1025-00006 · Graystone Forensics LLC · Board & Management Reporting

board-briefing-memo-matter-resolution.docx DOCUMENT Data Privacy

3 / 88 ← → ✕

CALDERWOOD & HARKNESS LLP Attorneys at Law

1700 K Street NW, Suite 900 Washington, D.C. 20006 Telephone: (202) 555-7400 Facsimile: (202) 555-7401 www.calderwoodharkness.com

PRIVILEGED AND CONFIDENTIAL ATTORNEY-CLIENT PRIVILEGED / ATTORNEY WORK PRODUCT

November 29, 2023

Matter No.: 1025-00006

TO: Franklin Reeves, Chair, Audit Committee, Board of Directors, Quorum Insurance Holdings Corp. Members of the Board of Directors of Quorum Insurance Holdings Corp.

FROM: Kevin Ostrowski, Partner, Calderwood & Harkness LLP

CC: Margaret D. Calloway, Chief Executive Officer, Quorum Insurance Holdings Corp. Thomas R. Whitfield, General Counsel, Quorum Insurance Holdings Corp. Jennifer Liang, Chief Privacy Officer, Quorum Insurance Holdings Corp. David Naranjo, Chief Information Security Officer, Quorum Insurance Holdings Corp.

RE: Data Security Incident — Palomar Data Solutions, Inc. — Final Matter Resolution and Closure Report

This memorandum is a privileged and confidential attorney-client communication and constitutes attorney work product prepared in anticipation of litigation and in connection with the provision of legal advice. This document is intended solely for the use of the addressees and copy recipients identified above and should not be disclosed, distributed, or reproduced without the prior written consent of Calderwood & Harkness LLP. Any inadvertent disclosure does not constitute a waiver of any applicable privilege.

I. EXECUTIVE SUMMARY

This memorandum serves as the final privileged briefing to the Audit Committee and Board of Directors of Quorum Insurance Holdings Corp. ("Quorum" or the "Company") regarding the successful resolution and closure of all regulatory engagements and vendor accountability matters arising from the vendor-originated data security incident at Palomar Data Solutions, Inc. ("Palomar"). Calderwood & Harkness LLP ("Calderwood & Harkness" or the "Firm") has had the privilege of serving as outside counsel to Quorum in connection with this matter since May 4, 2023, and we are pleased to report that all workstreams have been concluded with highly favorable outcomes for the Company.

As detailed in this memorandum, all three regulatory tracks that arose from the incident have now concluded without any enforcement action, fine, penalty, consent decree, or other adverse regulatory outcome being imposed against Quorum:

• Multistate Attorney General Coalition (29 States): A closure letter was received on November 22, 2023, from the co-lead offices of the Connecticut and New York Attorneys General, on behalf of all 29 participating states, confirming that the multistate enforcement track is closing without action against Quorum.

• Connecticut Insurance Department: The inquiry initiated by the Financial Analysis Division, Cybersecurity Unit, was formally closed on November 28, 2023, with no enforcement action, no recommendations for corrective action, and no adverse findings.

• HHS Office for Civil Rights (HIPAA): A no further action letter was received on November 30, 2023, confirming that the Office for Civil Rights will take no further action regarding the reported breach of protected health information.

In addition to these regulatory outcomes, Quorum achieved a substantial vendor indemnification recovery from Palomar through a Settlement Agreement and Mutual Release executed on October 27, 2023. The settlement yields an effective total recovery of $6,156,000, consisting of a $4,200,000 cash payment and $1,956,000 in fee reductions to be realized over an 18-month period.

Total incident response costs across all workstreams amounted to $8,230,250. Of this amount, Quorum's cyber-insurance policy with Atlas Mutual Insurance Company covers $5,730,250, representing all costs in excess of the Company's $2,500,000 self-insured retention. When combined with the Palomar indemnification recovery, the Company's total recoveries exceed its total incident response costs, resulting in a net favorable financial outcome.

Based on the successful conclusion of all regulatory engagements, completion of all consumer notifications, execution of the Palomar settlement, and submission of the final insurance claim, Calderwood & Harkness recommends that the Audit Committee approve formal closure of this engagement effective December 1, 2023.

This memorandum should be read in conjunction with the prior Board briefings provided on May 11, 2023 (initial incident report and engagement scope), July 21, 2023 (forensic investigation findings and consumer notification plan), and October 16, 2023 (regulatory engagement update and Palomar settlement negotiations status). The present memorandum supersedes no prior briefing but rather provides the final chapter in the matter's resolution.

II. BACKGROUND — INCIDENT SUMMARY

For the benefit of any Board member who may not have been present for all prior briefings, and to provide complete context for this closing report, we summarize below the key facts of the data security incident that gave rise to this engagement.

Origin of the Incident

The incident at issue arose not from any failure or vulnerability within Quorum's own information systems, but rather from a data security breach at Palomar Data Solutions, Inc. ("Palomar"), a third-party claims-processing vendor that has provided services to Quorum under a Master Services Agreement dated November 12, 2019 (the "MSA"), as subsequently amended. Palomar is Quorum's second-largest vendor by annual contract value, with a post-Amendment 1 (effective April 1, 2021) annual contract value ("ACV") of approximately $16,300,000 (the original ACV prior to Amendment 1 was approximately $14.2 million). Palomar processes a significant volume of claims data on behalf of Quorum, including personal information of Quorum's policyholders, claimants, and beneficiaries.

The Vulnerability and Initial Compromise

On or about March 14, 2023, an unauthorized threat actor exploited a known remote code execution vulnerability, designated CVE-2023-0669, in Palomar's GoAnywhere MFT (Managed File Transfer) file transfer appliance. CVE-2023-0669 is a pre-authentication command injection vulnerability in Severin Corporation's GoAnywhere MFT platform that was publicly disclosed in early February 2023 and for which a vendor patch was made available shortly thereafter. Despite the availability of the patch and the critical severity rating of the vulnerability, Palomar failed to apply the patch to its GoAnywhere MFT environment in a timely manner.

This failure is of particular significance because the MSA's Data Security Exhibit (Exhibit D), as amended by Amendment 2 (executed September 15, 2022), expressly required Palomar to patch critical vulnerabilities within 30 days of the vendor's release of a patch. The patch for CVE-2023-0669 was available well in advance of the March 14, 2023 exploitation date, and Palomar's failure to apply it within the contractually mandated timeframe constituted a direct breach of its obligations under the MSA.

Data Exfiltration

Following the initial unauthorized access on or about March 14, 2023, the threat actor maintained persistent access to Palomar's GoAnywhere MFT environment and exfiltrated data over an approximately 35-day window, spanning from March 14, 2023 through April 18, 2023. During this period, the threat actor extracted files containing personal information, financial data, and protected health information pertaining to individuals whose data was maintained in Palomar's environment in connection with its claims-processing services for Quorum.

Detection and Notification

On April 18, 2023, Palomar's Security Operations Center ("SOC") detected anomalous outbound data transfers from its GoAnywhere MFT environment. Palomar's internal incident response team initiated containment and investigation procedures. However, Palomar did not notify Quorum of the incident until April 21, 2023 — approximately 72 hours after detection. This timeline is significant because Section 9.4 of the MSA requires Palomar to notify Quorum of any suspected or confirmed data security incident involving Quorum data within 48 hours of discovery. Palomar's notification was therefore approximately 24 hours past the contractual deadline, constituting a second breach of the MSA.

Engagement of Counsel and Forensic Investigators

Upon receiving notification from Palomar, Quorum's General Counsel, Thomas R. Whitfield, initiated the Company's incident response procedures and, following internal assessment, engaged Calderwood & Harkness on May 4, 2023, to serve as outside counsel and coordinate the Company's legal response. The following day, May 5, 2023, Calderwood & Harkness retained Graystone Forensics LLC ("Graystone") to conduct a forensic investigation under the protection of the attorney-client privilege and work product doctrine. Graystone's engagement was structured to ensure that the forensic findings would be covered by privilege, with Graystone reporting directly to Calderwood & Harkness rather than to Quorum or Palomar.

Forensic Findings

Graystone completed its forensic investigation and issued its final report on July 14, 2023. The investigation confirmed that the data of 318,247 individuals across 29 states and the District of Columbia was compromised in the incident. The types of data affected were categorized as follows:

• Personally Identifiable Information (PII): All 318,247 affected individuals had the following categories of PII compromised: full names, dates of birth, Social Security numbers, and driver's license numbers.

• Financial Information: A subset of 84,619 individuals also had financial information compromised, including bank account numbers and payment card numbers. These individuals were primarily claimants who had provided banking information for electronic funds transfer of claims payments.

• Protected Health Information (PHI): A subset of 41,203 individuals also had protected health information compromised, including health conditions, diagnosis codes, and treatment information derived from workers' compensation claims and other health-related insurance claims processed by Palomar on Quorum's behalf.

