Contract analysis

I. Executive Summary On September 8, 2023, Quorum Insurance Holdings Corp. ("Quorum" or the "Company") received a joint demand letter (the "Demand Letter") from the Connecticut Attorney General's Office, Consumer Protection Division, through Assistant Attorney General Diane Marchetti, and the New York Attorney General's Office, Bureau of Internet and Technology, through Assistant Attorney General Mark Petrosian. The

II. Summary of the Multistate AG Demand Letter A. Issuing Authorities and Coalition Composition The Demand Letter is co-authored by two lead state attorneys general offices, which serve as the administrative leads for the Multistate Coalition: • Connecticut: Office of the Attorney General, Consumer Protection Division. The lead contact is Assistant Attorney General Diane Marchetti, who has served as lead on several r

1. Detailed Incident Timeline. The Coalition requests a detailed account of the incident timeline, including the date of initial unauthorized access, the date on which the breach was discovered, the date on which Palomar notified Quorum, and the dates of all subsequent material events through the completion of consumer notifications. This request is straightforward, and we are well-positioned to provide a comprehensi

2. Root Cause and Attack Vector. The Coalition requests a description of the root cause of the breach and the specific attack vector exploited by the threat actor. We can describe the exploitation of CVE-2023-0669 in Palomar's GoAnywhere MFT file transfer appliance without disclosing privileged forensic analysis. The key messaging point in responding to this demand is that the root cause was a known, patchable vulner

3. Scope of Compromised Data. The Coalition requests a breakdown of the categories of compromised data, both by data type and by state. Quorum has completed the data mining necessary to provide this information, and the state-by-state breakdown is available. This demand can be fully addressed.

4. Relationship with Palomar Data Solutions. The Coalition requests information regarding Quorum's contractual relationship with Palomar, including the data security requirements imposed on Palomar under the Master Services Agreement. We can provide a substantive overview of the MSA's data security provisions without disclosing privileged negotiation positions, internal assessments of Palomar's compliance posture, or

5. Investigation and Remediation Steps. The Coalition requests a description of the steps Quorum took to investigate and remediate the breach. We can describe the engagement of forensic investigators, the scope of the investigation, and the remedial actions taken, without producing privileged materials such as the Graystone Forensics reports.

6. Consumer Notification Compliance. The Coalition requests detailed information regarding the consumer notification process, including the timing of notifications, the content of notification letters, the delivery method employed, and Quorum's compliance with each state's specific breach notification statute. We are well-positioned to respond comprehensively to this demand, as Quorum maintained meticulous records of

7. Credit Monitoring and Identity Protection Services. The Coalition requests information regarding the credit monitoring and identity protection services offered to affected individuals, including the duration of coverage, the provider, and enrollment statistics. This information is readily available and can be provided.

8. Information Security Program Description. The Coalition requests a description of Quorum's enterprise-wide information security program, including the organizational structure, technical safeguards, and administrative controls. We recommend providing a high-level overview that demonstrates the maturity and comprehensiveness of Quorum's program without disclosing specific technical configurations, penetration testi

9. Vendor Oversight and Accountability Measures. The Coalition requests information regarding the steps Quorum has taken to hold Palomar accountable and to oversee Palomar's remediation efforts. We can describe the contractual enforcement actions taken, the enhanced security measures required of Palomar, and the governance changes implemented, while preserving the confidentiality of specific settlement positions and

10. Steps to Prevent Recurrence. The Coalition requests a description of the measures Quorum has implemented or plans to implement to prevent similar incidents in the future. We can provide a robust description of the program enhancements Quorum has undertaken and is planning.

11. Response Deadline. The Demand Letter specifies a response deadline of thirty (30) days from receipt, which sets the initial deadline at October 8, 2023. As discussed in Section IV.B below, we recommend requesting a brief five-day extension to October 13, 2023, to ensure that we can provide a comprehensive and accurate response.

