Contract analysis

I. COVER LETTER 1.1 Introductory Statement Dear Attorney General Campbell and Director Galvin: Calderwood & Harkness LLP represents Quorum Insurance Holdings Corp. ("Quorum" or "QIH"), a Delaware corporation publicly traded on the Nasdaq Stock Market under the ticker symbol QIHC, with its principal executive offices located at 400 Constitution Plaza, Suite 2200, Hartford, CT 06103. We submit this filing on behalf of

II. DESCRIPTION OF THE INCIDENT 2.1 Nature of the Breach On or about March 14, 2023, a threat actor exploited a known but unpatched remote code execution vulnerability, identified as CVE-2023-0669, in a GoAnywhere MFT (Managed File Transfer) file transfer appliance operated by Palomar Data Solutions, Inc., Quorum's third-party claims data processing vendor. The CVE-2023-0669 vulnerability is a pre-authentication dese

III. INFORMATION INVOLVED IN THE BREACH 3.1 Types of Personal Information Compromised (Massachusetts Residents) Based on the completed forensic investigation and data mining analysis, the personal information involved in this incident with respect to affected Massachusetts residents includes the following categories, as defined under Mass. Gen. Laws ch. 93H, § 1: • Full names (first name and last name, or first initi

IV. ACTIONS TAKEN IN RESPONSE TO THE BREACH 4.1 Forensic Investigation Upon receiving notification from Palomar on April 21, 2023, Quorum promptly initiated its internal incident response procedures. On May 4, 2023, Quorum engaged Calderwood & Harkness LLP as outside counsel, and on May 5, 2023, Graystone Forensics LLC was retained under the direction of counsel to conduct a comprehensive forensic investigation. The

V. STEPS INDIVIDUALS CAN TAKE TO PROTECT THEMSELVES Quorum is recommending that affected Massachusetts residents take the following steps to protect themselves from potential misuse of their personal information:

1. Enroll in Complimentary Credit Monitoring and Identity Theft Protection Services. Affected individuals should promptly enroll in the 24-month complimentary credit monitoring and identity theft protection services being offered by Quorum. Enrollment information, including a unique activation code and instructions, is included in the consumer notification letter. Individuals should enroll within 90 days of the date

2. Monitor Financial Account Statements. Affected individuals should carefully review their bank account statements, credit card statements, and other financial account statements for any unauthorized transactions or suspicious activity. Any unauthorized charges or withdrawals should be reported immediately to the applicable financial institution.

3. Review Credit Reports. Affected individuals are encouraged to obtain and review free copies of their credit reports from the three major credit reporting agencies — Harborview Enterprises, Penrose Group, and Penmark Enterprises — at www.annualcreditreport.com or by calling 1-877-322-8228. Under federal law, individuals are entitled to one free credit report from each of the three credit reporting agencies every tw

4. Place Fraud Alerts. Affected individuals may place an initial fraud alert on their credit files by contacting any one of the three major credit reporting agencies. An initial fraud alert lasts for one year and requires potential creditors to take steps to verify the identity of the applicant before extending credit. The contact information for each agency is as follows: • Harborview Enterprises: P.O. Box 105069, A

5. Place Security Freezes. Affected individuals have the right to place a security freeze on their credit files at no cost. A security freeze prohibits the credit reporting agency from releasing any information from the individual's credit file without the individual's express authorization. A security freeze may delay or interfere with the timely approval of any subsequent request or application the individual makes

6. Review Explanation of Benefits Statements. For affected individuals whose protected health information was involved, Quorum recommends carefully reviewing Explanation of Benefits ("EOB") statements received from health insurers for any unauthorized medical services, prescriptions, or other healthcare activity. Any suspicious or unauthorized medical activity should be reported to the applicable health insurer immed

7. File Identity Theft Reports. If an affected individual detects any suspicious activity or believes that his or her personal information has been misused, the individual should file an identity theft report with the Federal Trade Commission ("FTC") at www.identitytheft.gov or by calling 1-877-438-4338, and should also file a report with local law enforcement.

8. Contact the Dedicated Toll-Free Call Center. Affected individuals may contact the dedicated toll-free call center at 1-855-491-0327, Monday through Friday, 9:00 a.m. to 9:00 p.m. Eastern Time, for additional information and assistance.

VI. INFORMATION REQUIRED BY MASSACHUSETTS STATUTE 6.1 Statutory Checklist (Mass. Gen. Laws ch. 93H, § 3) In compliance with Mass. Gen. Laws ch. 93H, § 3, the following information is provided: 6.2 Compliance with 201 CMR 17.00 Quorum Insurance Holdings Corp. maintains a comprehensive written information security program ("WISP") consistent with the requirements of 201 CMR 17.00, the Standards for the Protection of Pe

VII. OTHER REGULATORY FILINGS Quorum Insurance Holdings Corp. is concurrently filing data breach notifications with regulators in all 29 affected states and the District of Columbia, in accordance with the applicable breach notification statutes and regulations of each jurisdiction. The following is a summary of the principal regulatory filings being made: The filing with the U.S. Department of Health and Human Servi

VIII. AVAILABILITY FOR FURTHER INFORMATION Quorum Insurance Holdings Corp. and Calderwood & Harkness LLP are available to provide any additional information that the Attorney General or the Director of Consumer Affairs and Business Regulation may require in connection with this notification, and to respond to any questions or inquiries regarding the incident, the investigation, the notification process, or the remedi

IX. SIGNATURE Respectfully submitted, CALDERWOOD & HARKNESS LLP By: ________ Name: Kevin Ostrowski Title: Partner Calderwood & Harkness LLP 1700 K Street NW, Suite 900 Washington, D.C. 20006 On Behalf of Quorum Insurance Holdings Corp. Date: August 17, 2023

X. ENCLOSURES The following exhibits are enclosed with this filing: Exhibit A — Copy of Massachusetts-Specific Consumer Notification Letter Enclosed herewith is a copy of the consumer notification letter dated August 12, 2023, which has been adapted specifically for the 10,217 affected Massachusetts residents. The notification letter is compliant with the requirements of Mass. Gen. Laws ch. 93H, § 3, and 201 CMR 17.0