commissioners ("NAIC") Insurance Data Security Model Law, as adopted by the applicable state insurance departments.

VIII. AVAILABILITY FOR FURTHER INFORMATION

Quorum Insurance Holdings Corp. and Calderwood & Harkness LLP are available to provide any additional information that the Attorney General or the Director of Consumer Affairs and Business Regulation may require in connection with this notification, and to respond to any questions or inquiries regarding the incident, the investigation, the notification process, or the remedial measures being undertaken.

All inquiries from the Attorney General's Office or the Office of the Director of Consumer Affairs and Business Regulation should be directed to the following contacts:

Outside Counsel:

Kevin Ostrowski, Partner Calderwood & Harkness LLP 1700 K Street NW, Suite 900 Washington, D.C. 20006 Telephone: (202) 555-7140

Email: kostrowski@calderwoodharkness.com

Alan Burke, Associate Calderwood & Harkness LLP 1700 K Street NW, Suite 900 Washington, D.C. 20006 Telephone: (202) 555-7152

Email: aburke@calderwoodharkness.com

Quorum Insurance Holdings Corp.:

Thomas R. Whitfield, General Counsel Quorum Insurance Holdings Corp. 400 Constitution Plaza, Suite 2200 Hartford, CT 06103 Telephone: (860) 555-3200

Email: twhitfield@quoruminsurance.com

Jennifer Liang, Chief Privacy Officer Quorum Insurance Holdings Corp. 400 Constitution Plaza, Suite 2200 Hartford, CT 06103 Telephone: (860) 555-3215

Email: jliang@quoruminsurance.com

Quorum takes the security of personal information very seriously and deeply regrets any concern or inconvenience this incident may cause to affected Massachusetts residents. Quorum is committed to cooperating fully with the Attorney General and the Director of Consumer Affairs and Business Regulation in connection with this matter.

IX. SIGNATURE

Respectfully submitted,

CALDERWOOD & HARKNESS LLP

By: ________

Name: Kevin Ostrowski

Title: Partner

Calderwood & Harkness LLP 1700 K Street NW, Suite 900 Washington, D.C. 20006

On Behalf of Quorum Insurance Holdings Corp.

Date: August 17, 2023

X. ENCLOSURES

The following exhibits are enclosed with this filing:

Exhibit A — Copy of Massachusetts-Specific Consumer Notification Letter

Enclosed herewith is a copy of the consumer notification letter dated August 12, 2023, which has been adapted specifically for the 10,217 affected Massachusetts residents. The notification letter is compliant with the requirements of Mass. Gen. Laws ch. 93H, § 3, and 201 CMR 17.00, and includes the following content:

• A description of the data security incident, including the nature of the breach, the dates of unauthorized access, and the identity of the third-party vendor whose systems were compromised;

• A description of the specific types of personal information involved for the individual recipient;

• A description of the steps Quorum has taken and is taking in response to the incident, including the forensic investigation, vendor remediation, and enhanced security measures;

• An offer of twenty-four (24) months of complimentary credit monitoring and identity theft protection services at no cost to the individual, together with a unique activation code and enrollment instructions;

• The toll-free call center telephone number (1-855-491-0327) operated by Clearfield Notification Services LLC, with hours of operation;

• Information regarding the individual's right to obtain a police report and how to do so;

• Information regarding the individual's right to request a security freeze, including contact information for the three major credit reporting agencies;

• Recommended steps for self-protection, including monitoring financial account statements, reviewing credit reports, placing fraud alerts, reviewing Explanation of Benefits statements (where applicable), and filing identity theft reports with the FTC and local law enforcement.

Exhibit B — Quorum Insurance Holdings Corp. Entity Information

Enclosed herewith is a summary of entity information for Quorum Insurance Holdings Corp., as follows:

This filing and all enclosed materials are submitted to the Office of the Attorney General of the Commonwealth of Massachusetts and the Office of the Director of Consumer Affairs and Business Regulation pursuant to Mass. Gen. Laws ch. 93H, § 3. This filing contains information that Quorum Insurance Holdings Corp. considers confidential and proprietary, including details regarding its information security practices, vendor relationships, and incident response activities. Quorum respectfully requests that these materials be treated as confidential to the extent permitted by applicable law, including Mass. Gen. Laws ch. 66, § 10, and 950 CMR 32.00 et seq.