Root Cause Determination

As noted above, the root cause of the incident was Palomar's failure to timely patch CVE-2023-0669 in its GoAnywhere MFT environment. This failure was a direct violation of the patching requirements set forth in Exhibit D (Data Security Exhibit) of the MSA, as amended by Amendment 2 (executed September 15, 2022). The amendment specifically required Palomar to apply patches for critical vulnerabilities — defined by reference to Common Vulnerability Scoring System (CVSS) scores of 9.0 or higher — within 30 days of the vendor's release of a patch. CVE-2023-0669 carried a CVSS score of 7.2 (categorized as "high"), but Exhibit D, as amended, extended the 30-day patching requirement to vulnerabilities rated "high" (CVSS 7.0–8.9) as well as "critical" (CVSS 9.0–10.0). The patch for CVE-2023-0669 was available for a period well exceeding 30 days prior to the March 14, 2023 exploitation.

III. CONSUMER AND REGULATORY NOTIFICATION COMPLETION

A. Consumer Notifications

Following the completion of Graystone's forensic investigation and the identification of affected data types, Calderwood & Harkness coordinated a comprehensive consumer notification program in compliance with the breach notification statutes of all 29 affected states and the District of Columbia, as well as the Health Insurance Portability and Accountability Act ("HIPAA") notification requirements at 45 C.F.R. Part 164, Subpart D.

Data Mining and Individual Identification. The data mining process — involving the review, deduplication, and verification of affected individual records and the matching of those records to current mailing addresses — was completed on August 4, 2023. This process was performed by Clearfield Notification Services LLC ("Clearfield"), a specialized breach notification vendor, under the direction of Calderwood & Harkness and in coordination with Quorum's internal data teams and Palomar's data custodians.

Notification Letter Development and Mailing. Calderwood & Harkness prepared three distinct versions of the consumer notification letter, each tailored to the specific types of data compromised for the relevant population of affected individuals:

1. General PII Version: Sent to individuals whose names, dates of birth, Social Security numbers, and/or driver's license numbers were compromised, but who did not have financial information or PHI affected.

2. SSN + Financial Data Version: Sent to the subset of 84,619 individuals whose financial information (bank account numbers and/or payment card numbers) was compromised in addition to PII.

3. PHI Version (HIPAA-Compliant): Sent to the subset of 41,203 individuals whose protected health information was compromised. This version was drafted in compliance with the content requirements of 45 C.F.R. § 164.404(c), including a description of the types of PHI involved, steps individuals should take to protect themselves, a description of what Quorum is doing to investigate and mitigate the breach, and contact information for further inquiries.

In addition to these three base versions, state-specific adaptations were prepared for jurisdictions with unique content requirements. Most notably, separate versions were prepared for California, to comply with the specific content requirements of California Civil Code § 1798.82 and the Confidentiality of Medical Information Act ("CMIA"), and for Massachusetts, to comply with the requirements of Massachusetts General Laws Chapter 93H, § 3 and 201 CMR 17.00.

Consumer notification letters were mailed on a rolling basis over a 28-day period, commencing August 18, 2023 and concluding September 15, 2023. A total of 318,247 notification letters were mailed during this period. All letters were sent via first-class U.S. mail through Clearfield's secure mailing facilities.

Credit Monitoring and Identity Theft Protection. Each notification letter offered affected individuals 24 months of complimentary credit monitoring and identity theft protection services through Clearfield. The credit monitoring package includes three-bureau credit monitoring, identity theft insurance coverage, and access to identity restoration services. As of the date of this memorandum, the estimated enrollment take-rate is approximately 40%, representing approximately 127,299 enrollees. This take-rate is consistent with industry benchmarks for incidents of this nature and scale.

Call Center Operations. Clearfield operated a dedicated toll-free call center for a 12-week window following the initial mailing of notification letters. Call center agents were trained by Calderwood & Harkness and Quorum personnel on the specifics of the incident and were provided with approved scripts and FAQs. Call volume throughout the 12-week period was manageable and within projected ranges. No material escalations, media inquiries routed through the call center, or regulatory complaints originated from call center interactions were reported by Clearfield.

Substitute Notice and Website Posting. In compliance with applicable state breach notification statutes that require or permit substitute notice in addition to individual written notice, Quorum published a substitute notice and website posting on its corporate website on August 15, 2023, three days prior to the commencement of individual notification mailings. The website notice remained prominently posted throughout the notification period and continues to be accessible via Quorum's website.

Crisis Communications. BrightPath Consulting Group Inc. ("BrightPath") was engaged to manage all crisis communications associated with the incident. BrightPath's scope of work included the preparation and dissemination of press statements, internal employee communications, and investor-facing disclosures. BrightPath coordinated closely with Calderwood & Harkness, Mr. Whitfield's office, and Quorum's corporate communications team throughout the notification period to ensure consistent and accurate messaging. Media coverage of the incident was limited in scope and duration, and BrightPath's proactive communications strategy contributed to minimizing reputational impact to the Company.

B. Regulatory Notifications

Calderwood & Harkness, in coordination with Quorum's legal and compliance teams, prepared and filed all required regulatory notifications across all affected jurisdictions. All notifications were filed timely, and no notification deadline was missed in any jurisdiction. The regulatory notification filings are summarized below:

• Connecticut Attorney General: Filed August 14, 2023, pursuant to Connecticut General Statutes § 36a-701b. The filing reported that 52,114 Connecticut residents were affected by the incident.

• Connecticut Insurance Department: Filed August 14, 2023, pursuant to Connecticut General Statutes § 38a-999b (Connecticut Insurance Data Security Law). The filing was made concurrently with the Connecticut Attorney General filing and contained supplemental information specific to the insurance regulatory context.

• HHS Office for Civil Rights (HIPAA): Filed August 15, 2023, with HHS-OCR Region I (Boston), pursuant to 45 C.F.R. § 164.408. The filing reported the breach of unsecured protected health information affecting 41,203 individuals. Because this breach affected more than 500 individuals, the notification was filed within 60 days of the discovery of the breach, as required by the HIPAA Breach Notification Rule.

• New York Attorney General: Filed August 16, 2023, pursuant to New York General Business Law § 899-aa. The filing reported that 47,831 New York residents were affected.

• California Attorney General: Filed August 16, 2023, pursuant to California Civil Code § 1798.82. The filing reported that 38,206 California residents were affected. Because this number exceeded 500 California residents, a copy of the notification letter was also submitted to the California Attorney General as required by statute.

• Massachusetts Attorney General and Office of Consumer Affairs and Business Regulation: Filed August 17, 2023, pursuant to Massachusetts General Laws Chapter 93H, § 3. The filing reported that 10,217 Massachusetts residents were affected.

• 24 Additional State Attorneys General and Regulators: Filings were submitted between August 17 and August 25, 2023, to the attorneys general and/or applicable regulatory authorities in each of the remaining affected states. All filings were submitted in compliance with the applicable state-specific breach notification statutes, including any state-specific content, format, or timing requirements.

In addition to the above regulatory filings, a media notice was published on August 15, 2023, in compliance with 45 C.F.R. § 164.406, which requires notification to prominent media outlets serving affected states when a breach of unsecured PHI affects more than 500 residents of a state or jurisdiction. The media notice was distributed to major media outlets in the relevant jurisdictions in coordination with BrightPath.

To reiterate, no notification deadline was missed in any jurisdiction. The timely and comprehensive nature of Quorum's notification program was a significant factor in the favorable regulatory outcomes described in Section IV below.

IV. RESOLUTION OF REGULATORY ENGAGEMENTS

This Section describes the resolution of each of the three regulatory engagement tracks that arose from the incident. As noted in the Executive Summary, all three tracks have concluded without any adverse action against Quorum.

A. Multistate Attorney General Coalition (29 States)

Joint Demand Letter. On September 8, 2023, Calderwood & Harkness received a joint demand letter from the offices of the Connecticut Attorney General and the New York Attorney General, acting on behalf of a 29-state coalition. The letter was signed by Assistant Attorney General Diane Marchetti of the Connecticut Attorney General's Consumer Protection Division (lead counsel for the coalition) and Assistant Attorney General Mark Petrosian of the New York Attorney General's Bureau of Internet and Technology (co-lead counsel). The demand letter requested detailed information regarding the incident, Quorum's information security program, the consumer notification process, and Quorum's relationship with Palomar.

The 29 states participating in the coalition were: Connecticut (lead), New York (co-lead), Massachusetts, California, Illinois, Pennsylvania, New Jersey, Ohio, Texas, Florida, Georgia, Virginia, Maryland, North Carolina, South Carolina, Michigan, Minnesota, Indiana, Wisconsin, Colorado, Arizona, Oregon, Washington, Tennessee, Missouri, Louisiana, Nevada, Iowa, and New Hampshire.

Calderwood & Harkness's Response. Calderwood & Harkness prepared and submitted a comprehensive written response on October 13, 2023. The response was accompanied by four supporting exhibits:

• Exhibit A: A detailed incident timeline and summary of remedial measures implemented by Quorum and required of Palomar following the incident.

• Exhibit B: Representative samples of each version of the consumer notification letter, along with a comprehensive compliance checklist demonstrating that all state-specific notification requirements had been satisfied.

• Exhibit C: A summary of Quorum's vendor accountability efforts, including the contractual bases for Quorum's claims against Palomar, the indemnification demand, and the resulting settlement.

