Contract analysis

I. Executive Summary This memorandum provides a comprehensive analysis of the closure letter dated November 22, 2023, received from the twenty-nine-state multistate attorney general coalition, which confirms the closure of the enforcement inquiry relating to the Palomar Data Solutions security incident without any enforcement action being taken against Quorum Insurance Holdings Corp. ("Quorum" or the "Company"). The

II. Background and Procedural History A. The Underlying Incident The events giving rise to the multistate attorney general inquiry originated not within Quorum's own systems or network infrastructure, but rather at Palomar Data Solutions, Inc. ("Palomar"), Quorum's third-party claims-processing vendor. Palomar provides claims intake, adjudication support, and payment processing services to Quorum under a Master Servi

III. Analysis of the Closure Letter A. Key Language and Findings The closure letter, which is being provided to Quorum under separate cover in its original form, confirms in its operative language that "the multistate coalition has concluded its review of this matter and has determined that no further action is warranted at this time." This language is unambiguous in its import: the twenty-nine-state coalition has ma

IV. Status of Remaining Regulatory Inquiries A. Connecticut Insurance Department In addition to the multistate attorney general inquiry, Quorum's notification of the incident to the Connecticut Insurance Department triggered a separate regulatory inquiry by that agency. The inquiry was initiated by Richard Nakamura of the Financial Analysis Division, Cybersecurity Unit, following Quorum's filing of the regulatory not

V. Implications and Remaining Considerations A. Litigation Risk Assessment The closure of the multistate attorney general inquiry without enforcement action significantly reduces the overall risk profile for the Palomar Data Solutions incident. The multistate inquiry represented the most consequential regulatory threat facing Quorum in connection with the breach, given the potential for a coordinated enforcement acti

VI. Recommendations Based on the foregoing analysis, Calderwood & Harkness recommends the following immediate and ongoing actions. A. Immediate Steps

1. Board Notification. Circulate the closure letter to the Quorum Board of Directors Audit Committee (Franklin Reeves, Chair) as part of the matter resolution briefing. The favorable closure of the multistate attorney general inquiry is a material development that should be communicated to the Board in a timely manner, consistent with the Company's governance practices and the Board's prior involvement in overseeing

2. Palomar Payment Confirmation. Confirm receipt of Palomar's $4,200,000 cash indemnification payment by the contractual deadline of approximately November 26, 2023. If payment is not received by that date, Calderwood & Harkness should be notified immediately to assess enforcement options under the settlement agreement.

3. Insurance Coordination. Coordinate with Rachel Bernstein (Calderwood & Harkness, Securities & Capital Markets) and the Atlas Mutual claims team (Paul Enriquez) regarding final insurance recovery processing and any subrogation implications arising from the Palomar indemnification settlement. Ensure that the Palomar settlement terms and recovery amounts are properly disclosed to Atlas to avoid any potential issues u

4. Internal Communication. Issue an internal communication to Quorum senior leadership confirming the favorable resolution of the multistate attorney general track. This communication should be prepared in consultation with Calderwood & Harkness to ensure that it is appropriately worded and does not inadvertently waive any privileges or create any unintended implications. B. Ongoing Compliance Steps

1. Palomar Amendment 3 Monitoring. Continue monitoring Palomar's compliance with the enhanced security requirements imposed by MSA Amendment 3, including the fourteen-day critical patch management deadline, mandatory endpoint detection and response implementation, quarterly vulnerability scanning with reports to Quorum, and the engagement of an independent third-party security assessor for an annual assessment. Prima

2. Post-Incident Recommendations. Implement the post-incident recommendations that will be detailed in Calderwood & Harkness's forthcoming Post-Incident Lessons Learned & Remediation Recommendations Memorandum, which will be prepared upon the conclusion of all regulatory tracks and will address opportunities to strengthen Quorum's incident response protocols, vendor management practices, and information security gove

3. Document Retention and Privilege Maintenance. Maintain all privileged documents, attorney work product, and attorney-client communications related to the matter in accordance with the Document Retention & Privilege Log Protocol to be issued by Calderwood & Harkness in connection with the matter closure. It is essential that the integrity of the privilege over these materials be preserved, particularly in light of

4. Vendor Risk Management Program Enhancements. Update Quorum's enterprise-wide vendor risk management program based on the lessons learned from the Palomar incident. Specific areas for enhancement include strengthened vendor security due diligence processes during onboarding and renewal; shorter contractual notification windows for all critical vendors handling sensitive data; expanded third-party audit and assessme

5. Tabletop Exercises. Conduct tabletop exercises that specifically incorporate vendor-originated data breach scenarios, to test and refine Quorum's incident response capabilities in the context of third-party security events. These exercises should involve cross-functional participation from legal, information security, privacy, vendor risk management, and business operations teams, and should be designed to simulat

VII. Conclusion The closure of the multistate attorney general inquiry without enforcement action represents the most significant regulatory milestone in the Palomar Data Solutions incident response and constitutes a highly favorable outcome for Quorum Insurance Holdings Corp. The multistate inquiry — involving a coalition of twenty-nine state attorneys general, co-led by the Connecticut and New York Attorneys Genera