Field	Detail
Entity Name	Quorum Insurance Holdings Corp.
Principal Address	400 Constitution Plaza, Suite 2200, Hartford, CT 06103
State of Incorporation	Delaware
Employer Identification Number (EIN)	06-4832197
Nasdaq Ticker Symbol	QIHC
General Counsel	Thomas R. Whitfield
Chief Privacy Officer	Jennifer Liang
Outside Counsel (for purposes of this filing)	Kevin Ostrowski, Partner, Calderwood & Harkness LLP, 1700 K Street NW, Suite 900, Washington, D.C. 20006
Outside Counsel Telephone	(202) 555-7140
Outside Counsel Email	kostrowski@calderwoodharkness.com
Industry	Insurance (property & casualty, specialty lines, life & annuity) and financial technology
Statutory Requirement	Response
Nature of the breach of security	Third-party vendor network compromise via exploitation of an unpatched remote code execution vulnerability (CVE-2023-0669) in Palomar Data Solutions' GoAnywhere MFT file transfer appliance, resulting in unauthorized access, lateral movement, and data exfiltration over an approximately 35-day period (March 14 – April 18, 2023)
Number of Massachusetts residents affected	10,217
Name and address of the entity that experienced the breach	Palomar Data Solutions, Inc., 7100 Greenville Avenue, Suite 450, Dallas, TX 75231
Name and address of the entity filing the notification	Quorum Insurance Holdings Corp., 400 Constitution Plaza, Suite 2200, Hartford, CT 06103 (filing made by outside counsel, Calderwood & Harkness LLP, 1700 K Street NW, Suite 900, Washington, D.C. 20006)
Whether a police report has been filed	Palomar reported the incident to the Federal Bureau of Investigation on April 25, 2023. Quorum has cooperated with the FBI's investigation. No separate state or local police report has been filed to date.
Contact information for the filer	Kevin Ostrowski, Partner, Calderwood & Harkness LLP, 1700 K Street NW, Suite 900, Washington, D.C. 20006; Telephone: (202) 555-7140; Email: kostrowski@calderwoodharkness.com
Steps being taken regarding the breach	Comprehensive forensic investigation completed; individual consumer notifications mailed; 24 months of complimentary credit monitoring and identity theft protection services offered; dedicated toll-free call center established; vendor remediation and enhanced security measures implemented; vendor indemnification rights asserted; Quorum's own vendor risk management program and incident response capabilities enhanced
Jurisdiction / Regulator	Filing Date	Statutory Authority
Connecticut Attorney General	August 14, 2023	Conn. Gen. Stat. § 36a-701b
Connecticut Insurance Department	August 14, 2023	Conn. Gen. Stat. § 38a-999b
U.S. Department of Health and Human Services, Office for Civil Rights	August 15, 2023	45 C.F.R. § 164.408 (HIPAA Breach Notification Rule, for the subset of 41,203 individuals whose protected health information was involved)
New York Attorney General	August 16, 2023	N.Y. Gen. Bus. Law § 899-aa

California Attorney General	August 16, 2023	Cal. Civ. Code § 1798.82
Massachusetts Attorney General and Director of Consumer Affairs	August 17, 2023	Mass. Gen. Laws ch. 93H, § 3
All remaining affected state filings	August 17–25, 2023	Applicable state breach notification statutes
Field	Detail
Full Legal Name	Quorum Insurance Holdings Corp.
Principal Address	400 Constitution Plaza, Suite 2200, Hartford, CT 06103
State of Incorporation	Delaware
Employer Identification Number (EIN)	06-4832197
Nasdaq Ticker Symbol	QIHC
Authorized Representative for This Filing	Kevin Ostrowski, Partner, Calderwood & Harkness LLP, 1700 K Street NW, Suite 900, Washington, D.C. 20006
General Counsel	Thomas R. Whitfield
Chief Privacy Officer	Jennifer Liang
Chief Information Security Officer	David Naranjo