• Exhibit D: An overview of Quorum's enterprise information security program, including its governance structure, technical controls, vendor risk management framework, and incident response capabilities.

The response was structured around five key themes that Calderwood & Harkness identified as most relevant to the coalition's enforcement considerations:

1. Vendor-Originated Breach: The breach occurred in Palomar's systems, not Quorum's. Quorum's own information systems were not compromised, and the vulnerability that was exploited (CVE-2023-0669) existed in Palomar's GoAnywhere MFT environment, not in any Quorum-owned or Quorum-operated system.

2. Robust Information Security Program: Quorum maintains a mature, well-resourced information security program that meets or exceeds industry standards for organizations of its size and complexity, including compliance with the NIST Cybersecurity Framework and applicable state insurance data security laws.

3. Timely Consumer and Regulatory Notifications: Quorum completed all consumer and regulatory notifications within the timeframes required by applicable law in all 29 affected states and the District of Columbia.

4. Proactive Vendor Accountability: Quorum took prompt and decisive action to hold Palomar accountable for its contractual breaches, including issuing a formal indemnification demand and negotiating a settlement that yielded substantial financial recovery for the Company and enhanced security protections going forward.

5. Comprehensive Remediation: Quorum implemented a comprehensive remediation program, including enhanced vendor oversight measures, contractual amendments with Palomar, and credit monitoring and identity theft protection services for all affected individuals.

Supplemental Submission. On November 3, 2023, Calderwood & Harkness submitted a supplemental information package to the coalition, providing updated credit monitoring enrollment statistics (demonstrating strong take-rates and successful program operation) and a summary of the October 27, 2023 settlement with Palomar, including the enhanced security measures that Palomar agreed to implement.

Closure Letter. On November 22, 2023, Calderwood & Harkness received a closure letter signed by AAG Diane Marchetti and AAG Mark Petrosian on behalf of all 29 participating states. The closure letter confirmed that the multistate enforcement track is closing without action against Quorum. No fine, penalty, consent decree, assurance of voluntary compliance ("AVC"), or any other enforcement mechanism was imposed. The closure letter acknowledged Quorum's cooperation with the investigation and the comprehensive nature of its response.

This outcome represents a highly favorable result for Quorum. Multistate AG investigations of data security incidents frequently result in consent decrees, substantial monetary penalties, or AVCs imposing ongoing compliance obligations and monitoring requirements. The closure of this investigation without any such action reflects the effectiveness of the cooperative, transparent engagement strategy that Calderwood & Harkness and Quorum's management team pursued throughout the process. A copy of the closure letter is attached hereto as Enclosure 1.

B. Connecticut Insurance Department

Inquiry. Following Quorum's August 14, 2023 notification filing with the Connecticut Insurance Department pursuant to Connecticut General Statutes § 38a-999b, the Department opened an inquiry into the incident. The inquiry was conducted by examiner Richard Nakamura of the Department's Financial Analysis Division, Cybersecurity Unit. The Connecticut Insurance Data Security Law imposes specific cybersecurity requirements on insurance licensees, including requirements related to information security programs, vendor risk management, incident response, and breach notification.

Calderwood & Harkness's Response. On September 22, 2023, Calderwood & Harkness submitted a formal response to the Department's inquiry, detailing Quorum's compliance with the Connecticut Insurance Data Security Law, including its written information security program, its risk assessment procedures, its vendor oversight framework, and its incident response plan. The response demonstrated that Quorum's information security program meets or exceeds the requirements of the Connecticut statute and that the incident did not result from any deficiency in Quorum's own security posture.

Supplemental Submission. On October 20, 2023, Calderwood & Harkness submitted supplemental information in response to follow-up questions from examiner Nakamura. The supplemental submission addressed additional questions regarding Quorum's vendor oversight program — specifically the procedures by which Quorum evaluates and monitors the security practices of its third-party service providers — the security provisions of the Palomar MSA (including the Data Security Exhibit and its amendments), and the post-incident remediation measures implemented by Quorum and required of Palomar.

Closure. On November 28, 2023, the Connecticut Insurance Department formally closed its inquiry. The closure was communicated in a letter from examiner Nakamura confirming that the Department has concluded its review with no enforcement action, no recommendations for corrective action, and no adverse findings against Quorum. This is a clean closure with no residual obligations or conditions. A copy of the closure letter is attached hereto as Enclosure 2.

C. HHS Office for Civil Rights (HIPAA)

Breach Notification. On August 15, 2023, Quorum filed a breach notification with the U.S. Department of Health and Human Services, Office for Civil Rights ("HHS-OCR"), Region I (Boston), pursuant to 45 C.F.R. § 164.408. The notification reported the breach of unsecured protected health information affecting 41,203 individuals. The PHI at issue consisted of health conditions, diagnosis codes, and treatment information derived from workers' compensation claims and other health-related insurance claims that Palomar processed on Quorum's behalf.

OCR Follow-Up Inquiry. Following receipt of the breach notification, HHS-OCR issued a follow-up inquiry seeking additional information regarding the incident. Calderwood & Harkness submitted a comprehensive response on October 5, 2023, addressing the nature and scope of the PHI compromised, the circumstances of the breach (including the vendor-originated nature of the incident and Palomar's specific security failures), Quorum's HIPAA compliance measures (including its HIPAA Privacy and Security Policies, its Business Associate Agreement with Palomar, and its HIPAA training program), and the post-incident remediation steps taken by both Quorum and Palomar.

No Further Action Letter. On November 30, 2023, Calderwood & Harkness received a no further action letter from HHS-OCR confirming that no further action will be taken regarding the reported breach. Specifically, HHS-OCR will not pursue a corrective action plan, resolution agreement, or civil monetary penalty in connection with this matter. A copy of the no further action letter is attached hereto as Enclosure 3.

D. Summary of Regulatory Outcomes

The following table summarizes the disposition of each regulatory engagement:

All three regulatory tracks have concluded with no adverse action of any kind against Quorum. Calderwood & Harkness attributes this outcome to four principal factors: (1) the vendor-originated nature of the breach, which demonstrated that the vulnerability and security failure were attributable to Palomar rather than Quorum; (2) Quorum's strong compliance posture, including timely and complete notifications to all affected individuals and regulators, and a robust enterprise information security program; (3) Quorum's proactive vendor accountability efforts, which demonstrated to regulators that the Company took seriously its obligation to hold its vendor responsible; and (4) the cooperative and transparent engagement strategy pursued with all regulators, which fostered a constructive dialogue and facilitated efficient resolution of each inquiry.

V. VENDOR ACCOUNTABILITY — PALOMAR DATA SOLUTIONS SETTLEMENT

A. Contractual Basis for Claims

As detailed in prior briefings, Quorum identified two distinct breaches of the MSA by Palomar that formed the basis for Quorum's indemnification claims:

First, Palomar breached its obligation under Exhibit D (the Data Security Exhibit), as amended by Amendment 2 (executed September 15, 2022), to patch critical and high-severity vulnerabilities within 30 days of the vendor's release of a patch. CVE-2023-0669 was publicly disclosed in early February 2023, and a vendor patch was made available shortly thereafter. Palomar failed to apply the patch within the 30-day window, and the vulnerability was exploited on or about March 14, 2023 — well after the contractual patching deadline had passed. This failure was the direct and proximate cause of the data breach.

Second, Palomar breached Section 9.4 of the MSA, which requires Palomar to notify Quorum of any suspected or confirmed data security incident involving Quorum data within 48 hours of discovery. Palomar's SOC detected the anomalous outbound data transfers on April 18, 2023, but Palomar did not notify Quorum until April 21, 2023 — approximately 72 hours after detection, or roughly 24 hours past the contractual notification deadline. While this delay did not ultimately affect the scope of data compromised (the exfiltration had already concluded by the time Palomar detected the anomalous activity), the late notification delayed the commencement of Quorum's incident response and forensic investigation.

Demand Letter. On June 20, 2023, Calderwood & Harkness issued a formal breach of contract demand letter to Palomar's outside counsel, Catherine Langford, Partner at Mercer, Haight & Dunlop LLP, demanding full indemnification of $8,230,250 (the estimated total incident response costs) under Section 12.2 of the MSA. Section 12.2 contains a broad indemnification obligation requiring Palomar to indemnify, defend, and hold harmless Quorum from and against all losses, damages, costs, expenses (including reasonable attorneys' fees), and liabilities arising from or related to Palomar's breach of its obligations under the MSA, including its data security obligations. The indemnification cap under the MSA is $32,600,000, calculated as two times the trailing twelve-month fees paid to Palomar ($16,300,000 × 2), which significantly exceeded Quorum's total claimed damages.

Palomar's Initial Response. Palomar, through Ms. Langford, responded on July 7, 2023. Palomar's response disputed certain aspects of causation and the scope of damages, and offered a $1,500,000 "goodwill credit" in lieu of a formal indemnification payment. Calderwood & Harkness assessed this offer as inadequate, both in quantum and in its characterization as a goodwill gesture rather than a contractual obligation.

