1025-00006 · Graystone Forensics LLC · Board & Management Reporting

board-briefing-memo-initial-incident.docx DOCUMENT Data Privacy

2 / 88 ← → ✕

Contract analysis Extract to table

PRIVILEGED & CONFIDENTIAL ATTORNEY-CLIENT PRIVILEGED — ATTORNEY WORK PRODUCT

MEMORANDUM

May 11, 2023

TO:

Franklin Reeves, Chair, Audit Committee, Board of Directors, Quorum Insurance Holdings Corp.

Members of the Board of Directors of Quorum Insurance Holdings Corp.

FROM:

Kevin Ostrowski, Responsible Partner, Privacy & Data Security, Calderwood & Harkness LLP

Thomas R. Whitfield, General Counsel, Quorum Insurance Holdings Corp.

RE:

Initial Briefing — Vendor-Originated Data Security Incident (Palomar Data Solutions, Inc.)

MATTER NO.: 1025-00006

PRIVILEGE NOTICE: This memorandum is a privileged and confidential attorney-client communication and attorney work product, prepared in anticipation of litigation and for the purpose of providing legal advice to Quorum Insurance Holdings Corp. and its Board of Directors. The contents of this memorandum reflect the mental impressions, conclusions, opinions, and legal theories of counsel. This memorandum should not be disclosed to any third party without prior written authorization from Calderwood & Harkness LLP or the Quorum Insurance Holdings Corp. General Counsel's Office. Inadvertent disclosure of this memorandum does not constitute a waiver of any applicable privilege or protection.

I. Executive Summary

The purpose of this memorandum is to provide the Audit Committee and the full Board of Directors of Quorum Insurance Holdings Corp. ("Quorum" or the "Company") with an initial confidential briefing regarding a significant data security incident that originated from Quorum's third-party claims-processing vendor, Palomar Data Solutions, Inc. ("Palomar" or "PDS"). This briefing is being provided under the attorney-client privilege and work product doctrine, and all recipients are requested to treat the contents of this memorandum with the utmost confidentiality.

On April 21, 2023, Quorum received notification from Palomar that Palomar had discovered unauthorized access to its network environment on April 18, 2023. Based on Palomar's preliminary internal investigation and information subsequently gathered by counsel, the unauthorized access is believed to have begun on or about March 14, 2023, through the exploitation of a known remote code execution vulnerability, identified as CVE-2023-0669, in Palomar's GoAnywhere MFT file transfer appliance. The vulnerability in question had been publicly disclosed and a vendor-supplied patch had been made available prior to the date of exploitation.

The incident potentially exposed personally identifiable information ("PII"), protected health information ("PHI"), and financial data belonging to Quorum policyholders and claimants whose data was processed by Palomar under the Master Services Agreement dated November 12, 2019, as subsequently amended (the "MSA"). The categories of data at risk include, but may not be limited to, Social Security numbers, dates of birth, financial account information, and health-related claims data from Quorum's personal lines division.

The full scope of affected individuals has not yet been determined. However, preliminary indications suggest that the exposure may be substantial, potentially spanning multiple states in which Quorum's personal lines division operates. The forensic investigation necessary to determine the definitive scope and nature of compromised data is currently underway and is expected to produce preliminary findings in early June 2023 and a final report by mid-July 2023.

Calderwood & Harkness LLP ("Calderwood & Harkness" or the "Firm") was formally engaged on May 4, 2023, to coordinate the legal response to this incident, including oversight of the privileged forensic investigation, regulatory compliance analysis, notification obligation assessment, vendor accountability, and insurance coverage coordination. On May 5, 2023, Calderwood & Harkness retained Graystone Forensics LLC ("Graystone") under the attorney-client privilege umbrella to conduct the technical forensic investigation.

Insurance coverage has been noticed under Quorum's cyber-liability insurance tower. A formal notice of claim was filed with Atlas Mutual Insurance Company ("Atlas Mutual"), Quorum's primary cyber-liability insurer, on May 8, 2023. Precautionary notice was also provided to Pinnacle Surplus Lines Insurance Corp. ("Pinnacle"), the excess carrier. A common interest agreement was executed on May 10, 2023, to facilitate the sharing of privileged information with Atlas Mutual without waiver of applicable privileges.

At this stage, no regulatory enforcement actions, inquiries, or lawsuits have been filed in connection with this incident. The matter remains in the investigation and assessment phase. Calderwood & Harkness and the General Counsel's Office will continue to provide the Audit Committee with updated briefings at key milestones as the investigation and response progress.

II. Background — Quorum's Relationship with Palomar Data Solutions

A. Palomar Overview

Palomar Data Solutions, Inc. ("Palomar" or "PDS") is a Texas corporation headquartered at 7100 Greenville Avenue, Suite 450, Dallas, Texas 75231. Palomar provides claims data processing, document management, and data analytics services to mid-to-large insurance carriers across the United States. Palomar has been in operation since 2008 and has grown to become a significant vendor in the insurance technology services space.

Palomar's senior management team includes Marcus J. Trevino, Chief Executive Officer; Anita Raghavan, Chief Technology Officer; and Derek Copeland, General Counsel. Palomar reported annual revenue of approximately $340 million for its fiscal year ending December 31, 2022, and employs approximately 2,100 individuals across its Dallas headquarters and satellite offices.

Quorum is Palomar's second-largest client by revenue, underscoring the significance of the commercial relationship and the volume of Quorum data processed within Palomar's environment. This relationship, and the nature and volume of Quorum data entrusted to Palomar, are directly relevant to assessing both the potential scope of the current incident and Quorum's contractual rights against Palomar.

B. Master Services Agreement

Quorum and Palomar are parties to a Master Services Agreement (the "MSA") executed on November 12, 2019, with a five-year initial term expiring November 11, 2024. The MSA governs Palomar's provision of claims data processing and related services to Quorum's personal lines insurance division. The original annual contract value ("ACV") under the MSA was $14,200,000.

Since execution, the MSA has been amended twice:

Amendment 1 (executed March 3, 2021): This amendment expanded the scope of services to include data processing for Quorum's QuorumEdge platform, a proprietary claims analytics tool. Amendment 1 increased the ACV by $2,100,000, bringing the total ACV to $16,300,000 effective April 1, 2021.

Amendment 2 (executed September 15, 2022): This amendment updated the Data Security Exhibit (Exhibit D) to the MSA, incorporating enhanced data security requirements. Specifically, Amendment 2 added a requirement that Palomar maintain and provide to Quorum a SOC 2 Type II audit report on an annual basis, and updated the minimum cyber-liability insurance coverage thresholds that Palomar is required to maintain. Amendment 2 was negotiated in connection with Quorum's enterprise-wide vendor risk management enhancement initiative led by Priya Deshmukh, VP, Vendor Risk Management.

Under the MSA, Palomar processes claims data for Quorum's personal lines division, which includes property, casualty, auto, and workers' compensation lines. The data processed by Palomar encompasses PII (including names, Social Security numbers, dates of birth, and driver's license numbers), financial information (including bank account numbers and payment card numbers), and health-related claims data that may constitute PHI under the Health Insurance Portability and Accountability Act ("HIPAA") and its implementing regulations.

C. Relevant Contractual Provisions

The MSA contains several provisions directly relevant to the current incident and Quorum's legal position. Calderwood & Harkness has conducted a preliminary review of these provisions, and a more comprehensive analysis is underway. The key provisions are summarized below:

Data Security Exhibit (Exhibit D, as amended by Amendment 2): Exhibit D requires Palomar to implement and maintain "commercially reasonable" administrative, technical, and physical safeguards to protect Quorum data against unauthorized access, use, disclosure, alteration, or destruction. Exhibit D further specifies, among other requirements, that Palomar must: (i) apply patches for critical vulnerabilities within thirty (30) days of the date the applicable vendor patch is publicly released; (ii) conduct annual penetration testing of its network environment by a qualified independent third-party assessor; and (iii) provide Quorum with a SOC 2 Type II audit report on an annual basis. These requirements are central to the assessment of Palomar's potential liability, as discussed further below.

Breach Notification Clause (Section 9.4): Section 9.4 of the MSA requires Palomar to notify Quorum within forty-eight (48) hours of Palomar's discovery of any security incident that affects or is reasonably believed to affect Quorum data. The notification must include a description of the nature of the incident, the data types potentially affected, and the remedial actions taken or planned. As discussed in Section III.B below, Palomar's notification to Quorum was provided approximately twenty-four (24) hours after the expiration of this contractual deadline.

Indemnification (Section 12.2): Section 12.2 provides that Palomar shall indemnify, defend, and hold harmless Quorum and its officers, directors, employees, and agents from and against all losses, damages, costs, and expenses (including reasonable attorneys' fees) arising out of or resulting from Palomar's breach of its data security obligations under the MSA, including Exhibit D. This indemnification obligation is subject to a contractual liability cap equal to two times (2×) the trailing twelve-month fees paid by Quorum to Palomar. Based on the current ACV of $16,300,000, the applicable liability cap is $32,600,000.

Insurance Requirements (Exhibit E): Exhibit E requires Palomar to obtain and maintain, at its own expense, cyber-liability insurance coverage with a minimum per-occurrence limit of $10,000,000 throughout the term of the MSA. Calderwood & Harkness has requested that Palomar provide current certificates of insurance for verification, and Palomar's counsel has indicated that such certificates will be provided in due course.

Termination for Cause (Section 14.2): Section 14.2 provides that Quorum may terminate the MSA upon written notice in the event of a material breach by Palomar, provided that Palomar is given a thirty (30) day period to cure the breach following receipt of written notice. Calderwood & Harkness is evaluating whether the events giving rise to this incident constitute a material breach of the MSA that could support termination for cause, while also considering the operational implications and transition planning that would be required if termination were pursued.

III. Incident discovery and Timeline

A. Chronology of Events

The following chronology sets forth the key events related to the incident, based on information available as of the date of this memorandum. This timeline is preliminary and subject to revision as the forensic investigation progresses and additional information becomes available.

On or about March 14, 2023: A threat actor exploited a known but unpatched remote code execution vulnerability, designated CVE-2023-0669, in Palomar's GoAnywhere MFT file transfer appliance to gain initial unauthorized access to Palomar's network environment. The GoAnywhere MFT platform is a managed file transfer solution that Palomar uses to facilitate the secure transfer of data files between Palomar and its clients, including Quorum. CVE-2023-0669 is a pre-authentication command injection vulnerability that permits a remote attacker to execute arbitrary code on the affected system. A vendor-supplied patch for this vulnerability was publicly released by Severin Corporation (the vendor of GoAnywhere MFT) in early February 2023, more than thirty days prior to the exploitation date. Palomar's failure to apply this patch within the timeframe required by Exhibit D of the MSA is a significant factor in the legal analysis.

March 14 – April 18, 2023 (approximately 35 days): During this period, the threat actor maintained persistent unauthorized access to Palomar's network environment. Based on Palomar's initial assessment, the threat actor engaged in lateral movement within the network, ultimately gaining access to Palomar's claims processing environment. During this window, the threat actor is believed to have staged and exfiltrated structured data files from the claims processing environment. The precise volume and content of exfiltrated data are the primary subjects of the ongoing Graystone forensic investigation.