DATA BREACH NOTIFICATION FILING PURSUANT TO MASS. GEN. LAWS CH. 93H, § 3
August 17, 2023
Filed By: Calderwood & Harkness LLP, on behalf of Quorum Insurance Holdings Corp.
Filed With:
Office of the Attorney General of the Commonwealth of Massachusetts Consumer Protection Division One Ashburton Place Boston, MA 02108
Massachusetts Department of Consumer Affairs and Business Regulation Office of the Director of Consumer Affairs 501 Boylston Street, Suite 5100 Boston, MA 02116
Submitted Via: Massachusetts online data breach notification portal and concurrent hard copy transmittal
From:
Kevin Ostrowski, Partner Calderwood & Harkness LLP 1700 K Street NW, Suite 900 Washington, D.C. 20006 Telephone: (202) 555-7140
Email: kostrowski@calderwoodharkness.com
On Behalf Of:
Quorum Insurance Holdings Corp. 400 Constitution Plaza, Suite 2200 Hartford, CT 06103
Reference: Data Breach Notification — Quorum Insurance Holdings Corp.
Calderwood & Harkness Matter No.: 1025-00006
I. COVER LETTER
1.1 Introductory Statement
Dear Attorney General Campbell and Director Galvin:
Calderwood & Harkness LLP represents Quorum Insurance Holdings Corp. ("Quorum" or "QIH"), a Delaware corporation publicly traded on the Nasdaq Stock Market under the ticker symbol QIHC, with its principal executive offices located at 400 Constitution Plaza, Suite 2200, Hartford, CT 06103. We submit this filing on behalf of Quorum in compliance with the notification requirements of Mass. Gen. Laws ch. 93H, § 3, which mandates that any person or entity that owns or licenses data that includes personal information about a resident of the Commonwealth of Massachusetts provide written notice to the Office of the Attorney General and the Office of the Director of Consumer Affairs and Business Regulation as soon as practicable and without unreasonable delay when such person or entity knows or has reason to know that a breach of security involving such personal information has occurred.
This notification concerns a data security incident involving unauthorized access to and exfiltration of personal information of Massachusetts residents. The personal information at issue was maintained by Quorum's third-party claims-processing vendor, Palomar Data Solutions, Inc. ("Palomar"), a Texas corporation headquartered at 7100 Greenville Avenue, Suite 450, Dallas, TX 75231. As described in detail below, a threat actor exploited a vulnerability in a file transfer application operated by Palomar, gained unauthorized access to Palomar's network environment, and exfiltrated data files containing personal information of Quorum policyholders and claimants. The breach occurred within Palomar's network infrastructure and did not directly compromise Quorum's own internal systems or network.
Based on the completed forensic investigation and data mining analysis, Quorum has determined that the personal information of 10,217 Massachusetts residents was involved in this incident. This filing provides a comprehensive description of the incident, the categories of personal information compromised, the remedial actions taken, and the steps being undertaken to assist affected individuals.
1.2 Contact Information for Quorum Insurance Holdings Corp.
The following contact information is provided for Quorum Insurance Holdings Corp. in connection with this filing:
Quorum is a top-25 U.S. insurance holding company by gross written premiums, with operating subsidiaries licensed and conducting business in all 50 states, the District of Columbia, Puerto Rico, and the U.S. Virgin Islands. Quorum provides a diversified range of insurance products and services across its property & casualty, specialty lines, and life & annuity segments, and also operates a growing financial technology platform serving insurance distribution partners.
1.3 Purpose and Statutory Basis
This notification is filed in compliance with Mass. Gen. Laws ch. 93H, § 3, which provides, in relevant part, that any person or entity that owns or licenses data that includes personal information about a resident of the Commonwealth shall provide notice to the Attorney General and the Director of Consumer Affairs and Business Regulation as soon as practicable and without unreasonable delay when such person or entity knows or has reason to know of a breach of security or when such person or entity knows or has reason to know that the personal information of such resident was acquired or used by an unauthorized person or used for an unauthorized purpose. This filing satisfies both the Attorney General notification and the Director of Consumer Affairs and Business Regulation notification requirements under the statute.
Concurrent with this filing, individual consumer notification letters are being mailed to all 10,217 affected Massachusetts residents. The initial mailing commenced on August 18, 2023, the day following the date of this filing, in accordance with the statutory requirement that such notice be provided as soon as practicable and without unreasonable delay. A copy of the Massachusetts-specific consumer notification letter is enclosed with this filing as Exhibit A.
Quorum has acted diligently and in good faith throughout the investigation of this incident. The timeline between the initial discovery of the breach by Palomar, Quorum's receipt of notice from Palomar, Quorum's engagement of outside counsel and forensic investigators, the completion of the forensic investigation, the completion of the data mining and individual identification process, and the commencement of notifications reflects a sustained and reasonable effort to investigate the full scope and nature of the incident and to provide accurate and meaningful notice to all affected individuals and regulators.
II. DESCRIPTION OF THE INCIDENT
2.1 Nature of the Breach
On or about March 14, 2023, a threat actor exploited a known but unpatched remote code execution vulnerability, identified as CVE-2023-0669, in a GoAnywhere MFT (Managed File Transfer) file transfer appliance operated by Palomar Data Solutions, Inc., Quorum's third-party claims data processing vendor. The CVE-2023-0669 vulnerability is a pre-authentication deserialization vulnerability in the GoAnywhere MFT application, versions prior to 7.1.2, which allows a remote attacker to execute arbitrary code on the affected system without valid credentials. This vulnerability was publicly disclosed and a patch was made available by the vendor, Severin Corporation (formerly Strathmore Industries), in February 2023. Palomar had not applied the available patch to its GoAnywhere MFT appliance at the time of the exploitation.
Following the initial exploitation of the vulnerability, the threat actor gained unauthorized access to Palomar's network environment. The forensic investigation conducted by Graystone Forensics LLC ("Graystone") determined that the threat actor engaged in lateral movement within Palomar's network, ultimately accessing file servers and databases containing structured data files that included personal information of Quorum's policyholders and claimants. The threat actor staged the targeted data and conducted data exfiltration over an approximately thirty-five (35) day window, from March 14, 2023 through April 18, 2023.
