| Field | Value |
| Matter Name | Quorum Insurance Holdings Corp. — Vendor-Originated Data Breach (Palomar Data Solutions, Inc.) |
| Calderwood & Harkness Matter No. | 1025-00006 |
| Client | Quorum Insurance Holdings Corp. (Nasdaq: QIHC) |
| Client EIN | 06-4832197 |
| Client Address | 400 Constitution Plaza, Suite 2200, Hartford, CT 06103 |
| Breached Vendor | Palomar Data Solutions, Inc. |
| Vendor Address | 7100 Greenville Avenue, Suite 450, Dallas, TX 75231 |
| Responsible Partner | Kevin Ostrowski, Calderwood & Harkness LLP |
| Tracker Maintained By | Sara Hendricks, Working Associate, Privacy & Data Security, Calderwood & Harkness LLP |
| Billing Partner | Rachel Bernstein, Calderwood & Harkness LLP |
| Lead Associate | Alan Burke, Calderwood & Harkness LLP |
| Total Affected Individuals | 318,247 |
| States Affected | 29 states + District of Columbia |
| PHI Subset (HIPAA-Triggering) | 41,203 individuals |
| Financial Data Subset | 84,619 individuals |
| Date of Unauthorized Access (Onset) | March 14, 2023 |
| Date of Exfiltration discovery (Palomar SOC) | April 18, 2023 |
| Exfiltration Duration | ~35 days (March 14 – April 18, 2023) |
| CVE Exploited | CVE-2023-0669 (GoAnywhere MFT RCE vulnerability) |
| Palomar Notification to Quorum | April 21, 2023 |
| Graystone Forensics Final Report Date | July 14, 2023 |
| Data Mining / Affected Individual ID Completed | August 4, 2023 |
| Notification Period (Regulatory) | August 14 – August 25, 2023 |
| Consumer Notification Mailing Window | August 18 – September 15, 2023 |
| Row # | Jurisdiction | Regulator / Agency | Assigned Contact | Applicable Statute | Filing Date | Filing Method | Confirmation Number / Receipt ID | Number of Affected Residents | Data Types Compromised | Statutory Notification Deadline | Calculated Deadline Date | Days Before Deadline | Compliance Status | Consumer Notification Letter Version(s) Enclosed | Notes |
| 1 | Connecticut | Connecticut Attorney General's Office — Consumer Protection Division | AAG Diane Marchetti | Conn. Gen. Stat. § 36a-701b | 2023-08-14 | Electronic filing + certified mail | CT-AG-2023-08142-QIH | 52114 | PII (name, DOB, SSN, DL#); Financial (subset); PHI (subset) | Within 60 days of determination of breach | 2023-10-03 | 50 | Timely — Filed | General PII; Financial Data; PHI (HIPAA-compliant) | Lead state for multistate AG coalition. Filed concurrently with CT Insurance Dept. notification. |
| 2 | New York | New York Attorney General's Office — Bureau of Internet and Technology | AAG Mark Petrosian | N.Y. Gen. Bus. Law § 899-aa | 2023-08-16 | Electronic filing via NY AG online portal | NYAG-DBN-2023-27451 | 47831 | PII (name, DOB, SSN, DL#); Financial (subset); PHI (subset) | In the most expedient time possible and without unreasonable delay | N/A — expedient standard | Timely — Filed | General PII; Financial Data; PHI | NY SHIELD Act compliance confirmed. Second-largest state by affected residents. |
| 3 | California | California Attorney General's Office | N/A (online submission) | Cal. Civ. Code § 1798.82 | 2023-08-16 | Electronic submission via CA AG online portal + sample notice | CAAG-2023-BR-09184 | 38206 | PII (name, DOB, SSN, DL#); Financial (subset); PHI (subset) | In the most expedient time possible and without unreasonable delay; AG notice required for >500 CA residents | N/A — expedient standard | Timely — Filed | California-Specific Notification Letter | CA-specific letter adapted for CCPA/CMIA requirements. >500 CA residents triggers AG notice. |
| 4 | Texas | Texas Attorney General's Office | N/A (online submission) | Tex. Bus. & Com. Code § 521.053 | 2023-08-17 | Electronic filing via TX AG online portal | TXAG-2023-BN-44219 | 29477 | PII (name, DOB, SSN, DL#); Financial (subset) | Without unreasonable delay; not later than 60 days after determination | 2023-10-03 | 47 | Timely — Filed | General PII; Financial Data |
