1025-00006 · Graystone Forensics LLC · Regulatory Notifications

ny-ag-notification-filing.docx DOCUMENT Data Privacy

77 / 88 ← → ✕

REGULATORY DATA BREACH NOTIFICATION FILING

Submitted Pursuant to New York General Business Law § 899-aa

August 16, 2023

Filing Method: Electronic submission via the New York Attorney General's online breach notification portal, with concurrent email transmission to the Bureau of Internet and Technology

FROM:

Calderwood & Harkness LLP Outside Counsel to Quorum Insurance Holdings Corp. Kevin Ostrowski, Partner, Privacy & Data Security Practice Group 1700 K Street NW, Suite 900 Washington, D.C. 20006 Telephone: (202) 555-7400 Facsimile: (202) 555-7401

Email: kostrowski@calderwoodharkness.com

New York Office: 51 West 52nd Street, 34th Floor New York, NY 10019

Matter Number: 1025-00006

TO:

Office of the New York Attorney General Bureau of Internet and Technology

Attention: Assistant Attorney General Mark Petrosian

28 Liberty Street New York, NY 10005

Re: Notice of Data Security Incident Pursuant to N.Y. Gen. Bus. Law § 899-aa — Quorum Insurance Holdings Corp.

Right-click to update Table of Contents

I. INTRODUCTION AND PURPOSE OF FILING

Calderwood & Harkness LLP respectfully submits this notification on behalf of its client, Quorum Insurance Holdings Corp. ("Quorum" or "QIH"), a Delaware corporation publicly traded on the Nasdaq Stock Market (ticker symbol: QIHC), with its principal executive offices located at 400 Constitution Plaza, Suite 2200, Hartford, Connecticut 06103. This filing is made pursuant to New York General Business Law § 899-aa, which requires any person or business that owns or licenses computerized data that includes private information to provide notification to the New York Attorney General when a breach of the security of the system has resulted in the unauthorized acquisition of private information of New York residents.

Quorum is a top-25 United States insurance holding company operating in all fifty states, the District of Columbia, and select international markets. Through its operating subsidiaries, Quorum offers a comprehensive suite of insurance products, including personal lines property and casualty insurance, commercial lines insurance, specialty insurance products, life insurance, and annuity products. Quorum also operates a proprietary digital underwriting platform known as QuorumEdge, which utilizes advanced analytics and machine learning to support underwriting decisions across its personal and commercial lines divisions. The company's Employer Identification Number (EIN) is 06-4832197. For the fiscal year ended December 31, 2022, Quorum reported annual revenue of approximately $4.82 billion. Quorum employs approximately 11,400 individuals across its domestic and international operations.

The current officers of Quorum relevant to this filing are as follows: Margaret D. Calloway serves as Chief Executive Officer; Thomas R. Whitfield serves as Executive Vice President and General Counsel; David Naranjo serves as Senior Vice President and Chief Information Security Officer; and Jennifer Liang serves as Vice President and Chief Privacy Officer.

This filing reports a data security incident that originated not from Quorum's own information technology systems or network infrastructure, but from the systems of its third-party claims-processing vendor, Palomar Data Solutions, Inc. ("Palomar"), a Texas corporation headquartered at 7100 Greenville Avenue, Suite 450, Dallas, Texas 75231. As described in detail below, a threat actor exploited a known vulnerability in Palomar's managed file transfer system to gain unauthorized access to Palomar's network environment and exfiltrate structured data files containing personal information of Quorum policyholders and claimants. The forensic investigation into this incident has confirmed that personal information belonging to approximately 47,831 New York residents was compromised in connection with this incident.

Quorum takes the privacy and security of the personal information entrusted to it with the utmost seriousness. Upon learning of this incident, Quorum promptly engaged outside counsel and a leading digital forensics firm to investigate the scope and nature of the compromise, and has taken the remedial actions described in this filing to protect affected individuals and to prevent similar incidents from occurring in the future.

II. DESCRIPTION OF THE SECURITY INCIDENT

A. Nature of the Incident

On or about March 14, 2023, an unauthorized threat actor exploited CVE-2023-0669, a known remote code execution vulnerability in the GoAnywhere MFT (Managed File Transfer) appliance, to gain unauthorized access to the network environment maintained by Palomar Data Solutions, Inc. The GoAnywhere MFT appliance is a widely used enterprise software platform designed to facilitate secure file transfers between organizations and their business partners. CVE-2023-0669 is a pre-authentication command injection vulnerability that, when successfully exploited, allows an attacker to execute arbitrary code on the host system without valid credentials. This vulnerability was publicly disclosed in early February 2023, and a vendor-issued patch was made available by Severin Corporation (the developer of GoAnywhere MFT) on or about February 7, 2023. Palomar failed to timely apply the available patch to its GoAnywhere MFT appliance, leaving its file transfer infrastructure exposed to exploitation.

Palomar Data Solutions serves as Quorum's third-party claims data processing vendor for Quorum's personal lines division. The relationship between Quorum and Palomar is governed by a Master Services Agreement dated November 12, 2019, as subsequently amended by Amendment No. 1, effective April 1, 2021 (the "MSA"). Pursuant to the MSA, Palomar provides claims data processing, document management, and advanced analytics services on behalf of Quorum's personal lines operations. The annual contract value of the Palomar engagement is approximately $16.3 million, as adjusted by Amendment No. 1. In connection with the services provided under the MSA, Palomar receives and processes structured data files containing personal information of Quorum policyholders and claimants, including claims records, policyholder identifying information, and in certain cases, financial account information and protected health information associated with workers' compensation and health-related insurance claims.

Following the initial exploitation of the GoAnywhere MFT vulnerability on or about March 14, 2023, the threat actor conducted lateral movement within Palomar's network environment, progressing from the compromised file transfer appliance into Palomar's internal claims processing infrastructure. Over the course of the ensuing weeks, the threat actor identified and exfiltrated structured data files containing Quorum policyholder and claimant information. The data exfiltration was carried out through a series of outbound data transfers from Palomar's network to external infrastructure controlled by the threat actor.

The unauthorized access and data exfiltration window spanned approximately thirty-five (35) days, from on or about March 14, 2023, through on or about April 18, 2023. During this period, the threat actor maintained persistent access to Palomar's network environment and progressively identified and targeted files containing sensitive personal information. The forensic investigation has determined that the threat actor's activities were focused on data exfiltration rather than ransomware deployment, data destruction, or disruption of Palomar's operational systems.

B. Discovery and Notification Timeline

The following timeline details the key dates associated with the discovery of the security incident, the forensic investigation, and the notification process:

April 18, 2023: Palomar's Security Operations Center (SOC) detected anomalous outbound data transfers emanating from its network environment during routine monitoring activities. Upon detecting the anomalous transfers, Palomar's SOC initiated its internal incident response procedures and took steps to contain the intrusion, including isolating the compromised GoAnywhere MFT appliance and revoking the threat actor's access to the network. This date marks both the end of the exfiltration window and the date of Palomar's internal discovery of the security incident.

April 21, 2023: Palomar notified Quorum of the security incident. Notification was transmitted via email from Derek Copeland, Palomar's General Counsel, to Thomas R. Whitfield, Quorum's General Counsel, and David Naranjo, Quorum's Chief Information Security Officer. The notification stated that Palomar had experienced a security incident affecting its network environment and that data belonging to Quorum and its policyholders may have been compromised. This notification occurred approximately three (3) calendar days after Palomar's internal discovery of the incident.

May 4, 2023: Quorum engaged Calderwood & Harkness LLP, through its Privacy & Data Security practice group, to manage all aspects of the incident response, including coordination and oversight of the forensic investigation, assessment of regulatory notification obligations across all affected jurisdictions, preparation and issuance of consumer notification communications, and evaluation of vendor accountability and contractual remedies against Palomar.

May 5, 2023: Calderwood & Harkness, acting at the direction of Quorum and under the attorney-client privilege, retained Graystone Forensics LLC to conduct a comprehensive forensic investigation into the nature, scope, and impact of the security incident. Graystone Forensics LLC is headquartered at 1950 Old Gallows Road, Suite 600, Tysons Corner, Virginia 22182. The engagement was supervised by Dr. Nolan Briggs, Managing Director of Incident Response, and Kendra Faulkner, Senior Forensic Analyst, at Graystone Forensics. The engagement of Graystone was structured under the attorney-client privilege and work product doctrine umbrella, pursuant to the direction and control of Calderwood & Harkness as outside counsel to Quorum.

June 2, 2023: Graystone Forensics issued a preliminary forensic findings report to Calderwood & Harkness. The preliminary report confirmed that structured data files had been exfiltrated from Palomar's claims processing environment and identified the attack vector as CVE-2023-0669. The preliminary report also provided an initial estimate of the categories of data potentially affected, although the precise scope of compromised data and the identities of affected individuals had not yet been fully determined at that stage of the investigation.