The forensic evidence indicates that the threat actor utilized encrypted channels and obfuscation techniques to transfer data from Palomar's environment to external infrastructure. Graystone's analysis confirmed that the exfiltrated data included structured files in comma-separated value (CSV) and database extract formats containing personal information fields corresponding to Quorum policyholder and claimant records.
It is important to note that the breach occurred entirely within Palomar's network and systems. Quorum's own internal corporate network, information technology infrastructure, and data repositories were not directly compromised in this incident. The personal information at issue was in the custody and control of Palomar at the time of the unauthorized access, pursuant to the services Palomar provides to Quorum under the parties' Master Services Agreement.
2.2 discovery and Notification Timeline
The following timeline sets forth the key dates related to the discovery, investigation, and notification process:
April 18, 2023 — Detection by Palomar. Palomar's Security Operations Center ("SOC") detected anomalous outbound data transfers from its network environment during routine monitoring and alerting. Upon detection, Palomar's SOC initiated incident containment procedures, including isolation of the affected GoAnywhere MFT appliance and affected network segments. This date also represents the end of the active exfiltration window, as determined by the forensic investigation.
April 21, 2023 — Initial Notification from Palomar to Quorum. Derek Copeland, General Counsel of Palomar Data Solutions, Inc., notified Thomas R. Whitfield, General Counsel of Quorum Insurance Holdings Corp., and David Naranjo, Chief Information Security Officer ("CISO") of Quorum, of the security incident via email. The notification indicated that Palomar had experienced a cybersecurity event that may have involved data belonging to Quorum and that Palomar was conducting an investigation.
May 4, 2023 — Engagement of Outside Counsel. Quorum engaged Calderwood & Harkness LLP as outside counsel to manage the legal aspects of the incident response, including overseeing the forensic investigation, assessing regulatory notification obligations, managing communications, and advising on remediation.
May 5, 2023 — Engagement of Forensic Investigators. Graystone Forensics LLC ("Graystone"), a Virginia-based cybersecurity forensics firm, was retained under the direction and at the request of counsel to conduct a comprehensive forensic investigation into the nature, scope, and cause of the breach. The engagement was led by Dr. Nolan Briggs, Managing Director of Incident Response at Graystone, and Kendra Faulkner, Senior Forensic Analyst. Graystone's engagement was structured to preserve the attorney-client privilege and work product protection applicable to its forensic findings and analysis.
June 2, 2023 — Preliminary Forensic Findings Report. Graystone issued a preliminary forensic findings report to Calderwood & Harkness LLP confirming the exfiltration of structured data files containing Quorum policyholder and claimant information from Palomar's environment. The preliminary report confirmed the attack vector (CVE-2023-0669 exploitation of the GoAnywhere MFT appliance), the general timeline of unauthorized access and exfiltration, and the categories of data that were likely involved. However, the preliminary report did not yet provide a definitive accounting of the specific individuals affected or the complete list of data elements compromised for each individual.
July 14, 2023 — Final Forensic Report. Graystone issued its final forensic report to Calderwood & Harkness LLP, confirming the full scope of compromised data. The final report identified all categories of personal information that were exfiltrated, provided a comprehensive inventory of the affected data files, and confirmed the approximate number of individuals whose personal information was involved across all jurisdictions.
August 4, 2023 — Completion of Data Mining and Individual Identification. Following receipt of the final forensic report, Quorum, through its vendor Clearfield Notification Services LLC and under the direction of Calderwood & Harkness LLP, undertook a comprehensive data mining and analysis process to identify the specific individuals whose personal information was involved, determine the specific data elements compromised for each individual, and identify the state of residence of each affected individual. This process was completed on August 4, 2023, at which point Quorum was able to confirm that 10,217 Massachusetts residents were among the 318,247 individuals whose personal information was involved in the incident.
August 17, 2023 — Regulatory Notification (This Filing). This notification is being filed with the Massachusetts Attorney General and the Massachusetts Director of Consumer Affairs and Business Regulation.
August 18, 2023 — Consumer Notification Mailing Commences. Individual written notification letters are being mailed to all 10,217 affected Massachusetts residents via first-class U.S. mail beginning August 18, 2023.
2.3 Vendor Relationship Context
Palomar Data Solutions, Inc. provides claims data processing, document management, and data analytics services to Quorum Insurance Holdings Corp. under a Master Services Agreement ("MSA") originally executed on November 12, 2019. The MSA has been subsequently amended on two occasions: Amendment No. 1, dated March 3, 2021, which expanded the scope of services to include additional data processing functions; and Amendment No. 2, dated September 15, 2022, which updated certain data security requirements and service level commitments.
Under the MSA and its amendments, Palomar processes personal information of Quorum's policyholders and claimants in connection with Quorum's personal lines claims operations. The personal information processed by Palomar includes, among other data elements, policyholder and claimant names, Social Security numbers, dates of birth, driver's license numbers, financial account information, and health-related information associated with workers' compensation and health-related insurance claims. The MSA contains data security obligations, breach notification provisions, and indemnification obligations applicable to Palomar.
III. INFORMATION INVOLVED IN THE BREACH
3.1 Types of Personal Information Compromised (Massachusetts Residents)
Based on the completed forensic investigation and data mining analysis, the personal information involved in this incident with respect to affected Massachusetts residents includes the following categories, as defined under Mass. Gen. Laws ch. 93H, § 1:
•  Full names (first name and last name, or first initial and last name)
•  Social Security numbers