Negotiations. Calderwood & Harkness prepared and submitted a detailed rebuttal to Palomar's position on July 25, 2023, addressing each of Palomar's arguments regarding causation and damages. Following this exchange, the parties engaged in extensive settlement negotiations through September and October 2023. These negotiations were conducted principally between Mr. Ostrowski and Ms. Langford, with the involvement of Mr. Whitfield and Palomar's senior management at key junctures. The negotiations were informed by the strength of Quorum's contractual position, the clear evidence of Palomar's breaches, and the practical considerations of maintaining the ongoing commercial relationship between the parties for the remaining term of the MSA.

B. Settlement Terms (Executed October 27, 2023)

On October 27, 2023, Quorum and Palomar executed a Settlement Agreement and Mutual Release (the "Settlement Agreement") resolving all indemnification claims arising from the incident. The principal terms of the Settlement Agreement are as follows:

(a) Cash Payment. Palomar agreed to pay Quorum $4,200,000 in cash, payable within 30 calendar days of the execution date (i.e., on or before approximately November 26, 2023).

(b) Fee Reduction. Palomar agreed to a reduction of 8% on the annual contract value of $16,300,000 for a period of 18 months, effective November 1, 2023. This fee reduction yields total savings to Quorum of $1,956,000 over the 18-month period ($16,300,000 × 8% = $1,304,000 per year × 1.5 years = $1,956,000).

(c) Independent Third-Party Security Assessor. Palomar agreed to engage, at its own expense, an independent third-party security assessor to conduct enhanced annual security audits of Palomar's information security environment, with the scope to include the systems and controls relevant to Palomar's processing of Quorum data. The results of these audits are to be shared with Quorum.

(d) Enhanced Security Measures. Palomar agreed to implement enhanced patch management procedures and deploy endpoint detection and response ("EDR") capabilities across its environment within 90 days of the settlement execution date.

(e) Mutual Release. The parties exchanged mutual releases of all claims related to the incident, including Quorum's release of any further indemnification claims and Palomar's release of any counterclaims or cross-claims.

The total effective recovery to Quorum under the Settlement Agreement is $6,156,000, comprising $4,200,000 in cash and $1,956,000 in fee savings. A copy of the Settlement Agreement is attached hereto as Enclosure 4.

C. MSA Amendment 3

Concurrent with the execution of the Settlement Agreement, Quorum and Palomar executed Amendment 3 to the Master Services Agreement (the "MSA Amendment 3"), dated October 27, 2023. MSA Amendment 3 amends the MSA (as previously amended by Amendment 1, effective April 1, 2021, and Amendment 2, executed September 15, 2022) to incorporate the following enhanced security and oversight provisions:

• Enhanced Patching Requirements: The patching window for critical and high-severity vulnerabilities has been reduced from 30 days to 14 days from the date of vendor patch release.

• Mandatory Endpoint Detection and Response: Palomar is required to deploy and maintain EDR solutions across all systems involved in the processing, storage, or transmission of Quorum data.

• Quarterly Vulnerability Scanning: Palomar is required to conduct quarterly vulnerability scans of its environment and provide reports of scan results to Quorum within 15 business days of each scan completion.

• Annual Independent Security Assessment: Palomar is required to engage, at its own expense, an independent third-party assessor to conduct an annual security assessment. The assessment scope, methodology, and assessor selection are subject to Quorum's reasonable approval.

• Enhanced Incident Notification Requirement: The notification window for suspected or confirmed data security incidents has been reduced from 48 hours to 24 hours from the time of discovery.

• Fee Reduction: The 18-month 8% fee reduction agreed to in the Settlement Agreement has been incorporated into the MSA as a formal amendment to the pricing schedule.

The MSA continues in effect through its original five-year term, which expires on November 11, 2024. A copy of MSA Amendment 3 is attached hereto as Enclosure 5.

VI. FINANCIAL SUMMARY — TOTAL COSTS, INSURANCE RECOVERY, AND NET IMPACT

A. Total Incident Response Costs

The following table summarizes the total incident response costs incurred in connection with the Palomar data security incident:

For transparency and in accordance with our standard billing disclosure practices for Board-level engagements, we provide the following summary of Calderwood & Harkness's fees:

Calderwood & Harkness billed approximately 2,400 total hours across the engagement team over the course of the matter. The engagement team consisted of the following timekeepers: Kevin Ostrowski, Partner (billing rate: $1,250/hour); Rachel Bernstein, Of Counsel (billing rate: $1,175/hour); Alan Burke, Senior Associate (billing rate: $825/hour); and Sara Hendricks, Associate (billing rate: $650/hour). The blended effective rate across all timekeepers was approximately $901.56 per hour. The total engagement duration was approximately 212 days (May 4, 2023 through December 1, 2023), spanning approximately seven months.

A detailed final cost summary, broken down by cost category, vendor, and billing period, is attached hereto as Enclosure 6.

B. Cyber-Insurance Recovery

Quorum maintains a cyber-insurance program consisting of the following policies:

• Primary Policy: Atlas Mutual Insurance Company, Policy No. CYB-2023-041587. The policy provides a per-occurrence limit of $15,000,000, subject to a self-insured retention ("SIR") of $2,500,000.

• Excess Policy: Pinnacle Surplus Lines Insurance Corp., Policy No. XS-CYB-2023-7812. The excess policy provides $25,000,000 in coverage excess of the $15,000,000 primary policy limit, for a total cyber-insurance tower of $40,000,000.

Quorum filed an insurance claim under the Atlas Mutual primary policy on May 8, 2023, bearing Claim No. CYB-CLM-2023-05892. Atlas Mutual acknowledged the claim and accepted coverage for forensic investigation costs, consumer notification costs, call center operations, credit monitoring services, crisis communications expenses, and regulatory defense legal fees incurred in excess of the SIR. Coverage was confirmed without reservation for these categories of expense.

A proof of loss and final cost summary was submitted to Atlas Mutual on November 15, 2023, reflecting the total incident response costs of $8,230,250. The insurance recovery analysis is as follows:

• Amount within SIR (Quorum's responsibility): $2,500,000

• Amount covered by Atlas Mutual primary policy: $5,730,250 ($8,230,250 total costs minus $2,500,000 SIR)

• Pinnacle excess layer: Not implicated. Total costs of $8,230,250 are well within the $15,000,000 primary policy limit, and accordingly, no claim was made against the Pinnacle excess layer.

Atlas Mutual's reimbursement of the $5,730,250 is currently in process. Quorum's insurance broker for the cyber-insurance program is Whitmore Risk Advisors Inc. (Sandra Whitmore-Kim, Lead Broker), located at 390 Park Avenue, 18th Floor, New York, NY 10022. Ms. Whitmore-Kim has been instrumental in facilitating the claims process and maintaining productive communications with Atlas Mutual throughout the engagement.

C. Palomar Indemnification Recovery

As described in Section V above, the total effective recovery from Palomar under the Settlement Agreement is $6,156,000, consisting of:

• Cash payment: $4,200,000 (payable within 30 days of the October 27, 2023 execution date)

• 18-month fee reduction: $1,956,000 (8% reduction on $16,300,000 ACV, realized prospectively over the 18-month period commencing November 1, 2023)

D. Net Financial Impact to Quorum

The net financial impact to Quorum, taking into account all costs, insurance recoveries, and vendor indemnification recoveries, is summarized as follows:

The combined total of insurance and Palomar recoveries is $11,886,250 ($5,730,250 + $6,156,000), which exceeds the total incident response costs of $8,230,250 by $3,656,000. However, it is important to note that the timing of cash flows differs: Quorum bore the SIR obligation of $2,500,000 and other costs as they were incurred, the insurance reimbursement is currently in process, the Palomar cash payment was due approximately November 26, 2023, and the fee reduction savings will be realized prospectively over the 18-month period. Accordingly, while the net financial impact is effectively favorable when all recoveries are taken into account, the Company did experience interim cash outlays that will be recovered through a combination of insurance reimbursement, the Palomar cash payment, and the prospective fee savings.

For context, Quorum's fiscal year 2022 annual revenue was $4.82 billion, and the Company's market capitalization as of May 2023 was approximately $6.1 billion. Total incident response costs of $8,230,250 represent approximately 0.17% of annual revenue. The financial impact of this incident, even before accounting for recoveries, is not individually material to Quorum's financial statements or overall financial position.

VII. SEC DISCLOSURE STATUS

As analyzed in the separate SEC Disclosure Analysis Memorandum prepared by Calderwood & Harkness and dated July 19, 2023, the Firm evaluated Quorum's disclosure obligations arising from the incident under the Securities and Exchange Commission's cybersecurity disclosure rules, including Item 1.05 of Form 8-K (requiring disclosure of material cybersecurity incidents) and periodic reporting obligations under Forms 10-Q and 10-K (requiring updated risk factor disclosures).

Materiality Assessment. Based on the totality of circumstances, including the total incident response costs of $8,230,250 measured against Quorum's $4.82 billion in annual revenue (approximately 0.17%), the availability of substantial insurance coverage, and the anticipated vendor indemnification recovery, Calderwood & Harkness assessed the financial impact of the incident as not individually material to Quorum's financial statements or to a reasonable investor's assessment of the Company's financial condition or results of operations. This assessment was consistent with the views of Quorum's General Counsel and management team.