April 18, 2023: Palomar's internal Security Operations Center ("SOC") detected unusual patterns of outbound data transfers from its network. This detection triggered Palomar's internal incident response procedures. Palomar's security team initiated containment measures, including isolating the affected systems and revoking the threat actor's access credentials. This date is considered the date of Palomar's discovery of the incident for purposes of contractual and regulatory notification timelines.

April 21, 2023: Palomar General Counsel Derek Copeland notified Quorum General Counsel Thomas R. Whitfield and Quorum Chief Information Security Officer David Naranjo via email of the security incident. The notification provided a high-level description of the incident, including the approximate date range of unauthorized access, the suspected vulnerability exploited, and an indication that Quorum data may have been affected. This notification was provided approximately seventy-two (72) hours after Palomar's internal discovery on April 18, 2023, which is approximately twenty-four (24) hours later than the forty-eight (48) hour contractual notification deadline under MSA Section 9.4.

April 21 – May 3, 2023: Following receipt of Palomar's notification, Quorum's General Counsel and CISO initiated internal coordination, including preliminary assessment of the potential scope and impact, review of the MSA provisions, and evaluation of the need for outside counsel engagement. During this period, Quorum's internal teams gathered initial information from Palomar regarding the nature and extent of the compromise.

May 4, 2023: Quorum formally engaged Calderwood & Harkness LLP, through its Privacy & Data Security practice group in Washington, D.C., to manage the legal response to the incident. The engagement encompasses incident response coordination, forensic investigation oversight under privilege, notification obligation analysis, regulatory compliance and defense, vendor accountability and indemnification analysis, and insurance coverage coordination.

May 5, 2023: Calderwood & Harkness retained Graystone Forensics LLC, a digital forensics and incident response firm headquartered in Tysons Corner, Virginia, under the attorney-client privilege umbrella to conduct the technical forensic investigation. The retention of Graystone through outside counsel is intended to protect the forensic investigation and its work product under the attorney-client privilege and work product doctrine.

May 6, 2023: Calderwood & Harkness prepared, and Quorum issued, legal hold notices to the Information Technology and Claims Operations departments. The legal hold notices were directed to David Naranjo, Chief Information Security Officer, and Robert Wentworth, Senior Vice President, Claims Operations, directing the preservation of all documents, electronic records, communications, and data related to the Palomar incident, Quorum's relationship with Palomar, and the data processed by Palomar on behalf of Quorum.

May 7, 2023: Graystone Forensics finalized the scope of work and investigation plan for the forensic investigation, establishing the following key milestones: preliminary findings report targeted for delivery in early June 2023; final forensic report targeted for delivery by mid-July 2023. The investigation plan encompasses analysis of Palomar's network logs, system artifacts, and data transfer records to determine the threat actor's entry vector, the timeline and scope of unauthorized access, the specific data sets accessed and exfiltrated, and the data types compromised.

May 8, 2023: Calderwood & Harkness prepared and submitted an initial incident assessment memorandum to Thomas R. Whitfield, General Counsel. On the same date, Quorum filed a formal notice of claim with Atlas Mutual Insurance Company under its primary cyber-liability insurance policy (Claim No. CYB-CLM-2023-05892), and precautionary notice was sent to Pinnacle Surplus Lines Insurance Corp. under the excess cyber-liability policy.

May 10, 2023: A common interest agreement was executed between Quorum and Atlas Mutual Insurance Company to permit the sharing of privileged investigation materials and communications between the parties and their respective counsel without waiver of the attorney-client privilege or work product protection.

May 11, 2023: This memorandum is being provided to the Audit Committee and the Board of Directors.

B. Palomar's Late Notification

Under MSA Section 9.4, Palomar was contractually required to notify Quorum within forty-eight (48) hours of Palomar's discovery of a security incident affecting or reasonably believed to affect Quorum data. Palomar discovered the incident on April 18, 2023, when its Security Operations Center detected the anomalous outbound data transfers. Accordingly, the contractual notification deadline expired at approximately the same time on April 20, 2023.

Palomar did not notify Quorum until April 21, 2023, approximately seventy-two (72) hours after discovery. This represents a delay of approximately twenty-four (24) hours beyond the contractual deadline established by Section 9.4 of the MSA.

This late notification is noted as a potential contractual breach that will be addressed in the vendor accountability workstream. While the delay may not, standing alone, have caused additional harm to Quorum (given that the unauthorized access had already persisted for approximately thirty-five days prior to Palomar's own detection), the breach of the notification covenant is relevant to the overall assessment of Palomar's contractual compliance and may support Quorum's indemnification demand and other contractual remedies.

IV. Preliminary Assessment of Potential Scope and Impact

A. Data Types Potentially Compromised

Based on Palomar's initial notification to Quorum and Calderwood & Harkness's preliminary assessment of the categories of Quorum data processed by Palomar under the MSA, the incident potentially involves the following categories of Quorum data:

Personally Identifiable Information (PII): Full names, dates of birth, Social Security numbers, and driver's license numbers of Quorum policyholders and claimants whose claims were processed by Palomar.

Financial Information: Bank account numbers, routing numbers, and payment card numbers associated with premium payments, claims payments, and other financial transactions processed by Palomar on behalf of Quorum.

Protected Health Information (PHI): Health conditions, medical diagnosis codes (including ICD-10 codes), treatment information, provider information, and other health-related data from workers' compensation and health-related insurance claims processed by Palomar. To the extent this data constitutes PHI under HIPAA, its compromise may trigger additional notification obligations under the HIPAA Breach Notification Rule.

The full scope and number of affected individuals have not yet been determined. The identification of specific data sets accessed and exfiltrated by the threat actor, and the enumeration of affected individuals, are among the primary objectives of the Graystone forensic investigation. Until the forensic investigation is completed, all assessments of scope remain preliminary and subject to material revision.

B. Potential Geographic Scope

Quorum's personal lines division operates across all fifty (50) states and the District of Columbia. The claims data processed by Palomar under the MSA may include data pertaining to policyholders and claimants residing in numerous states. As a result, depending on the forensic findings, the incident may trigger notification obligations under multiple state breach notification laws, each of which has its own requirements regarding the timing, content, and method of notification, as well as specific data elements that trigger the notification obligation.

In addition, if PHI is confirmed to have been compromised, the HIPAA Breach Notification Rule (45 C.F.R. Part 164, Subpart D) may require notification to the U.S. Department of Health and Human Services ("HHS"), Office for Civil Rights, and to affected individuals. The HIPAA notification obligations are separate from and in addition to state breach notification requirements.

Calderwood & Harkness has commenced a comprehensive fifty-state breach notification law survey to prepare for notification obligations once the forensic investigation determines the definitive scope of compromised data and the geographic distribution of affected individuals. This survey will identify, on a state-by-state basis, the applicable notification triggers, deadlines, content requirements, and designated regulatory recipients.

C. Potential Regulatory and Legal Implications

Calderwood & Harkness has identified the following potential regulatory and legal implications arising from this incident, each of which will be evaluated in greater detail as the forensic investigation progresses and the scope of the incident is determined:

State Breach Notification Laws: Depending on the data types confirmed compromised and the states of residence of affected individuals, Quorum may be required to provide notification to affected consumers and to state attorneys general or other designated state agencies under applicable state breach notification statutes. The specific notification triggers, deadlines, and requirements vary by state. Calderwood & Harkness's fifty-state survey will identify all applicable obligations.

Connecticut Attorney General Notification: Under Connecticut General Statutes § 36a-701b, Quorum is required to notify the Connecticut Attorney General of any breach of security involving the personal information of Connecticut residents. Given that Quorum is headquartered in Hartford, Connecticut, and that a significant number of affected individuals may reside in Connecticut, compliance with this statute will be a priority.

Connecticut Insurance Data Security Law: As a licensed Connecticut insurer, Quorum is subject to the Connecticut Insurance Data Security Law, Connecticut General Statutes § 38a-999b, which imposes specific data security and breach notification obligations on licensees of the Connecticut Insurance Department. Calderwood & Harkness is evaluating Quorum's obligations under this statute, including any required notification to the Connecticut Insurance Department.

HIPAA Breach Notification Rule: If PHI is confirmed compromised, the HIPAA Breach Notification Rule (45 C.F.R. Part 164, Subpart D) will require Quorum to provide notification to affected individuals, to the HHS Office for Civil Rights, and potentially to prominent media outlets in states where more than 500 individuals are affected. The HIPAA Breach Notification Rule requires notification without unreasonable delay and in no case later than sixty (60) days following the discovery of the breach. Calderwood & Harkness is evaluating the applicability of HIPAA to the Quorum-Palomar relationship and the data at issue, including whether Palomar functions as a business associate under HIPAA.

Multistate Attorney General Inquiries: Incidents of this nature and scale frequently attract the attention of state attorneys general, who may initiate informal or formal inquiries, demand letters, or coordinated multistate investigations. Calderwood & Harkness will monitor for any incoming communications from state regulators and will prepare Quorum to respond promptly and effectively.

Consumer Class Action Litigation: Data security incidents involving the compromise of sensitive PII and financial data frequently give rise to consumer class action litigation, typically alleging claims such as negligence, breach of implied contract, unjust enrichment, and violations of state consumer protection statutes. Calderwood & Harkness will monitor for any litigation filings and will coordinate with Quorum's litigation counsel as appropriate.

SEC Disclosure Obligations: As a publicly traded company, Quorum is subject to the Securities and Exchange Commission's ("SEC") cybersecurity disclosure requirements. Under Item 1.05 of Form 8-K, Quorum is required to disclose a material cybersecurity incident within four (4) business days of determining that the incident is material. Additionally, Quorum's periodic reports (including Form 10-Q) may require risk factor updates related to the incident. Calderwood & Harkness will conduct a formal materiality assessment upon receipt of the final forensic report, at which point a recommendation regarding 8-K and 10-Q disclosure will be provided to the Audit Committee and the Chief Executive Officer. At this early stage, given the ongoing investigation and the uncertainty regarding scope, no determination of materiality has been made.

V. Engagement of Outside Counsel and Forensic Investigators

A. Calderwood & Harkness LLP

Calderwood & Harkness LLP was formally engaged by Quorum on May 4, 2023, to serve as outside counsel for the legal response to this incident (Matter No. 1025-00006). The engagement is managed through the Firm's Privacy & Data Security practice group, headquartered in Washington, D.C. Calderwood & Harkness's scope of engagement encompasses incident response coordination, forensic investigation oversight under the attorney-client privilege, notification obligation analysis, regulatory compliance and defense (if needed), vendor accountability and indemnification analysis, insurance coverage coordination, and SEC disclosure assessment.

The engagement team consists of the following attorneys:

Kevin Ostrowski — Responsible Partner, Privacy & Data Security practice group, Washington, D.C. office. Mr. Ostrowski has over twenty years of experience advising companies on data security incident response, regulatory investigations, and data privacy compliance. Billing rate: $1,250 per hour.

Rachel Bernstein — Billing Partner, Privacy & Data Security practice group, New York office. Ms. Bernstein focuses on regulatory defense, multistate attorney general investigations, and cybersecurity governance. Billing rate: $1,175 per hour.