•  Dates of birth
•  Driver's license numbers
These four categories of personal information were involved for all 10,217 affected Massachusetts residents.
In addition, for a subset of the 10,217 affected Massachusetts residents, the following additional categories of personal information were also involved:
•  Financial account information, including bank account numbers and payment card numbers (with associated routing numbers or expiration dates, as applicable). Approximately 2,814 Massachusetts residents had financial account information compromised.
•  Protected health information ("PHI"), including health conditions, medical diagnosis codes (ICD-10), treatment information, and related clinical data associated with workers' compensation claims and health-related insurance claims submitted to Quorum. Approximately 1,347 Massachusetts residents had protected health information compromised.
The consumer notification letters being sent to affected Massachusetts residents are tailored to identify the specific categories of personal information that were compromised for each individual recipient.
3.2 Overall Scope of the Breach (All Jurisdictions)
The total number of affected individuals across all jurisdictions is 318,247, spanning 29 states and the District of Columbia. Of the total affected population:
•  Approximately 84,619 individuals had financial account information (bank account numbers and/or payment card numbers) compromised.
•  Approximately 41,203 individuals had protected health information compromised.
Massachusetts, with 10,217 affected residents, represents one of the states with more than 10,000 affected individuals. Quorum is concurrently filing notifications with regulators in all affected jurisdictions, as described in Section VII below.
IV. ACTIONS TAKEN IN RESPONSE TO THE BREACH
4.1 Forensic Investigation
Upon receiving notification from Palomar on April 21, 2023, Quorum promptly initiated its internal incident response procedures. On May 4, 2023, Quorum engaged Calderwood & Harkness LLP as outside counsel, and on May 5, 2023, Graystone Forensics LLC was retained under the direction of counsel to conduct a comprehensive forensic investigation.
The forensic investigation was designed to determine the full scope, nature, and root cause of the breach. Graystone's investigation confirmed the following key findings:
•  Attack Vector: The threat actor exploited CVE-2023-0669, a pre-authentication remote code execution vulnerability in Palomar's GoAnywhere MFT file transfer appliance. The vulnerability had been publicly disclosed and a patch had been made available by Severin Corporation in February 2023. Palomar had not applied the patch at the time of the exploitation.
•  Timeline of Unauthorized Access: The threat actor maintained unauthorized access to Palomar's network environment for approximately 35 days, from March 14, 2023 through April 18, 2023.
•  Lateral Movement: Following initial access through the GoAnywhere MFT appliance, the threat actor conducted lateral movement within Palomar's network, escalating privileges and accessing file servers and database systems that housed structured data files containing Quorum policyholder and claimant information.
•  Data Staging and Exfiltration: The threat actor staged targeted data files on intermediate systems within Palomar's network and exfiltrated the data using encrypted channels to external infrastructure controlled by the threat actor.
•  Exfiltrated Data: The exfiltrated data included structured files in CSV and database extract formats containing personal information fields including names, Social Security numbers, dates of birth, driver's license numbers, financial account information, and protected health information of Quorum policyholders and claimants.
Graystone issued a preliminary forensic findings report on June 2, 2023, and a final forensic report on July 14, 2023. Following receipt of the final forensic report, the data mining and individual identification process was completed on August 4, 2023.
4.2 Consumer Notification
Individual written notification letters are being mailed to all 10,217 affected Massachusetts residents via first-class U.S. mail. The mailing commenced on August 18, 2023, and is expected to be completed by approximately September 15, 2023, taking into account the time required for address verification, printing, and postal delivery.
The notification letters comply with the requirements of Mass. Gen. Laws ch. 93H, § 3, and include all statutorily required elements, including:
•  A description of the incident and the nature of the breach;
•  The types of personal information that were the subject of the breach;
•  The steps Quorum has taken or plans to take in response to the incident;
•  The right of the individual to obtain a police report;
•  How to request a security freeze and the necessary information to do so;
•  Contact information for the filer and for the toll-free call center.
Each notification letter is customized to identify the specific categories of personal information that were compromised for the individual recipient.
The notification process is being managed by Clearfield Notification Services LLC, with Jerome Tillman serving as the designated Account Manager. Clearfield Notification Services LLC is located at 4500 Rockside Road, Suite 210, Independence, OH 44131. Clearfield is a nationally recognized provider of data breach notification, call center, and credit monitoring administration services, and has been engaged to manage the end-to-end notification logistics for this incident.
A copy of the Massachusetts-specific consumer notification letter is enclosed with this filing as Exhibit A.
4.3 Credit Monitoring and Identity Theft Protection Services
All 10,217 affected Massachusetts residents are being offered twenty-four (24) months of complimentary credit monitoring and identity theft protection services at no cost to the affected individuals. These services are being provided through a reputable, nationally recognized identity theft protection provider and include the following features:
•  Credit monitoring with alerts for key changes to the individual's credit file;
•  Identity theft insurance coverage;
•  Dark web monitoring for compromised personal information;
•  Identity restoration assistance from trained specialists.
Enrollment information and detailed instructions for activating the complimentary services are included in the consumer notification letter. Affected individuals will have a 90-day enrollment window from the date of the notification letter to activate their complimentary services, after which the enrollment code will expire.
Based on Quorum's historical experience with breach notification events, and consistent with industry benchmarks, Quorum estimates an approximate take-rate of 40% for enrollment in the credit monitoring and identity theft protection services. Nationally, across the total population of 318,247 affected individuals, this translates to an estimated 127,299 enrollees. The proportional Massachusetts subset is expected to be approximately 4,087 enrollees, although actual enrollment will depend on individual choices.