July 14, 2023: Graystone Forensics issued its final forensic investigation report to Calderwood & Harkness. The final report confirmed the full scope of the data compromise, including a definitive identification of the affected data types, the volume of exfiltrated files, the timeline of the unauthorized access and exfiltration activities, and the universe of potentially affected individuals. The final report also confirmed the root cause of the incident and verified that Quorum's own network and information technology systems were not compromised.

August 4, 2023: The data mining and affected individual identification process was completed. This process involved the systematic review and analysis of the exfiltrated data files to identify each individual whose personal information was contained in the compromised files, to categorize the specific data elements compromised for each individual, and to determine the state of residence for each affected individual. The completion of this process confirmed the number and identities of affected individuals in each state, including the 47,831 affected New York residents who are the subject of this filing.

C. Root Cause

The root cause of the security incident was the exploitation of CVE-2023-0669, a known remote code execution vulnerability in the GoAnywhere MFT file transfer appliance used by Palomar Data Solutions, Inc. As noted above, a vendor-issued patch for this vulnerability was publicly available from Severin Corporation prior to the date of exploitation. The forensic investigation conducted by Graystone Forensics confirmed that Palomar failed to timely apply the available patch to its GoAnywhere MFT appliance, which constituted the critical security lapse that allowed the threat actor to gain initial access to Palomar's network environment.

The breach was vendor-originated in its entirety. The forensic investigation confirmed that Quorum's own information technology systems, network infrastructure, internal databases, and applications, including the QuorumEdge digital underwriting platform, were not compromised, accessed, or otherwise affected by the threat actor. The compromise was limited to Palomar's environment, and the personal information at issue was accessed and exfiltrated from systems and files maintained within Palomar's infrastructure.

III. INFORMATION ABOUT AFFECTED NEW YORK RESIDENTS

A. Number of Affected Individuals

The total number of New York residents whose private information was compromised in connection with this security incident is 47,831. This figure has been determined through the comprehensive data mining and affected individual identification process described in Section II.B above, which was completed on August 4, 2023.

The 47,831 affected New York residents represent the second-largest state-level population affected in the overall breach. Across all affected jurisdictions, the security incident impacted a total of approximately 318,247 individuals residing in twenty-nine (29) states and the District of Columbia. The five states with the largest affected populations are Connecticut (52,114 individuals), New York (47,831 individuals), California (38,206 individuals), New Jersey (approximately 24,800 individuals), and Massachusetts (10,217 individuals).

B. Types of Private Information Compromised

The forensic investigation conducted by Graystone Forensics, together with the subsequent data mining and affected individual identification process, confirmed that the following categories of "private information," as that term is defined under New York General Business Law § 899-aa, were compromised for New York residents as a result of this security incident:

Personal Identifiers: Full legal names and dates of birth of affected individuals were contained in the compromised data files. These personal identifiers were present for substantially all of the 47,831 affected New York residents, as names and dates of birth are standard data fields in Quorum's claims processing records.

Social Security Numbers: Social Security numbers were compromised for a significant portion of the affected New York resident population. Social Security numbers are collected and maintained in connection with various insurance claims, including personal lines property and casualty claims, workers' compensation claims, and certain other claims categories processed through Palomar's systems.

Driver's License Numbers: Driver's license numbers were compromised for a portion of the affected New York resident population. Driver's license numbers are collected in connection with certain categories of personal lines claims, including automobile insurance claims and certain property insurance claims where identity verification is required.

Financial Account Information (subset): For a subset of the 47,831 affected New York residents, financial account information was also compromised. The compromised financial account information includes bank account numbers and/or payment card numbers that were on file for claims payment processing purposes. The New York residents with compromised financial account information are part of the overall population of 84,619 individuals nationally whose financial account data was exposed in the breach.

Protected Health Information (subset): For a separate subset of the 47,831 affected New York residents, protected health information ("PHI") was also compromised. The compromised PHI includes health conditions, medical diagnosis codes (including ICD-10 codes), and treatment information derived from workers' compensation claims and other health-related insurance claims processed through Palomar's systems. The New York residents with compromised PHI are part of the overall population of 41,203 individuals nationally whose protected health information was exposed in the breach.

C. Data Elements Triggering Notification

Under New York General Business Law § 899-aa, "private information" is defined to include personal information consisting of any information concerning a natural person that, because of name, number, personal mark, or other identifier, can be used to identify such natural person, in combination with any one or more of the following data elements, when either the data element or the combination of personal information plus the data element is not encrypted or encrypted with an encryption key that has also been accessed or acquired: (i) Social Security number; (ii) driver's license number or non-driver identification card number; or (iii) account number, credit or debit card number, in combination with any required security code, access code, password, or other information that would permit access to an individual's financial account.

In this incident, each of the foregoing categories of data elements was compromised for one or more subsets of the affected New York resident population. Specifically, the exposure of Social Security numbers in combination with names independently triggers the notification obligation under Section 899-aa. Similarly, the exposure of driver's license numbers in combination with names independently triggers the notification obligation. Further, the exposure of financial account information, including bank account numbers and payment card numbers, in combination with names, independently triggers the notification obligation. The notification obligations under Section 899-aa have therefore been triggered by multiple independent data element combinations.

IV. REMEDIAL ACTIONS TAKEN

Quorum Insurance Holdings Corp. has taken and continues to take a comprehensive set of remedial actions in response to this security incident. These actions are designed to investigate the scope and impact of the breach, to notify affected individuals and applicable regulators, to protect affected individuals from potential harm, and to prevent the occurrence of similar incidents in the future. The remedial actions taken by Quorum are summarized below.

A. Forensic Investigation

Immediately upon learning of the security incident, Quorum took steps to retain qualified forensic experts to investigate the nature, scope, and impact of the compromise. Quorum, through its outside counsel Calderwood & Harkness LLP, retained Graystone Forensics LLC to conduct a comprehensive forensic investigation. Graystone Forensics is a nationally recognized digital forensics and incident response firm with extensive experience in investigating data security incidents affecting major financial services and insurance organizations. The Graystone engagement was led by Dr. Nolan Briggs, Managing Director of Incident Response, and Kendra Faulkner, Senior Forensic Analyst.

The forensic investigation confirmed the attack vector utilized by the threat actor (exploitation of CVE-2023-0669 in Palomar's GoAnywhere MFT appliance), the timeline of the unauthorized access and data exfiltration (March 14 through April 18, 2023), the scope of data exfiltration (structured data files from Palomar's claims processing environment containing Quorum policyholder and claimant information), and the specific data types compromised. Critically, the forensic investigation confirmed that Quorum's own network infrastructure, information technology systems, and internal databases were not breached, accessed, or otherwise compromised in connection with this incident. The compromise was limited entirely to Palomar's environment.

B. Consumer Notification

Quorum is providing written notification to all 47,831 affected New York residents by individual notification letters mailed via first-class United States mail. The consumer notification mailing process commenced on August 18, 2023, and is expected to be completed no later than September 15, 2023. The notification letters have been prepared in compliance with the content requirements of New York General Business Law § 899-aa and are designed to provide affected individuals with clear and comprehensive information about the incident, the types of personal information involved, the steps Quorum has taken in response, and the actions individuals can take to protect themselves.

Because the categories of personal information compromised vary among affected individuals, Quorum has developed three tailored versions of the consumer notification letter: (1) a general PII version for individuals whose compromised data includes names, dates of birth, Social Security numbers, and/or driver's license numbers; (2) an SSN and financial data version for individuals whose compromised data also includes bank account numbers and/or payment card numbers; and (3) a PHI version for individuals whose compromised data also includes health conditions, diagnosis codes, and/or treatment information from insurance claims. Each individual will receive the version of the notification letter that corresponds to the specific data elements compromised for that individual.

A sample copy of the consumer notification letter being sent to New York residents is enclosed with this filing as Attachment A.

C. Credit Monitoring and Identity Theft Protection

Quorum is offering all affected individuals, including all 47,831 affected New York residents, twenty-four (24) months of complimentary credit monitoring and identity theft protection services at no cost to the affected individual. These services are being administered by Clearfield Notification Services LLC, a nationally recognized provider of data breach notification, credit monitoring, and identity theft protection services. The Clearfield engagement is managed by Jerome Tillman, Account Manager, at Clearfield's principal offices located at 4500 Rockside Road, Suite 210, Independence, Ohio 44131.

The credit monitoring and identity theft protection services offered to affected individuals include, without limitation, daily credit monitoring of the individual's credit file at one or more of the three major national credit reporting agencies, alerts regarding potentially suspicious changes to the individual's credit file, identity theft insurance coverage, and identity restoration assistance in the event that an individual becomes a victim of identity theft. Enrollment information, instructions, and a unique activation code for each recipient are included in the consumer notification letters. Based on historical enrollment rates for similar data breach notification programs, Quorum estimates an overall take-rate of approximately 40%, which would result in approximately 127,299 enrollees nationally.

