Contract analysis

I. Introduction and Representation We write on behalf of our client, Quorum Insurance Holdings Corp. ("Quorum" or "QIH"), a Delaware corporation publicly traded on the Nasdaq Global Select Market under the ticker symbol QIHC, with its principal executive offices located at 400 Constitution Plaza, Suite 2200, Hartford, Connecticut 06103. Quorum is a top-25 United States insurance holding company with operating subsidi

II. Background — The Contractual Relationship A. The Master Services Agreement On November 12, 2019, Quorum and Palomar entered into the Master Services Agreement pursuant to which Palomar agreed to provide claims data processing, document management, and analytics services for Quorum's personal lines insurance division. The MSA has a five-year term commencing on November 12, 2019, and expiring on November 11, 2024,

III. Key Contractual Obligations at Issue This Section summarizes the specific contractual provisions that Palomar has breached or that are otherwise relevant to Quorum's indemnification demand. Quorum's recitation of these provisions is not intended to be exhaustive, and Quorum reserves the right to identify additional breached provisions as the investigation continues. A. Data Security Obligations — Exhibit D (as A

Section 9.4 of the MSA imposes a time-critical notification obligation on Palomar. Specifically, Section 9.4 requires Palomar to notify Quorum in writing within forty-eight (48) hours of discovering any security incident, data breach, or unauthorized access, use, or disclosure involving or reasonably believed to involve Quorum data. The notification must include, to the extent known at the time, a description of the

Section 12.2 of the MSA provides that Palomar shall indemnify, defend, and hold harmless Quorum and its affiliates, directors, officers, employees, agents, and representatives (collectively, the "Quorum Indemnitees") from and against any and all losses, liabilities, damages, costs, and expenses, including reasonable attorneys' fees and expenses, arising out of or relating to any breach by Palomar of its data security

Section 14.2 of the MSA provides that either party may terminate the MSA upon written notice if the other party commits a material breach of the MSA and fails to cure such breach within thirty (30) calendar days after receipt of written notice specifying the nature of the breach. As discussed in Section V.C below, the breaches at issue are not susceptible to cure — the data has been exfiltrated and the harm to Quorum

IV. The Security Incident — Facts Based on the information available to Quorum as of the date of this letter — including Palomar's breach notification, subsequent communications between the parties, and the preliminary findings of the forensic investigation conducted under the direction of this firm — the relevant facts are as follows. A. Unauthorized Access and Exploitation On or about March 14, 2023, a threat actor

V. Palomar's Breaches of the MSA Based on the foregoing facts, Palomar has committed the following material breaches of the MSA. A. Breach of Data Security Obligations (Exhibit D) Failure to Timely Patch Critical Vulnerability. Palomar failed to apply the vendor-issued patch for CVE-2023-0669 within thirty (30) calendar days of the date on which the patch was made generally available by the vendor, as required by Sec

VI. Damages and Losses Arising from Palomar's Breaches A. Overview. As a direct and proximate result of Palomar's material breaches of the MSA, Quorum has incurred and will continue to incur substantial losses, costs, and expenses in connection with its response to the security incident. These losses include, without limitation, the costs of forensic investigation, consumer notification and credit monitoring, crisis

1. Forensic Investigation Costs — $1,847,000. Quorum has retained Graystone Forensics LLC under the direction of this firm to conduct the forensic investigation into the security incident. The engagement is led by Dr. Nolan Briggs, Managing Director, Incident Response, a nationally recognized expert in digital forensics and incident response. Graystone's scope of work includes technical forensic analysis of Palomar's

2. Notification and Credit Monitoring Costs — $3,214,500. Quorum has contracted with Clearfield Notification Services LLC ("Clearfield") to manage the consumer notification and credit monitoring program for affected individuals. The Clearfield engagement is managed by Jerome Tillman, Account Manager, and encompasses the following components: (a) Notification Printing and Mailing. Clearfield will prepare, print, and m

3. Crisis Communications Costs — $385,000. Quorum has retained BrightPath Consulting Group Inc. ("BrightPath"), a leading crisis communications firm, to manage external and internal communications strategy in connection with the security incident. The engagement is led by Meredith Ashford, Managing Director. BrightPath's scope of work includes preparation and coordination of press statements and media inquiries, deve

4. Legal Fees — $2,163,750. Calderwood & Harkness LLP was engaged by Quorum on May 4, 2023, to serve as outside breach response counsel. The scope of this firm's engagement encompasses incident response coordination and management, oversight and direction of the forensic investigation, fifty-state notification compliance analysis and implementation, regulatory defense and preparation for potential regulatory inquirie

5. Internal Costs — $620,000. Quorum has incurred and continues to incur significant internal costs in connection with its response to the security incident, including IT remediation efforts to secure Quorum's own systems and assess any residual risk from the compromise of data within Palomar's environment, employee overtime for members of Quorum's information security, legal, compliance, and customer service teams w

VII. Quorum's Remediation Efforts and Mitigation Quorum wishes to make clear that it has acted promptly, diligently, and responsibly to mitigate harm following its discovery of the security incident. From the moment Quorum received Palomar's notification on April 21, 2023, Quorum mobilized its internal incident response team, including its General Counsel, Chief Information Security Officer, Chief Privacy Officer, an

VIII. Reservation of Rights Quorum expressly reserves all rights, claims, and remedies available to it under the MSA, at law, and in equity, including without limitation the following: (a) The right to seek indemnification under Section 12.2 of the MSA up to the full contractual liability cap of $32,600,000, including for losses and expenses not yet incurred or not yet quantified as of the date of this letter; (b) Th

IX. Demand for Response Quorum hereby demands a substantive written response from Palomar, through counsel, within thirty (30) calendar days of the date of this letter — that is, no later than July 20, 2023. Palomar's response should address, at a minimum, the following: (a) Palomar's acknowledgment of its indemnification obligations under Section 12.2 of the MSA with respect to the losses described herein; (b) Palom

X. Closing Quorum looks forward to Palomar's prompt and good-faith response to this letter and to the resolution of this matter in a manner that respects the parties' contractual rights and obligations. Quorum remains willing to engage in constructive discussions regarding the resolution of its indemnification demand, including with respect to the timing and mechanics of payment. However, Quorum will not delay or for

1. Copy of Master Services Agreement dated November 12, 2019

2. Copy of Amendment 1 dated March 3, 2021

3. Copy of Amendment 2 dated September 15, 2022

4. Copy of Palomar breach notification email dated April 21, 2023 (Derek Copeland to Thomas R. Whitfield and David Naranjo) Attorney | Role | Hourly Rate Kevin Ostrowski, Partner | Lead Engagement Partner | $1,250 Rachel Bernstein, Partner | Regulatory and Compliance | $1,175 Alan Burke, Associate | Notification Compliance and Vendor Accountability | $825 Sarah Hendricks, Associate | Forensic Oversight and Data Minin