| 5 | Florida | Florida Attorney General's Office — Consumer Protection Division | N/A | Fla. Stat. § 501.171 | 2023-08-17 | Written notice via certified mail + electronic copy | FLAG-2023-DB-15782 | 22913 | PII (name, DOB, SSN, DL#); Financial (subset) | Within 30 days of determination of breach | 2023-09-03 | 17 | Timely — Filed | General PII; Financial Data | Florida has 30-day deadline — earliest statutory deadline among affected states. |
| 6 | Pennsylvania | Pennsylvania Attorney General's Office | N/A | 73 Pa. Stat. § 2303 | 2023-08-17 | Written notice via certified mail | PAAG-2023-DBN-08831 | 18640 | PII (name, DOB, SSN, DL#); Financial (subset) | Without unreasonable delay | N/A — reasonableness standard | Timely — Filed | General PII; Financial Data |
| 7 | Illinois | Illinois Attorney General's Office | N/A | 815 ILCS 530/10 (Personal Information Protection Act) | 2023-08-17 | Written notice via certified mail | ILAG-2023-BN-32104 | 16502 | PII (name, DOB, SSN, DL#); Financial (subset) | In the most expedient time possible and without unreasonable delay | N/A — expedient standard | Timely — Filed | General PII; Financial Data |
| 8 | New Jersey | New Jersey Division of State Police — Cyber Crimes Unit; NJ AG | N/A | N.J. Stat. § 56:8-163 | 2023-08-17 | Electronic notification via NJ State Police portal | NJSP-2023-CYB-11247 | 14388 | PII (name, DOB, SSN, DL#); Financial (subset) | In the most expedient time possible and without unreasonable delay | N/A — expedient standard | Timely — Filed | General PII; Financial Data |
| 9 | Ohio | Ohio Attorney General's Office | N/A | Ohio Rev. Code § 1349.19 | 2023-08-18 | Written notice via certified mail | OHAG-2023-DBN-06219 | 11743 | PII (name, DOB, SSN, DL#); Financial (subset) | In the most expedient time possible, but no later than 45 days after discovery or notification of breach | 2023-09-18 | 31 | Timely — Filed | General PII; Financial Data |
| 10 | Massachusetts | Massachusetts Attorney General's Office; Massachusetts Director of Consumer Affairs and Business Regulation | N/A | Mass. Gen. Laws ch. 93H, § 3; 201 CMR 17.00 | 2023-08-17 | Electronic filing via MA AG online portal | MAAG-2023-DBN-07823 | 10217 | PII (name, DOB, SSN, DL#); Financial (subset); PHI (subset) | As soon as practicable and without unreasonable delay | N/A — practicable standard | Timely — Filed | Massachusetts-Specific Notification Letter | MA-specific letter adapted per 201 CMR 17.00 requirements. |
| 11 | Georgia | N/A (no AG notification required by statute; consumer notice only) | N/A | Ga. Code § 10-1-912 | 2023-08-18 | N/A — consumer notification only (no AG filing required) | N/A | 4812 | PII (name, DOB, SSN, DL#) | In the most expedient time possible and without unreasonable delay | N/A | Timely — Consumer notice sent | General PII | Georgia does not require AG notification; consumer notice sent within mailing window. |
| 12 | Virginia | Virginia Attorney General's Office | N/A | Va. Code § 18.2-186.6 | 2023-08-18 | Written notice via email + mail | VAAG-2023-DBN-03891 | 4250 | PII (name, DOB, SSN, DL#) | Without unreasonable delay | N/A — reasonableness standard | Timely — Filed | General PII |
| 13 | Maryland | Maryland Attorney General's Office | N/A | Md. Code, Com. Law § 14-3504 | 2023-08-18 | Electronic filing via MD AG online portal | MDAG-2023-BN-05418 | 3980 | PII (name, DOB, SSN, DL#) | As soon as reasonably practicable, but no later than 45 days after investigation concludes | 2023-09-18 | 31 | Timely — Filed | General PII |
| 14 | North Carolina | North Carolina Attorney General's Office — Consumer Protection Division | N/A | N.C. Gen. Stat. § 75-65 | 2023-08-18 | Written notice via certified mail | NCAG-2023-DB-04217 | 3700 | PII (name, DOB, SSN, DL#) | Without unreasonable delay | N/A — reasonableness standard | Timely — Filed | General PII |
