Contract analysis

I. Purpose and Summary The purpose of this memorandum is to provide Quorum Insurance Holdings Corp. ("Quorum") General Counsel Thomas R. Whitfield with an updated assessment of the insurance coverage posture related to the data security incident originating from Quorum's third-party claims-processing vendor, Palomar Data Solutions, Inc. ("Palomar"). This memorandum reflects developments through August 30, 2023, inclu

II. Background — Incident and Insurance Claim Filing A. Incident Overview On or about March 14, 2023, a threat actor exploited CVE-2023-0669, a critical remote code execution vulnerability in Palomar Data Solutions' GoAnywhere MFT file transfer appliance, to gain unauthorized access to Palomar's network environment. The GoAnywhere MFT vulnerability, which was publicly disclosed in early February 2023, had been widely

III. Overview of Quorum's Cyber-Liability Insurance Tower Quorum maintains a two-layer cyber-liability insurance tower providing aggregate coverage of up to $40,000,000, structured as described below. Both policies are currently in force and the incident falls within the applicable policy periods. A. Primary Policy — Atlas Mutual Insurance Company The Atlas primary policy provides broad cyber-liability coverage, incl

IV. Atlas Mutual's Coverage Determination A. Acknowledgment and Acceptance On June 15, 2023, Atlas Mutual issued a written reservation-of-rights acknowledgment letter in response to the formal claim submission. The issuance of a reservation-of-rights letter at this stage is customary practice for claims of this nature and magnitude and does not indicate any adverse coverage determination. Rather, it reflects the insu

1. Forensic Investigation Costs. Atlas has confirmed coverage for the fees and costs of Graystone Forensics LLC incurred in connection with the privileged forensic investigation of the security incident. This includes Graystone's work in conducting the forensic analysis of Palomar's systems, identifying the attack vector and threat actor methodology, determining the scope of data exfiltration, and preparing the final

2. Notification Costs. Atlas has confirmed coverage for consumer notification printing and mailing costs incurred through Clearfield Notification Services LLC ("Clearfield"). This encompasses the preparation, printing, and mailing of individualized notification letters to each of the 318,247 affected individuals in compliance with the applicable data breach notification statutes of the 29 states and the District of C

3. Credit Monitoring and Identity Theft Protection Costs. Atlas has confirmed coverage for 24-month credit monitoring and identity theft protection enrollment for affected individuals, as administered by Clearfield. The 24-month coverage period is consistent with industry best practices and regulatory expectations for incidents involving the compromise of Social Security numbers and financial account information.

4. Call Center Operations Costs. Atlas has confirmed coverage for Clearfield's call center operations during the 12-week operational window established to handle inquiries from affected individuals following the mailing of notification letters.

5. Crisis Communications Costs. Atlas has confirmed coverage for the fees and costs of BrightPath Consulting Group Inc. ("BrightPath") for public relations and crisis communications support provided to Quorum in connection with the incident.

6. Regulatory Defense Costs. Atlas has confirmed coverage for Calderwood & Harkness's legal fees attributable to regulatory notification compliance, including the preparation and submission of state regulator breach notifications, as well as the defense of the multistate attorney general inquiry, the Connecticut Insurance Department inquiry, and the HHS-OCR inquiry. This category encompasses all reasonable and necess

7. Potential Regulatory Fines and Penalties. Atlas has confirmed that regulatory fines and penalties, to the extent insurable under applicable law, would be covered under the policy. No fines or penalties have been assessed or are currently anticipated as of the date of this memorandum. B. Consent and Cooperation Requirements The Atlas policy contains standard consent and cooperation provisions that require the insur

3. Pre-Existing Security Deficiencies. Atlas's reservation letter contains a general reservation regarding any costs that may be attributable to pre-existing security deficiencies at Quorum itself, as distinguished from security deficiencies at Palomar. This reservation reflects the general principle that costs associated with remediating an insured's pre-existing security failures (as opposed to responding to a spec

V. Estimated Costs and Coverage Analysis A. Total Estimated Incident Response Costs As of August 30, 2023, Calderwood & Harkness estimates the total incident response costs for the Palomar data security incident as follows: Several points merit additional discussion: Notification Services. The notification cost estimate of $3,214,500 reflects Clearfield's contractual pricing for notification printing and mailing serv

VI. Interaction with Palomar Indemnification Claim In addition to the insurance recovery, Calderwood & Harkness has asserted an indemnification claim against Palomar Data Solutions, Inc. under the contractual indemnification provisions of the Master Services Agreement between Quorum and Palomar. Specifically, Calderwood & Harkness, on behalf of Quorum, submitted a formal written demand for indemnification under Secti

VII. Status of Regulatory Engagements and Coverage Implications Calderwood & Harkness is managing several parallel regulatory engagements arising from the Palomar data security incident. The costs associated with all of these regulatory engagements are covered as regulatory defense costs under the Atlas policy. A summary of each engagement and its current status follows. A. Multistate Attorney General Inquiry A coali

VIII. Open Items and Recommendations Based on the foregoing analysis, Calderwood & Harkness recommends the following actions and identifies the following open items for Quorum's attention: A. Ongoing Coordination with Atlas Mutual Calderwood & Harkness recommends that Quorum continue its proactive and cooperative approach to the Atlas claims relationship. Specifically, Calderwood & Harkness will continue to provide p

IX. Conclusion In summary, Quorum Insurance Holdings Corp.'s insurance coverage posture with respect to the Palomar Data Solutions security incident is favorable. Atlas Mutual Insurance Company has accepted coverage for all major categories of incident response costs in excess of the $2,500,000 self-insured retention, including forensic investigation costs, notification and credit monitoring costs, crisis communicati