4.4 Toll-Free Call Center
A dedicated toll-free call center has been established specifically for affected individuals to obtain additional information and assistance regarding this incident. The call center is operated by Clearfield Notification Services LLC and is staffed by trained representatives who can answer questions about the incident, the notification letter, the credit monitoring enrollment process, and the steps individuals can take to protect themselves.
The toll-free call center number is 1-855-491-0327 and is operational Monday through Friday, 9:00 a.m. to 9:00 p.m. Eastern Time. The call center will remain operational for a twelve (12) week window from the date of the initial mailing, through approximately November 10, 2023.
4.5 Remediation and Vendor Accountability
Quorum has taken comprehensive steps to address the root causes of this incident and to hold Palomar Data Solutions accountable for the breach. These measures include the following:
Contractual Remedies. Quorum has formally asserted its contractual indemnification rights under Article 9 of the Master Services Agreement and related amendments. Quorum has demanded that Palomar indemnify, defend, and hold harmless Quorum for all costs, expenses, losses, and liabilities arising out of the breach, including without limitation the costs of the forensic investigation, notification, credit monitoring, call center operations, regulatory compliance, and any resulting litigation or regulatory proceedings. Calderwood & Harkness LLP transmitted a formal demand letter to Palomar's outside counsel on June 19, 2023.
Enhanced Security Requirements for Palomar. Quorum has required Palomar to implement enhanced security measures as a condition of the continued business relationship. These measures include, but are not limited to:
•  Implementation of an enhanced patch management program with defined timelines for the application of critical security patches (within 48 hours of vendor release for critical vulnerabilities, within 14 days for high-severity vulnerabilities);
•  Deployment of an enterprise-grade endpoint detection and response ("EDR") solution across all Palomar systems and endpoints;
•  Implementation of enhanced network segmentation and micro-segmentation to limit the potential for lateral movement in the event of a future compromise;
•  Engagement of an independent, nationally recognized third-party cybersecurity firm to conduct a comprehensive security assessment of Palomar's information technology environment, including penetration testing and vulnerability assessment, with findings and remediation plans to be shared with Quorum;
•  Enhanced logging, monitoring, and alerting capabilities, including implementation of a security information and event management ("SIEM") platform with 24/7 monitoring.
Quorum's Internal Enhancements. In addition to the requirements imposed on Palomar, Quorum has taken steps to enhance its own vendor risk management program and internal incident response capabilities. These enhancements include:
•  Revision and strengthening of Quorum's Third-Party Risk Management Policy and Procedures, including enhanced due diligence requirements for vendors that process personal information;
•  Implementation of a continuous monitoring program for critical third-party vendors, including periodic review of security posture, patch management compliance, and incident response readiness;
•  Enhancement of Quorum's Incident Response Plan, including updated escalation procedures, refined roles and responsibilities, and the conduct of tabletop exercises simulating vendor-related breach scenarios;
•  Additional training for Quorum's information security, legal, and compliance teams on vendor risk management and incident response best practices.
4.6 Law Enforcement
Quorum has cooperated with law enforcement authorities in connection with this incident. Palomar Data Solutions reported the breach to the Federal Bureau of Investigation ("FBI") on April 25, 2023, and has been cooperating with the FBI's investigation. Quorum has made itself available to law enforcement and has provided information as requested to support the investigation. No law enforcement authority has requested a delay in notification to affected individuals.
4.7 Substitute Notice
In addition to direct mail notification to all affected Massachusetts residents for whom Quorum has a valid mailing address, Quorum is also providing substitute notice via a prominent posting on Quorum's corporate website (www.quoruminsurance.com/security-incident) to supplement the direct mail notification. The website posting includes a description of the incident, the types of personal information involved, the steps Quorum is taking in response, and information about the credit monitoring services and toll-free call center. This substitute notice is provided out of an abundance of caution and is not intended to replace the direct individual written notification being provided to each affected individual.
V. STEPS INDIVIDUALS CAN TAKE TO PROTECT THEMSELVES
Quorum is recommending that affected Massachusetts residents take the following steps to protect themselves from potential misuse of their personal information:
1.  Enroll in Complimentary Credit Monitoring and Identity Theft Protection Services. Affected individuals should promptly enroll in the 24-month complimentary credit monitoring and identity theft protection services being offered by Quorum. Enrollment information, including a unique activation code and instructions, is included in the consumer notification letter. Individuals should enroll within 90 days of the date of the notification letter.
2.  Monitor Financial Account Statements. Affected individuals should carefully review their bank account statements, credit card statements, and other financial account statements for any unauthorized transactions or suspicious activity. Any unauthorized charges or withdrawals should be reported immediately to the applicable financial institution.
3.  Review Credit Reports. Affected individuals are encouraged to obtain and review free copies of their credit reports from the three major credit reporting agencies — Harborview Enterprises, Penrose Group, and Penmark Enterprises — at www.annualcreditreport.com or by calling 1-877-322-8228. Under federal law, individuals are entitled to one free credit report from each of the three credit reporting agencies every twelve months.
4.  Place Fraud Alerts. Affected individuals may place an initial fraud alert on their credit files by contacting any one of the three major credit reporting agencies. An initial fraud alert lasts for one year and requires potential creditors to take steps to verify the identity of the applicant before extending credit. The contact information for each agency is as follows:
