1025-00006 · Graystone Forensics LLC · Regulatory Notifications

media-notice-hhs-ocr.docx DOCUMENT Data Privacy

76 / 88 ← → ✕

NOTICE OF DATA BREACH INVOLVING PROTECTED HEALTH INFORMATION

FOR IMMEDIATE RELEASE / DISTRIBUTION: AUGUST 15, 2023

Issued by: Quorum Insurance Holdings Corp. 400 Constitution Plaza, Suite 2200 Hartford, CT 06103

Introduction and Summary of Incident

Quorum Insurance Holdings Corp. ("Quorum" or the "Company"), a publicly traded insurance and financial technology company headquartered in Hartford, Connecticut (Nasdaq: QIHC), is issuing this notice to inform members of the public and affected individuals regarding a data security incident involving protected health information ("PHI") maintained by one of the Company's third-party service providers, Palomar Data Solutions, Inc. ("Palomar"), a Dallas, Texas-based data processing and business process outsourcing company.

Palomar provides claims data processing, data warehousing, and related business process outsourcing services to Quorum under a Master Services Agreement originally executed in 2019 and subsequently amended. In the course of performing these services, Palomar receives, processes, stores, and transmits personal information, including PHI, on behalf of Quorum and its operating subsidiaries.

On or about March 14, 2023, an unauthorized third party exploited a known remote code execution vulnerability, identified as CVE-2023-0669, present in a file transfer appliance used within Palomar's network environment. By exploiting this vulnerability, the unauthorized third party gained unauthorized access to certain systems and data repositories within Palomar's network infrastructure. The unauthorized access continued through approximately April 18, 2023 — an approximately 35-day window — during which period certain data files were staged and exfiltrated from Palomar's systems.

Palomar's security operations center detected anomalous outbound data transfers on April 18, 2023, and promptly initiated its internal incident response protocols. Palomar notified Quorum of the incident on April 21, 2023, at which time Quorum commenced its own internal assessment and escalation procedures.

Upon receiving notification of the incident, Quorum promptly engaged outside legal counsel, Calderwood & Harkness LLP, and a nationally recognized forensic investigation firm, Graystone Forensics LLC, to investigate the nature, scope, and severity of the incident. The forensic investigation, which was completed on July 14, 2023, confirmed that files containing personal information — including PHI — of certain Quorum policyholders and claimants were accessed and exfiltrated by the unauthorized third party during the period of unauthorized access.

Quorum is providing this media notice in compliance with the Health Insurance Portability and Accountability Act of 1996 ("HIPAA") Breach Notification Rule, specifically 45 C.F.R. § 164.406, which requires that a covered entity provide notice to prominent media outlets serving the affected states or jurisdictions when a breach of unsecured PHI affects more than 500 individuals residing in any such state or jurisdiction. This notice is being issued without unreasonable delay and within 60 calendar days following the completion of the investigation that confirmed the scope and nature of the compromised data.

Description of What Happened

The data security incident originated at Palomar Data Solutions, Inc., a third-party vendor that processes claims data on behalf of Quorum pursuant to a Business Associate Agreement executed in accordance with 45 C.F.R. § 164.502(e) and 45 C.F.R. § 164.504(e). The following is a description of the key facts and timeline associated with the incident, as determined through the forensic investigation conducted by Graystone Forensics LLC.

Initial Compromise. On or about March 14, 2023, a threat actor exploited a known remote code execution vulnerability — tracked as CVE-2023-0669 — in Palomar's GoAnywhere MFT (Managed File Transfer) appliance. GoAnywhere MFT is a widely deployed enterprise file transfer solution used by organizations to securely exchange data files with business partners and clients. The CVE-2023-0669 vulnerability, which had been publicly disclosed and for which a vendor-issued patch was available, allowed the threat actor to execute arbitrary code on the affected appliance and gain an initial foothold within Palomar's network environment.

Lateral Movement and Data Staging. Following the initial compromise, the threat actor moved laterally within Palomar's internal network, accessing additional systems, servers, and data repositories. During this phase, the threat actor identified and staged structured data files — including flat files, database exports, and archived claim records — that contained Quorum policyholder and claimant information. These files had been maintained by Palomar in connection with its claims data processing services for Quorum.

Data Exfiltration. The exfiltration of staged data files occurred over an approximately 35-day period, from on or about March 14, 2023, through April 18, 2023. During this window, the threat actor transferred copies of the compromised files to external infrastructure under the threat actor's control. The precise volume of exfiltrated data was determined through forensic analysis of network traffic logs, endpoint telemetry, and server artifacts.

Detection. On April 18, 2023, Palomar's security operations center detected anomalous outbound data transfers from certain servers within its network. Palomar's incident response team immediately initiated containment procedures, including isolating the affected systems, revoking compromised credentials, and engaging its own cybersecurity response resources to assess the scope of the intrusion.

Notification to Quorum. Palomar notified Quorum of the data security incident on April 21, 2023, three days following detection. Quorum's information security and legal teams immediately commenced an internal assessment of the potential impact on Quorum's data and its policyholders and claimants.

