Contract analysis

I. Introduction and Purpose of Notice Calderwood & Harkness LLP serves as outside counsel to Quorum Insurance Holdings Corp. ("Quorum" or the "Policyholder"), a Delaware corporation publicly traded on the Nasdaq Stock Market (ticker symbol: QIHC), with its principal executive offices located at 400 Constitution Plaza, Suite 2200, Hartford, CT 06103 (EIN: 06-4832197). We write on behalf of Quorum in connection with th

II. Identification of the Policyholder The Named Insured under the Excess Policy is Quorum Insurance Holdings Corp., the relevant details of which are set forth below: Full Legal Name: Quorum Insurance Holdings Corp. Entity Type: Corporation organized under the laws of the State of Delaware Public Listing: Nasdaq Stock Market; ticker symbol: QIHC Headquarters Address: 400 Constitution Plaza, Suite 2200, Hartford, CT

III. Description of the Cyber-Security Incident A. Overview. Quorum has become aware of a significant data security incident (the "Incident") originating from the systems and network environment of its third-party claims-processing vendor, Palomar Data Solutions, Inc. ("Palomar"), a Texas corporation headquartered at 7100 Greenville Avenue, Suite 450, Dallas, TX 75231. Palomar provides claims data processing, documen

IV. Anticipated Categories of Loss While it is premature to estimate total losses with precision at this stage of the investigation, Quorum anticipates incurring costs in the following categories in connection with the Incident. Quorum believes that some or all of these cost categories may constitute covered losses under the cyber-liability insurance tower, subject to the terms, conditions, definitions, and exclusion

1. Forensic Investigation Costs. Fees and expenses of Graystone Forensics LLC for the privileged forensic investigation, including digital forensics analysis, incident response services, threat intelligence services, data mining and review to identify affected individuals and data types, and preparation of forensic reports. These costs are being incurred at the direction of outside counsel and are expected to be subs

2. Consumer Notification Costs. Costs associated with the printing, mailing, and delivery of notification letters to potentially affected individuals across multiple states, in compliance with applicable state data breach notification statutes. Given the anticipated scope of the affected population, these costs are expected to be significant and will include the preparation and customization of notification letters t

3. Call Center Operations. Costs associated with the establishment and operation of a dedicated call center to respond to inquiries from affected individuals following the issuance of breach notification letters. This will include staffing, training, script development, telecommunications infrastructure, and ongoing operational costs for the duration of the call center operation.

4. Credit Monitoring and Identity Theft Protection Services. Costs associated with the enrollment of affected individuals in complimentary credit monitoring and identity theft protection programs for a period to be determined based on legal requirements, regulatory expectations, and the nature of the data compromised. Given the potential compromise of Social Security numbers and financial account information, Quorum

5. Crisis Communications and Public Relations. Fees and expenses for external crisis communications advisors retained to assist Quorum in managing press inquiries, preparing public statements, developing employee communications, and coordinating investor-facing disclosures, including any required filings with the U.S. Securities and Exchange Commission. Quorum is a publicly traded company and anticipates that the Inc

6. Regulatory Notification and Defense Costs. Costs associated with the preparation and filing of regulatory notifications with state attorneys general, state insurance departments and commissioners, and federal regulators, including the U.S. Department of Health and Human Services, Office for Civil Rights ("HHS-OCR"), to the extent PHI is confirmed to be among the compromised data. This category also includes costs

7. Legal Fees. Fees and expenses of outside counsel, Calderwood & Harkness LLP, for incident response coordination, forensic investigation oversight, breach notification compliance analysis and implementation, regulatory defense, vendor accountability assessment, insurance coverage analysis and claims management, and related legal services. These legal fees are anticipated to be ongoing for a considerable period as t

8. Internal Costs. Quorum's internal costs associated with responding to the Incident, including IT remediation and security hardening measures, employee overtime, executive and management time devoted to incident response, internal audit activities, and related operational costs. While the recoverability of internal costs will depend on the specific policy language, Quorum identifies these costs here to provide a co

V. Underlying Primary Insurance Information For Pinnacle's reference and records, the following is a summary of the underlying primary cyber-liability insurance coverage maintained by Quorum: Primary Carrier: Atlas Mutual Insurance Company Address: 120 South LaSalle Street, Suite 3200, Chicago, IL 60603 Primary Policy Number: CYB-2023-041587 Policy Period: January 1, 2023 – January 1, 2024 Per-Occurrence Limit of Lia

VI. Cyber Insurance Broker Information Quorum's cyber-liability insurance program, including both the Atlas Mutual Primary Policy and the Pinnacle Excess Policy, was placed by the following broker: Broker: Whitmore Risk Advisors Inc. Address: 390 Park Avenue, 18th Floor, New York, NY 10022 Lead Broker: Sandra Whitmore-Kim Whitmore Risk Advisors Inc. and Ms. Whitmore-Kim have been notified of the Incident and of Quoru

VII. Outside Counsel and Forensic Investigator Information The following professionals have been engaged by Quorum in connection with the Incident response and are authorized to communicate with Pinnacle on Quorum's behalf regarding this matter: Outside Counsel: Calderwood & Harkness LLP 1700 K Street NW, Suite 900 Washington, D.C. 20006 Responsible Partner: Kevin Ostrowski, Privacy & Data Security Practice Group Bil

VIII. Reservation of Rights Quorum expressly reserves all rights under the Excess Policy, including but not limited to all coverage rights, defenses, claims for reimbursement, and any other rights, remedies, or entitlements available to Quorum under the Excess Policy, at law, or in equity. Without limiting the generality of the foregoing, Quorum specifically reserves the following: (a) The right to assert coverage fo

IX. Requested Acknowledgment Quorum respectfully requests that Pinnacle acknowledge receipt of this precautionary notice of potential claim in writing. Such acknowledgment may be directed to: Kevin Ostrowski, Partner Calderwood & Harkness LLP 1700 K Street NW, Suite 900 Washington, D.C. 20006 Email: kostrowski@calderwoodharkness.com Telephone: (202) 555-7418 In addition, Quorum requests that Pinnacle provide the foll

X. Request for Cooperation and Communication All communications from Pinnacle regarding this matter should be directed to Kevin Ostrowski, Partner, Calderwood & Harkness LLP, at the address and contact information set forth in Section IX above. Mr. Ostrowski and his team at Calderwood & Harkness are authorized to communicate with Pinnacle on behalf of Quorum with respect to all aspects of this claim. Quorum will prov

XI. Closing We appreciate Pinnacle's prompt attention to this precautionary notice of potential claim. Quorum is committed to a thorough, diligent, and timely response to the Incident and to keeping its insurance carriers, including Pinnacle, fully informed throughout the investigation and response process. We are available to discuss this matter at Pinnacle's convenience and to provide any additional information tha

1. Copy of Notice of Claim Letter to Atlas Mutual Insurance Company dated May 8, 2023 (Primary Policy No. CYB-2023-041587; Primary Claim No. CYB-CLM-2023-05892) cc: Thomas R. Whitfield, General Counsel, Quorum Insurance Holdings Corp. David Naranjo, Chief Information Security Officer, Quorum Insurance Holdings Corp. Jennifer Liang, Chief Privacy Officer, Quorum Insurance Holdings Corp. Sandra Whitmore-Kim, Lead Broke