III. Strategic Objectives A. Primary Objective Our primary objective in responding to the Multistate AG Demand Letter is to achieve closure of the inquiry without formal enforcement action, consent order, monetary penalty, or required injunctive relief. In our experience, state attorneys general evaluating data breach responses consider several key factors when determining whether to pursue enforcement action, includ

IV. Recommended Response Approach A. Overarching Tone and Posture The tone and posture of Quorum's response will be as important as its substance. State attorneys general are experienced at distinguishing between companies that genuinely cooperate with investigations and those that merely go through the motions. A defensive or adversarial posture would be counterproductive and could increase the risk of enforcement a

1. Kevin Ostrowski will place telephone calls to AAG Marchetti and AAG Petrosian on September 12 or 13, 2023, to request the extension informally. This personal outreach serves the dual purpose of introducing Calderwood & Harkness as Quorum's counsel, establishing a constructive working relationship with the lead AAGs, and ensuring that the extension request does not come as a surprise.

2. Following the telephone conversations, Calderwood & Harkness will send written confirmation of the extension request via email and letter to both AAGs, with copies to the other Coalition members as directed by the lead states.

3. If the extension is denied — which we consider unlikely given the modest nature of the request — we are prepared to file a substantially complete response by the original October 8, 2023 deadline. The drafting timeline set forth in Section IX below has been designed with sufficient margin to accommodate this contingency.

V. Key Themes and Messaging Framework The following six themes constitute the core messaging framework for Quorum's response. Each theme is supported by specific facts and should be woven throughout the written narrative response and supporting exhibits. The themes are designed to work together to present a cohesive narrative: Quorum is a responsible, well-managed company that maintained appropriate safeguards, was v

VI. Proposed Response Structure and Exhibits A. Written Narrative Response The written narrative response to the Multistate Coalition should be organized into the following sections, each of which corresponds to one or more of the information demands set forth in the Demand Letter and incorporates the themes and messaging framework discussed in Section V above: Introductory Section. The response should open with a co

Section I: Incident Overview and Timeline. This section should provide a clear, chronological narrative of the incident from the date of initial unauthorized access through the completion of consumer notifications and ongoing remediation efforts. The timeline should be presented in a factual, straightforward manner, avoiding legal conclusions or characterizations that could be construed as admissions.

Section II: Root Cause Analysis. This section should describe the root cause of the breach — the exploitation of CVE-2023-0669 in Palomar's GoAnywhere MFT appliance — and explain that the breach was vendor-originated and attributable to Palomar's failure to timely patch a known vulnerability. This section should present factual information derived from the investigation without producing or referencing privileged mat

Section III: Scope of Compromised Data. This section should provide a comprehensive breakdown of the compromised data, both by data type and by state. The state-by-state figures, based on the data mining completed by August 4, 2023, are as follows: The response should also break down the data by type: general PII (all 318,247 individuals), financial data (84,619 individuals), and PHI (41,203 individuals), with descri

Section IV: Quorum's Relationship with Palomar. This section should describe the nature of Quorum's contractual relationship with Palomar, the scope of services Palomar provides, and the data security requirements imposed on Palomar under the MSA. This section should provide a substantive overview of the key contractual provisions without disclosing privileged negotiation positions or the specific terms of the ongoin

Section V: Investigation and Remediation Steps. This section should describe the steps Quorum took upon learning of the incident, including the engagement of forensic investigators, the scope and findings of the investigation, the remedial actions taken within Palomar's environment, and Quorum's own validation and verification activities. This section should be drafted carefully to present factual information without

Section VI: Consumer Notification Compliance. This section should provide a detailed account of Quorum's consumer and regulatory notification process, including the timing, content, and delivery method of all notifications, and Quorum's compliance with each state's specific breach notification statute. This section should cross-reference the compliance checklist in Exhibit B.

Section VII: Consumer Remediation. This section should describe the credit monitoring and identity theft protection services offered to affected individuals, the call center established to assist affected individuals, enrollment statistics, and the total investment in consumer remediation.

Section VIII: Vendor Accountability Measures. This section should describe the steps Quorum has taken to hold Palomar accountable, including the contractual enforcement actions pursued, the enhanced security measures required of Palomar, and the governance changes implemented. This section should cross-reference the vendor accountability summary in Exhibit C.