D. Call Center

Quorum has established a dedicated toll-free call center to respond to inquiries from affected individuals regarding the security incident and the notification and remediation services being offered. The call center is operated by Clearfield Notification Services LLC on behalf of Quorum and is staffed with trained call center agents who can address questions about the nature and scope of the incident, the types of personal information involved, the steps individuals can take to protect themselves, and the process for enrolling in the complimentary credit monitoring and identity theft protection services. The call center is staffed and operational for a twelve (12) week window beginning with the commencement of the consumer notification mailing cycle. Call center agents are trained using a comprehensive script and frequently asked questions document prepared by Calderwood & Harkness LLP in consultation with Quorum's incident response team.

E. Substitute Notice / Website Posting

In addition to the individual written notifications described above, Quorum has published a notice on its corporate website (www.quoruminsurance.com) describing the security incident, the types of personal information involved, the steps Quorum has taken in response to the incident, the actions individuals can take to protect themselves, and contact information for the Clearfield call center. The website notice is prominently displayed and accessible from Quorum's main webpage through a conspicuous link. This website posting supplements the individual written notifications and is intended to ensure broad awareness of the incident among potentially affected individuals.

F. Vendor Accountability

Quorum has pursued and continues to pursue contractual remedies against Palomar Data Solutions, Inc. in connection with this security incident. Quorum has identified two specific contractual breaches by Palomar under the Master Services Agreement:

First, Quorum has identified Palomar's failure to timely apply the vendor-issued patch for CVE-2023-0669 to its GoAnywhere MFT appliance as a breach of the Data Security Exhibit (Exhibit D) of the MSA. Exhibit D requires Palomar to maintain commercially reasonable security measures to protect the confidentiality, integrity, and availability of Quorum data processed by Palomar, and specifically requires Palomar to apply patches for critical and high-severity vulnerabilities within thirty (30) days of vendor patch release. The patch for CVE-2023-0669 was available from Severin Corporation on or about February 7, 2023. The exploitation of the vulnerability occurred on or about March 14, 2023, more than thirty days after the patch was available, indicating that Palomar had not applied the patch within the required timeframe.

Second, Quorum has identified Palomar's notification to Quorum on April 21, 2023, as an additional contractual breach. Section 9.4 of the MSA requires Palomar to notify Quorum of any security incident affecting Quorum data within forty-eight (48) hours of Palomar's discovery of such incident. Palomar's SOC discovered the incident on April 18, 2023, but Palomar did not notify Quorum until April 21, 2023—approximately twenty-four (24) hours past the contractual forty-eight-hour notification deadline.

Quorum is actively pursuing indemnification from Palomar under the indemnification provisions set forth in Section 12.2 of the MSA, which requires Palomar to indemnify and hold harmless Quorum from and against all losses, damages, liabilities, costs, and expenses arising from Palomar's breach of its obligations under the MSA, including its data security obligations. In addition, Quorum has demanded that Palomar implement enhanced security measures going forward, including improved patch management processes, deployment of advanced endpoint detection and response (EDR) capabilities, implementation of network segmentation to limit lateral movement within Palomar's environment, and enhanced monitoring and logging of file transfer activities.

G. Internal Remediation

In addition to pursuing vendor accountability, Quorum has taken a number of internal remedial actions to strengthen its own security posture and vendor risk management practices in light of this incident.

Quorum has enhanced its vendor risk management program, which is overseen by Priya Deshmukh, Vice President of Vendor Risk Management. The enhancements include more rigorous security due diligence requirements for new and existing third-party vendors, increased frequency of vendor security assessments and audits, and strengthened contractual security requirements in vendor agreements. Quorum is also implementing additional ongoing monitoring capabilities to provide greater visibility into the security practices and posture of its critical third-party vendors.

Upon learning of the security incident, Quorum activated its incident response plan in accordance with its established procedures. As part of the incident response process, Quorum issued a legal hold notice preserving all documents, communications, and electronically stored information related to the security incident, the Palomar vendor relationship, and the incident response and remediation activities. The legal hold was implemented under the direction of Thomas R. Whitfield, General Counsel, and remains in effect.

Quorum is conducting a comprehensive review of its third-party vendor security due diligence and ongoing monitoring requirements, with the goal of identifying and implementing additional safeguards to reduce the risk of vendor-originated security incidents in the future.

V. INSURANCE AND CRISIS COMMUNICATIONS

Quorum Insurance Holdings Corp. maintains cyber-liability insurance coverage to defray costs associated with data security incidents of this nature. Quorum's primary cyber-liability insurance policy is issued by Atlas Mutual Insurance Company (Policy No. CYB-2023-041587), which provides a per-occurrence limit of $15,000,000 subject to a $2,500,000 self-insured retention. In addition, Quorum maintains excess cyber-liability coverage through a policy issued by Pinnacle Surplus Lines Insurance Corp. (Policy No. XS-CYB-2023-7812), which provides a $25,000,000 excess layer above the primary policy limits.

A claim was filed under the primary cyber-liability policy on May 8, 2023 (Claim No. CYB-CLM-2023-05892). Atlas Mutual Insurance Company has acknowledged receipt of the claim and is currently reviewing coverage. The costs associated with the forensic investigation, consumer notification, credit monitoring and identity theft protection services, call center operations, regulatory compliance, and legal fees in connection with this incident are expected to be covered under the primary policy, subject to the self-insured retention and the terms, conditions, and exclusions of the policy.

In addition to its insurance coverage, Quorum retained BrightPath Consulting Group Inc. to assist with external and internal communications strategy management in connection with the security incident. The BrightPath engagement is led by Meredith Ashford, Managing Director, and encompasses the development and execution of media relations strategy, internal employee communications, investor relations communications, and policyholder and agent communications related to the incident. BrightPath has assisted Quorum in preparing clear, accurate, and timely public disclosures regarding the incident, including the required Form 8-K filing with the U.S. Securities and Exchange Commission.

VI. OTHER REGULATORY NOTIFICATIONS

In addition to this filing with the Office of the New York Attorney General, Quorum is filing data breach notifications with regulators in all other affected jurisdictions as required by applicable law. The following is a summary of the other regulatory notifications being filed or already filed in connection with this security incident:

• Connecticut Attorney General: Filed August 14, 2023, pursuant to Connecticut General Statutes § 36a-701b. The Connecticut notification covers 52,114 affected Connecticut residents, the largest state-level affected population. Because Quorum is headquartered in Hartford, Connecticut, the Connecticut notification was prioritized and filed first.

• Connecticut Insurance Department: Filed August 14, 2023, pursuant to Connecticut General Statutes § 38a-999b, which imposes separate notification requirements on insurance licensees and registrants.

• U.S. Department of Health and Human Services, Office for Civil Rights: Filed August 15, 2023, pursuant to 45 C.F.R. § 164.408 (the HIPAA Breach Notification Rule). This notification covers the 41,203 individuals nationally whose protected health information was compromised in the incident. Because the breach affected more than 500 individuals, Quorum is required to provide notification to HHS OCR without unreasonable delay and in no case later than sixty (60) days following the discovery of the breach.

• California Attorney General: Filed August 16, 2023 (concurrently with this New York filing), pursuant to California Civil Code § 1798.82. The California notification covers 38,206 affected California residents.

• Massachusetts Attorney General and Office of Consumer Affairs and Business Regulation: Filing scheduled for August 17, 2023, pursuant to Massachusetts General Laws ch. 93H, § 3. The Massachusetts notification covers 10,217 affected Massachusetts residents.

• Attorneys General and/or Regulators in Remaining Affected States: Notifications are scheduled to be filed between August 17, 2023, and August 25, 2023, in the remaining twenty-four (24) affected states, including but not limited to New Jersey, Pennsylvania, Florida, Texas, Illinois, Ohio, Georgia, Virginia, Maryland, North Carolina, and the District of Columbia. Each notification will be filed in compliance with the applicable statutory requirements and deadlines of the respective jurisdiction.

In total, the security incident affected individuals residing in twenty-nine (29) states and the District of Columbia. All regulatory notifications are being prepared and filed in compliance with the applicable statutory deadlines and content requirements. Quorum is committed to full and timely compliance with all applicable breach notification laws across all affected jurisdictions.

VII. CONTACT INFORMATION

Questions, correspondence, or requests for additional information regarding this notification filing, the underlying security incident, or Quorum's remediation efforts should be directed to the following contacts:

Kevin Ostrowski Partner, Privacy & Data Security Practice Group Calderwood & Harkness LLP 1700 K Street NW, Suite 900 Washington, D.C. 20006 Telephone: (202) 555-7400

Email: kostrowski@calderwoodharkness.com

(Counsel to Quorum Insurance Holdings Corp.)