Engagement of Outside Counsel and Forensic Investigators. Quorum retained Calderwood & Harkness LLP as outside legal counsel on May 4, 2023. On May 5, 2023, under the direction and supervision of Calderwood & Harkness LLP and subject to the protections of the attorney-client privilege and the work product doctrine, Quorum engaged Graystone Forensics LLC, a nationally recognized cybersecurity incident response firm, to conduct a comprehensive forensic investigation of the incident. The scope of the engagement included analysis of Palomar's network logs, endpoint artifacts, data exfiltration pathways, and identification of compromised data assets attributable to Quorum.

Preliminary and Final Findings. Graystone Forensics LLC delivered its preliminary forensic findings to Calderwood & Harkness LLP on June 2, 2023. The preliminary findings confirmed that data files containing Quorum policyholder and claimant information had been accessed and exfiltrated during the period of unauthorized access. The final forensic report, incorporating the complete technical analysis, was delivered on July 14, 2023.

Data Mining and Affected Individual Identification. Following receipt of the final forensic report, Quorum engaged a specialized data mining team to review and analyze the compromised data files in order to identify all affected individuals and the specific categories of information compromised for each individual. The data mining and affected individual identification process was completed on August 4, 2023.

Types of Information Involved

The forensic investigation and subsequent data mining process confirmed that the compromised data includes protected health information of approximately 41,203 individuals. These individuals are Quorum policyholders and claimants whose workers' compensation claims and health-related insurance claims were processed by Palomar on Quorum's behalf.

The types of PHI that may have been involved in the breach include, but are not necessarily limited to, the following categories of health-related information:

• Health conditions and diagnoses

• Diagnosis codes (including ICD-10-CM codes)

• Treatment information, including descriptions of medical procedures and services rendered

• Dates of medical service

• Health plan beneficiary identification numbers

• Claim status and adjudication information

• Information associated with workers' compensation claims, including descriptions of workplace injuries, treating provider information, and claim disposition details

• Information associated with health-related insurance claims processed through Quorum's operating subsidiaries

In addition to PHI, the affected individuals' personally identifiable information ("PII") may also have been compromised. The categories of PII that may have been involved include:

• Full legal names

• Dates of birth

• Social Security numbers

• Driver's license or state identification card numbers

• Home addresses

• Telephone numbers and email addresses

A subset of affected individuals also had financial information compromised, including bank account numbers, bank routing numbers, and/or payment card numbers (including credit and debit card numbers, expiration dates, and associated security codes). The financial information subset represents a portion of the overall affected population and was primarily associated with individuals who had received or were designated to receive electronic claims payments or premium refunds processed through Palomar.

The total number of affected individuals across all data types is 318,247 individuals, residing across 29 states and the District of Columbia. Of those 318,247 individuals, the PHI subset — those individuals whose protected health information was confirmed to have been involved in the breach — constitutes 41,203 individuals. The remaining affected individuals had PII and/or financial information compromised but did not have health-related information involved.

Scope of Affected Individuals by State

The breach affected individuals residing in 29 states and the District of Columbia. The table below sets forth the total number of affected individuals (across all data types, not limited to the PHI subset) in the jurisdictions with the most significant numbers of affected residents:

The 41,203 individuals whose PHI was compromised are distributed among these same jurisdictions in proportion to the overall affected population. Each of the states and the District of Columbia listed above had more than 500 affected residents, triggering the media notice requirement under 45 C.F.R. § 164.406(a). The specific number of PHI-affected individuals per state has been reported to the U.S. Department of Health and Human Services, Office for Civil Rights, and to the applicable state attorneys general and regulators, as required by law.

What Quorum Is Doing in Response

Quorum takes the security and privacy of personal information and protected health information entrusted to it and its service providers extremely seriously. Quorum deeply regrets this incident and understands the concern it may cause affected individuals. In response to the incident, Quorum has taken and continues to take the following actions:

Investigation and Legal Response. Quorum engaged Calderwood & Harkness LLP as outside legal counsel and Graystone Forensics LLC as forensic investigators to conduct a thorough and comprehensive investigation into the incident, including the identification of affected individuals and the categories of information compromised.

Regulatory Notifications. Quorum notified the U.S. Department of Health and Human Services, Office for Civil Rights ("HHS-OCR"), on August 15, 2023, pursuant to the HIPAA Breach Notification Rule, 45 C.F.R. § 164.408. In addition, Quorum filed regulatory notifications with the attorneys general and/or other applicable regulators in all 29 affected states and the District of Columbia, with filings commencing on August 14, 2023, and all filings completed or in process in accordance with the applicable state notification deadlines.

Individual Notification. Quorum is mailing individual notification letters via first-class U.S. mail to all 318,247 affected individuals, with mailings beginning on August 18, 2023. All individual notification mailings are expected to be completed by September 15, 2023. The individual notification letters describe the incident, the types of information involved, the steps individuals can take to protect themselves, and information about the complimentary protective services being offered by Quorum. Substitute notice is also being provided via the Company's dedicated incident response webpage for any individuals whose mailing addresses are insufficient or out of date.

