Extract to table
Pull the structured facts out of a document: parties, dates, amounts, obligations.
Extract to table / initial-incident-assessment-memo.docx
initial-incident-assessment-memo.docx
Parties
HARKNESS LLP
Quorum Insurance Holdings Corp
Vendor-Originated Data Security Inc
Dunlop LLP
Graystone Forensics LLC
Severin Corp
Pinnacle Surplus Lines Insurance Corp
Whitmore Risk Advisors Inc
Dates
May 8, 2023
May 4, 2023
March 14, 2023
April 18, 2023
April 21, 2023
November 12, 2019
November 11, 2024
March 3, 2021
April 1, 2021
September 15, 2022
Amounts
$14,200,000
$2,100,000
$16,300,000
$10,000,000
$100
$750
$6.1
$4.82
$40,000,000
$32,600,000
Obligations
• Vulnerability and Patch Management: Palomar is required to patch critical vulnerabilities within thirty (30) days of vendor patch release
Under § 38a-999b(e), a domestic insurer that is the subject of a cybersecurity event must notify the Insurance Commissioner within three (3) business days after making a determination that a cybersecurity event has occurred
408, if a breach affects 500 or more individuals, the covered entity must notify the HHS Office for Civil Rights ("OCR") without unreasonable delay and in no case later than sixty (60) days from the date of discovery of the breach
Where a breach affects 500 or more residents of a single state or jurisdiction, notification must also be provided to prominent media outlets serving that state or jurisdiction
In addition to private litigation risk, Quorum must assess its obligations under the federal securities laws
However, any exercise of termination rights must be weighed carefully against practical considerations