Thomas R. Whitfield Executive Vice President and General Counsel Quorum Insurance Holdings Corp. 400 Constitution Plaza, Suite 2200 Hartford, CT 06103 Telephone: (860) 555-3100

Email: twhitfield@quoruminsurance.com

Quorum Insurance Holdings Corp. is committed to full cooperation with the Office of the New York Attorney General in connection with this matter and will promptly respond to any follow-up inquiries, requests for additional documentation, or other communications from the Bureau of Internet and Technology or other divisions of the Office of the Attorney General.

VIII. SIGNATURE BLOCK

Respectfully submitted,

CALDERWOOD & HARKNESS LLP

By: ________

Kevin Ostrowski Partner, Privacy & Data Security Practice Group Calderwood & Harkness LLP 1700 K Street NW, Suite 900 Washington, D.C. 20006

On behalf of Quorum Insurance Holdings Corp.

Date: August 16, 2023

Enclosure: Attachment A — Sample Consumer Notification Letter (New York Residents)

ATTACHMENT A

SAMPLE CONSUMER NOTIFICATION LETTER (New York Residents)

August 18, 2023

Quorum Insurance Holdings Corp. 400 Constitution Plaza, Suite 2200 Hartford, CT 06103

[Name of Affected Individual] [Street Address] [City, State ZIP Code]

Re: Notice of Data Security Incident

Dear [Name of Affected Individual]:

We are writing to inform you about a data security incident that may have affected your personal information. Quorum Insurance Holdings Corp. ("Quorum") takes the privacy and security of the personal information entrusted to us very seriously, and we deeply regret that this incident occurred. We are providing this notice to explain what happened, what information was involved, what we are doing in response, and the steps you can take to protect yourself.

What Happened

Quorum utilizes Palomar Data Solutions, Inc. ("Palomar") as a third-party vendor for claims data processing services. On or about March 14, 2023, a threat actor gained unauthorized access to Palomar's network by exploiting a vulnerability in Palomar's file transfer system. The unauthorized access continued through approximately April 18, 2023, when Palomar's security team discovered the intrusion and took steps to contain it. Palomar notified Quorum of the incident on April 21, 2023.

Upon learning of the incident, Quorum immediately engaged outside counsel, Calderwood & Harkness LLP, and a leading forensic investigation firm, Graystone Forensics LLC, to investigate the scope and impact of the incident. The forensic investigation determined that certain files containing personal information of Quorum policyholders and claimants were accessed and exfiltrated from Palomar's systems during the period of unauthorized access. Importantly, the investigation confirmed that Quorum's own internal systems and networks were not compromised in this incident.

What Information Was Involved

Based on the results of the forensic investigation and subsequent data review, we have determined that the following categories of your personal information were involved in this incident:

• Your name, date of birth, Social Security number, and/or driver's license number

• [If applicable:] Your bank account number and/or payment card number

• [If applicable, for individuals with PHI exposure:] Health-related information, including health conditions, medical diagnosis codes, and/or treatment information related to insurance claims

Not all of the above data elements were necessarily compromised for every affected individual. We have tailored this notice to reflect the specific types of information that were involved for you.

What We Are Doing

Quorum has taken the following steps to address this incident and to protect affected individuals:

• Forensic Investigation. We engaged Graystone Forensics LLC, a nationally recognized digital forensics firm, to conduct a thorough and comprehensive forensic investigation of the incident. The investigation has been completed and has informed the remediation steps described in this letter.

• Regulatory Notification. We are notifying all applicable state and federal regulators of this incident, as required by law, including the New York Attorney General, the U.S. Department of Health and Human Services, and regulators in all other affected jurisdictions.

• Vendor Accountability. We are pursuing contractual remedies against Palomar, including demanding that Palomar implement enhanced security measures to prevent similar incidents in the future. These measures include improved patch management processes and advanced endpoint detection and response capabilities.

• Credit Monitoring and Identity Theft Protection. We are offering you complimentary credit monitoring and identity theft protection services for twenty-four (24) months at no cost to you. Please see the enrollment details below.

• Dedicated Call Center. We have established a dedicated toll-free call center to answer your questions and assist you with enrolling in the complimentary credit monitoring and identity theft protection services.

What You Can Do

While we have no evidence at this time that your personal information has been misused as a result of this incident, we encourage you to take the following steps to help protect yourself:

Enroll in Complimentary Credit Monitoring. We strongly encourage you to take advantage of the complimentary 24-month credit monitoring and identity theft protection services we are offering. Please see the enrollment details provided below.

Review Your Account Statements and Credit Reports. We recommend that you regularly review your account statements, explanation of benefits forms, and free credit reports for any unauthorized activity. Under federal law, you are entitled to one free credit report annually from each of the three major national credit reporting agencies. To request your free credit report, visit www.annualcreditreport.com or call 1-877-322-8228.

Consider Placing a Fraud Alert or Security Freeze. You may wish to consider placing an initial fraud alert on your credit file, which requires creditors to take additional steps to verify your identity before extending credit in your name. An initial fraud alert lasts for one year and can be renewed. You may also consider placing a security freeze on your credit file, which restricts access to your credit report and may prevent new accounts from being opened in your name without your consent. To place a fraud alert or security freeze, contact the three major national credit reporting agencies at the following:

Harborview Enterprises: P.O. Box 105788, Atlanta, GA 30348; 1-800-525-6285; www.Harborview Enterprises.com

Penrose Group: P.O. Box 9554, Allen, TX 75013; 1-888-397-3742; www.Penrose Group.com

Penmark Enterprises: P.O. Box 2000, Chester, PA 19016; 1-800-680-7289; www.Penmark Enterprises.com

Remain Vigilant for Phishing and Social Engineering. Be cautious of unsolicited emails, telephone calls, text messages, or other communications that request personal information or direct you to click on links or open attachments. Quorum will never ask you to provide your Social Security number, financial account credentials, or other sensitive personal information via email or unsolicited telephone call.

Monitor Financial Accounts. [If applicable, for individuals with financial data exposure:] We recommend that you monitor your financial accounts closely and promptly contact your financial institution if you notice any unauthorized transactions or suspicious activity on your accounts.

Report Identity Theft. If you believe you are or may become a victim of identity theft, you may file a report with your local law enforcement agency. You may also file an identity theft complaint with the Federal Trade Commission (FTC) online at www.identitytheft.gov, by telephone at 1-877-ID-THEFT (1-877-438-4338), or by mail at Federal Trade Commission, 600 Pennsylvania Avenue, NW, Washington, D.C. 20580. The FTC's website provides comprehensive resources and a step-by-step guide for individuals who believe they have been victims of identity theft.

New York Residents — Additional Rights. Under New York law, you have the right to obtain a copy of the police report filed in connection with any identity theft claim. You also have the right to request a security freeze on your credit report at no charge by contacting the credit reporting agencies listed above. Information about identity theft prevention is available from the New York Attorney General's office at (800) 771-7755 or www.ag.ny.gov.

Credit Monitoring Enrollment Details

We have arranged for you to enroll in complimentary credit monitoring and identity theft protection services provided by Clearfield Notification Services LLC. The services include daily credit monitoring, identity theft protection, identity theft insurance, and identity restoration assistance. The services are available to you at no cost for a period of twenty-four (24) months from the date of your enrollment.

To enroll, please use one of the following methods:

Online: Visit [Enrollment Website URL] and enter your unique activation code provided below.

By Telephone: Call [Toll-Free Enrollment Number] and provide your unique activation code to the enrollment specialist.

Your Unique Activation Code: [Individualized Activation Code]

Enrollment Deadline: You must enroll by November 18, 2023, to take advantage of this complimentary offering.

Contact Information

If you have any questions about this incident or the services we are offering, please do not hesitate to contact our dedicated call center:

Toll-Free Call Center Number: [Toll-Free Number] Call Center Hours: Monday through Friday, 9:00 a.m. to 9:00 p.m. Eastern Time

Written Inquiries: Quorum Insurance Holdings Corp.

Attention: Data Incident Response Team

400 Constitution Plaza, Suite 2200 Hartford, CT 06103

Closing

Quorum sincerely regrets this incident and any concern or inconvenience it may cause you. We are committed to safeguarding the personal information entrusted to us and have taken significant steps to address the circumstances that led to this incident and to prevent similar incidents from occurring in the future. We will continue to work diligently to protect the information of our policyholders and claimants, and we appreciate your patience and understanding as we work through this matter.

Sincerely,

Thomas R. Whitfield Executive Vice President and General Counsel Quorum Insurance Holdings Corp.

This notice is being provided to you pursuant to New York General Business Law § 899-aa. This notice has not been delayed by law enforcement. If you have questions, please contact us using the information provided above.