Complimentary Credit Monitoring and Identity Theft Protection. Quorum is providing all affected individuals with 24 months of complimentary credit monitoring and identity theft protection services through Clearfield Notification Services LLC, a nationally recognized provider of breach response and identity protection services. The credit monitoring services include monitoring of credit files at all three major national credit reporting agencies (Harborview Enterprises, Penrose Group, and Penmark Enterprises), identity theft insurance coverage, and access to fraud resolution specialists. Instructions for enrolling in these complimentary services are included in the individual notification letters and are available on the dedicated incident response webpage.

Dedicated Call Center. Quorum, through Clearfield Notification Services LLC, is operating a dedicated toll-free call center to assist affected individuals with questions regarding the incident, the types of information involved, and enrollment in the complimentary credit monitoring and identity theft protection services. The call center is staffed by trained representatives who can assist callers in multiple languages. The call center will operate for a 12-week window beginning August 18, 2023, in order to ensure that affected individuals have adequate time to obtain information and enroll in protective services.

Communications Management. Quorum has retained BrightPath Consulting Group Inc. to manage communications related to the incident, including media relations, public communications, and coordination of substitute notice activities.

Vendor Accountability. Quorum is holding Palomar Data Solutions, Inc. accountable for the security failures that led to the incident. Quorum is pursuing all available contractual remedies, including indemnification obligations under the Master Services Agreement and Business Associate Agreement between the parties. Quorum has also required Palomar to provide a detailed remediation plan and evidence of enhanced security controls.

Enhanced Security Measures. Quorum is working with Palomar to implement enhanced security measures designed to prevent the recurrence of similar incidents, including improved patch management protocols, deployment of advanced endpoint detection and response ("EDR") capabilities, enhanced network segmentation, and implementation of additional monitoring and alerting controls for data exfiltration indicators. Quorum has also undertaken a comprehensive review of its own vendor management and third-party risk assessment programs to strengthen oversight of service providers with access to sensitive data.

What Individuals Can Do to Protect Themselves

Quorum encourages all affected individuals to take the following steps to help protect themselves against potential misuse of their personal information and protected health information:

Enroll in Complimentary Credit Monitoring and Identity Theft Protection Services. Affected individuals are strongly encouraged to enroll in the complimentary 24-month credit monitoring and identity theft protection services being offered by Quorum through Clearfield Notification Services LLC. Enrollment instructions and activation codes are included in the individual notification letters and are also available on the dedicated incident response webpage and through the toll-free call center.

Monitor Health Insurance Statements. Affected individuals should carefully review explanation of benefits ("EOB") statements received from their health insurers and health plans for any services, procedures, claims, or charges that they do not recognize. Unauthorized or unfamiliar entries on EOB statements may be an indicator of medical identity theft.

Review Credit Reports. Affected individuals should obtain and review their credit reports from each of the three major national credit reporting agencies — Harborview Enterprises, Penrose Group, and Penmark Enterprises — and examine the reports for any accounts, inquiries, or other activity that is unfamiliar or not recognized. Under federal law, individuals are entitled to one free credit report per year from each of the three bureaus, which can be obtained at www.annualcreditreport.com or by calling 1-877-322-8228.

Place a Fraud Alert or Security Freeze. Affected individuals may wish to consider placing a fraud alert or a security freeze (also known as a credit freeze) on their credit files. A fraud alert instructs creditors to take additional steps to verify the identity of an applicant before opening new accounts in the individual's name. A security freeze restricts access to the individual's credit file, making it more difficult for unauthorized persons to open accounts in the individual's name. Fraud alerts and security freezes can be placed by contacting any one of the three major credit reporting agencies:

• Harborview Enterprises: P.O. Box 105069, Atlanta, GA 30348-5069; 1-800-685-1111; www.Harborview Enterprises.com

• Penrose Group: P.O. Box 9554, Allen, TX 75013; 1-888-397-3742; www.Penrose Group.com

• Penmark Enterprises: P.O. Box 2000, Chester, PA 19016-2000; 1-800-680-7289; www.Penmark Enterprises.com

Remain Vigilant for Suspicious Communications. Affected individuals should remain vigilant for unsolicited communications — whether by telephone, email, text message, or mail — that request personal information, health information, financial information, or login credentials. These communications may be attempts by malicious actors to use information obtained in the breach to conduct phishing or social engineering attacks. Individuals should not provide personal or sensitive information in response to unsolicited requests and should verify the legitimacy of any communication before responding.

Report Suspected Identity Theft or Fraud. Affected individuals who suspect that they are the victim of identity theft or fraud should report the matter to their local law enforcement agency and to the Federal Trade Commission ("FTC"). Reports to the FTC can be filed online at www.identitytheft.gov or by telephone at 1-877-438-4338. The FTC provides comprehensive resources and step-by-step guidance for individuals who believe they may be victims of identity theft.