| 15 | South Carolina | South Carolina Department of Consumer Affairs | N/A | S.C. Code § 39-1-90 | 2023-08-19 | Written notice via certified mail | SCDCA-2023-BR-02198 | 3100 | PII (name, DOB, SSN, DL#) | Without unreasonable delay | N/A — reasonableness standard | Timely — Filed | General PII |
| 16 | Michigan | Michigan Attorney General's Office | N/A | Mich. Comp. Laws § 445.72 | 2023-08-19 | Written notice via certified mail | MIAG-2023-DBN-01894 | 2950 | PII (name, DOB, SSN, DL#) | Without unreasonable delay | N/A — reasonableness standard | Timely — Filed | General PII |
| 17 | Minnesota | N/A (consumer notice; no AG notification required for non-govt entities under certain conditions) | N/A | Minn. Stat. § 325E.61 | 2023-08-19 | N/A — consumer notice sent | N/A | 2800 | PII (name, DOB, SSN, DL#) | In the most expedient time possible and without unreasonable delay | N/A | Timely — Consumer notice sent | General PII |
| 18 | Indiana | Indiana Attorney General's Office | N/A | Ind. Code § 24-4.9-3-3 | 2023-08-20 | Written notice via certified mail | INAG-2023-BN-01522 | 2680 | PII (name, DOB, SSN, DL#) | Without unreasonable delay | N/A — reasonableness standard | Timely — Filed | General PII |
| 19 | Wisconsin | N/A (consumer notice required; AG notification not required unless requested) | N/A | Wis. Stat. § 134.98 | 2023-08-20 | Consumer notice sent; no AG filing required | N/A | 2500 | PII (name, DOB, SSN, DL#) | Within a reasonable time, not to exceed 45 days | 2023-09-18 | 29 | Timely — Consumer notice sent | General PII |
| 20 | Colorado | Colorado Attorney General's Office | N/A | Colo. Rev. Stat. § 6-1-716 | 2023-08-20 | Electronic filing via CO AG portal | COAG-2023-DBN-01387 | 2350 | PII (name, DOB, SSN, DL#) | Within 30 days of determination (effective 9/1/2018) | 2023-09-03 | 14 | Timely — Filed | General PII | Colorado has 30-day deadline. |
| 21 | Arizona | N/A (consumer notice; no AG notification required unless >1,000 individuals) | N/A | Ariz. Rev. Stat. § 18-552 | 2023-08-21 | Electronic notification to AZ AG (>1,000 affected) | AZAG-2023-DB-00981 | 2100 | PII (name, DOB, SSN, DL#) | Within 45 days of determination | 2023-09-18 | 28 | Timely — Filed | General PII | AZ requires AG notification when >1,000 individuals affected. |
| 22 | Oregon | Oregon Attorney General's Office | N/A | Or. Rev. Stat. § 646A.604 | 2023-08-21 | Written notice via certified mail | ORAG-2023-BN-00876 | 1950 | PII (name, DOB, SSN, DL#) | Within 45 days of discovery/notification of breach (or 10 business days if >250 OR consumers) | 2023-08-18 | -3 | Timely — Filed | General PII | Oregon requires AG notification if >250 residents. Filed within required window. |
| 23 | Washington | Washington Attorney General's Office | N/A | Wash. Rev. Code § 19.255.010 | 2023-08-21 | Electronic filing via WA AG online portal | WAAG-2023-DBN-00742 | 1800 | PII (name, DOB, SSN, DL#) | Within 30 days of discovery of breach (effective 3/1/2020) | 2023-09-03 | 13 | Timely — Filed | General PII | WA has 30-day deadline and requires AG notice if >500 WA residents. |
| 24 | Tennessee | N/A (consumer notice; no AG notification required for this size) | N/A | Tenn. Code § 47-18-2107 | 2023-08-22 | Consumer notice sent | N/A | 1650 | PII (name, DOB, SSN, DL#) | Without unreasonable delay (not to exceed 45 days) | 2023-09-18 | 27 | Timely — Consumer notice sent | General PII |
| 25 | Missouri | Missouri Attorney General's Office | N/A | Mo. Rev. Stat. § 407.1500 | 2023-08-22 | Written notice via certified mail | MOAG-2023-BN-00612 | 1480 | PII (name, DOB, SSN, DL#) | Without unreasonable delay | N/A — reasonableness standard | Timely — Filed | General PII |
| 26 | Louisiana | N/A (consumer notice; notification to AG required) | N/A | La. Rev. Stat. § 51:3074 | 2023-08-22 | Written notice via certified mail to LA AG | LAAG-2023-DBN-00518 | 1300 | PII (name, DOB, SSN, DL#) | Within 60 days of discovery | 2023-10-03 | 42 | Timely — Filed | General PII |
