Contract analysis

1. Introduction and Background We write to memorialize the agreed-upon expansion of the scope of Calderwood & Harkness LLP's engagement by Quorum Insurance Holdings Corp. ("Quorum" or the "Company") in connection with the data security incident originating from the Company's third-party claims-processing vendor, Palomar Data Solutions, Inc. ("Palomar"). This letter supplements, and should be read in conjunction with,

2. Purpose of This Letter The purpose of this letter is to formally expand the scope of Calderwood & Harkness's engagement to encompass three additional workstreams that have arisen as natural and foreseeable outgrowths of the original incident response engagement. Specifically, the expanded scope will include the following:

1. Defense of the Multistate Attorney General Inquiry. Calderwood & Harkness will represent Quorum in connection with the joint multistate attorney general inquiry initiated by a 29-state coalition led by the Offices of the Connecticut Attorney General and the New York Attorney General, including the preparation and submission of the Company's formal response to the coalition's demand letter and all subsequent engage

2. Vendor Indemnification Negotiations Against Palomar Data Solutions, Inc. Calderwood & Harkness will lead the negotiation of indemnification and settlement terms with Palomar and its outside counsel, Mercer, Haight & Dunlop LLP, seeking to maximize Quorum's contractual recovery for incident response costs and related damages arising from Palomar's breaches of the Master Services Agreement.

3. Regulatory Engagement with the Connecticut Insurance Department and HHS Office for Civil Rights. Calderwood & Harkness will manage Quorum's ongoing regulatory engagement with the Connecticut Insurance Department's Cybersecurity Unit and HHS-OCR's Region I office in connection with their respective post-notification inquiries and any compliance reviews or investigations that may follow. We understand and confirm th

3. Expanded Workstream 1 — Defense of the Multistate Attorney General Inquiry 3.1 Background. On September 8, 2023, Quorum received a joint demand letter (the "Multistate Demand Letter") from the Office of the Connecticut Attorney General, Consumer Protection Division (led by Assistant Attorney General Diane Marchetti), and the Office of the New York Attorney General, Bureau of Internet and Technology (led by Assista

4. Expanded Workstream 2 — Vendor Indemnification Negotiations Against Palomar Data Solutions, Inc. 4.1 Background. Quorum and Palomar Data Solutions, Inc. are parties to a Master Services Agreement dated November 12, 2019 (the "MSA"), as amended by Amendment 1 dated March 3, 2021 and Amendment 2 dated September 15, 2022. Under the MSA, Palomar serves as Quorum's primary third-party claims-processing vendor and, in t

5. Expanded Workstream 3 — Regulatory Engagement with the Connecticut Insurance Department and HHS Office for Civil Rights 5.1 Connecticut Insurance Department Quorum filed its notification of the data security incident with the Connecticut Insurance Department, Financial Analysis Division, Cybersecurity Unit (Examiner: Richard Nakamura), on August 14, 2023, pursuant to Conn. Gen. Stat. § 38a-999b, which requires ins

6. Engagement Terms — Confirmation and Updates 6.1 Billing Rates We confirm that the billing rates set forth in the Original Engagement Letter dated May 4, 2023 remain in full force and effect for all work performed under the expanded scope described in this letter. For ease of reference, the applicable billing rates are as follows: In the event that it becomes necessary to staff additional attorneys or other profess

7. Estimated Budget for Expanded Workstreams We recognize the importance of providing budget guidance to assist Quorum in managing its legal costs and insurance reporting obligations. We note, however, that precise budgets are inherently difficult to estimate in matters of this nature given the unpredictable trajectory of regulatory inquiries, the uncertain pace of vendor negotiations, and the possibility of unforese

8. Acknowledgment We would appreciate it if you would indicate Quorum's agreement to the expanded scope of engagement described in this letter by signing in the space provided below and returning a signed copy to our office. An electronic signature and return via email to kostrowski@calderwoodharkness.com will be sufficient, with a hard copy to follow at your convenience. We are grateful for the continued confidence