Contact Health Insurers. Individuals who suspect that their health information may have been misused — for example, if they receive EOB statements reflecting services they did not receive, or if they are contacted by health care providers regarding appointments or treatments they did not seek — should promptly contact their health insurer or health plan to report the suspected misuse and request a review of their health records and claims history.

Contact Information for Affected Individuals

Individuals who believe they may have been affected by this incident, or who have questions about the incident, the types of information involved, or the complimentary credit monitoring and identity theft protection services being offered, may contact Quorum through the following channels:

Toll-Free Call Center:

Telephone: 1-844-XXX-XXXX (toll-free) Operated by: Clearfield Notification Services LLC Hours of Operation: Monday through Friday, 8:00 a.m. to 8:00 p.m. Eastern Time; Saturday, 9:00 a.m. to 5:00 p.m. Eastern Time The call center will be operational for a 12-week window beginning August 18, 2023, through November 10, 2023.

Mailing Address:

Quorum Insurance Holdings Corp.

Attention: Data Security Incident Response

400 Constitution Plaza, Suite 2200 Hartford, CT 06103

Dedicated Incident Response Website:

www.quoruminsurance.com/incident-response The dedicated website contains substitute notice information, answers to frequently asked questions, and instructions for enrolling in complimentary credit monitoring and identity theft protection services.

Filing a Complaint with HHS-OCR. Individuals who believe that their health information privacy rights have been violated as a result of this incident may file a complaint with the U.S. Department of Health and Human Services, Office for Civil Rights. Complaints may be filed online through the HHS-OCR complaint portal at www.hhs.gov/hipaa/filing-a-complaint or by mail to:

U.S. Department of Health and Human Services Office for Civil Rights 200 Independence Avenue, S.W. Room 509F, HHH Building Washington, D.C. 20201 Telephone: 1-877-696-6775

About Quorum Insurance Holdings Corp.

Quorum Insurance Holdings Corp. is a Delaware corporation publicly traded on the Nasdaq Stock Market under the ticker symbol QIHC. The Company is headquartered at 400 Constitution Plaza, Suite 2200, Hartford, Connecticut 06103.

Quorum is a top-25 U.S. insurance holding company with operating subsidiaries licensed and doing business in all 50 states, the District of Columbia, Puerto Rico, and the U.S. Virgin Islands. The Company offers a diversified portfolio of insurance and financial products, including personal lines (auto, homeowners, renters), commercial lines (commercial property, general liability, commercial auto, workers' compensation), specialty insurance (professional liability, cyber liability, directors and officers liability, environmental liability), and life and annuity products. Quorum also develops and operates QuorumEdge, a proprietary digital underwriting and policy administration platform that serves the Company's direct-to-consumer and agent-distributed channels.

For fiscal year 2022, Quorum reported annual revenue of approximately $4.82 billion and net written premiums of approximately $3.97 billion. As of December 31, 2022, the Company employed approximately 11,400 individuals across its headquarters, regional offices, and operating subsidiaries nationwide.

Additional information about Quorum Insurance Holdings Corp. is available on the Company's website at www.quoruminsurance.com and through the Company's filings with the U.S. Securities and Exchange Commission.

Media Contact Information

Members of the media with inquiries regarding this incident should direct their questions to:

Meredith Ashford Managing Director BrightPath Consulting Group Inc. 450 Lexington Avenue, 4th Floor New York, NY 10017 Telephone: (212) XXX-XXXX

Email: mashford@brightpathconsulting.com

Legal counsel for Quorum Insurance Holdings Corp. in connection with this matter:

Kevin Ostrowski, Partner Privacy & Data Security Practice Group Calderwood & Harkness LLP 1700 K Street NW, Suite 900 Washington, D.C. 20006 Telephone: (202) XXX-XXXX

Email: kostrowski@calderwoodharkness.com

Members of the media are asked to direct all inquiries through BrightPath Consulting Group Inc. in the first instance. Legal counsel will respond to media inquiries at their discretion and as appropriate under the circumstances.

# # #

This notice is being provided pursuant to the Health Insurance Portability and Accountability Act of 1996 (HIPAA) Breach Notification Rule, 45 C.F.R. § 164.406, which requires notice to prominent media outlets serving the affected states or jurisdictions when a breach of unsecured protected health information affects more than 500 individuals. This notice is also being issued in accordance with applicable state breach notification statutes in each of the 29 affected states and the District of Columbia. Nothing in this notice is intended to constitute an admission of liability by Quorum Insurance Holdings Corp. or any of its subsidiaries, affiliates, officers, directors, or employees.

