Contract analysis

I. INTRODUCTION AND PURPOSE OF FILING Calderwood & Harkness LLP respectfully submits this notification on behalf of its client, Quorum Insurance Holdings Corp. ("Quorum" or "QIH"), a Delaware corporation publicly traded on the Nasdaq Stock Market (ticker symbol: QIHC), with its principal executive offices located at 400 Constitution Plaza, Suite 2200, Hartford, Connecticut 06103. This filing is made pursuant to New Y

II. DESCRIPTION OF THE SECURITY INCIDENT A. Nature of the Incident On or about March 14, 2023, an unauthorized threat actor exploited CVE-2023-0669, a known remote code execution vulnerability in the GoAnywhere MFT (Managed File Transfer) appliance, to gain unauthorized access to the network environment maintained by Palomar Data Solutions, Inc. The GoAnywhere MFT appliance is a widely used enterprise software platfo

III. INFORMATION ABOUT AFFECTED NEW YORK RESIDENTS A. Number of Affected Individuals The total number of New York residents whose private information was compromised in connection with this security incident is 47,831. This figure has been determined through the comprehensive data mining and affected individual identification process described in Section II.B above, which was completed on August 4, 2023. The 47,831 a

IV. REMEDIAL ACTIONS TAKEN Quorum Insurance Holdings Corp. has taken and continues to take a comprehensive set of remedial actions in response to this security incident. These actions are designed to investigate the scope and impact of the breach, to notify affected individuals and applicable regulators, to protect affected individuals from potential harm, and to prevent the occurrence of similar incidents in the fut

V. INSURANCE AND CRISIS COMMUNICATIONS Quorum Insurance Holdings Corp. maintains cyber-liability insurance coverage to defray costs associated with data security incidents of this nature. Quorum's primary cyber-liability insurance policy is issued by Atlas Mutual Insurance Company (Policy No. CYB-2023-041587), which provides a per-occurrence limit of $15,000,000 subject to a $2,500,000 self-insured retention. In addi

VI. OTHER REGULATORY NOTIFICATIONS In addition to this filing with the Office of the New York Attorney General, Quorum is filing data breach notifications with regulators in all other affected jurisdictions as required by applicable law. The following is a summary of the other regulatory notifications being filed or already filed in connection with this security incident: • Connecticut Attorney General: Filed August

VII. CONTACT INFORMATION Questions, correspondence, or requests for additional information regarding this notification filing, the underlying security incident, or Quorum's remediation efforts should be directed to the following contacts: Kevin Ostrowski Partner, Privacy & Data Security Practice Group Calderwood & Harkness LLP 1700 K Street NW, Suite 900 Washington, D.C. 20006 Telephone: (202) 555-7400 Email: kostrow

VIII. SIGNATURE BLOCK Respectfully submitted, CALDERWOOD & HARKNESS LLP By: ________ Kevin Ostrowski Partner, Privacy & Data Security Practice Group Calderwood & Harkness LLP 1700 K Street NW, Suite 900 Washington, D.C. 20006 On behalf of Quorum Insurance Holdings Corp. Date: August 16, 2023 Enclosure: Attachment A — Sample Consumer Notification Letter (New York Residents) ATTACHMENT A SAMPLE CONSUMER NOTIFICATION LE