External Auditor Consultation. Quorum's external auditor, Halstead & Monroe LLP (Gregory Chin, Engagement Partner, located at 1600 Market Street, Suite 2800, Philadelphia, PA 19103), was consulted regarding the financial statement treatment of the incident costs and anticipated recoveries. Halstead & Monroe concurred that the incident costs did not require disclosure as a separately identified line item in Quorum's financial statements and that the Company's existing disclosures regarding cybersecurity risk were adequate, subject to appropriate updates to risk factor language in periodic filings.

Risk Factor Disclosures. Appropriate risk factor disclosures addressing cybersecurity risks, including the potential for vendor-originated data security incidents, were included in Quorum's periodic SEC filings following the incident, consistent with the Company's existing risk factor framework and the SEC's guidance on cybersecurity disclosure.

Forward-Looking Assessment. With all three regulatory tracks now closed without enforcement action, no fine or penalty imposed, and the Palomar settlement executed, Calderwood & Harkness does not anticipate that any further disclosure updates will be necessary beyond standard risk factor language in future periodic filings. No Form 8-K filing under Item 1.05 was required or made in connection with this incident, and no additional 8-K filing is anticipated.

VIII. POST-INCIDENT REMEDIATION AND LESSONS LEARNED

Calderwood & Harkness has prepared a separate Post-Incident Lessons Learned & Remediation Recommendations Memorandum, dated November 30, 2023, which will be provided to the Audit Committee and Board under separate cover. That memorandum contains a detailed analysis of the incident response process, identifies areas for improvement, and sets forth specific recommendations for enhancing Quorum's information security and vendor risk management programs. The following is a summary of the key recommendations:

Enterprise-Level Recommendations:

• Enhancement of Vendor Risk Management Program: Quorum's vendor risk management program, overseen by Priya Deshmukh, Vice President, Vendor Risk Management, should be enhanced to include more rigorous vendor security due diligence at the onboarding stage, shorter contractual notification windows for security incidents (24 hours or less for all critical vendors), expanded third-party audit rights, and more frequent reassessment of vendor security posture throughout the vendor lifecycle.

• Incident Response Plan Update: Quorum's enterprise incident response plan should be reviewed and updated to incorporate lessons learned from this incident, including refinements to the escalation procedures, external counsel engagement protocols, and regulatory notification workflows. The Company should also implement a regular tabletop exercise program, conducting at least two exercises per year involving cross-functional stakeholders and external counsel.

• Data Minimization Practices: Quorum should review its data-sharing practices with third-party vendors to ensure that only the minimum necessary data is provided to vendors to perform their contracted services. This review should focus in particular on whether the volume and sensitivity of data shared with Palomar and other claims-processing vendors can be reduced without adversely affecting service delivery.

• Cyber-Insurance Program Reassessment: Quorum should periodically reassess the adequacy of its cyber-insurance tower in light of the evolving threat landscape and the Company's vendor ecosystem. While the current tower ($40,000,000 total) was more than adequate for this incident, the Company should ensure that its coverage remains commensurate with its risk profile.

Palomar-Specific Enhancements: The following enhanced security measures have already been implemented or are in progress pursuant to the Settlement Agreement and MSA Amendment 3:

• Critical and high-severity patching window reduced from 30 days to 14 days from vendor patch release.

• Mandatory endpoint detection and response deployment across all systems processing, storing, or transmitting Quorum data.

• Quarterly vulnerability scanning with reports provided to Quorum within 15 business days of each scan.

• Annual independent security assessment at Palomar's expense, with scope and assessor selection subject to Quorum's reasonable approval.

• Incident notification window reduced from 48 hours to 24 hours.

In addition, Palomar's next SOC 2 Type II audit, performed by Kessler, Park & Associates CPA, PLLC (Vivian Park, Engagement Partner, 3000 Oak Lawn Avenue, Suite 700, Dallas, TX 75219), is expected to incorporate the enhanced controls implemented pursuant to the Settlement Agreement and MSA Amendment 3. Quorum should request and review the updated SOC 2 Type II report upon its completion to verify that the enhanced controls have been appropriately designed and are operating effectively.

IX. ENGAGEMENT CLOSURE

Calderwood & Harkness recommends that the engagement in connection with the Palomar data security incident (Matter No. 1025-00006) be formally closed effective December 1, 2023. All substantive workstreams have been concluded, as summarized below:

Document Retention and Privilege Log Protocol. A separate Document Retention & Privilege Log Protocol Memorandum will be issued by Calderwood & Harkness on December 1, 2023. This memorandum will address the retention, organization, and cataloguing of all privileged and non-privileged documents generated or collected in connection with this matter, the maintenance of the engagement privilege log, and procedures for responding to any future document requests, subpoenas, or discovery demands that may be received in connection with this incident.

Ongoing Availability. While Calderwood & Harkness recommends formal closure of the active engagement, the Firm remains available to Quorum for any follow-up matters that may arise in connection with the incident. In particular, we note that while no litigation has been filed against Quorum to date — including no class action complaints, individual lawsuits, or regulatory enforcement actions — the applicable statutes of limitations have not expired in all jurisdictions. Calderwood & Harkness will continue to monitor for any litigation developments and is prepared to provide defense representation if any claims are asserted. The Company's cyber-insurance policy with Atlas Mutual includes coverage for defense costs and indemnification in connection with third-party claims, subject to the terms and conditions of the policy.

X. CONCLUSION AND RECOMMENDATION

The Palomar data security incident has been resolved with what Calderwood & Harkness considers to be the most favorable outcome achievable under the circumstances. The key outcomes are:

• No enforcement action from any regulator — the multistate AG coalition (29 states), the Connecticut Insurance Department, and HHS-OCR have all closed their respective inquiries without imposing any fine, penalty, consent decree, corrective action plan, or other adverse enforcement mechanism against Quorum.

• A substantial vendor indemnification recovery of $6,156,000 ($4,200,000 cash plus $1,956,000 in fee savings) from Palomar, reflecting Quorum's strong contractual position and effective negotiation strategy.

• Full insurance coverage for all incident response costs exceeding the $2,500,000 self-insured retention, with the total insurance recovery of $5,730,250 well within the primary policy limit.

• Enhanced contractual protections for the remaining term of the Palomar MSA, including shortened patching windows, mandatory EDR deployment, quarterly vulnerability scanning, annual independent security assessments, and accelerated incident notification requirements.

• A net favorable financial outcome when all recoveries are taken into account, with combined insurance and vendor recoveries exceeding total incident response costs.

Calderwood & Harkness extends its sincere commendation to the Quorum management team for their exceptional cooperation and responsiveness throughout this engagement. In particular, we recognize the contributions of Thomas R. Whitfield, General Counsel, whose leadership and judgment were instrumental in guiding the Company's response from the outset; Jennifer Liang, Chief Privacy Officer, whose deep expertise in privacy law and regulatory requirements ensured the accuracy and completeness of all notifications; David Naranjo, Chief Information Security Officer, whose technical knowledge and operational responsiveness facilitated the forensic investigation and remediation efforts; Priya Deshmukh, Vice President, Vendor Risk Management, whose diligence in managing the Palomar relationship and driving the MSA amendments was essential to the vendor accountability workstream; and Robert Wentworth, Senior Vice President, Claims Operations, whose coordination of internal resources and data access enabled the efficient identification of affected individuals and data types.

Recommendation. Calderwood & Harkness respectfully recommends that the Audit Committee take the following actions:

1. Approve formal closure of the matter, Matter No. 1025-00006, effective December 1, 2023, and direct that Calderwood & Harkness issue the Document Retention & Privilege Log Protocol Memorandum to ensure the preservation and organization of all matter-related documents.

2. Review and adopt the post-incident remediation recommendations set forth in the Post-Incident Lessons Learned & Remediation Recommendations Memorandum (to be provided under separate cover), and direct management to develop an implementation timeline and report back to the Audit Committee on progress.

3. Consider the adequacy of Quorum's cyber-insurance program in light of the incident, including whether the current tower limits, SIR levels, and coverage terms remain appropriate for the Company's evolving risk profile. Calderwood & Harkness recommends that management, in consultation with Whitmore Risk Advisors, conduct a comprehensive coverage review in connection with the next policy renewal cycle.

Calderwood & Harkness is available to answer any questions from the Audit Committee or individual Board members regarding the contents of this memorandum, the enclosed documents, or any other aspect of the matter. We welcome the opportunity to discuss this report at the next scheduled Audit Committee meeting or at such other time as may be convenient.