Alan Burke — Lead Associate, Privacy & Data Security practice group, Washington, D.C. office. Mr. Burke is responsible for day-to-day management of the incident response workstreams, including coordination with Graystone Forensics and the notification law survey. Billing rate: $825 per hour.

Sara Hendricks — Working Associate, Privacy & Data Security practice group, Washington, D.C. office. Ms. Hendricks is responsible for the state-by-state notification trigger analysis and regulatory compliance research. Billing rate: $650 per hour.

Additional attorneys may be staffed as warranted by developments in the matter, including, if necessary, attorneys from Calderwood & Harkness's Securities & Capital Markets, Insurance Coverage, and Litigation practice groups.

B. Graystone Forensics LLC

Graystone Forensics LLC ("Graystone") was retained on May 5, 2023, to conduct the technical forensic investigation of the Palomar data security incident. Graystone was retained under the Calderwood & Harkness attorney-client privilege umbrella — that is, Graystone was engaged by and reports to Calderwood & Harkness, rather than directly to Quorum, in order to ensure that the forensic investigation and all resulting work product are protected by the attorney-client privilege and the work product doctrine.

Graystone is headquartered at 1950 Old Gallows Road, Suite 600, Tysons Corner, Virginia 22182. Graystone is a nationally recognized digital forensics and incident response firm with extensive experience in investigating large-scale data security incidents in the insurance, financial services, and healthcare sectors.

The Graystone engagement team includes:

Dr. Nolan Briggs — Managing Director, Incident Response. Dr. Briggs serves as the engagement lead and is responsible for overall direction and quality assurance of the forensic investigation.

Kendra Faulkner — Senior Forensic Analyst. Ms. Faulkner serves as the analyst lead and is responsible for hands-on forensic analysis, including log analysis, artifact examination, and data exfiltration assessment.

The scope of Graystone's engagement encompasses the following:

• Determination of the threat actor's initial entry vector and method of exploitation;

• Reconstruction of the timeline of unauthorized access, including dates, duration, and progression of activity within Palomar's network;

• Identification of all data sets accessed, staged, and exfiltrated by the threat actor;

• Assessment of the data types compromised within each exfiltrated data set;

• Attribution analysis (to the extent feasible) to identify the threat actor or threat group responsible;

• Preparation of privileged forensic reports documenting findings and conclusions.

Graystone's reporting milestones are as follows: a preliminary findings report is targeted for delivery in early June 2023, and a final forensic report is targeted for delivery by mid-July 2023. All Graystone work product, including draft and final reports, communications, notes, and analyses, is directed to and through Calderwood & Harkness to preserve the attorney-client privilege and work product protection.

C. Palomar's Counsel

Palomar Data Solutions, Inc. is represented in connection with this incident by Mercer, Haight & Dunlop LLP, a law firm based in Dallas, Texas. The lead partner on the Palomar engagement is Catherine Langford, and the associate is Brian Soto. Calderwood & Harkness is coordinating with Mercer, Haight & Dunlop as appropriate to facilitate the forensic investigation, including obtaining access to Palomar's network logs, system artifacts, and other evidence relevant to the investigation.

This coordination is being conducted on a limited basis and with appropriate safeguards to preserve Quorum's separate privilege interests and to avoid any inadvertent waiver. Calderwood & Harkness has not entered into a joint defense or common interest agreement with Palomar or its counsel, and Quorum's interests remain separate from and potentially adverse to Palomar's interests.

VI. Insurance Coverage and Claim Status

A. Quorum's Cyber-Liability Insurance Tower

Quorum maintains a two-layer cyber-liability insurance tower, as described below. The policies were placed through Quorum's cyber-insurance broker, Whitmore Risk Advisors Inc. (Sandra Whitmore-Kim, Lead Broker), located at 390 Park Avenue, 18th Floor, New York, New York 10022.

Primary Policy:

The Atlas primary policy covers, among other things, first-party forensic investigation costs, notification costs, credit monitoring and identity theft protection services, crisis communications and public relations expenses, regulatory defense costs (including attorneys' fees and related expenses incurred in connection with regulatory investigations, inquiries, and enforcement proceedings), and regulatory fines and penalties where insurable under applicable law. The policy is written on a claims-made and reported basis and covers claims first made and reported during the policy period.

Excess Policy:

The Pinnacle excess policy provides $25,000,000 in coverage excess of the $15,000,000 Atlas primary policy, for a total cyber-liability insurance tower of $40,000,000. The excess policy follows form to the terms and conditions of the Atlas primary policy.

B. Claim Filing

A formal notice of claim was filed with Atlas Mutual Insurance Company on May 8, 2023, and was assigned Claim Number CYB-CLM-2023-05892. The notice of claim described the incident, the date of discovery, the nature of the potential exposure, and the response actions being undertaken by Quorum and its counsel.

Precautionary notice of the incident was also sent to Pinnacle Surplus Lines Insurance Corp. on May 8, 2023, consistent with the notice requirements of the excess policy and best practices for timely notification to all layers of the insurance tower.

Atlas Mutual has acknowledged receipt of the notice of claim and has indicated that it is evaluating coverage. Calderwood & Harkness has prepared a separate coverage analysis memorandum, provided to the General Counsel on a privileged basis, identifying the categories of costs and expenses expected to be covered under the primary policy, potential coverage issues (including compliance with policy conditions, cooperation requirements, and any applicable exclusions), and strategies for maximizing insurance recovery.

C. Common Interest Agreement

On May 10, 2023, a common interest agreement was executed between Quorum Insurance Holdings Corp. and Atlas Mutual Insurance Company. The purpose of this agreement is to establish a framework for the sharing of privileged investigation materials, forensic reports, and attorney-client communications between Quorum and Atlas Mutual (and their respective counsel) in connection with the coverage claim, without waiving the attorney-client privilege or work product protection that attaches to such materials.

The common interest agreement is standard practice in cybersecurity incidents where the insured and the insurer share a mutual interest in understanding the scope and nature of the incident for purposes of evaluating and processing the insurance claim. Calderwood & Harkness negotiated the terms of the agreement to ensure that Quorum's privilege rights are fully preserved.

VII. Immediate Response Actions Taken

A. Internal Quorum Actions

Upon engagement of Calderwood & Harkness on May 4, 2023, Quorum's incident response plan was formally activated under the direction of outside counsel. The Quorum incident response team was assembled, consisting of the following individuals:

• David Naranjo, Chief Information Security Officer

• Jennifer Liang, Chief Privacy Officer

• Thomas R. Whitfield, General Counsel

• Priya Deshmukh, Vice President, Vendor Risk Management

• Robert Wentworth, Senior Vice President, Claims Operations

The incident response team is meeting on a regular basis, with coordination calls led by Calderwood & Harkness, to ensure alignment on all response workstreams and to address issues as they arise.

On May 6, 2023, legal hold notices were issued to the Information Technology and Claims Operations departments, directed to David Naranjo and Robert Wentworth, respectively. The legal hold notices instruct all recipients and their teams to preserve all documents, electronic records, emails, instant messages, log files, and other data and communications that relate in any way to the Palomar incident, the Quorum-Palomar relationship, the MSA and its amendments, and the data processed by Palomar on behalf of Quorum. The legal hold remains in effect until further notice from the General Counsel's Office.

Communications lockdown protocols have been implemented to control the flow of information regarding the incident within and outside of Quorum. All internal communications regarding the incident are being routed through the General Counsel's Office, and all external communications are being coordinated through Calderwood & Harkness. Employees with knowledge of the incident have been instructed not to discuss the matter with any persons outside of the designated incident response team without prior authorization.

BrightPath Consulting Group Inc. ("BrightPath"), a crisis communications firm headquartered in New York, has been retained by Quorum to manage external and internal communications strategy related to the incident. BrightPath's engagement is being led by Meredith Ashford, Managing Director. BrightPath is preparing draft communications materials, including press statements, employee communications, customer-facing notices, and investor-facing disclosures, to be deployed as and when appropriate, subject to the direction of Calderwood & Harkness and the General Counsel. No public statements have been made at this time, and none are recommended until the scope of the incident is confirmed and notification obligations are triggered.

B. Vendor Coordination with Palomar

Quorum, through Calderwood & Harkness, has been in communication with Palomar and Palomar's counsel, Mercer, Haight & Dunlop LLP, regarding the scope and nature of the compromise. The primary objectives of this coordination are: (i) to obtain access to Palomar's network logs, system artifacts, and other technical evidence necessary for the Graystone forensic investigation; (ii) to understand Palomar's own internal investigation findings and remedial actions; and (iii) to assess Quorum's contractual rights and remedies under the MSA.

Calderwood & Harkness has commenced a detailed review of the MSA and its amendments to assess Quorum's contractual rights against Palomar, including indemnification rights under Section 12.2, termination rights under Section 14.2, and Palomar's obligations to cooperate with the investigation and to remediate the security deficiencies that gave rise to the incident.

Based on the preliminary review, Calderwood & Harkness has identified the following potential contractual breaches by Palomar:

(a) Failure to Patch Critical Vulnerability Within 30 Days (Exhibit D): The vulnerability exploited by the threat actor (CVE-2023-0669) is a critical remote code execution vulnerability in the GoAnywhere MFT file transfer appliance. A vendor-supplied patch for this vulnerability was publicly released by Severin Corporation in early February 2023. Under Exhibit D of the MSA, as amended by Amendment 2, Palomar was required to apply patches for critical vulnerabilities within thirty (30) days of the vendor patch release date. The exploitation of this vulnerability on or about March 14, 2023 — more than thirty days after the patch was available — indicates that Palomar failed to apply the patch within the required timeframe. This failure is a direct and proximate cause of the unauthorized access and constitutes a breach of Palomar's data security obligations under the MSA.

(b) Late Breach Notification (Section 9.4): As discussed in Section III.B above, Palomar's notification to Quorum on April 21, 2023, was provided approximately twenty-four (24) hours after the expiration of the forty-eight (48) hour contractual notification deadline. This constitutes a breach of Section 9.4 of the MSA.

Calderwood & Harkness will prepare a formal indemnification demand letter to be sent to Palomar upon completion of the forensic investigation and determination of the scope of Quorum's losses and expenses. In the interim, Quorum is preserving all contractual rights and remedies under the MSA.

C. Regulatory Posture

No regulatory notifications have been filed by Quorum at this time. Under applicable state breach notification laws and the HIPAA Breach Notification Rule, notification obligations are generally triggered by the determination that a breach of specified data elements has occurred. Because the forensic investigation is still underway and the scope and nature of compromised data have not yet been definitively determined, Calderwood & Harkness has advised that it is premature to initiate notifications at this stage.

Calderwood & Harkness is preparing a comprehensive fifty-state breach notification law survey, which will serve as the foundation for the state-by-state notification trigger analysis once the forensic findings are available. This survey will catalog, for each state and the District of Columbia, the applicable data elements that trigger the notification obligation, the required timing of notification (which varies from state to state), the form and content requirements for notification letters, the designated regulatory recipients (e.g., state attorneys general, consumer protection offices), and any other applicable requirements (e.g., media notification thresholds, credit monitoring mandates).