REGULATORY DATA BREACH NOTIFICATION FILING
Submitted Pursuant to New York General Business Law § 899-aa
August 16, 2023
Filing Method: Electronic submission via the New York Attorney General's online breach notification portal, with concurrent email transmission to the Bureau of Internet and Technology
FROM:
Calderwood & Harkness LLP Outside Counsel to Quorum Insurance Holdings Corp. Kevin Ostrowski, Partner, Privacy & Data Security Practice Group 1700 K Street NW, Suite 900 Washington, D.C. 20006 Telephone: (202) 555-7400 Facsimile: (202) 555-7401
Email: kostrowski@calderwoodharkness.com
New York Office: 51 West 52nd Street, 34th Floor New York, NY 10019
Matter Number: 1025-00006
TO:
Office of the New York Attorney General Bureau of Internet and Technology
Attention: Assistant Attorney General Mark Petrosian
28 Liberty Street New York, NY 10005
Re: Notice of Data Security Incident Pursuant to N.Y. Gen. Bus. Law § 899-aa — Quorum Insurance Holdings Corp.
Right-click to update Table of Contents
I. INTRODUCTION AND PURPOSE OF FILING
Calderwood & Harkness LLP respectfully submits this notification on behalf of its client, Quorum Insurance Holdings Corp. ("Quorum" or "QIH"), a Delaware corporation publicly traded on the Nasdaq Stock Market (ticker symbol: QIHC), with its principal executive offices located at 400 Constitution Plaza, Suite 2200, Hartford, Connecticut 06103. This filing is made pursuant to New York General Business Law § 899-aa, which requires any person or business that owns or licenses computerized data that includes private information to provide notification to the New York Attorney General when a breach of the security of the system has resulted in the unauthorized acquisition of private information of New York residents.
Quorum is a top-25 United States insurance holding company operating in all fifty states, the District of Columbia, and select international markets. Through its operating subsidiaries, Quorum offers a comprehensive suite of insurance products, including personal lines property and casualty insurance, commercial lines insurance, specialty insurance products, life insurance, and annuity products. Quorum also operates a proprietary digital underwriting platform known as QuorumEdge, which utilizes advanced analytics and machine learning to support underwriting decisions across its personal and commercial lines divisions. The company's Employer Identification Number (EIN) is 06-4832197. For the fiscal year ended December 31, 2022, Quorum reported annual revenue of approximately $4.82 billion. Quorum employs approximately 11,400 individuals across its domestic and international operations.
The current officers of Quorum relevant to this filing are as follows: Margaret D. Calloway serves as Chief Executive Officer; Thomas R. Whitfield serves as Executive Vice President and General Counsel; David Naranjo serves as Senior Vice President and Chief Information Security Officer; and Jennifer Liang serves as Vice President and Chief Privacy Officer.
This filing reports a data security incident that originated not from Quorum's own information technology systems or network infrastructure, but from the systems of its third-party claims-processing vendor, Palomar Data Solutions, Inc. ("Palomar"), a Texas corporation headquartered at 7100 Greenville Avenue, Suite 450, Dallas, Texas 75231. As described in detail below, a threat actor exploited a known vulnerability in Palomar's managed file transfer system to gain unauthorized access to Palomar's network environment and exfiltrate structured data files containing personal information of Quorum policyholders and claimants. The forensic investigation into this incident has confirmed that personal information belonging to approximately 47,831 New York residents was compromised in connection with this incident.
Quorum takes the privacy and security of the personal information entrusted to it with the utmost seriousness. Upon learning of this incident, Quorum promptly engaged outside counsel and a leading digital forensics firm to investigate the scope and nature of the compromise, and has taken the remedial actions described in this filing to protect affected individuals and to prevent similar incidents from occurring in the future.
II. DESCRIPTION OF THE SECURITY INCIDENT
A. Nature of the Incident
On or about March 14, 2023, an unauthorized threat actor exploited CVE-2023-0669, a known remote code execution vulnerability in the GoAnywhere MFT (Managed File Transfer) appliance, to gain unauthorized access to the network environment maintained by Palomar Data Solutions, Inc. The GoAnywhere MFT appliance is a widely used enterprise software platform designed to facilitate secure file transfers between organizations and their business partners. CVE-2023-0669 is a pre-authentication command injection vulnerability that, when successfully exploited, allows an attacker to execute arbitrary code on the host system without valid credentials. This vulnerability was publicly disclosed in early February 2023, and a vendor-issued patch was made available by Severin Corporation (the developer of GoAnywhere MFT) on or about February 7, 2023. Palomar failed to timely apply the available patch to its GoAnywhere MFT appliance, leaving its file transfer infrastructure exposed to exploitation.
Palomar Data Solutions serves as Quorum's third-party claims data processing vendor for Quorum's personal lines division. The relationship between Quorum and Palomar is governed by a Master Services Agreement dated November 12, 2019, as subsequently amended by Amendment No. 1, effective April 1, 2021 (the "MSA"). Pursuant to the MSA, Palomar provides claims data processing, document management, and advanced analytics services on behalf of Quorum's personal lines operations. The annual contract value of the Palomar engagement is approximately $16.3 million, as adjusted by Amendment No. 1. In connection with the services provided under the MSA, Palomar receives and processes structured data files containing personal information of Quorum policyholders and claimants, including claims records, policyholder identifying information, and in certain cases, financial account information and protected health information associated with workers' compensation and health-related insurance claims.
Following the initial exploitation of the GoAnywhere MFT vulnerability on or about March 14, 2023, the threat actor conducted lateral movement within Palomar's network environment, progressing from the compromised file transfer appliance into Palomar's internal claims processing infrastructure. Over the course of the ensuing weeks, the threat actor identified and exfiltrated structured data files containing Quorum policyholder and claimant information. The data exfiltration was carried out through a series of outbound data transfers from Palomar's network to external infrastructure controlled by the threat actor.
The unauthorized access and data exfiltration window spanned approximately thirty-five (35) days, from on or about March 14, 2023, through on or about April 18, 2023. During this period, the threat actor maintained persistent access to Palomar's network environment and progressively identified and targeted files containing sensitive personal information. The forensic investigation has determined that the threat actor's activities were focused on data exfiltration rather than ransomware deployment, data destruction, or disruption of Palomar's operational systems.
B. Discovery and Notification Timeline
The following timeline details the key dates associated with the discovery of the security incident, the forensic investigation, and the notification process:
April 18, 2023: Palomar's Security Operations Center (SOC) detected anomalous outbound data transfers emanating from its network environment during routine monitoring activities. Upon detecting the anomalous transfers, Palomar's SOC initiated its internal incident response procedures and took steps to contain the intrusion, including isolating the compromised GoAnywhere MFT appliance and revoking the threat actor's access to the network. This date marks both the end of the exfiltration window and the date of Palomar's internal discovery of the security incident.
April 21, 2023: Palomar notified Quorum of the security incident. Notification was transmitted via email from Derek Copeland, Palomar's General Counsel, to Thomas R. Whitfield, Quorum's General Counsel, and David Naranjo, Quorum's Chief Information Security Officer. The notification stated that Palomar had experienced a security incident affecting its network environment and that data belonging to Quorum and its policyholders may have been compromised. This notification occurred approximately three (3) calendar days after Palomar's internal discovery of the incident.
May 4, 2023: Quorum engaged Calderwood & Harkness LLP, through its Privacy & Data Security practice group, to manage all aspects of the incident response, including coordination and oversight of the forensic investigation, assessment of regulatory notification obligations across all affected jurisdictions, preparation and issuance of consumer notification communications, and evaluation of vendor accountability and contractual remedies against Palomar.
May 5, 2023: Calderwood & Harkness, acting at the direction of Quorum and under the attorney-client privilege, retained Graystone Forensics LLC to conduct a comprehensive forensic investigation into the nature, scope, and impact of the security incident. Graystone Forensics LLC is headquartered at 1950 Old Gallows Road, Suite 600, Tysons Corner, Virginia 22182. The engagement was supervised by Dr. Nolan Briggs, Managing Director of Incident Response, and Kendra Faulkner, Senior Forensic Analyst, at Graystone Forensics. The engagement of Graystone was structured under the attorney-client privilege and work product doctrine umbrella, pursuant to the direction and control of Calderwood & Harkness as outside counsel to Quorum.
June 2, 2023: Graystone Forensics issued a preliminary forensic findings report to Calderwood & Harkness. The preliminary report confirmed that structured data files had been exfiltrated from Palomar's claims processing environment and identified the attack vector as CVE-2023-0669. The preliminary report also provided an initial estimate of the categories of data potentially affected, although the precise scope of compromised data and the identities of affected individuals had not yet been fully determined at that stage of the investigation.
July 14, 2023: Graystone Forensics issued its final forensic investigation report to Calderwood & Harkness. The final report confirmed the full scope of the data compromise, including a definitive identification of the affected data types, the volume of exfiltrated files, the timeline of the unauthorized access and exfiltration activities, and the universe of potentially affected individuals. The final report also confirmed the root cause of the incident and verified that Quorum's own network and information technology systems were not compromised.