Date: August 15, 2023

Issuing Entity: Quorum Insurance Holdings Corp. 400 Constitution Plaza, Suite 2200 Hartford, CT 06103 Nasdaq: QIHC

State	Total Affected Individuals
Connecticut	52,114
New York	47,831
California	38,206
Texas	29,477
Florida	22,913
Pennsylvania	18,640
Illinois	16,502
New Jersey	14,388
Ohio	11,743
Massachusetts	10,217
Remaining 19 states and the District of Columbia (combined)	56,216
Total	318,247

NOTICE OF DATA BREACH INVOLVING PROTECTED HEALTH INFORMATION
FOR IMMEDIATE RELEASE / DISTRIBUTION: AUGUST 15, 2023
Issued by: Quorum Insurance Holdings Corp. 400 Constitution Plaza, Suite 2200 Hartford, CT 06103
Introduction and Summary of Incident
Quorum Insurance Holdings Corp. ("Quorum" or the "Company"), a publicly traded insurance and financial technology company headquartered in Hartford, Connecticut (Nasdaq: QIHC), is issuing this notice to inform members of the public and affected individuals regarding a data security incident involving protected health information ("PHI") maintained by one of the Company's third-party service providers, Palomar Data Solutions, Inc. ("Palomar"), a Dallas, Texas-based data processing and business process outsourcing company.
Palomar provides claims data processing, data warehousing, and related business process outsourcing services to Quorum under a Master Services Agreement originally executed in 2019 and subsequently amended. In the course of performing these services, Palomar receives, processes, stores, and transmits personal information, including PHI, on behalf of Quorum and its operating subsidiaries.
On or about March 14, 2023, an unauthorized third party exploited a known remote code execution vulnerability, identified as CVE-2023-0669, present in a file transfer appliance used within Palomar's network environment. By exploiting this vulnerability, the unauthorized third party gained unauthorized access to certain systems and data repositories within Palomar's network infrastructure. The unauthorized access continued through approximately April 18, 2023 — an approximately 35-day window — during which period certain data files were staged and exfiltrated from Palomar's systems.
Palomar's security operations center detected anomalous outbound data transfers on April 18, 2023, and promptly initiated its internal incident response protocols. Palomar notified Quorum of the incident on April 21, 2023, at which time Quorum commenced its own internal assessment and escalation procedures.
Upon receiving notification of the incident, Quorum promptly engaged outside legal counsel, Calderwood & Harkness LLP, and a nationally recognized forensic investigation firm, Graystone Forensics LLC, to investigate the nature, scope, and severity of the incident. The forensic investigation, which was completed on July 14, 2023, confirmed that files containing personal information — including PHI — of certain Quorum policyholders and claimants were accessed and exfiltrated by the unauthorized third party during the period of unauthorized access.
Quorum is providing this media notice in compliance with the Health Insurance Portability and Accountability Act of 1996 ("HIPAA") Breach Notification Rule, specifically 45 C.F.R. § 164.406, which requires that a covered entity provide notice to prominent media outlets serving the affected states or jurisdictions when a breach of unsecured PHI affects more than 500 individuals residing in any such state or jurisdiction. This notice is being issued without unreasonable delay and within 60 calendar days following the completion of the investigation that confirmed the scope and nature of the compromised data.
Description of What Happened
The data security incident originated at Palomar Data Solutions, Inc., a third-party vendor that processes claims data on behalf of Quorum pursuant to a Business Associate Agreement executed in accordance with 45 C.F.R. § 164.502(e) and 45 C.F.R. § 164.504(e). The following is a description of the key facts and timeline associated with the incident, as determined through the forensic investigation conducted by Graystone Forensics LLC.
Initial Compromise. On or about March 14, 2023, a threat actor exploited a known remote code execution vulnerability — tracked as CVE-2023-0669 — in Palomar's GoAnywhere MFT (Managed File Transfer) appliance. GoAnywhere MFT is a widely deployed enterprise file transfer solution used by organizations to securely exchange data files with business partners and clients. The CVE-2023-0669 vulnerability, which had been publicly disclosed and for which a vendor-issued patch was available, allowed the threat actor to execute arbitrary code on the affected appliance and gain an initial foothold within Palomar's network environment.
Lateral Movement and Data Staging. Following the initial compromise, the threat actor moved laterally within Palomar's internal network, accessing additional systems, servers, and data repositories. During this phase, the threat actor identified and staged structured data files — including flat files, database exports, and archived claim records — that contained Quorum policyholder and claimant information. These files had been maintained by Palomar in connection with its claims data processing services for Quorum.
Data Exfiltration. The exfiltration of staged data files occurred over an approximately 35-day period, from on or about March 14, 2023, through April 18, 2023. During this window, the threat actor transferred copies of the compromised files to external infrastructure under the threat actor's control. The precise volume of exfiltrated data was determined through forensic analysis of network traffic logs, endpoint telemetry, and server artifacts.
Detection. On April 18, 2023, Palomar's security operations center detected anomalous outbound data transfers from certain servers within its network. Palomar's incident response team immediately initiated containment procedures, including isolating the affected systems, revoking compromised credentials, and engaging its own cybersecurity response resources to assess the scope of the intrusion.
Notification to Quorum. Palomar notified Quorum of the data security incident on April 21, 2023, three days following detection. Quorum's information security and legal teams immediately commenced an internal assessment of the potential impact on Quorum's data and its policyholders and claimants.
