Contract analysis

I. EXECUTIVE SUMMARY Quorum Insurance Holdings Corp. submits this Response to address the inquiries and demands set forth in the Joint Demand Letter issued by the twenty-nine-state Multistate Attorney General Coalition on September 8, 2023. As demonstrated by the detailed factual record set forth below and in the accompanying Exhibits, the data security incident at issue originated entirely within the systems and net

II. BACKGROUND ON THE PARTIES AND THEIR RELATIONSHIP A. Quorum Insurance Holdings Corp. Quorum Insurance Holdings Corp. is a Delaware corporation, publicly traded on the Nasdaq Stock Market under the ticker symbol QIHC. The Company is headquartered at 400 Constitution Plaza, Suite 2200, Hartford, Connecticut 06103. Quorum is a top-25 United States insurance holding company, as measured by direct premiums written, wit

Section 9.4 of the MSA contains a breach notification clause requiring Palomar to notify Quorum within forty-eight (48) hours of discovering any security incident that affects or is reasonably believed to affect Quorum data. As discussed in detail below, Palomar's notification to Quorum following the incident at issue was approximately twenty-four hours beyond this contractual deadline.

Section 12.2 of the MSA contains an indemnification provision under which Palomar agreed to indemnify and hold harmless Quorum from and against any losses, costs, damages, or expenses arising from Palomar's breach of its obligations under the MSA, including its data security obligations. The indemnification obligation is subject to a contractual cap of two times (2×) the trailing twelve-month fees paid or payable und

III. DETAILED INCIDENT TIMELINE A comprehensive incident timeline is provided in Exhibit A to this Response. For the convenience of the Coalition, a summary of the key events and dates is set forth below. March 14, 2023 — Initial Compromise. On or about March 14, 2023, an unauthorized threat actor exploited CVE-2023-0669, a known critical remote code execution vulnerability in Palomar's GoAnywhere MFT (Managed File T

IV. ROOT CAUSE ANALYSIS A. The Vulnerability: CVE-2023-0669 The root cause of the data security incident was Palomar's failure to timely patch a known critical vulnerability in its GoAnywhere MFT file transfer appliance. The vulnerability, designated CVE-2023-0669, is a pre-authentication remote code execution vulnerability that allows an unauthenticated attacker to execute arbitrary code on the affected appliance. T

V. SCOPE OF COMPROMISED DATA A. Total Affected Population The forensic investigation conducted by Graystone Forensics, as confirmed in the final forensic report dated July 14, 2023, established that a total of 318,247 individuals across twenty-nine states and the District of Columbia were affected by the data security incident. All affected individuals had the following categories of personally identifiable informati

VI. QUORUM'S INCIDENT RESPONSE A. Immediate Response Actions Upon receiving Palomar's notification of the security incident on April 21, 2023, Quorum immediately commenced its internal assessment and response. Quorum's Chief Information Security Officer, David Naranjo, and Chief Privacy Officer, Jennifer Liang, jointly led the Company's initial internal response, coordinating with the Company's General Counsel, Thoma

VII. CONSUMER NOTIFICATION COMPLIANCE A. Notification Obligation Analysis Upon engagement, Calderwood & Harkness conducted a comprehensive, state-by-state analysis of the breach notification statutes in all fifty states and the District of Columbia to determine Quorum's notification obligations in connection with the incident. Based on the types of personal information compromised and the residency of affected indivi

1. General PII Version: Prepared for all 318,247 affected individuals. This version described the incident, identified the types of personal information compromised (name, date of birth, Social Security number, driver's license number), and provided guidance on protective steps.

2. SSN + Financial Data Version: Prepared for the 84,619 individuals whose financial information (bank account numbers, payment card numbers) was also compromised, in addition to the general PII categories. This version included additional guidance specific to the monitoring of financial accounts.

3. PHI Version (HIPAA-Compliant): Prepared for the 41,203 individuals whose protected health information was compromised. This version was drafted in compliance with the HIPAA Breach Notification Rule and included the specific content elements required by 45 C.F.R. § 164.404(c), including a description of the types of unsecured PHI involved, recommended protective steps, a description of what Quorum is doing to inves

4. California-Specific Version: Adapted for the 38,206 affected California residents to comply with the specific content and formatting requirements of California Civil Code § 1798.82, including the required prescribed heading and format requirements.

5. Massachusetts-Specific Version: Adapted for the 10,217 affected Massachusetts residents to comply with the specific content requirements of Massachusetts General Laws chapter 93H, § 3, including the right to obtain a police report and security freeze information. All notification letter versions included the following elements: • A clear and plain-language description of the incident, including the dates of unauth

VIII. VENDOR ACCOUNTABILITY MEASURES A. Identification of Palomar's Contractual Breaches The forensic investigation and Quorum's own legal analysis identified at least two material breaches by Palomar of its obligations under the MSA:

1. Failure to Timely Patch. Palomar failed to apply the available patch for the critical CVE-2023-0669 vulnerability in its GoAnywhere MFT file transfer appliance within thirty (30) days of the vendor patch release, in direct violation of the patching requirements set forth in the Data Security Exhibit (Exhibit D) of the MSA, as amended by Amendment 2 (executed September 15, 2022). This failure was the direct and pro

2. Late Breach Notification. Palomar failed to comply with the forty-eight-hour breach notification requirement set forth in Section 9.4 of the MSA. Palomar's SOC detected the anomalous activity on April 18, 2023, but Palomar's General Counsel did not notify Quorum's General Counsel and CISO until April 21, 2023 — approximately seventy-two hours after detection and approximately twenty-four hours beyond the contractu

IX. QUORUM'S INFORMATION SECURITY PROGRAM An overview of Quorum's enterprise information security program is provided in Exhibit D to this Response. The following summary highlights the key elements of the program relevant to the Coalition's inquiry. Governance. Quorum's information security program is overseen at the highest levels of the organization. The Company's Chief Information Security Officer, David Naranjo,

X. COSTS INCURRED AND FINANCIAL IMPACT Quorum has incurred total incident response costs of $8,230,250 in connection with this matter. These costs are broken down as follows: Insurance Recovery. Of the total $8,230,250 in incident response costs, $5,730,250 is covered by Quorum's primary cyber-liability insurance policy with Atlas Mutual Insurance Company (total costs of $8,230,250 less the $2,500,000 self-insured re