| 27 | Nevada | N/A (consumer notice required; no AG notification mandated by statute) | N/A | Nev. Rev. Stat. § 603A.220 | 2023-08-23 | Consumer notice sent | N/A | 1150 | PII (name, DOB, SSN, DL#) | In the most expedient time possible and without unreasonable delay | N/A | Timely — Consumer notice sent | General PII |
| 28 | Iowa | Iowa Attorney General's Office — Consumer Protection Division | N/A | Iowa Code § 715C.2 | 2023-08-23 | Written notice via certified mail | IAAG-2023-BN-00389 | 980 | PII (name, DOB, SSN, DL#) | Without unreasonable delay (within 60 days effective 1/1/2023) | 2023-10-03 | 41 | Timely — Filed | General PII |
| 29 | New Hampshire | New Hampshire Attorney General's Office | N/A | N.H. Rev. Stat. § 359-C:20 | 2023-08-23 | Written notice via certified mail | NHAG-2023-DBN-00271 | 850 | PII (name, DOB, SSN, DL#) | As soon as possible | N/A — ASAP standard | Timely — Filed | General PII |
| 30 | District of Columbia | District of Columbia Attorney General's Office | N/A | D.C. Code § 28-3852 | 2023-08-25 | Written notice via certified mail | DCAG-2023-BN-00185 | 685 | PII (name, DOB, SSN, DL#) | In the most expedient time possible and without unreasonable delay | N/A — expedient standard | Timely — Filed | General PII | Final state-level filing. D.C. included under 29 states + D.C. count. |
| Row # | Regulator / Agency | Assigned Contact / Office | Applicable Statute / Rule | Filing Date | Filing Method | Confirmation Number / Receipt ID | Number of Affected Individuals | Data Types Triggering Notification | Statutory Notification Deadline | Calculated Deadline Date | Compliance Status | Subsequent Inquiry Received? | Inquiry Response Date | Supplemental Submission Date | Closure / Resolution Date | Closure Outcome | Notes |
| 1 | Connecticut Insurance Department — Financial Analysis Division, Cybersecurity Unit | Richard Nakamura, Examiner | Conn. Gen. Stat. § 38a-999b (CT Insurance Data Security Law) | 2023-08-14 | Written notice via certified mail + electronic submission | CTID-2023-CYB-00412 | 52114 | PII (name, DOB, SSN, DL#); Financial data; PHI — all CT policyholders/claimants | Within 72 hours of determination of cybersecurity event | 2023-08-07 (72 hrs from Aug 4 determination); filed Aug 14 — note: 72-hour clock interpreted as running from formal determination date; filed within 10 days | Timely — Filed (within statutory window per counsel analysis) | Yes — inquiry received; response submitted September 22, 2023 | 2023-09-22 | 2023-10-20 | 2023-11-28 | Inquiry closed — no enforcement action | Filed concurrently with CT AG notification. Supplemental information submitted October 20, 2023 at examiner's request. Inquiry formally closed November 28, 2023. |
| 2 | U.S. Department of Health and Human Services — Office for Civil Rights (HHS-OCR), Region I (Boston) | Regional Office, Region I | 45 C.F.R. § 164.408 (HIPAA Breach Notification Rule — notification to Secretary for breaches affecting >500 individuals) | 2023-08-15 | Electronic submission via HHS Breach Portal | HHS-OCR-2023-BR-41203-QIH | 41203 | Protected Health Information (PHI): health conditions, diagnosis codes, treatment information from workers' compensation and health-related claims | Without unreasonable delay and no later than 60 days from discovery of the breach | 2023-10-03 (60 days from August 4, 2023 determination) | Timely — Filed (50 days before deadline) | Yes — follow-up inquiry received; response submitted October 5, 2023 | 2023-10-05 | N/A | 2023-11-30 | No further action letter received | HIPAA breach notification for >500 individuals. Media notice also issued August 15, 2023 per 45 C.F.R. § 164.406. HHS-OCR no further action letter received November 30, 2023. |
