Extract to table

Based on the factual record established by the forensic investigation conducted by Graystone Forensics LLC and the data mining completed by the Quorum incident response team, it is my conclusion that Quorum is required to provide notification to 47,831 affected New York residents whose private information was accessed and exfiltrated during the breach

Content Requirements — § 899-aa(2)(b) The SHIELD Act specifies the content that must be included in consumer notification letters

These content requirements are mandatory and must be included in the notification letter

Law § 899-aa(8)(a) provides that "[w]henever the attorney general shall be notified pursuant to this section, the person or business shall also, at the time, notify the state police, the division of state police, and the department of state

" While the statutory language could be read to suggest that AG notification precedes and triggers the obligation to notify the other agencies, the practical effect is that all three agencies must be notified concurrently with or prior to consumer notification

Accordingly, Quorum is subject to the full requirements of § 899-bb and must demonstrate a comprehensive data security program that includes administrative, technical, and physical safeguards