August 4, 2023: The data mining and affected individual identification process was completed. This process involved the systematic review and analysis of the exfiltrated data files to identify each individual whose personal information was contained in the compromised files, to categorize the specific data elements compromised for each individual, and to determine the state of residence for each affected individual. The completion of this process confirmed the number and identities of affected individuals in each state, including the 47,831 affected New York residents who are the subject of this filing.
C. Root Cause
The root cause of the security incident was the exploitation of CVE-2023-0669, a known remote code execution vulnerability in the GoAnywhere MFT file transfer appliance used by Palomar Data Solutions, Inc. As noted above, a vendor-issued patch for this vulnerability was publicly available from Severin Corporation prior to the date of exploitation. The forensic investigation conducted by Graystone Forensics confirmed that Palomar failed to timely apply the available patch to its GoAnywhere MFT appliance, which constituted the critical security lapse that allowed the threat actor to gain initial access to Palomar's network environment.
The breach was vendor-originated in its entirety. The forensic investigation confirmed that Quorum's own information technology systems, network infrastructure, internal databases, and applications, including the QuorumEdge digital underwriting platform, were not compromised, accessed, or otherwise affected by the threat actor. The compromise was limited to Palomar's environment, and the personal information at issue was accessed and exfiltrated from systems and files maintained within Palomar's infrastructure.
III. INFORMATION ABOUT AFFECTED NEW YORK RESIDENTS
A. Number of Affected Individuals
The total number of New York residents whose private information was compromised in connection with this security incident is 47,831. This figure has been determined through the comprehensive data mining and affected individual identification process described in Section II.B above, which was completed on August 4, 2023.
The 47,831 affected New York residents represent the second-largest state-level population affected in the overall breach. Across all affected jurisdictions, the security incident impacted a total of approximately 318,247 individuals residing in twenty-nine (29) states and the District of Columbia. The five states with the largest affected populations are Connecticut (52,114 individuals), New York (47,831 individuals), California (38,206 individuals), New Jersey (approximately 24,800 individuals), and Massachusetts (10,217 individuals).
B. Types of Private Information Compromised
The forensic investigation conducted by Graystone Forensics, together with the subsequent data mining and affected individual identification process, confirmed that the following categories of "private information," as that term is defined under New York General Business Law § 899-aa, were compromised for New York residents as a result of this security incident:
Personal Identifiers: Full legal names and dates of birth of affected individuals were contained in the compromised data files. These personal identifiers were present for substantially all of the 47,831 affected New York residents, as names and dates of birth are standard data fields in Quorum's claims processing records.
Social Security Numbers: Social Security numbers were compromised for a significant portion of the affected New York resident population. Social Security numbers are collected and maintained in connection with various insurance claims, including personal lines property and casualty claims, workers' compensation claims, and certain other claims categories processed through Palomar's systems.
Driver's License Numbers: Driver's license numbers were compromised for a portion of the affected New York resident population. Driver's license numbers are collected in connection with certain categories of personal lines claims, including automobile insurance claims and certain property insurance claims where identity verification is required.
Financial Account Information (subset): For a subset of the 47,831 affected New York residents, financial account information was also compromised. The compromised financial account information includes bank account numbers and/or payment card numbers that were on file for claims payment processing purposes. The New York residents with compromised financial account information are part of the overall population of 84,619 individuals nationally whose financial account data was exposed in the breach.
Protected Health Information (subset): For a separate subset of the 47,831 affected New York residents, protected health information ("PHI") was also compromised. The compromised PHI includes health conditions, medical diagnosis codes (including ICD-10 codes), and treatment information derived from workers' compensation claims and other health-related insurance claims processed through Palomar's systems. The New York residents with compromised PHI are part of the overall population of 41,203 individuals nationally whose protected health information was exposed in the breach.
C. Data Elements Triggering Notification
Under New York General Business Law § 899-aa, "private information" is defined to include personal information consisting of any information concerning a natural person that, because of name, number, personal mark, or other identifier, can be used to identify such natural person, in combination with any one or more of the following data elements, when either the data element or the combination of personal information plus the data element is not encrypted or encrypted with an encryption key that has also been accessed or acquired: (i) Social Security number; (ii) driver's license number or non-driver identification card number; or (iii) account number, credit or debit card number, in combination with any required security code, access code, password, or other information that would permit access to an individual's financial account.
In this incident, each of the foregoing categories of data elements was compromised for one or more subsets of the affected New York resident population. Specifically, the exposure of Social Security numbers in combination with names independently triggers the notification obligation under Section 899-aa. Similarly, the exposure of driver's license numbers in combination with names independently triggers the notification obligation. Further, the exposure of financial account information, including bank account numbers and payment card numbers, in combination with names, independently triggers the notification obligation. The notification obligations under Section 899-aa have therefore been triggered by multiple independent data element combinations.
IV. REMEDIAL ACTIONS TAKEN
Quorum Insurance Holdings Corp. has taken and continues to take a comprehensive set of remedial actions in response to this security incident. These actions are designed to investigate the scope and impact of the breach, to notify affected individuals and applicable regulators, to protect affected individuals from potential harm, and to prevent the occurrence of similar incidents in the future. The remedial actions taken by Quorum are summarized below.
A. Forensic Investigation
Immediately upon learning of the security incident, Quorum took steps to retain qualified forensic experts to investigate the nature, scope, and impact of the compromise. Quorum, through its outside counsel Calderwood & Harkness LLP, retained Graystone Forensics LLC to conduct a comprehensive forensic investigation. Graystone Forensics is a nationally recognized digital forensics and incident response firm with extensive experience in investigating data security incidents affecting major financial services and insurance organizations. The Graystone engagement was led by Dr. Nolan Briggs, Managing Director of Incident Response, and Kendra Faulkner, Senior Forensic Analyst.
The forensic investigation confirmed the attack vector utilized by the threat actor (exploitation of CVE-2023-0669 in Palomar's GoAnywhere MFT appliance), the timeline of the unauthorized access and data exfiltration (March 14 through April 18, 2023), the scope of data exfiltration (structured data files from Palomar's claims processing environment containing Quorum policyholder and claimant information), and the specific data types compromised. Critically, the forensic investigation confirmed that Quorum's own network infrastructure, information technology systems, and internal databases were not breached, accessed, or otherwise compromised in connection with this incident. The compromise was limited entirely to Palomar's environment.
B. Consumer Notification
Quorum is providing written notification to all 47,831 affected New York residents by individual notification letters mailed via first-class United States mail. The consumer notification mailing process commenced on August 18, 2023, and is expected to be completed no later than September 15, 2023. The notification letters have been prepared in compliance with the content requirements of New York General Business Law § 899-aa and are designed to provide affected individuals with clear and comprehensive information about the incident, the types of personal information involved, the steps Quorum has taken in response, and the actions individuals can take to protect themselves.
Because the categories of personal information compromised vary among affected individuals, Quorum has developed three tailored versions of the consumer notification letter: (1) a general PII version for individuals whose compromised data includes names, dates of birth, Social Security numbers, and/or driver's license numbers; (2) an SSN and financial data version for individuals whose compromised data also includes bank account numbers and/or payment card numbers; and (3) a PHI version for individuals whose compromised data also includes health conditions, diagnosis codes, and/or treatment information from insurance claims. Each individual will receive the version of the notification letter that corresponds to the specific data elements compromised for that individual.
A sample copy of the consumer notification letter being sent to New York residents is enclosed with this filing as Attachment A.
C. Credit Monitoring and Identity Theft Protection
Quorum is offering all affected individuals, including all 47,831 affected New York residents, twenty-four (24) months of complimentary credit monitoring and identity theft protection services at no cost to the affected individual. These services are being administered by Clearfield Notification Services LLC, a nationally recognized provider of data breach notification, credit monitoring, and identity theft protection services. The Clearfield engagement is managed by Jerome Tillman, Account Manager, at Clearfield's principal offices located at 4500 Rockside Road, Suite 210, Independence, Ohio 44131.