•  Harborview Enterprises: P.O. Box 105069, Atlanta, GA 30348-5069; 1-800-525-6285; www.Harborview Enterprises.com
•  Penrose Group: P.O. Box 2002, Allen, TX 75013; 1-888-397-3742; www.Penrose Group.com
•  Penmark Enterprises: P.O. Box 2000, Chester, PA 19016; 1-800-680-7289; www.Penmark Enterprises.com
5.  Place Security Freezes. Affected individuals have the right to place a security freeze on their credit files at no cost. A security freeze prohibits the credit reporting agency from releasing any information from the individual's credit file without the individual's express authorization. A security freeze may delay or interfere with the timely approval of any subsequent request or application the individual makes regarding a new loan, credit, mortgage, or any other account involving the extension of credit. To place a security freeze, individuals should contact each of the three credit reporting agencies listed above.
6.  Review Explanation of Benefits Statements. For affected individuals whose protected health information was involved, Quorum recommends carefully reviewing Explanation of Benefits ("EOB") statements received from health insurers for any unauthorized medical services, prescriptions, or other healthcare activity. Any suspicious or unauthorized medical activity should be reported to the applicable health insurer immediately.
7.  File Identity Theft Reports. If an affected individual detects any suspicious activity or believes that his or her personal information has been misused, the individual should file an identity theft report with the Federal Trade Commission ("FTC") at www.identitytheft.gov or by calling 1-877-438-4338, and should also file a report with local law enforcement.
8.  Contact the Dedicated Toll-Free Call Center. Affected individuals may contact the dedicated toll-free call center at 1-855-491-0327, Monday through Friday, 9:00 a.m. to 9:00 p.m. Eastern Time, for additional information and assistance.
VI. INFORMATION REQUIRED BY MASSACHUSETTS STATUTE
6.1 Statutory Checklist (Mass. Gen. Laws ch. 93H, § 3)
In compliance with Mass. Gen. Laws ch. 93H, § 3, the following information is provided:
6.2 Compliance with 201 CMR 17.00
Quorum Insurance Holdings Corp. maintains a comprehensive written information security program ("WISP") consistent with the requirements of 201 CMR 17.00, the Standards for the Protection of Personal Information of Residents of the Commonwealth. Quorum's WISP is designed to protect the security and confidentiality of personal information of Massachusetts residents and includes administrative, technical, and physical safeguards appropriate to the size, scope, and type of business of Quorum, the amount of resources available to Quorum, the amount of stored data, and the need for security and confidentiality of both consumer and employee information.
Quorum's administrative safeguards include, among other measures, designation of a Chief Privacy Officer and a Chief Information Security Officer with responsibility for the information security program; ongoing employee training on information security policies and procedures; regular risk assessments; and vendor due diligence and oversight processes designed to ensure that third-party service providers maintain appropriate security measures.
Quorum's technical safeguards include, among other measures, encryption of personal information in transit and at rest; access controls and authentication mechanisms, including multi-factor authentication; intrusion detection and prevention systems; firewalls and network segmentation; endpoint protection; regular vulnerability scanning and penetration testing; and security information and event management (SIEM) capabilities.
Quorum's physical safeguards include, among other measures, physical access controls at facilities where personal information is stored or processed; secure disposal procedures for physical and electronic media; and environmental controls.
In the wake of this incident, Quorum has undertaken post-incident enhancements to its information security program and vendor oversight procedures, as described in Section IV.5 above. These enhancements are designed to further strengthen Quorum's defenses against future incidents and to improve the organization's ability to detect, respond to, and recover from data security events, particularly those involving third-party vendors. Quorum is committed to continuous improvement of its information security practices and to ongoing compliance with 201 CMR 17.00 and all other applicable data protection requirements.
VII. OTHER REGULATORY FILINGS
Quorum Insurance Holdings Corp. is concurrently filing data breach notifications with regulators in all 29 affected states and the District of Columbia, in accordance with the applicable breach notification statutes and regulations of each jurisdiction. The following is a summary of the principal regulatory filings being made:
The filing with the U.S. Department of Health and Human Services, Office for Civil Rights, relates specifically to the subset of 41,203 individuals nationwide whose protected health information was compromised in the incident, and is being made pursuant to the breach notification requirements of the Health Insurance Portability and Accountability Act of 1996 ("HIPAA") and the Health Information Technology for Economic and Clinical Health Act ("HITECH Act"), as implemented through 45 C.F.R. §§ 164.400–164.414.
Quorum is also evaluating whether additional regulatory notifications are required under insurance-specific data security regulations, including the National Association of Insurance Commissioners ("NAIC") Insurance Data Security Model Law, as adopted by the applicable state insurance departments.
VIII. AVAILABILITY FOR FURTHER INFORMATION
Quorum Insurance Holdings Corp. and Calderwood & Harkness LLP are available to provide any additional information that the Attorney General or the Director of Consumer Affairs and Business Regulation may require in connection with this notification, and to respond to any questions or inquiries regarding the incident, the investigation, the notification process, or the remedial measures being undertaken.
All inquiries from the Attorney General's Office or the Office of the Director of Consumer Affairs and Business Regulation should be directed to the following contacts:
Outside Counsel:
Kevin Ostrowski, Partner Calderwood & Harkness LLP 1700 K Street NW, Suite 900 Washington, D.C. 20006 Telephone: (202) 555-7140
Email: kostrowski@calderwoodharkness.com
Alan Burke, Associate Calderwood & Harkness LLP 1700 K Street NW, Suite 900 Washington, D.C. 20006 Telephone: (202) 555-7152
Email: aburke@calderwoodharkness.com
Quorum Insurance Holdings Corp.:
Thomas R. Whitfield, General Counsel Quorum Insurance Holdings Corp. 400 Constitution Plaza, Suite 2200 Hartford, CT 06103 Telephone: (860) 555-3200
Email: twhitfield@quoruminsurance.com
Jennifer Liang, Chief Privacy Officer Quorum Insurance Holdings Corp. 400 Constitution Plaza, Suite 2200 Hartford, CT 06103 Telephone: (860) 555-3215
