Contract analysis

I. Purpose and Summary of Closure This memorandum documents the formal closure of Calderwood & Harkness LLP ("C&H") Matter No. 1025-00006 (the "Matter"), effective December 1, 2023. The purpose of this memorandum is to provide a comprehensive record of the engagement, its principal workstreams, key milestones, outcomes, financial summary, open items requiring post-closure monitoring, and lessons learned, for the bene

II. Client and Key Parties A. Client Quorum Insurance Holdings Corp. ("Quorum" or "QIH") is a Delaware corporation, publicly traded on the Nasdaq Stock Market under the ticker symbol QIHC. Quorum is headquartered at 400 Constitution Plaza, Suite 2200, Hartford, Connecticut 06103. Its Employer Identification Number is 06-4832197. Quorum operates in the insurance and financial technology sectors. Its core business line

III. Matter Background and Incident Summary A. The Palomar Data Solutions Relationship Quorum outsources claims data processing for its personal lines division to Palomar under a Master Services Agreement ("MSA") originally executed on November 12, 2019. The MSA has a five-year term expiring November 11, 2024. The original annual contract value was approximately $14.2 million, yielding a five-year total contract valu

Section 9.4 (Breach Notification): Required Palomar to notify Quorum of any confirmed or suspected security incident within 48 hours of discovery. As discussed below, Palomar's notification on April 21, 2023—three days after detection on April 18, 2023—exceeded this contractual deadline by approximately 24 hours.

Section 12.2 (Indemnification): Provided for Palomar's indemnification of Quorum for losses arising from Palomar's breach of its data security obligations, subject to a liability cap of two times the trailing twelve-month fees paid or payable under the MSA. Based on the applicable period, the indemnification cap was approximately $32.6 million (2 × $16.3M). Exhibit E (Insurance Requirements): Required Palomar to main

Section 14.2 (Termination for Cause): Permitted either party to terminate the MSA for material breach upon 30 days' written notice if the breaching party failed to cure the breach within the 30-day notice period. These contractual provisions formed the foundation of the firm's vendor accountability strategy and were instrumental in achieving the indemnification settlement described in Section V.B below. B. The Securi

IV. Engagement Timeline and Key Milestones A. Engagement Opening and Initial Response (May 2023) The engagement commenced on May 4, 2023, following Quorum's outreach to C&H's Privacy & Data Security practice. The initial response phase focused on activating Quorum's incident response plan, retaining the forensic investigation firm under the C&H privilege umbrella, securing the evidentiary record, initiating the insur

V. Outcomes Summary A. Regulatory Outcomes The Matter achieved uniformly favorable regulatory outcomes across all tracks. No fines, penalties, consent orders, or other enforcement actions were imposed by any regulator: • Multistate AG Coalition (29 states): All 29 state attorneys general participating in the coalition closed their inquiry without enforcement action. The closure letter, dated November 22, 2023, was is

VI. Financial Summary A. Total Incident Response Costs The following table summarizes the total incident response costs incurred in connection with the Palomar Data Solutions security incident: B. Calderwood & Harkness Fee Detail The firm's fees for this engagement were billed at the standard hourly rates for the assigned attorneys, with no alternative fee arrangement or discount applied. The fee detail is as follows

VII. Key Deliverables Log The following is a comprehensive listing of all significant work product delivered during the engagement, organized by workstream. All deliverables are maintained on the C&H document management system under Matter No. 1025-00006. Engagement & Privilege

1. Engagement letter (May 4, 2023)

2. Graystone Forensics LLC retention letter (May 5, 2023)

3. Common interest agreement with Atlas Mutual Insurance Company (May 10, 2023)

4. Privilege protocol memo — internal C&H (May 5, 2023)

5. Engagement scope expansion letter (September 10, 2023) Incident Assessment & Forensic Investigation

6. Incident response plan activation memo to Quorum IR team (May 4, 2023)

7. Initial incident assessment memo to Quorum GC (May 8, 2023)

8. Legal hold notice — Quorum IT and Claims departments (May 6, 2023)

9. Graystone scope of work and investigation plan (May 7, 2023)

10. Graystone preliminary forensic findings report — privileged (June 2, 2023)

11. C&H analysis of preliminary forensic findings (June 5, 2023)

12. Graystone final forensic report — privileged (July 14, 2023)

13. C&H summary and legal analysis of final forensic findings (July 18, 2023) Notification Obligation Analysis 14. 50-state breach notification law survey (June 8, 2023)

15. Notification trigger analysis memo (July 20, 2023)

16. HIPAA breach notification analysis memo (July 22, 2023)

17. Connecticut Insurance Data Security Law analysis memo (July 22, 2023)

18. New York SHIELD Act compliance memo (July 23, 2023)

19. California CCPA/CMIA notification analysis memo (July 24, 2023)

20. State-by-state notification timeline and content requirements matrix (August 1, 2023) Consumer Notifications.

21. Model consumer notification letter — general PII version (August 10, 2023)

22. Model consumer notification letter — SSN plus financial data version (August 10, 2023)

23. Model consumer notification letter — PHI/HIPAA-compliant version (August 10, 2023)

24. California-specific notification letter (August 12, 2023)

25. Massachusetts-specific notification letter (August 12, 2023)

26. Substitute notice / website posting language (August 15, 2023)

27. Call center script and FAQ (August 14, 2023)

28. Clearfield Notification Services statement of work (August 6, 2023) Regulatory Notifications.

29. Connecticut AG notification filing (August 14, 2023)

30. Connecticut Insurance Department notification filing (August 14, 2023)

31. HHS-OCR breach notification filing (August 15, 2023)

32. New York AG notification filing (August 16, 2023)

33. California AG notification filing (August 16, 2023)

34. Massachusetts AG and DoCR notification filing (August 17, 2023)

35. Remaining 24 state notification filings (August 17–25, 2023)

36. Media notice — HHS-OCR compliance (August 15, 2023)

37. Regulatory notification tracker (August 25, 2023) Regulatory Defense.

38. Annotated multistate AG demand letter (September 8, 2023)

39. Multistate AG response strategy memo (S