No regulatory inquiries, demand letters, or enforcement actions have been received by Quorum to date in connection with this incident. Calderwood & Harkness is monitoring all regulatory developments and will immediately notify the General Counsel and the Audit Committee upon receipt of any regulatory communication.

VIII. Anticipated Next Steps and Timeline

The following is the anticipated timeline for the next phases of the incident response. All dates are estimates and are subject to revision based on the progress of the forensic investigation and other developments.

Calderwood & Harkness and the General Counsel's Office will provide the Audit Committee with updated briefings at key milestones, including but not limited to the following events:

• Receipt and analysis of the Graystone preliminary findings report (expected early June 2023);

• Receipt and analysis of the Graystone final forensic report (targeted mid-July 2023);

• Prior to initiating regulatory notifications and consumer notification mailings;

• Upon receipt of any regulatory inquiry, demand letter, or enforcement action;

• Upon the filing of any lawsuit related to the incident;

• Upon completion of the SEC materiality assessment and prior to any public disclosure; and

• Upon any other material development in the matter.

IX. Estimated Financial Exposure (Preliminary)

At this early stage of the investigation, precise cost estimates are not available, and any projections are inherently subject to significant variability based on the ultimate scope of the incident. However, based on Calderwood & Harkness's experience advising clients on incidents of this general nature and scale, the following preliminary cost categories and order-of-magnitude estimates are provided for the Audit Committee's consideration:

These estimates do not include potential regulatory fines or penalties, litigation defense costs, or settlement or judgment amounts in the event of consumer class action litigation, each of which would represent additional cost categories that cannot be estimated at this time.

The consumer notification and credit monitoring cost estimate is dependent on several factors that remain uncertain, including the total number of affected individuals, the geographic distribution of those individuals, the duration of credit monitoring offered (typically twelve to twenty-four months), and the enrollment take-rate among affected individuals.

With respect to insurance recovery, Quorum's self-insured retention ("SIR") of $2,500,000 will be Quorum's initial out-of-pocket obligation before insurance coverage attaches. Costs and expenses incurred above the SIR should be covered under the Atlas Mutual primary policy, up to the per-occurrence limit of $15,000,000. To the extent total covered costs exceed $15,000,000, the Pinnacle excess policy provides an additional $25,000,000 in coverage, for a total insurance tower of $40,000,000.

Additionally, Quorum has potential indemnification recovery rights against Palomar under MSA Section 12.2. The contractual liability cap for Palomar's indemnification obligation is $32,600,000 (equal to two times the trailing twelve-month fees paid). Depending on the outcome of the indemnification demand and any ensuing negotiation or dispute, recovery from Palomar may offset a significant portion of Quorum's costs and expenses, including amounts within the SIR.

For context, Quorum's fiscal year 2022 annual revenue was approximately $4.82 billion, and the Company's market capitalization as of May 2023 is approximately $6.1 billion. While the financial impact of this incident is significant and will require careful management, the preliminary estimated cost range — taking into account insurance recovery and potential vendor indemnification — is expected to be manageable relative to the Company's overall financial scale. This assessment is, however, subject to material revision as the scope of the incident is determined and as regulatory and litigation developments unfold.

X. Recommendations

The Audit Committee is asked to note and consider the following recommendations from Calderwood & Harkness LLP and the General Counsel's Office:

1. Continue Privileged Forensic Investigation. The Audit Committee should authorize the continuation of the privileged forensic investigation through Graystone Forensics under the Calderwood & Harkness privilege umbrella, with milestone reporting to the Audit Committee as described in Section VIII above. The forensic investigation is essential to determining the scope of the incident, identifying affected individuals, and establishing the factual basis for all subsequent response actions, including regulatory notifications, vendor indemnification demands, and insurance claims.

2. Preserve Vendor Accountability Rights. Calderwood & Harkness and the General Counsel's Office recommend that Quorum take all steps necessary to document and preserve its contractual rights against Palomar, including documenting Palomar's breaches of the MSA (specifically, the failure to patch the critical vulnerability within the required thirty-day window under Exhibit D and the late notification under Section 9.4). Upon completion of the forensic investigation and quantification of Quorum's losses and expenses, a formal indemnification demand will be prepared and submitted to Palomar. Calderwood & Harkness will also evaluate whether termination for cause under Section 14.2 is advisable, taking into account both the legal merits and the operational implications of transitioning to an alternative vendor.

3. Monitor Regulatory Landscape. The incident response team, under the direction of Calderwood & Harkness, should actively monitor for any incoming regulatory inquiries, demand letters, or enforcement actions from state attorneys general, the Connecticut Insurance Department, the HHS Office for Civil Rights, or any other regulatory authority. Quorum's regulatory compliance posture should remain proactive and cooperative, and the Audit Committee should be notified immediately upon receipt of any regulatory communication.

4. Coordinate with Insurance Carriers. Calderwood & Harkness and Whitmore Risk Advisors should continue to coordinate with Atlas Mutual and Pinnacle to ensure compliance with all policy terms and conditions, including cooperation requirements, consent-to-settle provisions, and timely submission of covered cost documentation. The objective is to maximize insurance recovery and to ensure that the claim process proceeds efficiently.

5. Defer Public Disclosure. Public disclosure of the incident should be deferred until the scope of the incident is confirmed through the forensic investigation and regulatory or legal notification obligations are triggered. Premature disclosure could compromise the investigation, create unnecessary alarm among policyholders and the market, and potentially prejudice Quorum's legal position. BrightPath Consulting Group is preparing communications strategies and draft materials so that Quorum is prepared to execute an orderly disclosure when the appropriate time arrives.

6. SEC Disclosure Assessment. The SEC disclosure assessment is ongoing. A formal materiality analysis under Item 1.05 of Form 8-K and applicable 10-Q risk factor disclosure requirements will be conducted upon receipt of the final forensic report from Graystone, at which point a definitive recommendation regarding the timing, content, and form of any public disclosure will be provided to the Audit Committee and the Chief Executive Officer. No 8-K or 10-Q disclosure should be made without prior consultation with and recommendation from Calderwood & Harkness and the General Counsel.

XI. Contacts

The following is a list of key contacts for the matter. All communications regarding this incident should be directed through Thomas R. Whitfield, General Counsel, or Kevin Ostrowski, Calderwood & Harkness LLP, to preserve the attorney-client privilege.

XII. Closing Privilege Reminder

This memorandum is protected in its entirety by the attorney-client privilege and the work product doctrine. It was prepared by Calderwood & Harkness LLP and the Quorum Insurance Holdings Corp. General Counsel's Office in anticipation of litigation and for the purpose of providing legal advice to the Audit Committee and the Board of Directors of Quorum Insurance Holdings Corp. The memorandum reflects the mental impressions, conclusions, opinions, and legal theories of counsel.

The Audit Committee members and all Board members receiving this memorandum are respectfully requested to treat this document and its contents as strictly confidential. This memorandum should not be disclosed, distributed, or discussed with any person outside the Board of Directors of Quorum Insurance Holdings Corp. without the prior written authorization of Calderwood & Harkness LLP or the Quorum Insurance Holdings Corp. General Counsel's Office. Unauthorized disclosure of this memorandum could result in the waiver of the attorney-client privilege and work product protection, which would be detrimental to Quorum's legal interests.

All communications regarding this matter — whether written, oral, or electronic — should be directed through Thomas R. Whitfield, General Counsel, Quorum Insurance Holdings Corp., or Kevin Ostrowski, Responsible Partner, Calderwood & Harkness LLP, to ensure that the attorney-client privilege is preserved.

PRIVILEGED & CONFIDENTIAL — ATTORNEY-CLIENT PRIVILEGED — ATTORNEY WORK PRODUCT

Item	Detail
Insurer	Atlas Mutual Insurance Company (Chicago, IL)
Policy Number	CYB-2023-041587
Coverage Period	January 1, 2023 – January 1, 2024
Per-Occurrence Limit	$15,000,000
Aggregate Limit	$15,000,000
Self-Insured Retention (SIR)	$2,500,000
Claims Adjuster	Paul Enriquez
Item	Detail
Insurer	Pinnacle Surplus Lines Insurance Corp. (Boston, MA)
Policy Number	XS-CYB-2023-7812
Coverage Period	January 1, 2023 – January 1, 2024
Limit	$25,000,000 excess of $15,000,000
Follow-Form	Follows form to Atlas Mutual primary policy terms
Claims Contact	Lisa Garner
Timeframe	Action Item
May – early June 2023	Graystone Forensics conducts forensic investigation; preliminary findings report expected in early June 2023
June 2023	Calderwood & Harkness analyzes preliminary forensic findings and refines notification obligation assessment; completes fifty-state breach notification law survey; coordinates with Palomar's counsel on investigation access
Mid-July 2023 (target)	Graystone delivers final forensic report; definitive determination of scope of compromised data and identification of affected data sets
Late July – early August 2023 (estimated)	Data mining and affected individual identification; extraction and normalization of affected individual records for notification purposes
August 2023 (estimated)	Consumer notification letters mailed and regulatory notifications filed, subject to forensic findings and notification trigger analysis; credit monitoring enrollment offered to affected individuals
Ongoing	Vendor accountability assessment and indemnification demand preparation; insurance coverage coordination and claims processing; SEC disclosure materiality assessment; monitoring for regulatory inquiries and litigation filings
Cost Category	Estimated Range
Forensic investigation (Graystone Forensics)	$1,000,000 – $3,000,000
Consumer notification and credit monitoring	$2,000,000 – $5,000,000

Crisis communications (BrightPath Consulting)	$200,000 – $500,000
Legal fees (Calderwood & Harkness)	$1,500,000 – $3,000,000
Internal costs (IT remediation, employee overtime)	$500,000 – $1,000,000
Total estimated range	$5,200,000 – $12,500,000
Role	Name	Organization	Address / Contact
Responsible Partner, Outside Counsel	Kevin Ostrowski	Calderwood & Harkness LLP	1700 K Street NW, Suite 900, Washington, D.C. 20006
Billing Partner, Outside Counsel	Rachel Bernstein	Calderwood & Harkness LLP	51 West 52nd Street, 34th Floor, New York, NY 10019
General Counsel	Thomas R. Whitfield	Quorum Insurance Holdings Corp.	400 Constitution Plaza, Suite 2200, Hartford, CT 06103
Chief Information Security Officer	David Naranjo	Quorum Insurance Holdings Corp.	400 Constitution Plaza, Suite 2200, Hartford, CT 06103
Chief Privacy Officer	Jennifer Liang	Quorum Insurance Holdings Corp.	400 Constitution Plaza, Suite 2200, Hartford, CT 06103
Forensic Investigation Lead	Dr. Nolan Briggs	Graystone Forensics LLC	1950 Old Gallows Road, Suite 600, Tysons Corner, VA 22182
Primary Insurance Claims Adjuster	Paul Enriquez	Atlas Mutual Insurance Company	120 South LaSalle Street, Suite 3200, Chicago, IL 60603
Cyber-Insurance Broker	Sandra Whitmore-Kim	Whitmore Risk Advisors Inc.	390 Park Avenue, 18th Floor, New York, NY 10022