Respectfully submitted,

CALDERWOOD & HARKNESS LLP

By: ________

Kevin Ostrowski Partner, Privacy & Data Security Practice Group Calderwood & Harkness LLP 1700 K Street NW, Suite 900 Washington, D.C. 20006 Direct: (202) 555-7438

Email: kostrowski@calderwoodharkness.com

ENCLOSURES

The following documents are enclosed with this memorandum:

Enclosure 1: Multistate Attorney General Closure Letter, dated November 22, 2023 (copy)

Enclosure 2: Connecticut Insurance Department Closure Letter, dated November 28, 2023 (copy)

Enclosure 3: HHS-OCR No Further Action Letter, dated November 30, 2023 (copy)

Enclosure 4: Settlement Agreement and Mutual Release between Quorum Insurance Holdings Corp. and Palomar Data Solutions, Inc., dated October 27, 2023 (copy)

Enclosure 5: Amendment No. 3 to the Master Services Agreement between Quorum Insurance Holdings Corp. and Palomar Data Solutions, Inc., dated October 27, 2023 (copy)

Enclosure 6: Final Incident Response Cost Summary

The following documents will be provided under separate cover:

Post-Incident Lessons Learned & Remediation Recommendations Memorandum, dated November 30, 2023

Document Retention & Privilege Log Protocol Memorandum, dated December 1, 2023

PRIVILEGED AND CONFIDENTIAL — ATTORNEY-CLIENT PRIVILEGED / ATTORNEY WORK PRODUCT. This document and all enclosures are protected by the attorney-client privilege and the attorney work product doctrine. Distribution is limited to the addressees and copy recipients identified on the first page of this memorandum. Do not copy, distribute, or disclose without the prior written consent of Calderwood & Harkness LLP.

Regulatory Body	Notification/Filing Date	Inquiry Received	Response(s) Submitted	Outcome	Closure Date
Multistate AG Coalition (29 States)	Aug. 14–25, 2023	Sept. 8, 2023	Oct. 13, 2023; Nov. 3, 2023	Closed — No Action	Nov. 22, 2023
CT Insurance Department	Aug. 14, 2023	Following notification	Sept. 22, 2023; Oct. 20, 2023	Closed — No Action	Nov. 28, 2023
HHS-OCR (HIPAA)	Aug. 15, 2023	Following notification	Oct. 5, 2023	No Further Action	Nov. 30, 2023
Cost Category	Vendor/Provider	Amount
Forensic investigation	Graystone Forensics LLC	$1,847,000
Consumer notification, call center, credit monitoring	Clearfield Notification Services LLC	$3,214,500
— Notification printing and mailing (318,247 individuals)	Clearfield	$636,000
— Call center operations (12-week window)	Clearfield	$478,500
— Credit monitoring and identity protection (24-month term, negotiated flat fee)	Clearfield	$2,100,000
Crisis communications and public relations	BrightPath Consulting Group Inc.	$385,000
Legal fees	Calderwood & Harkness LLP	$2,163,750
Internal costs (IT remediation, employee overtime, related expenses)	Quorum Insurance Holdings Corp. (internal)	$620,000
TOTAL	$8,230,250
Item	Amount
Total incident response costs	$8,230,250
Less: Atlas Mutual insurance recovery (costs above SIR)	($5,730,250)
Quorum SIR obligation	$2,500,000
Less: Palomar cash indemnification payment	($4,200,000)
Net cash position after insurance and cash settlement	($1,700,000)
Plus: Palomar fee reduction (realized over 18 months)	$1,956,000
Net financial impact after all recoveries	Favorable by approximately $256,000
Workstream	Status	Completion/Closure Date
Forensic investigation	Completed	July 14, 2023 (Graystone final report)
Consumer notifications	Completed	September 15, 2023 (mailing window closed)