Section IX: Quorum's Information Security Program. This section should provide a high-level description of Quorum's enterprise-wide information security program, its governance structure, and its key technical and administrative controls. This section should cross-reference the program overview in Exhibit D.

Section X: Preventive Measures and Enhancements. This section should describe the forward-looking measures Quorum has implemented or is implementing to prevent recurrence, including enhancements to the vendor risk management program, shortened notification windows, expanded audit requirements, data minimization efforts, and incident response plan updates. B. Exhibit A — Incident Timeline and Remedial Measures Summary

1. Copies of all five notification letter versions (General PII, Financial Data, PHI, California-specific, Massachusetts-specific).

2. A state-by-state compliance checklist in tabular format, showing for each of the twenty-nine states plus the District of Columbia: the applicable statute, the statutory notification deadline, the date of Quorum's filing, the method of filing (e.g., online portal, email, certified mail), and Quorum's compliance status.

3. A copy of the substitute notice / website posting text.

4. A copy of the media notice distributed in compliance with 45 C.F.R. § 164.406. This exhibit is designed to provide the Coalition with comprehensive, independently verifiable evidence of Quorum's notification compliance. D. Exhibit C — Palomar Vendor Accountability Summary Exhibit C should provide a summary of Quorum's vendor accountability efforts that is sufficiently detailed to demonstrate the seriousness of Quo

1. An overview of the key MSA provisions requiring Palomar to maintain adequate data security, including the critical patch management requirement, the breach notification clause, and the indemnification provisions.

2. A description of Palomar's specific contractual breaches (failure to patch CVE-2023-0669 within the 30-day window; late notification exceeding the 48-hour requirement by approximately 24 hours).

3. A summary of the steps Quorum has taken to enforce its contractual rights, characterized as "active contractual enforcement proceedings" without disclosing specific dollar figures, settlement positions, or litigation strategy.

4. A description of the enhanced security measures Quorum is requiring Palomar to implement as a condition of the continued business relationship.

5. A caveat noting that certain information related to the contractual enforcement proceedings is subject to attorney-client privilege and work product protection and is not being disclosed in this submission. E. Exhibit D — Quorum Information Security Program Overview Exhibit D should provide a high-level description of Quorum's enterprise-wide information security program, organized around the following elements:

1. Governance Structure: Description of the organizational structure for information security governance, including the roles of CISO David Naranjo, CPO Jennifer Liang, and VP Vendor Risk Management Priya Deshmukh, and their reporting relationships to senior management and the Board of Directors.

2. Technical Safeguards: Overview of key technical controls, including network segmentation, access controls, encryption, monitoring and detection capabilities, and incident response infrastructure. This overview should be high-level and should not disclose specific configurations or technical details.

3. Administrative Safeguards: Description of policies, procedures, and governance frameworks, including information security policies, acceptable use policies, data classification standards, and risk assessment processes.

4. Vendor Risk Management Program: Description of the vendor due diligence, assessment, and monitoring program, including the contractual requirements imposed on vendors, the audit and assessment schedule, and the vendor risk tiering methodology.

5. Employee Training: Description of the security awareness training program, including frequency, content, and completion tracking.

6. Post-Incident Enhancements: Summary of the program enhancements undertaken in response to this incident, cross-referencing the preventive measures described in the narrative response.

VII. Privilege and Confidentiality Considerations The protection of privileged materials is a critical concern throughout the preparation and submission of the AG response. We address the key privilege considerations below. Graystone Forensics Investigation. The forensic investigation conducted by Graystone Forensics, LLC (Dr. Nolan Briggs, Lead Forensic Examiner; Kendra Faulkner, Senior Analyst) was initiated at the

VIII. Coordination with Parallel Regulatory Tracks A. Connecticut Insurance Department In addition to the Multistate AG inquiry, Quorum is subject to a separate inquiry from the Connecticut Insurance Department, Financial Analysis Division, Cybersecurity Unit, conducted by Richard Nakamura. This inquiry is being conducted under the authority of Conne