PRIVILEGED & CONFIDENTIAL ATTORNEY-CLIENT PRIVILEGED — ATTORNEY WORK PRODUCT
MEMORANDUM
May 11, 2023
TO:
Franklin Reeves, Chair, Audit Committee, Board of Directors, Quorum Insurance Holdings Corp.
Members of the Board of Directors of Quorum Insurance Holdings Corp.
FROM:
Kevin Ostrowski, Responsible Partner, Privacy & Data Security, Calderwood & Harkness LLP
Thomas R. Whitfield, General Counsel, Quorum Insurance Holdings Corp.
RE:
Initial Briefing — Vendor-Originated Data Security Incident (Palomar Data Solutions, Inc.)
MATTER NO.: 1025-00006
PRIVILEGE NOTICE: This memorandum is a privileged and confidential attorney-client communication and attorney work product, prepared in anticipation of litigation and for the purpose of providing legal advice to Quorum Insurance Holdings Corp. and its Board of Directors. The contents of this memorandum reflect the mental impressions, conclusions, opinions, and legal theories of counsel. This memorandum should not be disclosed to any third party without prior written authorization from Calderwood & Harkness LLP or the Quorum Insurance Holdings Corp. General Counsel's Office. Inadvertent disclosure of this memorandum does not constitute a waiver of any applicable privilege or protection.
I. Executive Summary
The purpose of this memorandum is to provide the Audit Committee and the full Board of Directors of Quorum Insurance Holdings Corp. ("Quorum" or the "Company") with an initial confidential briefing regarding a significant data security incident that originated from Quorum's third-party claims-processing vendor, Palomar Data Solutions, Inc. ("Palomar" or "PDS"). This briefing is being provided under the attorney-client privilege and work product doctrine, and all recipients are requested to treat the contents of this memorandum with the utmost confidentiality.
On April 21, 2023, Quorum received notification from Palomar that Palomar had discovered unauthorized access to its network environment on April 18, 2023. Based on Palomar's preliminary internal investigation and information subsequently gathered by counsel, the unauthorized access is believed to have begun on or about March 14, 2023, through the exploitation of a known remote code execution vulnerability, identified as CVE-2023-0669, in Palomar's GoAnywhere MFT file transfer appliance. The vulnerability in question had been publicly disclosed and a vendor-supplied patch had been made available prior to the date of exploitation.
The incident potentially exposed personally identifiable information ("PII"), protected health information ("PHI"), and financial data belonging to Quorum policyholders and claimants whose data was processed by Palomar under the Master Services Agreement dated November 12, 2019, as subsequently amended (the "MSA"). The categories of data at risk include, but may not be limited to, Social Security numbers, dates of birth, financial account information, and health-related claims data from Quorum's personal lines division.
The full scope of affected individuals has not yet been determined. However, preliminary indications suggest that the exposure may be substantial, potentially spanning multiple states in which Quorum's personal lines division operates. The forensic investigation necessary to determine the definitive scope and nature of compromised data is currently underway and is expected to produce preliminary findings in early June 2023 and a final report by mid-July 2023.
Calderwood & Harkness LLP ("Calderwood & Harkness" or the "Firm") was formally engaged on May 4, 2023, to coordinate the legal response to this incident, including oversight of the privileged forensic investigation, regulatory compliance analysis, notification obligation assessment, vendor accountability, and insurance coverage coordination. On May 5, 2023, Calderwood & Harkness retained Graystone Forensics LLC ("Graystone") under the attorney-client privilege umbrella to conduct the technical forensic investigation.
Insurance coverage has been noticed under Quorum's cyber-liability insurance tower. A formal notice of claim was filed with Atlas Mutual Insurance Company ("Atlas Mutual"), Quorum's primary cyber-liability insurer, on May 8, 2023. Precautionary notice was also provided to Pinnacle Surplus Lines Insurance Corp. ("Pinnacle"), the excess carrier. A common interest agreement was executed on May 10, 2023, to facilitate the sharing of privileged information with Atlas Mutual without waiver of applicable privileges.
At this stage, no regulatory enforcement actions, inquiries, or lawsuits have been filed in connection with this incident. The matter remains in the investigation and assessment phase. Calderwood & Harkness and the General Counsel's Office will continue to provide the Audit Committee with updated briefings at key milestones as the investigation and response progress.
II. Background — Quorum's Relationship with Palomar Data Solutions
A. Palomar Overview
Palomar Data Solutions, Inc. ("Palomar" or "PDS") is a Texas corporation headquartered at 7100 Greenville Avenue, Suite 450, Dallas, Texas 75231. Palomar provides claims data processing, document management, and data analytics services to mid-to-large insurance carriers across the United States. Palomar has been in operation since 2008 and has grown to become a significant vendor in the insurance technology services space.
Palomar's senior management team includes Marcus J. Trevino, Chief Executive Officer; Anita Raghavan, Chief Technology Officer; and Derek Copeland, General Counsel. Palomar reported annual revenue of approximately $340 million for its fiscal year ending December 31, 2022, and employs approximately 2,100 individuals across its Dallas headquarters and satellite offices.
Quorum is Palomar's second-largest client by revenue, underscoring the significance of the commercial relationship and the volume of Quorum data processed within Palomar's environment. This relationship, and the nature and volume of Quorum data entrusted to Palomar, are directly relevant to assessing both the potential scope of the current incident and Quorum's contractual rights against Palomar.
B. Master Services Agreement
Quorum and Palomar are parties to a Master Services Agreement (the "MSA") executed on November 12, 2019, with a five-year initial term expiring November 11, 2024. The MSA governs Palomar's provision of claims data processing and related services to Quorum's personal lines insurance division. The original annual contract value ("ACV") under the MSA was $14,200,000.
Since execution, the MSA has been amended twice:
Amendment 1 (executed March 3, 2021): This amendment expanded the scope of services to include data processing for Quorum's QuorumEdge platform, a proprietary claims analytics tool. Amendment 1 increased the ACV by $2,100,000, bringing the total ACV to $16,300,000 effective April 1, 2021.
Amendment 2 (executed September 15, 2022): This amendment updated the Data Security Exhibit (Exhibit D) to the MSA, incorporating enhanced data security requirements. Specifically, Amendment 2 added a requirement that Palomar maintain and provide to Quorum a SOC 2 Type II audit report on an annual basis, and updated the minimum cyber-liability insurance coverage thresholds that Palomar is required to maintain. Amendment 2 was negotiated in connection with Quorum's enterprise-wide vendor risk management enhancement initiative led by Priya Deshmukh, VP, Vendor Risk Management.
Under the MSA, Palomar processes claims data for Quorum's personal lines division, which includes property, casualty, auto, and workers' compensation lines. The data processed by Palomar encompasses PII (including names, Social Security numbers, dates of birth, and driver's license numbers), financial information (including bank account numbers and payment card numbers), and health-related claims data that may constitute PHI under the Health Insurance Portability and Accountability Act ("HIPAA") and its implementing regulations.
C. Relevant Contractual Provisions
The MSA contains several provisions directly relevant to the current incident and Quorum's legal position. Calderwood & Harkness has conducted a preliminary review of these provisions, and a more comprehensive analysis is underway. The key provisions are summarized below:
Data Security Exhibit (Exhibit D, as amended by Amendment 2): Exhibit D requires Palomar to implement and maintain "commercially reasonable" administrative, technical, and physical safeguards to protect Quorum data against unauthorized access, use, disclosure, alteration, or destruction. Exhibit D further specifies, among other requirements, that Palomar must: (i) apply patches for critical vulnerabilities within thirty (30) days of the date the applicable vendor patch is publicly released; (ii) conduct annual penetration testing of its network environment by a qualified independent third-party assessor; and (iii) provide Quorum with a SOC 2 Type II audit report on an annual basis. These requirements are central to the assessment of Palomar's potential liability, as discussed further below.
Breach Notification Clause (Section 9.4): Section 9.4 of the MSA requires Palomar to notify Quorum within forty-eight (48) hours of Palomar's discovery of any security incident that affects or is reasonably believed to affect Quorum data. The notification must include a description of the nature of the incident, the data types potentially affected, and the remedial actions taken or planned. As discussed in Section III.B below, Palomar's notification to Quorum was provided approximately twenty-four (24) hours after the expiration of this contractual deadline.
Indemnification (Section 12.2): Section 12.2 provides that Palomar shall indemnify, defend, and hold harmless Quorum and its officers, directors, employees, and agents from and against all losses, damages, costs, and expenses (including reasonable attorneys' fees) arising out of or resulting from Palomar's breach of its data security obligations under the MSA, including Exhibit D. This indemnification obligation is subject to a contractual liability cap equal to two times (2×) the trailing twelve-month fees paid by Quorum to Palomar. Based on the current ACV of $16,300,000, the applicable liability cap is $32,600,000.
Insurance Requirements (Exhibit E): Exhibit E requires Palomar to obtain and maintain, at its own expense, cyber-liability insurance coverage with a minimum per-occurrence limit of $10,000,000 throughout the term of the MSA. Calderwood & Harkness has requested that Palomar provide current certificates of insurance for verification, and Palomar's counsel has indicated that such certificates will be provided in due course.
Termination for Cause (Section 14.2): Section 14.2 provides that Quorum may terminate the MSA upon written notice in the event of a material breach by Palomar, provided that Palomar is given a thirty (30) day period to cure the breach following receipt of written notice. Calderwood & Harkness is evaluating whether the events giving rise to this incident constitute a material breach of the MSA that could support termination for cause, while also considering the operational implications and transition planning that would be required if termination were pursued.
III. Incident discovery and Timeline
A. Chronology of Events
The following chronology sets forth the key events related to the incident, based on information available as of the date of this memorandum. This timeline is preliminary and subject to revision as the forensic investigation progresses and additional information becomes available.
On or about March 14, 2023: A threat actor exploited a known but unpatched remote code execution vulnerability, designated CVE-2023-0669, in Palomar's GoAnywhere MFT file transfer appliance to gain initial unauthorized access to Palomar's network environment. The GoAnywhere MFT platform is a managed file transfer solution that Palomar uses to facilitate the secure transfer of data files between Palomar and its clients, including Quorum. CVE-2023-0669 is a pre-authentication command injection vulnerability that permits a remote attacker to execute arbitrary code on the affected system. A vendor-supplied patch for this vulnerability was publicly released by Severin Corporation (the vendor of GoAnywhere MFT) in early February 2023, more than thirty days prior to the exploitation date. Palomar's failure to apply this patch within the timeframe required by Exhibit D of the MSA is a significant factor in the legal analysis.
March 14 – April 18, 2023 (approximately 35 days): During this period, the threat actor maintained persistent unauthorized access to Palomar's network environment. Based on Palomar's initial assessment, the threat actor engaged in lateral movement within the network, ultimately gaining access to Palomar's claims processing environment. During this window, the threat actor is believed to have staged and exfiltrated structured data files from the claims processing environment. The precise volume and content of exfiltrated data are the primary subjects of the ongoing Graystone forensic investigation.
April 18, 2023: Palomar's internal Security Operations Center ("SOC") detected unusual patterns of outbound data transfers from its network. This detection triggered Palomar's internal incident response procedures. Palomar's security team initiated containment measures, including isolating the affected systems and revoking the threat actor's access credentials. This date is considered the date of Palomar's discovery of the incident for purposes of contractual and regulatory notification timelines.