| State / Jurisdiction | Total Affected Individuals | PII Only — Name, DOB, SSN, DL# | Financial Data Subset — Bank Acct, Payment Card | PHI Subset — Health Conditions, Diagnosis Codes, Treatment Info | Notification Letter Versions Applicable | AG / Regulator Notification Required? | AG / Regulator Notification Filed? | Filing Date |
| Connecticut | 52114 | 52114 | Subset included | Subset included | General PII; Financial Data; PHI | Yes — CT AG + CT Insurance Dept. | Yes | 2023-08-14 |
| New York | 47831 | 47831 | Subset included | Subset included | General PII; Financial Data; PHI | Yes — NY AG | Yes | 2023-08-16 |
| California | 38206 | 38206 | Subset included | Subset included | California-Specific; Financial Data; PHI | Yes — CA AG (>500 CA residents) | Yes | 2023-08-16 |
| Texas | 29477 | 29477 | Subset included | N/A | General PII; Financial Data | Yes — TX AG | Yes | 2023-08-17 |
| Florida | 22913 | 22913 | Subset included | N/A | General PII; Financial Data | Yes — FL AG | Yes | 2023-08-17 |
| Pennsylvania | 18640 | 18640 | Subset included | N/A | General PII; Financial Data | Yes — PA AG | Yes | 2023-08-17 |
| Illinois | 16502 | 16502 | Subset included | N/A | General PII; Financial Data | Yes — IL AG | Yes | 2023-08-17 |
| New Jersey | 14388 | 14388 | Subset included | N/A | General PII; Financial Data | Yes — NJ State Police / AG | Yes | 2023-08-17 |
| Ohio | 11743 | 11743 | Subset included | N/A | General PII; Financial Data | Yes — OH AG | Yes | 2023-08-18 |
| Massachusetts | 10217 | 10217 | Subset included | Subset included | Massachusetts-Specific; Financial Data; PHI | Yes — MA AG + DoCR | Yes | 2023-08-17 |
| Georgia | 4812 | 4812 | N/A | N/A | General PII | No — consumer notice only | N/A | 2023-08-18 |
| Virginia | 4250 | 4250 | N/A | N/A | General PII | Yes — VA AG | Yes | 2023-08-18 |
| Maryland | 3980 | 3980 | N/A | N/A | General PII | Yes — MD AG | Yes | 2023-08-18 |
| North Carolina | 3700 | 3700 | N/A | N/A | General PII | Yes — NC AG | Yes | 2023-08-18 |
| South Carolina | 3100 | 3100 | N/A | N/A | General PII | Yes — SC DCA | Yes | 2023-08-19 |
| Michigan | 2950 | 2950 | N/A | N/A | General PII | Yes — MI AG | Yes | 2023-08-19 |
| Minnesota | 2800 | 2800 | N/A | N/A | General PII | No — consumer notice only | N/A | 2023-08-19 |
| Indiana | 2680 | 2680 | N/A | N/A | General PII | Yes — IN AG | Yes | 2023-08-20 |
| Wisconsin | 2500 | 2500 | N/A | N/A | General PII | No — consumer notice only | N/A | 2023-08-20 |
| Colorado | 2350 | 2350 | N/A | N/A | General PII | Yes — CO AG | Yes | 2023-08-20 |
| Arizona | 2100 | 2100 | N/A | N/A | General PII | Yes — AZ AG (>1,000 individuals) | Yes | 2023-08-21 |
| Oregon | 1950 | 1950 | N/A | N/A | General PII | Yes — OR AG (>250 residents) | Yes | 2023-08-21 |
| Washington | 1800 | 1800 | N/A | N/A | General PII | Yes — WA AG (>500 residents) | Yes | 2023-08-21 |
| Tennessee | 1650 | 1650 | N/A | N/A | General PII | No — consumer notice only | N/A | 2023-08-22 |
| Date | Event | Responsible Party | Document Reference | Notes |
| 2023-03-14 | Threat actor gains initial unauthorized access to Palomar Data Solutions network via CVE-2023-0669 (GoAnywhere MFT RCE vulnerability) | N/A (threat actor) | Graystone Final Forensic Report (July 14, 2023) | Unpatched vulnerability exploited; Palomar's contractual obligation was to patch critical vulnerabilities within 30 days of vendor patch release per MSA Exhibit D |
| 2023-04-18 | Palomar SOC discovers anomalous outbound data transfers; end of exfiltration window (~35 days) | Palomar Data Solutions, Inc. | Graystone Final Forensic Report |
| 2023-04-21 | Palomar notifies Quorum of security incident (email from Derek Copeland to Thomas Whitfield and David Naranjo) | Palomar Data Solutions, Inc. (Derek Copeland, GC) | Email — Palomar Initial Breach Notification | Notification approximately 24 hours late per MSA Section 9.4 (48-hour contractual requirement) |
