Contract analysis

Section 1: Purpose and Instructions 1.1 Purpose This memorandum provides the standardized template cover letter for use in filing state regulatory breach notifications with the remaining twenty-four (24) state attorneys general and/or designated state regulators in connection with the Quorum Insurance Holdings Corp. data security incident involving its third-party claims-processing vendor, Palomar Data Solutions, Inc

24. Iowa In addition, the District of Columbia notification is included in this filing round where applicable. For purposes of this memorandum, references to "24 states" or "remaining states" include the District of Columbia unless otherwise specified. New Hampshire is also included in the master tracking for completeness and monitoring, although the number of affected residents is being finalized and the filing may

Section 2: Template Cover Letter The following is the full text of the template cover letter. All bracketed placeholders must be customized for each jurisdiction before filing. CALDERWOOD & HARKNESS LLP Attorneys at Law 1700 K Street NW, Suite 900 Washington, D.C. 20006 Telephone: (202) 555-4100 Facsimile: (202) 555-4101 [Filing Date — insert actual date of filing, August 17–25, 2023] [Name and Title of State Attorne

1. Engagement of Outside Counsel. Quorum engaged Calderwood & Harkness LLP as outside counsel to coordinate all legal aspects of the incident response, including regulatory notifications, consumer notifications, vendor accountability, and potential litigation management.

2. Privileged Forensic Investigation. Calderwood & Harkness LLP retained Graystone Forensics LLC under the attorney-client privilege and work-product doctrine to conduct a comprehensive forensic investigation of the incident, including root cause analysis, scope determination, and attribution analysis.

3. Insurance Claim. Quorum filed a claim under its cyber-liability insurance program with Atlas Mutual Insurance Company, Policy No. CYB-2023-00482, to offset the costs of incident response, consumer notification, credit monitoring services, and related expenses.

4. Containment and Remediation. Quorum worked closely with Palomar to ensure prompt containment and remediation of the vulnerability exploited in the attack. Palomar has confirmed that the CVE-2023-0669 vulnerability has been patched, the compromised file transfer appliance has been replaced, and additional network segmentation and monitoring controls have been implemented within Palomar's environment.

5. Data Mining and Individual Identification. Quorum engaged a specialized data mining firm to conduct a comprehensive review of the exfiltrated data files in order to identify all affected individuals and determine the specific types of personal information compromised for each individual. This process was completed on August 4, 2023.

6. Consumer Notification and Support Services. Quorum has engaged Clearfield Notification Services LLC ("Clearfield") to manage all aspects of consumer notification, including the preparation and mailing of individual written notification letters to all affected individuals, the operation of a dedicated toll-free call center staffed by trained representatives to respond to inquiries from affected individuals, and the

7. Crisis Communications. Quorum engaged BrightPath Consulting Group Inc. to provide crisis communications support and to assist with the development of external communications to policyholders, stakeholders, and the media.

8. Vendor Accountability. Quorum has pursued vendor accountability measures against Palomar, including formal contractual indemnification demands under the Master Services Agreement, demands for enhanced data security requirements and third-party security audits, and reservation of all rights and remedies available to Quorum under the agreement and applicable law.

9. Enhanced Vendor Risk Management. Quorum has undertaken a comprehensive review and enhancement of its vendor risk management program, including the implementation of enhanced due diligence procedures for third-party vendors with access to personal information, updated contractual data security requirements, mandatory annual security assessments for critical vendors, and revised incident response protocols to ensure

1. Copy of sample consumer notification letter (version applicable to [State Name] residents — [indicate version: general PII version / financial data version / PHI version / state-specific version, as appropriate]) 2. [If the state requires: Copy of substitute notice / website posting text] 3. [If the state requires: Completed state-specific breach notification form (e.g., [State Name] Breach Notification Report For

Section 3: State-Specific Customization Reference Table The following quick-reference table is provided to facilitate customization of the template cover letter for each of the remaining twenty-four (24) jurisdictions (plus the District of Columbia). The filing team should use this table in conjunction with the comprehensive State-by-State Notification Timeline & Content Requirements Matrix (dated August 1, 2023, pre

Section 4: Filing Checklist The following pre-filing checklist must be completed for each state filing before submission. The filing attorney should initial each item upon completion and retain the completed checklist in the matter file. State: ____________________ Filing Attorney: ____________________ Date: ____________________ Additional Notes: ________________________________________ ______________________________

Section 5: Filing Log Template The following filing log template is to be completed for each state as the filing is made. Upon completion of all filings, the information from this log will be transferred to the master Regulatory Notification Tracker maintained by Sara Hendricks. The Tracker is to be finalized no later than August 25, 2023, and a final version is to be provided to Kevin Ostrowski for review and to Tho