April 21, 2023: Palomar General Counsel Derek Copeland notified Quorum General Counsel Thomas R. Whitfield and Quorum Chief Information Security Officer David Naranjo via email of the security incident. The notification provided a high-level description of the incident, including the approximate date range of unauthorized access, the suspected vulnerability exploited, and an indication that Quorum data may have been affected. This notification was provided approximately seventy-two (72) hours after Palomar's internal discovery on April 18, 2023, which is approximately twenty-four (24) hours later than the forty-eight (48) hour contractual notification deadline under MSA Section 9.4.
April 21 – May 3, 2023: Following receipt of Palomar's notification, Quorum's General Counsel and CISO initiated internal coordination, including preliminary assessment of the potential scope and impact, review of the MSA provisions, and evaluation of the need for outside counsel engagement. During this period, Quorum's internal teams gathered initial information from Palomar regarding the nature and extent of the compromise.
May 4, 2023: Quorum formally engaged Calderwood & Harkness LLP, through its Privacy & Data Security practice group in Washington, D.C., to manage the legal response to the incident. The engagement encompasses incident response coordination, forensic investigation oversight under privilege, notification obligation analysis, regulatory compliance and defense, vendor accountability and indemnification analysis, and insurance coverage coordination.
May 5, 2023: Calderwood & Harkness retained Graystone Forensics LLC, a digital forensics and incident response firm headquartered in Tysons Corner, Virginia, under the attorney-client privilege umbrella to conduct the technical forensic investigation. The retention of Graystone through outside counsel is intended to protect the forensic investigation and its work product under the attorney-client privilege and work product doctrine.
May 6, 2023: Calderwood & Harkness prepared, and Quorum issued, legal hold notices to the Information Technology and Claims Operations departments. The legal hold notices were directed to David Naranjo, Chief Information Security Officer, and Robert Wentworth, Senior Vice President, Claims Operations, directing the preservation of all documents, electronic records, communications, and data related to the Palomar incident, Quorum's relationship with Palomar, and the data processed by Palomar on behalf of Quorum.
May 7, 2023: Graystone Forensics finalized the scope of work and investigation plan for the forensic investigation, establishing the following key milestones: preliminary findings report targeted for delivery in early June 2023; final forensic report targeted for delivery by mid-July 2023. The investigation plan encompasses analysis of Palomar's network logs, system artifacts, and data transfer records to determine the threat actor's entry vector, the timeline and scope of unauthorized access, the specific data sets accessed and exfiltrated, and the data types compromised.
May 8, 2023: Calderwood & Harkness prepared and submitted an initial incident assessment memorandum to Thomas R. Whitfield, General Counsel. On the same date, Quorum filed a formal notice of claim with Atlas Mutual Insurance Company under its primary cyber-liability insurance policy (Claim No. CYB-CLM-2023-05892), and precautionary notice was sent to Pinnacle Surplus Lines Insurance Corp. under the excess cyber-liability policy.
May 10, 2023: A common interest agreement was executed between Quorum and Atlas Mutual Insurance Company to permit the sharing of privileged investigation materials and communications between the parties and their respective counsel without waiver of the attorney-client privilege or work product protection.
May 11, 2023: This memorandum is being provided to the Audit Committee and the Board of Directors.
B. Palomar's Late Notification
Under MSA Section 9.4, Palomar was contractually required to notify Quorum within forty-eight (48) hours of Palomar's discovery of a security incident affecting or reasonably believed to affect Quorum data. Palomar discovered the incident on April 18, 2023, when its Security Operations Center detected the anomalous outbound data transfers. Accordingly, the contractual notification deadline expired at approximately the same time on April 20, 2023.
Palomar did not notify Quorum until April 21, 2023, approximately seventy-two (72) hours after discovery. This represents a delay of approximately twenty-four (24) hours beyond the contractual deadline established by Section 9.4 of the MSA.
This late notification is noted as a potential contractual breach that will be addressed in the vendor accountability workstream. While the delay may not, standing alone, have caused additional harm to Quorum (given that the unauthorized access had already persisted for approximately thirty-five days prior to Palomar's own detection), the breach of the notification covenant is relevant to the overall assessment of Palomar's contractual compliance and may support Quorum's indemnification demand and other contractual remedies.
IV. Preliminary Assessment of Potential Scope and Impact
A. Data Types Potentially Compromised
Based on Palomar's initial notification to Quorum and Calderwood & Harkness's preliminary assessment of the categories of Quorum data processed by Palomar under the MSA, the incident potentially involves the following categories of Quorum data:
Personally Identifiable Information (PII): Full names, dates of birth, Social Security numbers, and driver's license numbers of Quorum policyholders and claimants whose claims were processed by Palomar.
Financial Information: Bank account numbers, routing numbers, and payment card numbers associated with premium payments, claims payments, and other financial transactions processed by Palomar on behalf of Quorum.
Protected Health Information (PHI): Health conditions, medical diagnosis codes (including ICD-10 codes), treatment information, provider information, and other health-related data from workers' compensation and health-related insurance claims processed by Palomar. To the extent this data constitutes PHI under HIPAA, its compromise may trigger additional notification obligations under the HIPAA Breach Notification Rule.
The full scope and number of affected individuals have not yet been determined. The identification of specific data sets accessed and exfiltrated by the threat actor, and the enumeration of affected individuals, are among the primary objectives of the Graystone forensic investigation. Until the forensic investigation is completed, all assessments of scope remain preliminary and subject to material revision.
B. Potential Geographic Scope
Quorum's personal lines division operates across all fifty (50) states and the District of Columbia. The claims data processed by Palomar under the MSA may include data pertaining to policyholders and claimants residing in numerous states. As a result, depending on the forensic findings, the incident may trigger notification obligations under multiple state breach notification laws, each of which has its own requirements regarding the timing, content, and method of notification, as well as specific data elements that trigger the notification obligation.
In addition, if PHI is confirmed to have been compromised, the HIPAA Breach Notification Rule (45 C.F.R. Part 164, Subpart D) may require notification to the U.S. Department of Health and Human Services ("HHS"), Office for Civil Rights, and to affected individuals. The HIPAA notification obligations are separate from and in addition to state breach notification requirements.
Calderwood & Harkness has commenced a comprehensive fifty-state breach notification law survey to prepare for notification obligations once the forensic investigation determines the definitive scope of compromised data and the geographic distribution of affected individuals. This survey will identify, on a state-by-state basis, the applicable notification triggers, deadlines, content requirements, and designated regulatory recipients.
C. Potential Regulatory and Legal Implications
Calderwood & Harkness has identified the following potential regulatory and legal implications arising from this incident, each of which will be evaluated in greater detail as the forensic investigation progresses and the scope of the incident is determined:
State Breach Notification Laws: Depending on the data types confirmed compromised and the states of residence of affected individuals, Quorum may be required to provide notification to affected consumers and to state attorneys general or other designated state agencies under applicable state breach notification statutes. The specific notification triggers, deadlines, and requirements vary by state. Calderwood & Harkness's fifty-state survey will identify all applicable obligations.
Connecticut Attorney General Notification: Under Connecticut General Statutes § 36a-701b, Quorum is required to notify the Connecticut Attorney General of any breach of security involving the personal information of Connecticut residents. Given that Quorum is headquartered in Hartford, Connecticut, and that a significant number of affected individuals may reside in Connecticut, compliance with this statute will be a priority.
Connecticut Insurance Data Security Law: As a licensed Connecticut insurer, Quorum is subject to the Connecticut Insurance Data Security Law, Connecticut General Statutes § 38a-999b, which imposes specific data security and breach notification obligations on licensees of the Connecticut Insurance Department. Calderwood & Harkness is evaluating Quorum's obligations under this statute, including any required notification to the Connecticut Insurance Department.
HIPAA Breach Notification Rule: If PHI is confirmed compromised, the HIPAA Breach Notification Rule (45 C.F.R. Part 164, Subpart D) will require Quorum to provide notification to affected individuals, to the HHS Office for Civil Rights, and potentially to prominent media outlets in states where more than 500 individuals are affected. The HIPAA Breach Notification Rule requires notification without unreasonable delay and in no case later than sixty (60) days following the discovery of the breach. Calderwood & Harkness is evaluating the applicability of HIPAA to the Quorum-Palomar relationship and the data at issue, including whether Palomar functions as a business associate under HIPAA.
Multistate Attorney General Inquiries: Incidents of this nature and scale frequently attract the attention of state attorneys general, who may initiate informal or formal inquiries, demand letters, or coordinated multistate investigations. Calderwood & Harkness will monitor for any incoming communications from state regulators and will prepare Quorum to respond promptly and effectively.
Consumer Class Action Litigation: Data security incidents involving the compromise of sensitive PII and financial data frequently give rise to consumer class action litigation, typically alleging claims such as negligence, breach of implied contract, unjust enrichment, and violations of state consumer protection statutes. Calderwood & Harkness will monitor for any litigation filings and will coordinate with Quorum's litigation counsel as appropriate.
SEC Disclosure Obligations: As a publicly traded company, Quorum is subject to the Securities and Exchange Commission's ("SEC") cybersecurity disclosure requirements. Under Item 1.05 of Form 8-K, Quorum is required to disclose a material cybersecurity incident within four (4) business days of determining that the incident is material. Additionally, Quorum's periodic reports (including Form 10-Q) may require risk factor updates related to the incident. Calderwood & Harkness will conduct a formal materiality assessment upon receipt of the final forensic report, at which point a recommendation regarding 8-K and 10-Q disclosure will be provided to the Audit Committee and the Chief Executive Officer. At this early stage, given the ongoing investigation and the uncertainty regarding scope, no determination of materiality has been made.
V. Engagement of Outside Counsel and Forensic Investigators
A. Calderwood & Harkness LLP
Calderwood & Harkness LLP was formally engaged by Quorum on May 4, 2023, to serve as outside counsel for the legal response to this incident (Matter No. 1025-00006). The engagement is managed through the Firm's Privacy & Data Security practice group, headquartered in Washington, D.C. Calderwood & Harkness's scope of engagement encompasses incident response coordination, forensic investigation oversight under the attorney-client privilege, notification obligation analysis, regulatory compliance and defense (if needed), vendor accountability and indemnification analysis, insurance coverage coordination, and SEC disclosure assessment.
The engagement team consists of the following attorneys:
Kevin Ostrowski — Responsible Partner, Privacy & Data Security practice group, Washington, D.C. office. Mr. Ostrowski has over twenty years of experience advising companies on data security incident response, regulatory investigations, and data privacy compliance. Billing rate: $1,250 per hour.