The credit monitoring and identity theft protection services offered to affected individuals include, without limitation, daily credit monitoring of the individual's credit file at one or more of the three major national credit reporting agencies, alerts regarding potentially suspicious changes to the individual's credit file, identity theft insurance coverage, and identity restoration assistance in the event that an individual becomes a victim of identity theft. Enrollment information, instructions, and a unique activation code for each recipient are included in the consumer notification letters. Based on historical enrollment rates for similar data breach notification programs, Quorum estimates an overall take-rate of approximately 40%, which would result in approximately 127,299 enrollees nationally.
D. Call Center
Quorum has established a dedicated toll-free call center to respond to inquiries from affected individuals regarding the security incident and the notification and remediation services being offered. The call center is operated by Clearfield Notification Services LLC on behalf of Quorum and is staffed with trained call center agents who can address questions about the nature and scope of the incident, the types of personal information involved, the steps individuals can take to protect themselves, and the process for enrolling in the complimentary credit monitoring and identity theft protection services. The call center is staffed and operational for a twelve (12) week window beginning with the commencement of the consumer notification mailing cycle. Call center agents are trained using a comprehensive script and frequently asked questions document prepared by Calderwood & Harkness LLP in consultation with Quorum's incident response team.
E. Substitute Notice / Website Posting
In addition to the individual written notifications described above, Quorum has published a notice on its corporate website (www.quoruminsurance.com) describing the security incident, the types of personal information involved, the steps Quorum has taken in response to the incident, the actions individuals can take to protect themselves, and contact information for the Clearfield call center. The website notice is prominently displayed and accessible from Quorum's main webpage through a conspicuous link. This website posting supplements the individual written notifications and is intended to ensure broad awareness of the incident among potentially affected individuals.
F. Vendor Accountability
Quorum has pursued and continues to pursue contractual remedies against Palomar Data Solutions, Inc. in connection with this security incident. Quorum has identified two specific contractual breaches by Palomar under the Master Services Agreement:
First, Quorum has identified Palomar's failure to timely apply the vendor-issued patch for CVE-2023-0669 to its GoAnywhere MFT appliance as a breach of the Data Security Exhibit (Exhibit D) of the MSA. Exhibit D requires Palomar to maintain commercially reasonable security measures to protect the confidentiality, integrity, and availability of Quorum data processed by Palomar, and specifically requires Palomar to apply patches for critical and high-severity vulnerabilities within thirty (30) days of vendor patch release. The patch for CVE-2023-0669 was available from Severin Corporation on or about February 7, 2023. The exploitation of the vulnerability occurred on or about March 14, 2023, more than thirty days after the patch was available, indicating that Palomar had not applied the patch within the required timeframe.
Second, Quorum has identified Palomar's notification to Quorum on April 21, 2023, as an additional contractual breach. Section 9.4 of the MSA requires Palomar to notify Quorum of any security incident affecting Quorum data within forty-eight (48) hours of Palomar's discovery of such incident. Palomar's SOC discovered the incident on April 18, 2023, but Palomar did not notify Quorum until April 21, 2023—approximately twenty-four (24) hours past the contractual forty-eight-hour notification deadline.
Quorum is actively pursuing indemnification from Palomar under the indemnification provisions set forth in Section 12.2 of the MSA, which requires Palomar to indemnify and hold harmless Quorum from and against all losses, damages, liabilities, costs, and expenses arising from Palomar's breach of its obligations under the MSA, including its data security obligations. In addition, Quorum has demanded that Palomar implement enhanced security measures going forward, including improved patch management processes, deployment of advanced endpoint detection and response (EDR) capabilities, implementation of network segmentation to limit lateral movement within Palomar's environment, and enhanced monitoring and logging of file transfer activities.
G. Internal Remediation
In addition to pursuing vendor accountability, Quorum has taken a number of internal remedial actions to strengthen its own security posture and vendor risk management practices in light of this incident.
Quorum has enhanced its vendor risk management program, which is overseen by Priya Deshmukh, Vice President of Vendor Risk Management. The enhancements include more rigorous security due diligence requirements for new and existing third-party vendors, increased frequency of vendor security assessments and audits, and strengthened contractual security requirements in vendor agreements. Quorum is also implementing additional ongoing monitoring capabilities to provide greater visibility into the security practices and posture of its critical third-party vendors.
Upon learning of the security incident, Quorum activated its incident response plan in accordance with its established procedures. As part of the incident response process, Quorum issued a legal hold notice preserving all documents, communications, and electronically stored information related to the security incident, the Palomar vendor relationship, and the incident response and remediation activities. The legal hold was implemented under the direction of Thomas R. Whitfield, General Counsel, and remains in effect.
Quorum is conducting a comprehensive review of its third-party vendor security due diligence and ongoing monitoring requirements, with the goal of identifying and implementing additional safeguards to reduce the risk of vendor-originated security incidents in the future.
V. INSURANCE AND CRISIS COMMUNICATIONS
Quorum Insurance Holdings Corp. maintains cyber-liability insurance coverage to defray costs associated with data security incidents of this nature. Quorum's primary cyber-liability insurance policy is issued by Atlas Mutual Insurance Company (Policy No. CYB-2023-041587), which provides a per-occurrence limit of $15,000,000 subject to a $2,500,000 self-insured retention. In addition, Quorum maintains excess cyber-liability coverage through a policy issued by Pinnacle Surplus Lines Insurance Corp. (Policy No. XS-CYB-2023-7812), which provides a $25,000,000 excess layer above the primary policy limits.
A claim was filed under the primary cyber-liability policy on May 8, 2023 (Claim No. CYB-CLM-2023-05892). Atlas Mutual Insurance Company has acknowledged receipt of the claim and is currently reviewing coverage. The costs associated with the forensic investigation, consumer notification, credit monitoring and identity theft protection services, call center operations, regulatory compliance, and legal fees in connection with this incident are expected to be covered under the primary policy, subject to the self-insured retention and the terms, conditions, and exclusions of the policy.
In addition to its insurance coverage, Quorum retained BrightPath Consulting Group Inc. to assist with external and internal communications strategy management in connection with the security incident. The BrightPath engagement is led by Meredith Ashford, Managing Director, and encompasses the development and execution of media relations strategy, internal employee communications, investor relations communications, and policyholder and agent communications related to the incident. BrightPath has assisted Quorum in preparing clear, accurate, and timely public disclosures regarding the incident, including the required Form 8-K filing with the U.S. Securities and Exchange Commission.
VI. OTHER REGULATORY NOTIFICATIONS
In addition to this filing with the Office of the New York Attorney General, Quorum is filing data breach notifications with regulators in all other affected jurisdictions as required by applicable law. The following is a summary of the other regulatory notifications being filed or already filed in connection with this security incident:
•  Connecticut Attorney General: Filed August 14, 2023, pursuant to Connecticut General Statutes § 36a-701b. The Connecticut notification covers 52,114 affected Connecticut residents, the largest state-level affected population. Because Quorum is headquartered in Hartford, Connecticut, the Connecticut notification was prioritized and filed first.
•  Connecticut Insurance Department: Filed August 14, 2023, pursuant to Connecticut General Statutes § 38a-999b, which imposes separate notification requirements on insurance licensees and registrants.
•  U.S. Department of Health and Human Services, Office for Civil Rights: Filed August 15, 2023, pursuant to 45 C.F.R. § 164.408 (the HIPAA Breach Notification Rule). This notification covers the 41,203 individuals nationally whose protected health information was compromised in the incident. Because the breach affected more than 500 individuals, Quorum is required to provide notification to HHS OCR without unreasonable delay and in no case later than sixty (60) days following the discovery of the breach.
•  California Attorney General: Filed August 16, 2023 (concurrently with this New York filing), pursuant to California Civil Code § 1798.82. The California notification covers 38,206 affected California residents.
•  Massachusetts Attorney General and Office of Consumer Affairs and Business Regulation: Filing scheduled for August 17, 2023, pursuant to Massachusetts General Laws ch. 93H, § 3. The Massachusetts notification covers 10,217 affected Massachusetts residents.
•  Attorneys General and/or Regulators in Remaining Affected States: Notifications are scheduled to be filed between August 17, 2023, and August 25, 2023, in the remaining twenty-four (24) affected states, including but not limited to New Jersey, Pennsylvania, Florida, Texas, Illinois, Ohio, Georgia, Virginia, Maryland, North Carolina, and the District of Columbia. Each notification will be filed in compliance with the applicable statutory requirements and deadlines of the respective jurisdiction.
In total, the security incident affected individuals residing in twenty-nine (29) states and the District of Columbia. All regulatory notifications are being prepared and filed in compliance with the applicable statutory deadlines and content requirements. Quorum is committed to full and timely compliance with all applicable breach notification laws across all affected jurisdictions.