Engagement of Outside Counsel and Forensic Investigators. Quorum retained Calderwood & Harkness LLP as outside legal counsel on May 4, 2023. On May 5, 2023, under the direction and supervision of Calderwood & Harkness LLP and subject to the protections of the attorney-client privilege and the work product doctrine, Quorum engaged Graystone Forensics LLC, a nationally recognized cybersecurity incident response firm, to conduct a comprehensive forensic investigation of the incident. The scope of the engagement included analysis of Palomar's network logs, endpoint artifacts, data exfiltration pathways, and identification of compromised data assets attributable to Quorum.
Preliminary and Final Findings. Graystone Forensics LLC delivered its preliminary forensic findings to Calderwood & Harkness LLP on June 2, 2023. The preliminary findings confirmed that data files containing Quorum policyholder and claimant information had been accessed and exfiltrated during the period of unauthorized access. The final forensic report, incorporating the complete technical analysis, was delivered on July 14, 2023.
Data Mining and Affected Individual Identification. Following receipt of the final forensic report, Quorum engaged a specialized data mining team to review and analyze the compromised data files in order to identify all affected individuals and the specific categories of information compromised for each individual. The data mining and affected individual identification process was completed on August 4, 2023.
Types of Information Involved
The forensic investigation and subsequent data mining process confirmed that the compromised data includes protected health information of approximately 41,203 individuals. These individuals are Quorum policyholders and claimants whose workers' compensation claims and health-related insurance claims were processed by Palomar on Quorum's behalf.
The types of PHI that may have been involved in the breach include, but are not necessarily limited to, the following categories of health-related information:
•  Health conditions and diagnoses
•  Diagnosis codes (including ICD-10-CM codes)
•  Treatment information, including descriptions of medical procedures and services rendered
•  Dates of medical service
•  Health plan beneficiary identification numbers
•  Claim status and adjudication information
•  Information associated with workers' compensation claims, including descriptions of workplace injuries, treating provider information, and claim disposition details
•  Information associated with health-related insurance claims processed through Quorum's operating subsidiaries
In addition to PHI, the affected individuals' personally identifiable information ("PII") may also have been compromised. The categories of PII that may have been involved include:
•  Full legal names
•  Dates of birth
•  Social Security numbers
•  Driver's license or state identification card numbers
•  Home addresses
•  Telephone numbers and email addresses
A subset of affected individuals also had financial information compromised, including bank account numbers, bank routing numbers, and/or payment card numbers (including credit and debit card numbers, expiration dates, and associated security codes). The financial information subset represents a portion of the overall affected population and was primarily associated with individuals who had received or were designated to receive electronic claims payments or premium refunds processed through Palomar.
The total number of affected individuals across all data types is 318,247 individuals, residing across 29 states and the District of Columbia. Of those 318,247 individuals, the PHI subset — those individuals whose protected health information was confirmed to have been involved in the breach — constitutes 41,203 individuals. The remaining affected individuals had PII and/or financial information compromised but did not have health-related information involved.
Scope of Affected Individuals by State
The breach affected individuals residing in 29 states and the District of Columbia. The table below sets forth the total number of affected individuals (across all data types, not limited to the PHI subset) in the jurisdictions with the most significant numbers of affected residents:
The 41,203 individuals whose PHI was compromised are distributed among these same jurisdictions in proportion to the overall affected population. Each of the states and the District of Columbia listed above had more than 500 affected residents, triggering the media notice requirement under 45 C.F.R. § 164.406(a). The specific number of PHI-affected individuals per state has been reported to the U.S. Department of Health and Human Services, Office for Civil Rights, and to the applicable state attorneys general and regulators, as required by law.
What Quorum Is Doing in Response
Quorum takes the security and privacy of personal information and protected health information entrusted to it and its service providers extremely seriously. Quorum deeply regrets this incident and understands the concern it may cause affected individuals. In response to the incident, Quorum has taken and continues to take the following actions:
Investigation and Legal Response. Quorum engaged Calderwood & Harkness LLP as outside legal counsel and Graystone Forensics LLC as forensic investigators to conduct a thorough and comprehensive investigation into the incident, including the identification of affected individuals and the categories of information compromised.
Regulatory Notifications. Quorum notified the U.S. Department of Health and Human Services, Office for Civil Rights ("HHS-OCR"), on August 15, 2023, pursuant to the HIPAA Breach Notification Rule, 45 C.F.R. § 164.408. In addition, Quorum filed regulatory notifications with the attorneys general and/or other applicable regulators in all 29 affected states and the District of Columbia, with filings commencing on August 14, 2023, and all filings completed or in process in accordance with the applicable state notification deadlines.