Rachel Bernstein — Billing Partner, Privacy & Data Security practice group, New York office. Ms. Bernstein focuses on regulatory defense, multistate attorney general investigations, and cybersecurity governance. Billing rate: $1,175 per hour.
Alan Burke — Lead Associate, Privacy & Data Security practice group, Washington, D.C. office. Mr. Burke is responsible for day-to-day management of the incident response workstreams, including coordination with Graystone Forensics and the notification law survey. Billing rate: $825 per hour.
Sara Hendricks — Working Associate, Privacy & Data Security practice group, Washington, D.C. office. Ms. Hendricks is responsible for the state-by-state notification trigger analysis and regulatory compliance research. Billing rate: $650 per hour.
Additional attorneys may be staffed as warranted by developments in the matter, including, if necessary, attorneys from Calderwood & Harkness's Securities & Capital Markets, Insurance Coverage, and Litigation practice groups.
B. Graystone Forensics LLC
Graystone Forensics LLC ("Graystone") was retained on May 5, 2023, to conduct the technical forensic investigation of the Palomar data security incident. Graystone was retained under the Calderwood & Harkness attorney-client privilege umbrella — that is, Graystone was engaged by and reports to Calderwood & Harkness, rather than directly to Quorum, in order to ensure that the forensic investigation and all resulting work product are protected by the attorney-client privilege and the work product doctrine.
Graystone is headquartered at 1950 Old Gallows Road, Suite 600, Tysons Corner, Virginia 22182. Graystone is a nationally recognized digital forensics and incident response firm with extensive experience in investigating large-scale data security incidents in the insurance, financial services, and healthcare sectors.
The Graystone engagement team includes:
Dr. Nolan Briggs — Managing Director, Incident Response. Dr. Briggs serves as the engagement lead and is responsible for overall direction and quality assurance of the forensic investigation.
Kendra Faulkner — Senior Forensic Analyst. Ms. Faulkner serves as the analyst lead and is responsible for hands-on forensic analysis, including log analysis, artifact examination, and data exfiltration assessment.
The scope of Graystone's engagement encompasses the following:
• Determination of the threat actor's initial entry vector and method of exploitation;
• Reconstruction of the timeline of unauthorized access, including dates, duration, and progression of activity within Palomar's network;
• Identification of all data sets accessed, staged, and exfiltrated by the threat actor;
• Assessment of the data types compromised within each exfiltrated data set;
• Attribution analysis (to the extent feasible) to identify the threat actor or threat group responsible;
• Preparation of privileged forensic reports documenting findings and conclusions.
Graystone's reporting milestones are as follows: a preliminary findings report is targeted for delivery in early June 2023, and a final forensic report is targeted for delivery by mid-July 2023. All Graystone work product, including draft and final reports, communications, notes, and analyses, is directed to and through Calderwood & Harkness to preserve the attorney-client privilege and work product protection.
C. Palomar's Counsel
Palomar Data Solutions, Inc. is represented in connection with this incident by Mercer, Haight & Dunlop LLP, a law firm based in Dallas, Texas. The lead partner on the Palomar engagement is Catherine Langford, and the associate is Brian Soto. Calderwood & Harkness is coordinating with Mercer, Haight & Dunlop as appropriate to facilitate the forensic investigation, including obtaining access to Palomar's network logs, system artifacts, and other evidence relevant to the investigation.
This coordination is being conducted on a limited basis and with appropriate safeguards to preserve Quorum's separate privilege interests and to avoid any inadvertent waiver. Calderwood & Harkness has not entered into a joint defense or common interest agreement with Palomar or its counsel, and Quorum's interests remain separate from and potentially adverse to Palomar's interests.
VI. Insurance Coverage and Claim Status
A. Quorum's Cyber-Liability Insurance Tower
Quorum maintains a two-layer cyber-liability insurance tower, as described below. The policies were placed through Quorum's cyber-insurance broker, Whitmore Risk Advisors Inc. (Sandra Whitmore-Kim, Lead Broker), located at 390 Park Avenue, 18th Floor, New York, New York 10022.
Primary Policy:
The Atlas primary policy covers, among other things, first-party forensic investigation costs, notification costs, credit monitoring and identity theft protection services, crisis communications and public relations expenses, regulatory defense costs (including attorneys' fees and related expenses incurred in connection with regulatory investigations, inquiries, and enforcement proceedings), and regulatory fines and penalties where insurable under applicable law. The policy is written on a claims-made and reported basis and covers claims first made and reported during the policy period.
Excess Policy:
The Pinnacle excess policy provides $25,000,000 in coverage excess of the $15,000,000 Atlas primary policy, for a total cyber-liability insurance tower of $40,000,000. The excess policy follows form to the terms and conditions of the Atlas primary policy.
B. Claim Filing
A formal notice of claim was filed with Atlas Mutual Insurance Company on May 8, 2023, and was assigned Claim Number CYB-CLM-2023-05892. The notice of claim described the incident, the date of discovery, the nature of the potential exposure, and the response actions being undertaken by Quorum and its counsel.
Precautionary notice of the incident was also sent to Pinnacle Surplus Lines Insurance Corp. on May 8, 2023, consistent with the notice requirements of the excess policy and best practices for timely notification to all layers of the insurance tower.
Atlas Mutual has acknowledged receipt of the notice of claim and has indicated that it is evaluating coverage. Calderwood & Harkness has prepared a separate coverage analysis memorandum, provided to the General Counsel on a privileged basis, identifying the categories of costs and expenses expected to be covered under the primary policy, potential coverage issues (including compliance with policy conditions, cooperation requirements, and any applicable exclusions), and strategies for maximizing insurance recovery.
C. Common Interest Agreement
On May 10, 2023, a common interest agreement was executed between Quorum Insurance Holdings Corp. and Atlas Mutual Insurance Company. The purpose of this agreement is to establish a framework for the sharing of privileged investigation materials, forensic reports, and attorney-client communications between Quorum and Atlas Mutual (and their respective counsel) in connection with the coverage claim, without waiving the attorney-client privilege or work product protection that attaches to such materials.
The common interest agreement is standard practice in cybersecurity incidents where the insured and the insurer share a mutual interest in understanding the scope and nature of the incident for purposes of evaluating and processing the insurance claim. Calderwood & Harkness negotiated the terms of the agreement to ensure that Quorum's privilege rights are fully preserved.
VII. Immediate Response Actions Taken
A. Internal Quorum Actions
Upon engagement of Calderwood & Harkness on May 4, 2023, Quorum's incident response plan was formally activated under the direction of outside counsel. The Quorum incident response team was assembled, consisting of the following individuals:
• David Naranjo, Chief Information Security Officer
• Jennifer Liang, Chief Privacy Officer
• Thomas R. Whitfield, General Counsel
• Priya Deshmukh, Vice President, Vendor Risk Management
• Robert Wentworth, Senior Vice President, Claims Operations
The incident response team is meeting on a regular basis, with coordination calls led by Calderwood & Harkness, to ensure alignment on all response workstreams and to address issues as they arise.
On May 6, 2023, legal hold notices were issued to the Information Technology and Claims Operations departments, directed to David Naranjo and Robert Wentworth, respectively. The legal hold notices instruct all recipients and their teams to preserve all documents, electronic records, emails, instant messages, log files, and other data and communications that relate in any way to the Palomar incident, the Quorum-Palomar relationship, the MSA and its amendments, and the data processed by Palomar on behalf of Quorum. The legal hold remains in effect until further notice from the General Counsel's Office.
Communications lockdown protocols have been implemented to control the flow of information regarding the incident within and outside of Quorum. All internal communications regarding the incident are being routed through the General Counsel's Office, and all external communications are being coordinated through Calderwood & Harkness. Employees with knowledge of the incident have been instructed not to discuss the matter with any persons outside of the designated incident response team without prior authorization.
BrightPath Consulting Group Inc. ("BrightPath"), a crisis communications firm headquartered in New York, has been retained by Quorum to manage external and internal communications strategy related to the incident. BrightPath's engagement is being led by Meredith Ashford, Managing Director. BrightPath is preparing draft communications materials, including press statements, employee communications, customer-facing notices, and investor-facing disclosures, to be deployed as and when appropriate, subject to the direction of Calderwood & Harkness and the General Counsel. No public statements have been made at this time, and none are recommended until the scope of the incident is confirmed and notification obligations are triggered.
B. Vendor Coordination with Palomar
Quorum, through Calderwood & Harkness, has been in communication with Palomar and Palomar's counsel, Mercer, Haight & Dunlop LLP, regarding the scope and nature of the compromise. The primary objectives of this coordination are: (i) to obtain access to Palomar's network logs, system artifacts, and other technical evidence necessary for the Graystone forensic investigation; (ii) to understand Palomar's own internal investigation findings and remedial actions; and (iii) to assess Quorum's contractual rights and remedies under the MSA.
Calderwood & Harkness has commenced a detailed review of the MSA and its amendments to assess Quorum's contractual rights against Palomar, including indemnification rights under Section 12.2, termination rights under Section 14.2, and Palomar's obligations to cooperate with the investigation and to remediate the security deficiencies that gave rise to the incident.
Based on the preliminary review, Calderwood & Harkness has identified the following potential contractual breaches by Palomar:
(a) Failure to Patch Critical Vulnerability Within 30 Days (Exhibit D): The vulnerability exploited by the threat actor (CVE-2023-0669) is a critical remote code execution vulnerability in the GoAnywhere MFT file transfer appliance. A vendor-supplied patch for this vulnerability was publicly released by Severin Corporation in early February 2023. Under Exhibit D of the MSA, as amended by Amendment 2, Palomar was required to apply patches for critical vulnerabilities within thirty (30) days of the vendor patch release date. The exploitation of this vulnerability on or about March 14, 2023 — more than thirty days after the patch was available — indicates that Palomar failed to apply the patch within the required timeframe. This failure is a direct and proximate cause of the unauthorized access and constitutes a breach of Palomar's data security obligations under the MSA.
(b) Late Breach Notification (Section 9.4): As discussed in Section III.B above, Palomar's notification to Quorum on April 21, 2023, was provided approximately twenty-four (24) hours after the expiration of the forty-eight (48) hour contractual notification deadline. This constitutes a breach of Section 9.4 of the MSA.
Calderwood & Harkness will prepare a formal indemnification demand letter to be sent to Palomar upon completion of the forensic investigation and determination of the scope of Quorum's losses and expenses. In the interim, Quorum is preserving all contractual rights and remedies under the MSA.
C. Regulatory Posture
No regulatory notifications have been filed by Quorum at this time. Under applicable state breach notification laws and the HIPAA Breach Notification Rule, notification obligations are generally triggered by the determination that a breach of specified data elements has occurred. Because the forensic investigation is still underway and the scope and nature of compromised data have not yet been definitively determined, Calderwood & Harkness has advised that it is premature to initiate notifications at this stage.
