Contract analysis

I. Introduction and Purpose Calderwood & Harkness LLP submits this letter on behalf of our client, Quorum Insurance Holdings Corp. ("Quorum" or "QIH"), a Delaware corporation publicly traded on the Nasdaq Stock Market (ticker: QIHC), with its principal executive offices located at 400 Constitution Plaza, Suite 2200, Hartford, Connecticut 06103. This submission is made in response to the multistate coalition's request

1. Updated Credit Monitoring Enrollment Statistics and Consumer Remediation Update. The Coalition requested current data regarding the enrollment rates for complimentary credit monitoring and identity theft protection services offered to affected consumers, as well as an update on consumer complaint volume and any reports of confirmed consumer harm.

2. Confirmation of Palomar Data Solutions, Inc.'s Implementation of Enhanced Security Measures. The Coalition requested confirmation that the third-party vendor responsible for the data security incident—Palomar Data Solutions, Inc. ("Palomar")—has implemented or is in the process of implementing enhanced information security measures to address the root cause of the breach and reduce the risk of recurrence.

3. Summary of the Vendor Accountability Resolution Reached Between Quorum and Palomar. The Coalition requested a summary of the financial and contractual resolution reached between Quorum and Palomar on October 27, 2023, including the terms of financial recovery and the enhanced security obligations imposed upon Palomar as part of that resolution. Quorum has cooperated fully with the Coalition's inquiry since its inc

II. Updated Credit Monitoring Enrollment Statistics and Consumer Remediation Update A. Consumer Notification Summary As described in Quorum's initial written response, Quorum undertook a comprehensive consumer notification effort following its determination that the data security incident resulted in unauthorized access to, and exfiltration of, personally identifiable information ("PII"), financial data, and protecte

III. Confirmation of Palomar Data Solutions Enhanced Security Measures A. Background on the Vendor Relationship As detailed in Quorum's initial written response, the data security incident originated not within Quorum's own network environment, but within the network environment of Quorum's third-party claims data processing vendor, Palomar Data Solutions, Inc. ("Palomar"). Palomar is a Texas corporation headquartere

IV. Summary of Vendor Accountability Resolution (October 27, 2023 Settlement) A. Indemnification Claim Following the completion of the forensic investigation and the determination that Palomar's failure to timely apply the CVE-2023-0669 patch constituted a breach of Palomar's data security obligations under the MSA, Quorum asserted a formal indemnification claim against Palomar under Section 12.2 of the MSA. Section

V. Additional Remediation and Forward-Looking Measures by Quorum In addition to the vendor-specific remediation measures described in Sections III and IV above, Quorum has undertaken a comprehensive review and enhancement of its own information security program in the wake of the data security incident. While the incident originated within the network environment of a third-party vendor—and not within Quorum's own sy

VI. Conclusion Quorum respectfully submits that the information set forth in this submission, together with the information previously provided in Quorum's initial written response and Exhibits A through D, demonstrates Quorum's comprehensive, prompt, and good-faith response to the vendor-originated data security incident. Specifically, Quorum's response has included: • Timely and Compliant Consumer and Regulatory No