Email: jliang@quoruminsurance.com
Quorum takes the security of personal information very seriously and deeply regrets any concern or inconvenience this incident may cause to affected Massachusetts residents. Quorum is committed to cooperating fully with the Attorney General and the Director of Consumer Affairs and Business Regulation in connection with this matter.
IX. SIGNATURE
Respectfully submitted,
CALDERWOOD & HARKNESS LLP
By: ________
Name: Kevin Ostrowski
Title: Partner
Calderwood & Harkness LLP 1700 K Street NW, Suite 900 Washington, D.C. 20006
On Behalf of Quorum Insurance Holdings Corp.
Date: August 17, 2023
X. ENCLOSURES
The following exhibits are enclosed with this filing:
Exhibit A — Copy of Massachusetts-Specific Consumer Notification Letter
Enclosed herewith is a copy of the consumer notification letter dated August 12, 2023, which has been adapted specifically for the 10,217 affected Massachusetts residents. The notification letter is compliant with the requirements of Mass. Gen. Laws ch. 93H, § 3, and 201 CMR 17.00, and includes the following content:
•  A description of the data security incident, including the nature of the breach, the dates of unauthorized access, and the identity of the third-party vendor whose systems were compromised;
•  A description of the specific types of personal information involved for the individual recipient;
•  A description of the steps Quorum has taken and is taking in response to the incident, including the forensic investigation, vendor remediation, and enhanced security measures;
•  An offer of twenty-four (24) months of complimentary credit monitoring and identity theft protection services at no cost to the individual, together with a unique activation code and enrollment instructions;
•  The toll-free call center telephone number (1-855-491-0327) operated by Clearfield Notification Services LLC, with hours of operation;
•  Information regarding the individual's right to obtain a police report and how to do so;
•  Information regarding the individual's right to request a security freeze, including contact information for the three major credit reporting agencies;
•  Recommended steps for self-protection, including monitoring financial account statements, reviewing credit reports, placing fraud alerts, reviewing Explanation of Benefits statements (where applicable), and filing identity theft reports with the FTC and local law enforcement.
Exhibit B — Quorum Insurance Holdings Corp. Entity Information
Enclosed herewith is a summary of entity information for Quorum Insurance Holdings Corp., as follows:
This filing and all enclosed materials are submitted to the Office of the Attorney General of the Commonwealth of Massachusetts and the Office of the Director of Consumer Affairs and Business Regulation pursuant to Mass. Gen. Laws ch. 93H, § 3. This filing contains information that Quorum Insurance Holdings Corp. considers confidential and proprietary, including details regarding its information security practices, vendor relationships, and incident response activities. Quorum respectfully requests that these materials be treated as confidential to the extent permitted by applicable law, including Mass. Gen. Laws ch. 66, § 10, and 950 CMR 32.00 et seq.
Field | Detail
Entity Name | Quorum Insurance Holdings Corp.
Principal Address | 400 Constitution Plaza, Suite 2200, Hartford, CT 06103
State of Incorporation | Delaware
Employer Identification Number (EIN) | 06-4832197
Nasdaq Ticker Symbol | QIHC
General Counsel | Thomas R. Whitfield
Chief Privacy Officer | Jennifer Liang
Outside Counsel (for purposes of this filing) | Kevin Ostrowski, Partner, Calderwood & Harkness LLP, 1700 K Street NW, Suite 900, Washington, D.C. 20006
Outside Counsel Telephone | (202) 555-7140
Outside Counsel Email | kostrowski@calderwoodharkness.com
Industry | Insurance (property & casualty, specialty lines, life & annuity) and financial technology
Statutory Requirement | Response
Nature of the breach of security | Third-party vendor network compromise via exploitation of an unpatched remote code execution vulnerability (CVE-2023-0669) in Palomar Data Solutions' GoAnywhere MFT file transfer appliance, resulting in unauthorized access, lateral movement, and data exfiltration over an approximately 35-day period (March 14 – April 18, 2023)
Number of Massachusetts residents affected | 10,217
Name and address of the entity that experienced the breach | Palomar Data Solutions, Inc., 7100 Greenville Avenue, Suite 450, Dallas, TX 75231
Name and address of the entity filing the notification | Quorum Insurance Holdings Corp., 400 Constitution Plaza, Suite 2200, Hartford, CT 06103 (filing made by outside counsel, Calderwood & Harkness LLP, 1700 K Street NW, Suite 900, Washington, D.C. 20006)
Whether a police report has been filed | Palomar reported the incident to the Federal Bureau of Investigation on April 25, 2023. Quorum has cooperated with the FBI's investigation. No separate state or local police report has been filed to date.
Contact information for the filer | Kevin Ostrowski, Partner, Calderwood & Harkness LLP, 1700 K Street NW, Suite 900, Washington, D.C. 20006; Telephone: (202) 555-7140; Email: kostrowski@calderwoodharkness.com
Steps being taken regarding the breach | Comprehensive forensic investigation completed; individual consumer notifications mailed; 24 months of complimentary credit monitoring and identity theft protection services offered; dedicated toll-free call center established; vendor remediation and enhanced security measures implemented; vendor indemnification rights asserted; Quorum's own vendor risk management program and incident response capabilities enhanced
Jurisdiction / Regulator | Filing Date | Statutory Authority
Connecticut Attorney General | August 14, 2023 | Conn. Gen. Stat. § 36a-701b
Connecticut Insurance Department | August 14, 2023 | Conn. Gen. Stat. § 38a-999b
U.S. Department of Health and Human Services, Office for Civil Rights | August 15, 2023 | 45 C.F.R. § 164.408 (HIPAA Breach Notification Rule, for the subset of 41,203 individuals whose protected health information was involved)
New York Attorney General | August 16, 2023 | N.Y. Gen. Bus. Law § 899-aa
California Attorney General | August 16, 2023 | Cal. Civ. Code § 1798.82
Massachusetts Attorney General and Director of Consumer Affairs | August 17, 2023 | Mass. Gen. Laws ch. 93H, § 3
All remaining affected state filings | August 17–25, 2023 | Applicable state breach notification statutes
Field | Detail
Full Legal Name | Quorum Insurance Holdings Corp.
Principal Address | 400 Constitution Plaza, Suite 2200, Hartford, CT 06103
State of Incorporation | Delaware
Employer Identification Number (EIN) | 06-4832197
Nasdaq Ticker Symbol | QIHC
Authorized Representative for This Filing | Kevin Ostrowski, Partner, Calderwood & Harkness LLP, 1700 K Street NW, Suite 900, Washington, D.C. 20006
General Counsel | Thomas R. Whitfield
Chief Privacy Officer | Jennifer Liang
Chief Information Security Officer | David Naranjo