Contract analysis

I. Executive Summary The purpose of this memorandum is to provide Quorum Insurance Holdings Corp. ("Quorum" or the "Company") with a detailed analysis of the cyber-liability insurance coverage available to Quorum in connection with the vendor-originated data security incident involving Palomar Data Solutions, Inc. ("Palomar"). This analysis is based on our review of the applicable insurance policies, the facts presen

II. Background A. The Incident On or about March 14, 2023, a threat actor exploited a known remote code execution vulnerability — specifically, CVE-2023-0669, a pre-authentication command injection vulnerability in Severin Corporation's GoAnywhere MFT file transfer application — to gain unauthorized access to the network of Palomar Data Solutions, Inc. The exploitation of this particular vulnerability has been widely

III. Policy Summary — Atlas Mutual Primary Policy A. Policy Identification The primary layer of Quorum's cyber-liability insurance tower is provided by Atlas Mutual Insurance Company, an Illinois domestic mutual insurance company headquartered at 120 South LaSalle Street, Suite 3200, Chicago, IL 60603. The relevant policy details are as follows: B. Limits and Retention The Atlas Mutual primary policy provides the fol

1. Forensic Investigation Costs. The policy covers the reasonable and necessary costs of retaining forensic consultants to investigate the cause, scope, and nature of a security incident, including costs of determining what data was compromised, how the unauthorized access occurred, and whether the threat actor has been contained and ejected from the affected systems. This coverage grant is applicable to the engageme

2. Notification Costs. The policy covers the costs of notifying affected individuals as required by applicable federal and state breach notification laws, including the costs of printing notification letters, mailing and postage, substitute notice (where applicable), and the establishment and operation of a dedicated call center to field inquiries from affected individuals. Given that the compromised data likely impl

3. Credit Monitoring and Identity Theft Protection Services. The policy covers the costs of providing credit monitoring and identity theft protection services to affected individuals for a period consistent with industry practice or as required by applicable law. Quorum intends to offer 24 months of complimentary credit monitoring, which is consistent with prevailing industry standards and the expectations of state a

4. Crisis Management / Public Relations Costs. The policy covers the costs of retaining a crisis communications or public relations firm to manage the reputational impact of the security incident, including costs associated with preparation of press statements, employee communications, customer-facing communications, and media monitoring. This grant is applicable to the engagement of BrightPath Consulting Group Inc.,

5. Regulatory Defense Costs. The policy covers the costs of legal defense in connection with regulatory investigations, inquiries, or proceedings brought by federal, state, or local regulatory authorities arising out of the security incident. This includes attorney fees and costs incurred in responding to civil investigative demands, subpoenas, and similar regulatory requests from state attorneys general, state insur

6. Regulatory Fines and Penalties. The policy provides coverage for regulatory fines, penalties, and assessments imposed by a governmental authority arising from a covered security incident, to the extent such amounts are insurable under applicable law. The insurability of regulatory fines is a jurisdiction-specific issue that we address in greater detail in Section V.F below. Third-Party Coverage Grants The followin

1. Third-Party Claims / Liability. The policy provides coverage for defense costs and indemnity obligations arising from third-party claims — including civil lawsuits, class action complaints, and written demands — asserted against Quorum by affected individuals, businesses, or other third parties in connection with a covered security incident. While no third-party lawsuits have been filed as of the date of this memo

IV. Policy Summary — Pinnacle Surplus Lines Excess Policy A. Policy Identification The excess layer of Quorum's cyber-liability insurance tower is provided by Pinnacle Surplus Lines Insurance Corp., a Delaware corporation operating as a surplus lines carrier, headquartered at One Beacon Street, Suite 1100, Boston, MA 02108. The relevant policy details are as follows: B. Limits and Attachment The Pinnacle excess polic

V. Coverage Analysis — Anticipated Cost Categories This section analyzes each anticipated category of cost in the context of the Atlas Mutual primary policy's insuring agreements, consent requirements, and other relevant provisions. A. Forensic Investigation Costs (Graystone Forensics LLC) Graystone Forensics LLC ("Graystone") was retained by Calderwood & Harkness LLP on May 5, 2023, under the attorney-client privile

VI. Potential Coverage Issues and Gaps While we believe that coverage should be available for the Palomar incident under Quorum's cyber-liability insurance tower, there are several potential coverage issues and gaps that warrant careful attention. We analyze each below. A. Vendor-Originated Breach — Service Provider Coverage The most significant coverage issue presented by this incident is whether the Atlas Mutual po

VII. Estimated Total Costs and Coverage Positioning A. Preliminary Cost Estimates At this early stage of the engagement — with Graystone's forensic investigation still in its initial phases and the scope of affected individuals not yet confirmed — precise cost estimates are not available. However, based on the anticipated scope of the incident (a potential affected population of hundreds of thousands of individuals a

VIII. Recommendations and Next Steps Based on the foregoing analysis, we recommend the following action items to preserve and maximize Quorum's insurance coverage and to ensure compliance with all policy conditions:

1. Document Insurer Consents. Obtain and document formal written consent from Paul Enriquez at Atlas Mutual for the retention of the following vendors and professionals: (a) Graystone Forensics LLC as the forensic investigator; (b) Calderwood & Harkness LLP as breach response and regulatory defense counsel; (c) Clearfield Notification Services LLC as the notification and credit monitoring vendor (when engaged); and (

2. Billing Rate Confirmation. Confirm whether the Atlas Mutual policy contains billing rate caps, fee schedules, or litigation management guidelines that may affect reimbursement of Calderwood & Harkness's fees at the specified hourly rates. If rate caps apply, we will advise Quorum regarding the differential and its impact on Quorum's net cost exposure.

3. Cost Tracking and Segregation. Implement a comprehensive cost-tracking system from the outset of the engagement, with costs clearly segregated into the following categories: (a) Covered first-party incident response costs (forensics, notification, credit monitoring, crisis communications); (b) Covered regulatory defense costs; (c) Non-covered affirmative vendor indemnification and contractual claim costs; and (d)

4. SIR Satisfaction Documentation. Track cumulative covered costs against the $2,500,000 SIR on a rolling basis and notify Atlas Mutual in writing when the SIR threshold has been reached. Upon SIR satisfaction, Atlas Mutual's reimbursement obligation will commence, and Quorum should begin submitting cost documentation to Atlas Mutual for reimbursement on a periodic (e.g., monthly) basis.

5. Subrogation Coordination. Coordinate with Paul Enriquez at Atlas Mutual regarding the Palomar indemnification claim to ensure that Quorum's negotiations with Palomar do not prejudice Atlas's subrogation rights. Specifically: (a) Consult with Paul Enriquez before entering into any binding settlement agreement or release with Palomar; (b) Structure any settlement with Palomar to preserve Atlas's abil