CALDERWOOD & HARKNESS LLP Attorneys at Law
1700 K Street NW, Suite 900 Washington, D.C. 20006 Telephone: (202) 555-7400 Facsimile: (202) 555-7401 www.calderwoodharkness.com
PRIVILEGED AND CONFIDENTIAL ATTORNEY-CLIENT PRIVILEGED / ATTORNEY WORK PRODUCT
November 29, 2023
Matter No.: 1025-00006
TO: Franklin Reeves, Chair, Audit Committee, Board of Directors, Quorum Insurance Holdings Corp. Members of the Board of Directors of Quorum Insurance Holdings Corp.
FROM: Kevin Ostrowski, Partner, Calderwood & Harkness LLP
CC: Margaret D. Calloway, Chief Executive Officer, Quorum Insurance Holdings Corp. Thomas R. Whitfield, General Counsel, Quorum Insurance Holdings Corp. Jennifer Liang, Chief Privacy Officer, Quorum Insurance Holdings Corp. David Naranjo, Chief Information Security Officer, Quorum Insurance Holdings Corp.
RE: Data Security Incident — Palomar Data Solutions, Inc. — Final Matter Resolution and Closure Report
This memorandum is a privileged and confidential attorney-client communication and constitutes attorney work product prepared in anticipation of litigation and in connection with the provision of legal advice. This document is intended solely for the use of the addressees and copy recipients identified above and should not be disclosed, distributed, or reproduced without the prior written consent of Calderwood & Harkness LLP. Any inadvertent disclosure does not constitute a waiver of any applicable privilege.
I. EXECUTIVE SUMMARY
This memorandum serves as the final privileged briefing to the Audit Committee and Board of Directors of Quorum Insurance Holdings Corp. ("Quorum" or the "Company") regarding the successful resolution and closure of all regulatory engagements and vendor accountability matters arising from the vendor-originated data security incident at Palomar Data Solutions, Inc. ("Palomar"). Calderwood & Harkness LLP ("Calderwood & Harkness" or the "Firm") has had the privilege of serving as outside counsel to Quorum in connection with this matter since May 4, 2023, and we are pleased to report that all workstreams have been concluded with highly favorable outcomes for the Company.
As detailed in this memorandum, all three regulatory tracks that arose from the incident have now concluded without any enforcement action, fine, penalty, consent decree, or other adverse regulatory outcome being imposed against Quorum:
• Multistate Attorney General Coalition (29 States): A closure letter was received on November 22, 2023, from the co-lead offices of the Connecticut and New York Attorneys General, on behalf of all 29 participating states, confirming that the multistate enforcement track is closing without action against Quorum.
• Connecticut Insurance Department: The inquiry initiated by the Financial Analysis Division, Cybersecurity Unit, was formally closed on November 28, 2023, with no enforcement action, no recommendations for corrective action, and no adverse findings.
• HHS Office for Civil Rights (HIPAA): A no further action letter was received on November 30, 2023, confirming that the Office for Civil Rights will take no further action regarding the reported breach of protected health information.
In addition to these regulatory outcomes, Quorum achieved a substantial vendor indemnification recovery from Palomar through a Settlement Agreement and Mutual Release executed on October 27, 2023. The settlement yields an effective total recovery of $6,156,000, consisting of a $4,200,000 cash payment and $1,956,000 in fee reductions to be realized over an 18-month period.
Total incident response costs across all workstreams amounted to $8,230,250. Of this amount, Quorum's cyber-insurance policy with Atlas Mutual Insurance Company covers $5,730,250, representing all costs in excess of the Company's $2,500,000 self-insured retention. When combined with the Palomar indemnification recovery, the Company's total recoveries exceed its total incident response costs, resulting in a net favorable financial outcome.
Based on the successful conclusion of all regulatory engagements, completion of all consumer notifications, execution of the Palomar settlement, and submission of the final insurance claim, Calderwood & Harkness recommends that the Audit Committee approve formal closure of this engagement effective December 1, 2023.
This memorandum should be read in conjunction with the prior Board briefings provided on May 11, 2023 (initial incident report and engagement scope), July 21, 2023 (forensic investigation findings and consumer notification plan), and October 16, 2023 (regulatory engagement update and Palomar settlement negotiations status). The present memorandum supersedes no prior briefing but rather provides the final chapter in the matter's resolution.
II. BACKGROUND — INCIDENT SUMMARY
For the benefit of any Board member who may not have been present for all prior briefings, and to provide complete context for this closing report, we summarize below the key facts of the data security incident that gave rise to this engagement.
Origin of the Incident
The incident at issue arose not from any failure or vulnerability within Quorum's own information systems, but rather from a data security breach at Palomar Data Solutions, Inc. ("Palomar"), a third-party claims-processing vendor that has provided services to Quorum under a Master Services Agreement dated November 12, 2019 (the "MSA"), as subsequently amended. Palomar is Quorum's second-largest vendor by annual contract value, with a post-Amendment 1 (effective April 1, 2021) annual contract value ("ACV") of approximately $16,300,000 (the original ACV prior to Amendment 1 was approximately $14.2 million). Palomar processes a significant volume of claims data on behalf of Quorum, including personal information of Quorum's policyholders, claimants, and beneficiaries.
The Vulnerability and Initial Compromise
On or about March 14, 2023, an unauthorized threat actor exploited a known remote code execution vulnerability, designated CVE-2023-0669, in Palomar's GoAnywhere MFT (Managed File Transfer) file transfer appliance. CVE-2023-0669 is a pre-authentication command injection vulnerability in Severin Corporation's GoAnywhere MFT platform that was publicly disclosed in early February 2023 and for which a vendor patch was made available shortly thereafter. Despite the availability of the patch and the critical severity rating of the vulnerability, Palomar failed to apply the patch to its GoAnywhere MFT environment in a timely manner.
This failure is of particular significance because the MSA's Data Security Exhibit (Exhibit D), as amended by Amendment 2 (executed September 15, 2022), expressly required Palomar to patch critical vulnerabilities within 30 days of the vendor's release of a patch. The patch for CVE-2023-0669 was available well in advance of the March 14, 2023 exploitation date, and Palomar's failure to apply it within the contractually mandated timeframe constituted a direct breach of its obligations under the MSA.
Data Exfiltration
Following the initial unauthorized access on or about March 14, 2023, the threat actor maintained persistent access to Palomar's GoAnywhere MFT environment and exfiltrated data over an approximately 35-day window, spanning from March 14, 2023 through April 18, 2023. During this period, the threat actor extracted files containing personal information, financial data, and protected health information pertaining to individuals whose data was maintained in Palomar's environment in connection with its claims-processing services for Quorum.
Detection and Notification
On April 18, 2023, Palomar's Security Operations Center ("SOC") detected anomalous outbound data transfers from its GoAnywhere MFT environment. Palomar's internal incident response team initiated containment and investigation procedures. However, Palomar did not notify Quorum of the incident until April 21, 2023 — approximately 72 hours after detection. This timeline is significant because Section 9.4 of the MSA requires Palomar to notify Quorum of any suspected or confirmed data security incident involving Quorum data within 48 hours of discovery. Palomar's notification was therefore approximately 24 hours past the contractual deadline, constituting a second breach of the MSA.
Engagement of Counsel and Forensic Investigators
Upon receiving notification from Palomar, Quorum's General Counsel, Thomas R. Whitfield, initiated the Company's incident response procedures and, following internal assessment, engaged Calderwood & Harkness on May 4, 2023, to serve as outside counsel and coordinate the Company's legal response. The following day, May 5, 2023, Calderwood & Harkness retained Graystone Forensics LLC ("Graystone") to conduct a forensic investigation under the protection of the attorney-client privilege and work product doctrine. Graystone's engagement was structured to ensure that the forensic findings would be covered by privilege, with Graystone reporting directly to Calderwood & Harkness rather than to Quorum or Palomar.
Forensic Findings
Graystone completed its forensic investigation and issued its final report on July 14, 2023. The investigation confirmed that the data of 318,247 individuals across 29 states and the District of Columbia was compromised in the incident. The types of data affected were categorized as follows:
• Personally Identifiable Information (PII): All 318,247 affected individuals had the following categories of PII compromised: full names, dates of birth, Social Security numbers, and driver's license numbers.
• Financial Information: A subset of 84,619 individuals also had financial information compromised, including bank account numbers and payment card numbers. These individuals were primarily claimants who had provided banking information for electronic funds transfer of claims payments.
• Protected Health Information (PHI): A subset of 41,203 individuals also had protected health information compromised, including health conditions, diagnosis codes, and treatment information derived from workers' compensation claims and other health-related insurance claims processed by Palomar on Quorum's behalf.
Root Cause Determination
As noted above, the root cause of the incident was Palomar's failure to timely patch CVE-2023-0669 in its GoAnywhere MFT environment. This failure was a direct violation of the patching requirements set forth in Exhibit D (Data Security Exhibit) of the MSA, as amended by Amendment 2 (executed September 15, 2022). The amendment specifically required Palomar to apply patches for critical vulnerabilities — defined by reference to Common Vulnerability Scoring System (CVSS) scores of 9.0 or higher — within 30 days of the vendor's release of a patch. CVE-2023-0669 carried a CVSS score of 7.2 (categorized as "high"), but Exhibit D, as amended, extended the 30-day patching requirement to vulnerabilities rated "high" (CVSS 7.0–8.9) as well as "critical" (CVSS 9.0–10.0). The patch for CVE-2023-0669 was available for a period well exceeding 30 days prior to the March 14, 2023 exploitation.
III. CONSUMER AND REGULATORY NOTIFICATION COMPLETION
A. Consumer Notifications
Following the completion of Graystone's forensic investigation and the identification of affected data types, Calderwood & Harkness coordinated a comprehensive consumer notification program in compliance with the breach notification statutes of all 29 affected states and the District of Columbia, as well as the Health Insurance Portability and Accountability Act ("HIPAA") notification requirements at 45 C.F.R. Part 164, Subpart D.
Data Mining and Individual Identification. The data mining process — involving the review, deduplication, and verification of affected individual records and the matching of those records to current mailing addresses — was completed on August 4, 2023. This process was performed by Clearfield Notification Services LLC ("Clearfield"), a specialized breach notification vendor, under the direction of Calderwood & Harkness and in coordination with Quorum's internal data teams and Palomar's data custodians.
Notification Letter Development and Mailing. Calderwood & Harkness prepared three distinct versions of the consumer notification letter, each tailored to the specific types of data compromised for the relevant population of affected individuals:
1. General PII Version: Sent to individuals whose names, dates of birth, Social Security numbers, and/or driver's license numbers were compromised, but who did not have financial information or PHI affected.
2. SSN + Financial Data Version: Sent to the subset of 84,619 individuals whose financial information (bank account numbers and/or payment card numbers) was compromised in addition to PII.
3. PHI Version (HIPAA-Compliant): Sent to the subset of 41,203 individuals whose protected health information was compromised. This version was drafted in compliance with the content requirements of 45 C.F.R. § 164.404(c), including a description of the types of PHI involved, steps individuals should take to protect themselves, a description of what Quorum is doing to investigate and mitigate the breach, and contact information for further inquiries.
In addition to these three base versions, state-specific adaptations were prepared for jurisdictions with unique content requirements. Most notably, separate versions were prepared for California, to comply with the specific content requirements of California Civil Code § 1798.82 and the Confidentiality of Medical Information Act ("CMIA"), and for Massachusetts, to comply with the requirements of Massachusetts General Laws Chapter 93H, § 3 and 201 CMR 17.00.
Consumer notification letters were mailed on a rolling basis over a 28-day period, commencing August 18, 2023 and concluding September 15, 2023. A total of 318,247 notification letters were mailed during this period. All letters were sent via first-class U.S. mail through Clearfield's secure mailing facilities.
Credit Monitoring and Identity Theft Protection. Each notification letter offered affected individuals 24 months of complimentary credit monitoring and identity theft protection services through Clearfield. The credit monitoring package includes three-bureau credit monitoring, identity theft insurance coverage, and access to identity restoration services. As of the date of this memorandum, the estimated enrollment take-rate is approximately 40%, representing approximately 127,299 enrollees. This take-rate is consistent with industry benchmarks for incidents of this nature and scale.