Calderwood & Harkness is preparing a comprehensive fifty-state breach notification law survey, which will serve as the foundation for the state-by-state notification trigger analysis once the forensic findings are available. This survey will catalog, for each state and the District of Columbia, the applicable data elements that trigger the notification obligation, the required timing of notification (which varies from state to state), the form and content requirements for notification letters, the designated regulatory recipients (e.g., state attorneys general, consumer protection offices), and any other applicable requirements (e.g., media notification thresholds, credit monitoring mandates).
No regulatory inquiries, demand letters, or enforcement actions have been received by Quorum to date in connection with this incident. Calderwood & Harkness is monitoring all regulatory developments and will immediately notify the General Counsel and the Audit Committee upon receipt of any regulatory communication.
VIII. Anticipated Next Steps and Timeline
The following is the anticipated timeline for the next phases of the incident response. All dates are estimates and are subject to revision based on the progress of the forensic investigation and other developments.
Calderwood & Harkness and the General Counsel's Office will provide the Audit Committee with updated briefings at key milestones, including but not limited to the following events:
• Receipt and analysis of the Graystone preliminary findings report (expected early June 2023);
• Receipt and analysis of the Graystone final forensic report (targeted mid-July 2023);
• Prior to initiating regulatory notifications and consumer notification mailings;
• Upon receipt of any regulatory inquiry, demand letter, or enforcement action;
• Upon the filing of any lawsuit related to the incident;
• Upon completion of the SEC materiality assessment and prior to any public disclosure; and
• Upon any other material development in the matter.
IX. Estimated Financial Exposure (Preliminary)
At this early stage of the investigation, precise cost estimates are not available, and any projections are inherently subject to significant variability based on the ultimate scope of the incident. However, based on Calderwood & Harkness's experience advising clients on incidents of this general nature and scale, the following preliminary cost categories and order-of-magnitude estimates are provided for the Audit Committee's consideration:
These estimates do not include potential regulatory fines or penalties, litigation defense costs, or settlement or judgment amounts in the event of consumer class action litigation, each of which would represent additional cost categories that cannot be estimated at this time.
The consumer notification and credit monitoring cost estimate is dependent on several factors that remain uncertain, including the total number of affected individuals, the geographic distribution of those individuals, the duration of credit monitoring offered (typically twelve to twenty-four months), and the enrollment take-rate among affected individuals.
With respect to insurance recovery, Quorum's self-insured retention ("SIR") of $2,500,000 will be Quorum's initial out-of-pocket obligation before insurance coverage attaches. Costs and expenses incurred above the SIR should be covered under the Atlas Mutual primary policy, up to the per-occurrence limit of $15,000,000. To the extent total covered costs exceed $15,000,000, the Pinnacle excess policy provides an additional $25,000,000 in coverage, for a total insurance tower of $40,000,000.
Additionally, Quorum has potential indemnification recovery rights against Palomar under MSA Section 12.2. The contractual liability cap for Palomar's indemnification obligation is $32,600,000 (equal to two times the trailing twelve-month fees paid). Depending on the outcome of the indemnification demand and any ensuing negotiation or dispute, recovery from Palomar may offset a significant portion of Quorum's costs and expenses, including amounts within the SIR.
For context, Quorum's fiscal year 2022 annual revenue was approximately $4.82 billion, and the Company's market capitalization as of May 2023 is approximately $6.1 billion. While the financial impact of this incident is significant and will require careful management, the preliminary estimated cost range — taking into account insurance recovery and potential vendor indemnification — is expected to be manageable relative to the Company's overall financial scale. This assessment is, however, subject to material revision as the scope of the incident is determined and as regulatory and litigation developments unfold.
X. Recommendations
The Audit Committee is asked to note and consider the following recommendations from Calderwood & Harkness LLP and the General Counsel's Office:
1. Continue Privileged Forensic Investigation. The Audit Committee should authorize the continuation of the privileged forensic investigation through Graystone Forensics under the Calderwood & Harkness privilege umbrella, with milestone reporting to the Audit Committee as described in Section VIII above. The forensic investigation is essential to determining the scope of the incident, identifying affected individuals, and establishing the factual basis for all subsequent response actions, including regulatory notifications, vendor indemnification demands, and insurance claims.
2. Preserve Vendor Accountability Rights. Calderwood & Harkness and the General Counsel's Office recommend that Quorum take all steps necessary to document and preserve its contractual rights against Palomar, including documenting Palomar's breaches of the MSA (specifically, the failure to patch the critical vulnerability within the required thirty-day window under Exhibit D and the late notification under Section 9.4). Upon completion of the forensic investigation and quantification of Quorum's losses and expenses, a formal indemnification demand will be prepared and submitted to Palomar. Calderwood & Harkness will also evaluate whether termination for cause under Section 14.2 is advisable, taking into account both the legal merits and the operational implications of transitioning to an alternative vendor.
3. Monitor Regulatory Landscape. The incident response team, under the direction of Calderwood & Harkness, should actively monitor for any incoming regulatory inquiries, demand letters, or enforcement actions from state attorneys general, the Connecticut Insurance Department, the HHS Office for Civil Rights, or any other regulatory authority. Quorum's regulatory compliance posture should remain proactive and cooperative, and the Audit Committee should be notified immediately upon receipt of any regulatory communication.
4. Coordinate with Insurance Carriers. Calderwood & Harkness and Whitmore Risk Advisors should continue to coordinate with Atlas Mutual and Pinnacle to ensure compliance with all policy terms and conditions, including cooperation requirements, consent-to-settle provisions, and timely submission of covered cost documentation. The objective is to maximize insurance recovery and to ensure that the claim process proceeds efficiently.
5. Defer Public Disclosure. Public disclosure of the incident should be deferred until the scope of the incident is confirmed through the forensic investigation and regulatory or legal notification obligations are triggered. Premature disclosure could compromise the investigation, create unnecessary alarm among policyholders and the market, and potentially prejudice Quorum's legal position. BrightPath Consulting Group is preparing communications strategies and draft materials so that Quorum is prepared to execute an orderly disclosure when the appropriate time arrives.
6. SEC Disclosure Assessment. The SEC disclosure assessment is ongoing. A formal materiality analysis under Item 1.05 of Form 8-K and applicable 10-Q risk factor disclosure requirements will be conducted upon receipt of the final forensic report from Graystone, at which point a definitive recommendation regarding the timing, content, and form of any public disclosure will be provided to the Audit Committee and the Chief Executive Officer. No 8-K or 10-Q disclosure should be made without prior consultation with and recommendation from Calderwood & Harkness and the General Counsel.
XI. Contacts
The following is a list of key contacts for the matter. All communications regarding this incident should be directed through Thomas R. Whitfield, General Counsel, or Kevin Ostrowski, Calderwood & Harkness LLP, to preserve the attorney-client privilege.
XII. Closing Privilege Reminder
This memorandum is protected in its entirety by the attorney-client privilege and the work product doctrine. It was prepared by Calderwood & Harkness LLP and the Quorum Insurance Holdings Corp. General Counsel's Office in anticipation of litigation and for the purpose of providing legal advice to the Audit Committee and the Board of Directors of Quorum Insurance Holdings Corp. The memorandum reflects the mental impressions, conclusions, opinions, and legal theories of counsel.
The Audit Committee members and all Board members receiving this memorandum are respectfully requested to treat this document and its contents as strictly confidential. This memorandum should not be disclosed, distributed, or discussed with any person outside the Board of Directors of Quorum Insurance Holdings Corp. without the prior written authorization of Calderwood & Harkness LLP or the Quorum Insurance Holdings Corp. General Counsel's Office. Unauthorized disclosure of this memorandum could result in the waiver of the attorney-client privilege and work product protection, which would be detrimental to Quorum's legal interests.
All communications regarding this matter — whether written, oral, or electronic — should be directed through Thomas R. Whitfield, General Counsel, Quorum Insurance Holdings Corp., or Kevin Ostrowski, Responsible Partner, Calderwood & Harkness LLP, to ensure that the attorney-client privilege is preserved.
PRIVILEGED & CONFIDENTIAL — ATTORNEY-CLIENT PRIVILEGED — ATTORNEY WORK PRODUCT
Item | Detail
Insurer | Atlas Mutual Insurance Company (Chicago, IL)
Policy Number | CYB-2023-041587
Coverage Period | January 1, 2023 – January 1, 2024
Per-Occurrence Limit | $15,000,000
Aggregate Limit | $15,000,000
Self-Insured Retention (SIR) | $2,500,000
Claims Adjuster | Paul Enriquez
Item | Detail
Insurer | Pinnacle Surplus Lines Insurance Corp. (Boston, MA)
Policy Number | XS-CYB-2023-7812
Coverage Period | January 1, 2023 – January 1, 2024
Limit | $25,000,000 excess of $15,000,000
Follow-Form | Follows form to Atlas Mutual primary policy terms
Claims Contact | Lisa Garner
Timeframe | Action Item
May – early June 2023 | Graystone Forensics conducts forensic investigation; preliminary findings report expected in early June 2023
June 2023 | Calderwood & Harkness analyzes preliminary forensic findings and refines notification obligation assessment; completes fifty-state breach notification law survey; coordinates with Palomar's counsel on investigation access
Mid-July 2023 (target) | Graystone delivers final forensic report; definitive determination of scope of compromised data and identification of affected data sets
Late July – early August 2023 (estimated) | Data mining and affected individual identification; extraction and normalization of affected individual records for notification purposes
August 2023 (estimated) | Consumer notification letters mailed and regulatory notifications filed, subject to forensic findings and notification trigger analysis; credit monitoring enrollment offered to affected individuals
Ongoing | Vendor accountability assessment and indemnification demand preparation; insurance coverage coordination and claims processing; SEC disclosure materiality assessment; monitoring for regulatory inquiries and litigation filings
Cost Category | Estimated Range
Forensic investigation (Graystone Forensics) | $1,000,000 – $3,000,000
Consumer notification and credit monitoring | $2,000,000 – $5,000,000
Crisis communications (BrightPath Consulting) | $200,000 – $500,000
Legal fees (Calderwood & Harkness) | $1,500,000 – $3,000,000
Internal costs (IT remediation, employee overtime) | $500,000 – $1,000,000
Total estimated range | $5,200,000 – $12,500,000
Role | Name | Organization | Address / Contact
Responsible Partner, Outside Counsel | Kevin Ostrowski | Calderwood & Harkness LLP | 1700 K Street NW, Suite 900, Washington, D.C. 20006
Billing Partner, Outside Counsel | Rachel Bernstein | Calderwood & Harkness LLP | 51 West 52nd Street, 34th Floor, New York, NY 10019
General Counsel | Thomas R. Whitfield | Quorum Insurance Holdings Corp. | 400 Constitution Plaza, Suite 2200, Hartford, CT 06103
Chief Information Security Officer | David Naranjo | Quorum Insurance Holdings Corp. | 400 Constitution Plaza, Suite 2200, Hartford, CT 06103
Chief Privacy Officer | Jennifer Liang | Quorum Insurance Holdings Corp. | 400 Constitution Plaza, Suite 2200, Hartford, CT 06103
Forensic Investigation Lead | Dr. Nolan Briggs | Graystone Forensics LLC | 1950 Old Gallows Road, Suite 600, Tysons Corner, VA 22182
Primary Insurance Claims Adjuster | Paul Enriquez | Atlas Mutual Insurance Company | 120 South LaSalle Street, Suite 3200, Chicago, IL 60603
Cyber-Insurance Broker | Sandra Whitmore-Kim | Whitmore Risk Advisors Inc. | 390 Park Avenue, 18th Floor, New York, NY 10022

PRIVILEGED & CONFIDENTIAL ATTORNEY-CLIENT PRIVILEGED — ATTORNEY WORK PRODUCT

MEMORANDUM

MATTER NO.: 1025-00006

Record

Parties

Dates

Amounts