Contract analysis

Section 1: General Instructions for Call Center Agents 1.1 Purpose and Scope This script and frequently asked questions guide (collectively, this "Script") is provided to Clearfield Notification Services LLC ("Clearfield") call center agents who are handling inbound telephone calls from individuals who have received a data breach notification letter from Quorum Insurance Holdings Corp. ("Quorum"). The purpose of this

Section 2: Inbound Call Script — Standard Call Flow This section provides the standard call flow script that agents should follow for each inbound call. The script is organized sequentially, beginning with the greeting and ending with the call closing. Agents should follow this flow naturally, adapting as needed based on the caller's specific questions and concerns, while always staying within the bounds of the appro

Section 3: Frequently Asked Questions (FAQ) — Agent Reference This section provides approved answers to frequently asked questions that callers may raise. Agents should use the responses provided below verbatim or in close paraphrase. If a caller's question is not addressed in this FAQ, the agent should escalate the call to a Tier 2 supervisor. 3.1 General Incident Questions Q1: What happened? A: Use the approved inc

Section 4: Quick Reference Card for Agents This section is designed as a quick-reference summary for agents to keep readily accessible during calls. It consolidates key facts, escalation contacts, and the "Do Not Discuss" list in an at-a-glance format. 4.1 Key Facts at a Glance 4.2 Escalation Contact Matrix 4.3 Do Not Discuss List The following topics are strictly off-limits and must not be discussed with any caller

1. Name of the third-party vendor — Do not identify Palomar Data Solutions, Inc. by name. Refer only to "a third-party service provider" or "a vendor that provides claims processing services."

2. Technical details of the attack — Do not reference CVE-2023-0669, the GoAnywhere MFT file transfer appliance, or any specific vulnerability, exploit, or attack methodology.

3. Details of the forensic investigation or the investigating firm — Do not identify Graystone Forensics LLC by name or discuss the scope, methodology, findings, or timeline of the forensic investigation beyond the approved language.

4. Identity or details about the threat actor — Do not speculate about or identify the threat actor, any ransomware group, or any individual or entity responsible for the unauthorized access.

5. Details of any regulatory inquiry, multistate attorney general investigation, or insurance claim — Do not confirm or deny any regulatory investigation, AG inquiry, or insurance-related proceeding.

6. Any pending or potential litigation — Do not discuss any lawsuit, class action, demand letter, or legal proceeding, whether pending, threatened, or anticipated.

7. Details of the vendor contractual relationship or indemnification — Do not discuss the terms of the agreement between Quorum and Palomar, including any data processing agreement, service level agreement, indemnification clause, or insurance requirements.

8. Quorum's internal security architecture or systems — Do not discuss Quorum's own IT infrastructure, security controls, data storage practices, or internal systems.

9. Financial costs of the incident response — Do not discuss the cost of the notification, credit monitoring, forensic investigation, legal representation, or any other aspect of Quorum's incident response.

10. Number of individuals who have or have not enrolled in credit monitoring — Do not provide enrollment statistics, take-rates, or any aggregate data about enrollment.

11. Any information about other affected individuals — Do not disclose any information about other callers, other affected individuals, or any personally identifiable information belonging to anyone other than the verified caller.

Section 5: Script Updates and Version Control Version History Approvals This version of the Call Center Script and FAQ has been reviewed and approved by the following individuals: • Prepared by: Alan Burke, Lead Associate, and Sara Hendricks, Working Associate, Privacy & Data Security Practice Group, Calderwood & Harkness LLP • Approved by: Kevin Ostrowski, Responsible Partner, Calderwood & Harkness LLP • Reviewed by