VII. CONTACT INFORMATION
Questions, correspondence, or requests for additional information regarding this notification filing, the underlying security incident, or Quorum's remediation efforts should be directed to the following contacts:
Kevin Ostrowski Partner, Privacy & Data Security Practice Group Calderwood & Harkness LLP 1700 K Street NW, Suite 900 Washington, D.C. 20006 Telephone: (202) 555-7400
Email: kostrowski@calderwoodharkness.com
(Counsel to Quorum Insurance Holdings Corp.)
Thomas R. Whitfield Executive Vice President and General Counsel Quorum Insurance Holdings Corp. 400 Constitution Plaza, Suite 2200 Hartford, CT 06103 Telephone: (860) 555-3100
Email: twhitfield@quoruminsurance.com
Quorum Insurance Holdings Corp. is committed to full cooperation with the Office of the New York Attorney General in connection with this matter and will promptly respond to any follow-up inquiries, requests for additional documentation, or other communications from the Bureau of Internet and Technology or other divisions of the Office of the Attorney General.
VIII. SIGNATURE BLOCK
Respectfully submitted,
CALDERWOOD & HARKNESS LLP
By: ________
Kevin Ostrowski Partner, Privacy & Data Security Practice Group Calderwood & Harkness LLP 1700 K Street NW, Suite 900 Washington, D.C. 20006
On behalf of Quorum Insurance Holdings Corp.
Date: August 16, 2023
Enclosure: Attachment A — Sample Consumer Notification Letter (New York Residents)
ATTACHMENT A
SAMPLE CONSUMER NOTIFICATION LETTER (New York Residents)
August 18, 2023
Quorum Insurance Holdings Corp. 400 Constitution Plaza, Suite 2200 Hartford, CT 06103
[Name of Affected Individual] [Street Address] [City, State ZIP Code]
Re: Notice of Data Security Incident
Dear [Name of Affected Individual]:
We are writing to inform you about a data security incident that may have affected your personal information. Quorum Insurance Holdings Corp. ("Quorum") takes the privacy and security of the personal information entrusted to us very seriously, and we deeply regret that this incident occurred. We are providing this notice to explain what happened, what information was involved, what we are doing in response, and the steps you can take to protect yourself.
What Happened
Quorum utilizes Palomar Data Solutions, Inc. ("Palomar") as a third-party vendor for claims data processing services. On or about March 14, 2023, a threat actor gained unauthorized access to Palomar's network by exploiting a vulnerability in Palomar's file transfer system. The unauthorized access continued through approximately April 18, 2023, when Palomar's security team discovered the intrusion and took steps to contain it. Palomar notified Quorum of the incident on April 21, 2023.
Upon learning of the incident, Quorum immediately engaged outside counsel, Calderwood & Harkness LLP, and a leading forensic investigation firm, Graystone Forensics LLC, to investigate the scope and impact of the incident. The forensic investigation determined that certain files containing personal information of Quorum policyholders and claimants were accessed and exfiltrated from Palomar's systems during the period of unauthorized access. Importantly, the investigation confirmed that Quorum's own internal systems and networks were not compromised in this incident.
What Information Was Involved
Based on the results of the forensic investigation and subsequent data review, we have determined that the following categories of your personal information were involved in this incident:
•  Your name, date of birth, Social Security number, and/or driver's license number
•  [If applicable:] Your bank account number and/or payment card number
•  [If applicable, for individuals with PHI exposure:] Health-related information, including health conditions, medical diagnosis codes, and/or treatment information related to insurance claims
Not all of the above data elements were necessarily compromised for every affected individual. We have tailored this notice to reflect the specific types of information that were involved for you.
What We Are Doing
Quorum has taken the following steps to address this incident and to protect affected individuals:
•  Forensic Investigation. We engaged Graystone Forensics LLC, a nationally recognized digital forensics firm, to conduct a thorough and comprehensive forensic investigation of the incident. The investigation has been completed and has informed the remediation steps described in this letter.
•  Regulatory Notification. We are notifying all applicable state and federal regulators of this incident, as required by law, including the New York Attorney General, the U.S. Department of Health and Human Services, and regulators in all other affected jurisdictions.
•  Vendor Accountability. We are pursuing contractual remedies against Palomar, including demanding that Palomar implement enhanced security measures to prevent similar incidents in the future. These measures include improved patch management processes and advanced endpoint detection and response capabilities.
•  Credit Monitoring and Identity Theft Protection. We are offering you complimentary credit monitoring and identity theft protection services for twenty-four (24) months at no cost to you. Please see the enrollment details below.
•  Dedicated Call Center. We have established a dedicated toll-free call center to answer your questions and assist you with enrolling in the complimentary credit monitoring and identity theft protection services.
What You Can Do
While we have no evidence at this time that your personal information has been misused as a result of this incident, we encourage you to take the following steps to help protect yourself:
Enroll in Complimentary Credit Monitoring. We strongly encourage you to take advantage of the complimentary 24-month credit monitoring and identity theft protection services we are offering. Please see the enrollment details provided below.
Review Your Account Statements and Credit Reports. We recommend that you regularly review your account statements, explanation of benefits forms, and free credit reports for any unauthorized activity. Under federal law, you are entitled to one free credit report annually from each of the three major national credit reporting agencies. To request your free credit report, visit www.annualcreditreport.com or call 1-877-322-8228.
Consider Placing a Fraud Alert or Security Freeze. You may wish to consider placing an initial fraud alert on your credit file, which requires creditors to take additional steps to verify your identity before extending credit in your name. An initial fraud alert lasts for one year and can be renewed. You may also consider placing a security freeze on your credit file, which restricts access to your credit report and may prevent new accounts from being opened in your name without your consent. To place a fraud alert or security freeze, contact the three major national credit reporting agencies at the following:
Harborview Enterprises: P.O. Box 105788, Atlanta, GA 30348; 1-800-525-6285; www.Harborview Enterprises.com
Penrose Group: P.O. Box 9554, Allen, TX 75013; 1-888-397-3742; www.Penrose Group.com
Penmark Enterprises: P.O. Box 2000, Chester, PA 19016; 1-800-680-7289; www.Penmark Enterprises.com
Remain Vigilant for Phishing and Social Engineering. Be cautious of unsolicited emails, telephone calls, text messages, or other communications that request personal information or direct you to click on links or open attachments. Quorum will never ask you to provide your Social Security number, financial account credentials, or other sensitive personal information via email or unsolicited telephone call.
Monitor Financial Accounts. [If applicable, for individuals with financial data exposure:] We recommend that you monitor your financial accounts closely and promptly contact your financial institution if you notice any unauthorized transactions or suspicious activity on your accounts.
Report Identity Theft. If you believe you are or may become a victim of identity theft, you may file a report with your local law enforcement agency. You may also file an identity theft complaint with the Federal Trade Commission (FTC) online at www.identitytheft.gov, by telephone at 1-877-ID-THEFT (1-877-438-4338), or by mail at Federal Trade Commission, 600 Pennsylvania Avenue, NW, Washington, D.C. 20580. The FTC's website provides comprehensive resources and a step-by-step guide for individuals who believe they have been victims of identity theft.
New York Residents — Additional Rights. Under New York law, you have the right to obtain a copy of the police report filed in connection with any identity theft claim. You also have the right to request a security freeze on your credit report at no charge by contacting the credit reporting agencies listed above. Information about identity theft prevention is available from the New York Attorney General's office at (800) 771-7755 or www.ag.ny.gov.
Credit Monitoring Enrollment Details
We have arranged for you to enroll in complimentary credit monitoring and identity theft protection services provided by Clearfield Notification Services LLC. The services include daily credit monitoring, identity theft protection, identity theft insurance, and identity restoration assistance. The services are available to you at no cost for a period of twenty-four (24) months from the date of your enrollment.
To enroll, please use one of the following methods:
Online: Visit [Enrollment Website URL] and enter your unique activation code provided below.
By Telephone: Call [Toll-Free Enrollment Number] and provide your unique activation code to the enrollment specialist.
Your Unique Activation Code: [Individualized Activation Code]
Enrollment Deadline: You must enroll by November 18, 2023, to take advantage of this complimentary offering.
Contact Information
If you have any questions about this incident or the services we are offering, please do not hesitate to contact our dedicated call center:
Toll-Free Call Center Number: [Toll-Free Number] Call Center Hours: Monday through Friday, 9:00 a.m. to 9:00 p.m. Eastern Time
Written Inquiries: Quorum Insurance Holdings Corp.
Attention: Data Incident Response Team
400 Constitution Plaza, Suite 2200 Hartford, CT 06103
Closing
Quorum sincerely regrets this incident and any concern or inconvenience it may cause you. We are committed to safeguarding the personal information entrusted to us and have taken significant steps to address the circumstances that led to this incident and to prevent similar incidents from occurring in the future. We will continue to work diligently to protect the information of our policyholders and claimants, and we appreciate your patience and understanding as we work through this matter.
Sincerely,
Thomas R. Whitfield Executive Vice President and General Counsel Quorum Insurance Holdings Corp.
This notice is being provided to you pursuant to New York General Business Law § 899-aa. This notice has not been delayed by law enforcement. If you have questions, please contact us using the information provided above.