Individual Notification. Quorum is mailing individual notification letters via first-class U.S. mail to all 318,247 affected individuals, with mailings beginning on August 18, 2023. All individual notification mailings are expected to be completed by September 15, 2023. The individual notification letters describe the incident, the types of information involved, the steps individuals can take to protect themselves, and information about the complimentary protective services being offered by Quorum. Substitute notice is also being provided via the Company's dedicated incident response webpage for any individuals whose mailing addresses are insufficient or out of date.
Complimentary Credit Monitoring and Identity Theft Protection. Quorum is providing all affected individuals with 24 months of complimentary credit monitoring and identity theft protection services through Clearfield Notification Services LLC, a nationally recognized provider of breach response and identity protection services. The credit monitoring services include monitoring of credit files at all three major national credit reporting agencies (Harborview Enterprises, Penrose Group, and Penmark Enterprises), identity theft insurance coverage, and access to fraud resolution specialists. Instructions for enrolling in these complimentary services are included in the individual notification letters and are available on the dedicated incident response webpage.
Dedicated Call Center. Quorum, through Clearfield Notification Services LLC, is operating a dedicated toll-free call center to assist affected individuals with questions regarding the incident, the types of information involved, and enrollment in the complimentary credit monitoring and identity theft protection services. The call center is staffed by trained representatives who can assist callers in multiple languages. The call center will operate for a 12-week window beginning August 18, 2023, in order to ensure that affected individuals have adequate time to obtain information and enroll in protective services.
Communications Management. Quorum has retained BrightPath Consulting Group Inc. to manage communications related to the incident, including media relations, public communications, and coordination of substitute notice activities.
Vendor Accountability. Quorum is holding Palomar Data Solutions, Inc. accountable for the security failures that led to the incident. Quorum is pursuing all available contractual remedies, including indemnification obligations under the Master Services Agreement and Business Associate Agreement between the parties. Quorum has also required Palomar to provide a detailed remediation plan and evidence of enhanced security controls.
Enhanced Security Measures. Quorum is working with Palomar to implement enhanced security measures designed to prevent the recurrence of similar incidents, including improved patch management protocols, deployment of advanced endpoint detection and response ("EDR") capabilities, enhanced network segmentation, and implementation of additional monitoring and alerting controls for data exfiltration indicators. Quorum has also undertaken a comprehensive review of its own vendor management and third-party risk assessment programs to strengthen oversight of service providers with access to sensitive data.
What Individuals Can Do to Protect Themselves
Quorum encourages all affected individuals to take the following steps to help protect themselves against potential misuse of their personal information and protected health information:
Enroll in Complimentary Credit Monitoring and Identity Theft Protection Services. Affected individuals are strongly encouraged to enroll in the complimentary 24-month credit monitoring and identity theft protection services being offered by Quorum through Clearfield Notification Services LLC. Enrollment instructions and activation codes are included in the individual notification letters and are also available on the dedicated incident response webpage and through the toll-free call center.
Monitor Health Insurance Statements. Affected individuals should carefully review explanation of benefits ("EOB") statements received from their health insurers and health plans for any services, procedures, claims, or charges that they do not recognize. Unauthorized or unfamiliar entries on EOB statements may be an indicator of medical identity theft.
Review Credit Reports. Affected individuals should obtain and review their credit reports from each of the three major national credit reporting agencies — Harborview Enterprises, Penrose Group, and Penmark Enterprises — and examine the reports for any accounts, inquiries, or other activity that is unfamiliar or not recognized. Under federal law, individuals are entitled to one free credit report per year from each of the three bureaus, which can be obtained at www.annualcreditreport.com or by calling 1-877-322-8228.
Place a Fraud Alert or Security Freeze. Affected individuals may wish to consider placing a fraud alert or a security freeze (also known as a credit freeze) on their credit files. A fraud alert instructs creditors to take additional steps to verify the identity of an applicant before opening new accounts in the individual's name. A security freeze restricts access to the individual's credit file, making it more difficult for unauthorized persons to open accounts in the individual's name. Fraud alerts and security freezes can be placed by contacting any one of the three major credit reporting agencies:
•  Harborview Enterprises: P.O. Box 105069, Atlanta, GA 30348-5069; 1-800-685-1111; www.Harborview Enterprises.com
•  Penrose Group: P.O. Box 9554, Allen, TX 75013; 1-888-397-3742; www.Penrose Group.com
•  Penmark Enterprises: P.O. Box 2000, Chester, PA 19016-2000; 1-800-680-7289; www.Penmark Enterprises.com
Remain Vigilant for Suspicious Communications. Affected individuals should remain vigilant for unsolicited communications — whether by telephone, email, text message, or mail — that request personal information, health information, financial information, or login credentials. These communications may be attempts by malicious actors to use information obtained in the breach to conduct phishing or social engineering attacks. Individuals should not provide personal or sensitive information in response to unsolicited requests and should verify the legitimacy of any communication before responding.
