Contract analysis

I. Executive Summary The purpose of this memorandum is to analyze the legal implications of the privileged preliminary forensic findings report issued on June 2, 2023, by Graystone Forensics LLC ("Graystone"), through Dr. Nolan Briggs, Managing Director, Incident Response, and Kendra Faulkner, Senior Forensic Analyst, to Calderwood & Harkness LLP in connection with the security incident originating from the network e

II. Background and Procedural Posture A. Engagement Context Calderwood & Harkness LLP was engaged by Quorum Insurance Holdings Corp. on May 4, 2023, to serve as outside legal counsel in connection with the security incident affecting Quorum's data that was initially reported by Palomar Data Solutions, Inc. The engagement followed Quorum's receipt of an initial security incident notification from Palomar on April 21,

III. Summary of Graystone Preliminary Forensic Findings The following is a summary of the key findings set forth in Graystone's privileged preliminary forensic findings report dated June 2, 2023. The findings summarized below remain preliminary in nature; Graystone's investigation is ongoing, and certain conclusions — including the final enumeration of affected individuals and the state-by-state breakdown of affected

IV. Legal Analysis — Notification Obligations A. State Breach Notification Laws — High Likelihood of Triggering The confirmed exfiltration of personally identifiable information — including Social Security numbers, driver's license numbers, bank account numbers, and payment card numbers — will trigger breach notification obligations under virtually every state's data breach notification statute for residents of the a

V. Legal Analysis — Palomar Contractual Obligations and Breaches A. Data Security Exhibit (Exhibit D, as Amended) The MSA, as amended by Amendment 2 (executed September 15, 2022), contains a comprehensive Data Security Exhibit, designated as Exhibit D, which sets forth the security obligations that Palomar is required to maintain in connection with its processing, storage, and transmission of Quorum data. Exhibit D r

Section 9.4 of the MSA requires Palomar to notify Quorum "within forty-eight (48) hours of Palomar's discovery or reasonable suspicion of any Security Incident affecting Customer Data." The term "Security Incident" is defined broadly in Section 1.18 of the MSA to include "any actual or reasonably suspected unauthorized access to, acquisition of, use of, or disclosure of Customer Data, or any actual or reasonably susp

Section 12.2 of the MSA provides that Palomar shall indemnify, defend, and hold harmless Quorum and its affiliates, officers, directors, employees, and agents from and against all losses, damages, costs, expenses (including reasonable attorneys' fees), liabilities, claims, actions, suits, proceedings, and judgments arising from or related to Palomar's breach of its data security obligations under the MSA, including t

Section 14.2 of the MSA permits either party to terminate the MSA upon the other party's material breach that remains uncured for a period of thirty (30) calendar days following written notice specifying the nature of the breach. The question of whether Palomar's identified contractual breaches — the failure to patch CVE-2023-0669 and the late notification — constitute "material" breaches for purposes of Section 14.2

VI. Insurance Coverage Considerations The costs incurred and anticipated to be incurred in connection with the Palomar security incident are expected to fall within the categories of covered losses under Quorum's primary cyber-liability policy issued by Atlas Mutual Insurance Company (Policy No. CYB-2023-041587, Claim No. CYB-CLM-2023-05892). The Atlas policy covers a broad range of first-party incident response cost

VII. Recommended Next Steps Based on the analysis set forth in this memorandum, Calderwood & Harkness recommends the following actions, organized by timeframe: A. Immediate Actions (June 2023)

1. Completion of 50-State Breach Notification Law Survey. Calderwood & Harkness is preparing a comprehensive survey of the breach notification laws of all fifty states, the District of Columbia, and applicable territories. The target completion date is June 8, 2023. This survey will serve as the foundation for the state-by-state notification trigger analysis that will be prepared upon completion of data mining.

2. Continuation of Graystone Forensics Investigation. Graystone should continue its forensic investigation through to the issuance of the final forensic report, which is estimated to be completed by mid-July 2023. Calderwood & Harkness will continue to coordinate with Dr. Briggs and Ms. Faulkner on the scope and progress of the investigation.

3. Engagement of Data Mining Analysts. Authorize Graystone (or, if capacity or cost considerations warrant, a separate data mining vendor engaged under the Calderwood & Harkness privilege umbrella) to proceed with the data mining phase. The objective of this phase is to analyze the exfiltrated data files and identify all affected individuals by name, associate each individual with a state of residence, and identify t

4. Preparation of Consumer Notification Letter Templates. Calderwood & Harkness will begin drafting consumer notification letter templates for the principal notification categories: (a) individuals whose PII only was compromised; (b) individuals whose PII and financial data were compromised; and (c) individuals whose PHI was compromised, requiring HIPAA-compliant notification content. These templates will be prepared

5. Evaluation and Engagement of Notification Vendor. Quorum should evaluate and engage a notification vendor to handle the logistics of notification mailing, call center operations, and credit monitoring enrollment services. Clearfield Notification Services LLC has been identified as a strong candidate based on its experience with large-scale, multi-state insurance sector breach notifications. Calderwood & Harkness c

6. Engagement of Crisis Communications Consultant. Quorum should engage BrightPath Consulting Group Inc. (Meredith Ashford, Managing Director) to develop a crisis communications plan in anticipation of the public-facing notification phase. The plan should address media inquiries, policyholder communications, regulator and analyst relations, and internal employee communications. Early engagement of BrightPath will all

7. State-by-State Notification Trigger Analysis. Upon receipt of the Graystone final forensic report and completion of data mining, Calderwood & Harkness will prepare a comprehensive state-by-state notification trigger analysis identifying each jurisdiction with affected residents and the specific notification requirements (timing, content, regulatory filings) applicable in each.

8. HIPAA Breach Notification Analysis. Calderwood & Harkness will prepare a detailed HIPAA breach notification analysis for the subset of affected individuals whose PHI was compromised, addressing the scope of the PHI compromise, the applicable notification requirements under 45 C.F.R. Part 164, Subpart D, the notification timeline, and the required content of individual, HHS, and media notifications.

9. Connecticut Insurance Data Security Law Analysis. Calderwood & Harkness will prepare a separate analysis of Quorum's notification obligations under the Connecticut Insurance Data Security Law (Conn. Gen. Stat. § 38a-999b), including the content and timing of the required notification to the Connecticut Insurance Commissioner and coordination with Richard Nakamura at the Financial Analysis Division, Cybersecurity U

10. Comprehensive Contractual Analysis Memorandum. Calderwood & Harkness will prepare a detailed memorandum analyzing Palomar's contractual breaches under the MSA, Quorum's indemnification rights under Section 12.2, the scope and applicability of the liability cap under Section 13.1, and the recommended strategy for pursuing indemnification from Palomar. This memorandum will serve as the basis for a formal breach of

11. Notification Timing Strategy. Calderwood & Harkness wi