| 2023-05-04 | Calderwood & Harkness LLP engagement opened (Matter No. 1025-00006) | Calderwood & Harkness LLP (Kevin Ostrowski) | Engagement Letter |
| 2023-05-05 | Graystone Forensics LLC retained under attorney-client privilege | Calderwood & Harkness LLP / Graystone Forensics LLC (Dr. Nolan Briggs) | Outside Counsel Retention Letter |
| 2023-05-08 | Cyber-insurance claim filed with Atlas Mutual Insurance Company (Claim No. CYB-CLM-2023-05892) | Calderwood & Harkness LLP (Rachel Bernstein) | Notice of Claim Letter to Atlas | Policy No. CYB-2023-041587; $15M per-occurrence; $2.5M SIR |
| 2023-06-02 | Graystone preliminary forensic findings report issued | Graystone Forensics LLC (Dr. Nolan Briggs, Kendra Faulkner) | Graystone Preliminary Findings Memo | Confirmed exfiltration of structured data files |
| 2023-07-14 | Graystone final forensic report issued — confirmed full scope: 318,247 affected individuals, 29 states + D.C. | Graystone Forensics LLC | Graystone Final Forensic Report | PII: 318,247; Financial: 84,619; PHI: 41,203 |
| 2023-08-04 | Data mining / affected individual identification completed | Graystone Forensics LLC / Calderwood & Harkness LLP | N/A | Determination date for statutory notification deadline calculations |
| 2023-08-14 | CT AG and CT Insurance Department notifications filed | Calderwood & Harkness LLP (Sara Hendricks) | CT AG Notification Filing; CT Insurance Dept. Notification Filing | 52,114 CT residents affected |
| 2023-08-15 | HHS-OCR HIPAA breach notification filed; media notice issued | Calderwood & Harkness LLP | HHS-OCR Breach Notification; Media Notice | 41,203 PHI-affected individuals |
| 2023-08-16 | NY AG and CA AG notifications filed | Calderwood & Harkness LLP (Sara Hendricks) | NY AG Notification Filing; CA AG Notification Filing | NY: 47,831; CA: 38,206 |
| 2023-08-17 | MA AG and remaining state notifications begin filing (through August 25) | Calderwood & Harkness LLP (Sara Hendricks) | MA AG Notification Filing; Cover Transmittal Memo | MA: 10,217; remaining 24 states filed Aug 17–25 |
| 2023-08-18 | Consumer notification mailing begins | Clearfield Notification Services LLC (Jerome Tillman) | Clearfield Services Agreement/SOW | 318,247 notification letters; printing/mailing cost: $636,000 |
| 2023-08-25 | All regulatory notifications completed across 29 states + D.C. and federal regulators | Calderwood & Harkness LLP (Sara Hendricks) | This Regulatory Notification Tracker | All filings confirmed timely |
| 2023-09-08 | Multistate AG coalition joint demand letter received (29-state coalition led by CT AG and NY AG) | Connecticut AG (AAG Diane Marchetti); New York AG (AAG Mark Petrosian) | Multistate AG Joint Demand Letter |
| 2023-09-15 | Consumer notification mailing completed | Clearfield Notification Services LLC | N/A | 28-day mailing window (Aug 18 – Sep 15) |
| 2023-10-13 | Multistate AG response submitted with Exhibits A–D | Calderwood & Harkness LLP (Kevin Ostrowski, Alan Burke) | Multistate AG Response Brief |
| 2023-11-03 | Supplemental information provided to multistate AG | Calderwood & Harkness LLP (Alan Burke) | Supplemental Submission to Multistate AG |
| 2023-11-22 | Multistate AG closure letter received — no enforcement action | CT AG / NY AG (on behalf of 29-state coalition) | Multistate AG Closure Letter | Favorable outcome |
| 2023-11-28 | CT Insurance Department inquiry closed | Connecticut Insurance Department (Richard Nakamura) | CT Insurance Dept. Closure Letter | No enforcement action |
| 2023-11-30 | HHS-OCR no further action letter received | HHS-OCR, Region I (Boston) | HHS-OCR No Further Action Letter |
| 2023-12-01 | Calderwood & Harkness engagement closed; matter terminated | Calderwood & Harkness LLP (Kevin Ostrowski) | Matter Closing Memorandum | Engagement duration: May 4 – December 1, 2023 (212 days / ~7 months) |