Report Suspected Identity Theft or Fraud. Affected individuals who suspect that they are the victim of identity theft or fraud should report the matter to their local law enforcement agency and to the Federal Trade Commission ("FTC"). Reports to the FTC can be filed online at www.identitytheft.gov or by telephone at 1-877-438-4338. The FTC provides comprehensive resources and step-by-step guidance for individuals who believe they may be victims of identity theft.
Contact Health Insurers. Individuals who suspect that their health information may have been misused — for example, if they receive EOB statements reflecting services they did not receive, or if they are contacted by health care providers regarding appointments or treatments they did not seek — should promptly contact their health insurer or health plan to report the suspected misuse and request a review of their health records and claims history.
Contact Information for Affected Individuals
Individuals who believe they may have been affected by this incident, or who have questions about the incident, the types of information involved, or the complimentary credit monitoring and identity theft protection services being offered, may contact Quorum through the following channels:
Toll-Free Call Center:
Telephone: 1-844-XXX-XXXX (toll-free) Operated by: Clearfield Notification Services LLC Hours of Operation: Monday through Friday, 8:00 a.m. to 8:00 p.m. Eastern Time; Saturday, 9:00 a.m. to 5:00 p.m. Eastern Time The call center will be operational for a 12-week window beginning August 18, 2023, through November 10, 2023.
Mailing Address:
Quorum Insurance Holdings Corp.
Attention: Data Security Incident Response
400 Constitution Plaza, Suite 2200 Hartford, CT 06103
Dedicated Incident Response Website:
www.quoruminsurance.com/incident-response The dedicated website contains substitute notice information, answers to frequently asked questions, and instructions for enrolling in complimentary credit monitoring and identity theft protection services.
Filing a Complaint with HHS-OCR. Individuals who believe that their health information privacy rights have been violated as a result of this incident may file a complaint with the U.S. Department of Health and Human Services, Office for Civil Rights. Complaints may be filed online through the HHS-OCR complaint portal at www.hhs.gov/hipaa/filing-a-complaint or by mail to:
U.S. Department of Health and Human Services Office for Civil Rights 200 Independence Avenue, S.W. Room 509F, HHH Building Washington, D.C. 20201 Telephone: 1-877-696-6775
About Quorum Insurance Holdings Corp.
Quorum Insurance Holdings Corp. is a Delaware corporation publicly traded on the Nasdaq Stock Market under the ticker symbol QIHC. The Company is headquartered at 400 Constitution Plaza, Suite 2200, Hartford, Connecticut 06103.
Quorum is a top-25 U.S. insurance holding company with operating subsidiaries licensed and doing business in all 50 states, the District of Columbia, Puerto Rico, and the U.S. Virgin Islands. The Company offers a diversified portfolio of insurance and financial products, including personal lines (auto, homeowners, renters), commercial lines (commercial property, general liability, commercial auto, workers' compensation), specialty insurance (professional liability, cyber liability, directors and officers liability, environmental liability), and life and annuity products. Quorum also develops and operates QuorumEdge, a proprietary digital underwriting and policy administration platform that serves the Company's direct-to-consumer and agent-distributed channels.
For fiscal year 2022, Quorum reported annual revenue of approximately $4.82 billion and net written premiums of approximately $3.97 billion. As of December 31, 2022, the Company employed approximately 11,400 individuals across its headquarters, regional offices, and operating subsidiaries nationwide.
Additional information about Quorum Insurance Holdings Corp. is available on the Company's website at www.quoruminsurance.com and through the Company's filings with the U.S. Securities and Exchange Commission.
Media Contact Information
Members of the media with inquiries regarding this incident should direct their questions to:
Meredith Ashford Managing Director BrightPath Consulting Group Inc. 450 Lexington Avenue, 4th Floor New York, NY 10017 Telephone: (212) XXX-XXXX
Email: mashford@brightpathconsulting.com
Legal counsel for Quorum Insurance Holdings Corp. in connection with this matter:
Kevin Ostrowski, Partner Privacy & Data Security Practice Group Calderwood & Harkness LLP 1700 K Street NW, Suite 900 Washington, D.C. 20006 Telephone: (202) XXX-XXXX
Email: kostrowski@calderwoodharkness.com
Members of the media are asked to direct all inquiries through BrightPath Consulting Group Inc. in the first instance. Legal counsel will respond to media inquiries at their discretion and as appropriate under the circumstances.
# # #
This notice is being provided pursuant to the Health Insurance Portability and Accountability Act of 1996 (HIPAA) Breach Notification Rule, 45 C.F.R. § 164.406, which requires notice to prominent media outlets serving the affected states or jurisdictions when a breach of unsecured protected health information affects more than 500 individuals. This notice is also being issued in accordance with applicable state breach notification statutes in each of the 29 affected states and the District of Columbia. Nothing in this notice is intended to constitute an admission of liability by Quorum Insurance Holdings Corp. or any of its subsidiaries, affiliates, officers, directors, or employees.
Date: August 15, 2023
Issuing Entity: Quorum Insurance Holdings Corp. 400 Constitution Plaza, Suite 2200 Hartford, CT 06103 Nasdaq: QIHC
State | Total Affected Individuals
Connecticut | 52,114
New York | 47,831
California | 38,206
Texas | 29,477
Florida | 22,913
Pennsylvania | 18,640
Illinois | 16,502
New Jersey | 14,388
Ohio | 11,743
Massachusetts | 10,217
Remaining 19 states and the District of Columbia (combined) | 56,216
Total | 318,247

NOTICE OF DATA BREACH INVOLVING PROTECTED HEALTH INFORMATION

FOR IMMEDIATE RELEASE / DISTRIBUTION: AUGUST 15, 2023

Record

Parties

Dates

Amounts