Call Center Operations. Clearfield operated a dedicated toll-free call center for a 12-week window following the initial mailing of notification letters. Call center agents were trained by Calderwood & Harkness and Quorum personnel on the specifics of the incident and were provided with approved scripts and FAQs. Call volume throughout the 12-week period was manageable and within projected ranges. No material escalations, media inquiries routed through the call center, or regulatory complaints originated from call center interactions were reported by Clearfield.
Substitute Notice and Website Posting. In compliance with applicable state breach notification statutes that require or permit substitute notice in addition to individual written notice, Quorum published a substitute notice and website posting on its corporate website on August 15, 2023, three days prior to the commencement of individual notification mailings. The website notice remained prominently posted throughout the notification period and continues to be accessible via Quorum's website.
Crisis Communications. BrightPath Consulting Group Inc. ("BrightPath") was engaged to manage all crisis communications associated with the incident. BrightPath's scope of work included the preparation and dissemination of press statements, internal employee communications, and investor-facing disclosures. BrightPath coordinated closely with Calderwood & Harkness, Mr. Whitfield's office, and Quorum's corporate communications team throughout the notification period to ensure consistent and accurate messaging. Media coverage of the incident was limited in scope and duration, and BrightPath's proactive communications strategy contributed to minimizing reputational impact to the Company.
B. Regulatory Notifications
Calderwood & Harkness, in coordination with Quorum's legal and compliance teams, prepared and filed all required regulatory notifications across all affected jurisdictions. All notifications were filed timely, and no notification deadline was missed in any jurisdiction. The regulatory notification filings are summarized below:
• Connecticut Attorney General: Filed August 14, 2023, pursuant to Connecticut General Statutes § 36a-701b. The filing reported that 52,114 Connecticut residents were affected by the incident.
• Connecticut Insurance Department: Filed August 14, 2023, pursuant to Connecticut General Statutes § 38a-999b (Connecticut Insurance Data Security Law). The filing was made concurrently with the Connecticut Attorney General filing and contained supplemental information specific to the insurance regulatory context.
• HHS Office for Civil Rights (HIPAA): Filed August 15, 2023, with HHS-OCR Region I (Boston), pursuant to 45 C.F.R. § 164.408. The filing reported the breach of unsecured protected health information affecting 41,203 individuals. Because this breach affected more than 500 individuals, the notification was filed within 60 days of the discovery of the breach, as required by the HIPAA Breach Notification Rule.
• New York Attorney General: Filed August 16, 2023, pursuant to New York General Business Law § 899-aa. The filing reported that 47,831 New York residents were affected.
• California Attorney General: Filed August 16, 2023, pursuant to California Civil Code § 1798.82. The filing reported that 38,206 California residents were affected. Because this number exceeded 500 California residents, a copy of the notification letter was also submitted to the California Attorney General as required by statute.
• Massachusetts Attorney General and Office of Consumer Affairs and Business Regulation: Filed August 17, 2023, pursuant to Massachusetts General Laws Chapter 93H, § 3. The filing reported that 10,217 Massachusetts residents were affected.
• 24 Additional State Attorneys General and Regulators: Filings were submitted between August 17 and August 25, 2023, to the attorneys general and/or applicable regulatory authorities in each of the remaining affected states. All filings were submitted in compliance with the applicable state-specific breach notification statutes, including any state-specific content, format, or timing requirements.
In addition to the above regulatory filings, a media notice was published on August 15, 2023, in compliance with 45 C.F.R. § 164.406, which requires notification to prominent media outlets serving affected states when a breach of unsecured PHI affects more than 500 residents of a state or jurisdiction. The media notice was distributed to major media outlets in the relevant jurisdictions in coordination with BrightPath.
To reiterate, no notification deadline was missed in any jurisdiction. The timely and comprehensive nature of Quorum's notification program was a significant factor in the favorable regulatory outcomes described in Section IV below.
IV. RESOLUTION OF REGULATORY ENGAGEMENTS
This Section describes the resolution of each of the three regulatory engagement tracks that arose from the incident. As noted in the Executive Summary, all three tracks have concluded without any adverse action against Quorum.
A. Multistate Attorney General Coalition (29 States)
Joint Demand Letter. On September 8, 2023, Calderwood & Harkness received a joint demand letter from the offices of the Connecticut Attorney General and the New York Attorney General, acting on behalf of a 29-state coalition. The letter was signed by Assistant Attorney General Diane Marchetti of the Connecticut Attorney General's Consumer Protection Division (lead counsel for the coalition) and Assistant Attorney General Mark Petrosian of the New York Attorney General's Bureau of Internet and Technology (co-lead counsel). The demand letter requested detailed information regarding the incident, Quorum's information security program, the consumer notification process, and Quorum's relationship with Palomar.
The 29 states participating in the coalition were: Connecticut (lead), New York (co-lead), Massachusetts, California, Illinois, Pennsylvania, New Jersey, Ohio, Texas, Florida, Georgia, Virginia, Maryland, North Carolina, South Carolina, Michigan, Minnesota, Indiana, Wisconsin, Colorado, Arizona, Oregon, Washington, Tennessee, Missouri, Louisiana, Nevada, Iowa, and New Hampshire.
Calderwood & Harkness's Response. Calderwood & Harkness prepared and submitted a comprehensive written response on October 13, 2023. The response was accompanied by four supporting exhibits:
• Exhibit A: A detailed incident timeline and summary of remedial measures implemented by Quorum and required of Palomar following the incident.
• Exhibit B: Representative samples of each version of the consumer notification letter, along with a comprehensive compliance checklist demonstrating that all state-specific notification requirements had been satisfied.
• Exhibit C: A summary of Quorum's vendor accountability efforts, including the contractual bases for Quorum's claims against Palomar, the indemnification demand, and the resulting settlement.
• Exhibit D: An overview of Quorum's enterprise information security program, including its governance structure, technical controls, vendor risk management framework, and incident response capabilities.
The response was structured around five key themes that Calderwood & Harkness identified as most relevant to the coalition's enforcement considerations:
1. Vendor-Originated Breach: The breach occurred in Palomar's systems, not Quorum's. Quorum's own information systems were not compromised, and the vulnerability that was exploited (CVE-2023-0669) existed in Palomar's GoAnywhere MFT environment, not in any Quorum-owned or Quorum-operated system.
2. Robust Information Security Program: Quorum maintains a mature, well-resourced information security program that meets or exceeds industry standards for organizations of its size and complexity, including compliance with the NIST Cybersecurity Framework and applicable state insurance data security laws.
3. Timely Consumer and Regulatory Notifications: Quorum completed all consumer and regulatory notifications within the timeframes required by applicable law in all 29 affected states and the District of Columbia.
4. Proactive Vendor Accountability: Quorum took prompt and decisive action to hold Palomar accountable for its contractual breaches, including issuing a formal indemnification demand and negotiating a settlement that yielded substantial financial recovery for the Company and enhanced security protections going forward.
5. Comprehensive Remediation: Quorum implemented a comprehensive remediation program, including enhanced vendor oversight measures, contractual amendments with Palomar, and credit monitoring and identity theft protection services for all affected individuals.
Supplemental Submission. On November 3, 2023, Calderwood & Harkness submitted a supplemental information package to the coalition, providing updated credit monitoring enrollment statistics (demonstrating strong take-rates and successful program operation) and a summary of the October 27, 2023 settlement with Palomar, including the enhanced security measures that Palomar agreed to implement.
Closure Letter. On November 22, 2023, Calderwood & Harkness received a closure letter signed by AAG Diane Marchetti and AAG Mark Petrosian on behalf of all 29 participating states. The closure letter confirmed that the multistate enforcement track is closing without action against Quorum. No fine, penalty, consent decree, assurance of voluntary compliance ("AVC"), or any other enforcement mechanism was imposed. The closure letter acknowledged Quorum's cooperation with the investigation and the comprehensive nature of its response.
This outcome represents a highly favorable result for Quorum. Multistate AG investigations of data security incidents frequently result in consent decrees, substantial monetary penalties, or AVCs imposing ongoing compliance obligations and monitoring requirements. The closure of this investigation without any such action reflects the effectiveness of the cooperative, transparent engagement strategy that Calderwood & Harkness and Quorum's management team pursued throughout the process. A copy of the closure letter is attached hereto as Enclosure 1.
B. Connecticut Insurance Department
Inquiry. Following Quorum's August 14, 2023 notification filing with the Connecticut Insurance Department pursuant to Connecticut General Statutes § 38a-999b, the Department opened an inquiry into the incident. The inquiry was conducted by examiner Richard Nakamura of the Department's Financial Analysis Division, Cybersecurity Unit. The Connecticut Insurance Data Security Law imposes specific cybersecurity requirements on insurance licensees, including requirements related to information security programs, vendor risk management, incident response, and breach notification.
Calderwood & Harkness's Response. On September 22, 2023, Calderwood & Harkness submitted a formal response to the Department's inquiry, detailing Quorum's compliance with the Connecticut Insurance Data Security Law, including its written information security program, its risk assessment procedures, its vendor oversight framework, and its incident response plan. The response demonstrated that Quorum's information security program meets or exceeds the requirements of the Connecticut statute and that the incident did not result from any deficiency in Quorum's own security posture.
Supplemental Submission. On October 20, 2023, Calderwood & Harkness submitted supplemental information in response to follow-up questions from examiner Nakamura. The supplemental submission addressed additional questions regarding Quorum's vendor oversight program — specifically the procedures by which Quorum evaluates and monitors the security practices of its third-party service providers — the security provisions of the Palomar MSA (including the Data Security Exhibit and its amendments), and the post-incident remediation measures implemented by Quorum and required of Palomar.
Closure. On November 28, 2023, the Connecticut Insurance Department formally closed its inquiry. The closure was communicated in a letter from examiner Nakamura confirming that the Department has concluded its review with no enforcement action, no recommendations for corrective action, and no adverse findings against Quorum. This is a clean closure with no residual obligations or conditions. A copy of the closure letter is attached hereto as Enclosure 2.
C. HHS Office for Civil Rights (HIPAA)
Breach Notification. On August 15, 2023, Quorum filed a breach notification with the U.S. Department of Health and Human Services, Office for Civil Rights ("HHS-OCR"), Region I (Boston), pursuant to 45 C.F.R. § 164.408. The notification reported the breach of unsecured protected health information affecting 41,203 individuals. The PHI at issue consisted of health conditions, diagnosis codes, and treatment information derived from workers' compensation claims and other health-related insurance claims that Palomar processed on Quorum's behalf.
OCR Follow-Up Inquiry. Following receipt of the breach notification, HHS-OCR issued a follow-up inquiry seeking additional information regarding the incident. Calderwood & Harkness submitted a comprehensive response on October 5, 2023, addressing the nature and scope of the PHI compromised, the circumstances of the breach (including the vendor-originated nature of the incident and Palomar's specific security failures), Quorum's HIPAA compliance measures (including its HIPAA Privacy and Security Policies, its Business Associate Agreement with Palomar, and its HIPAA training program), and the post-incident remediation steps taken by both Quorum and Palomar.
No Further Action Letter. On November 30, 2023, Calderwood & Harkness received a no further action letter from HHS-OCR confirming that no further action will be taken regarding the reported breach. Specifically, HHS-OCR will not pursue a corrective action plan, resolution agreement, or civil monetary penalty in connection with this matter. A copy of the no further action letter is attached hereto as Enclosure 3.
D. Summary of Regulatory Outcomes
The following table summarizes the disposition of each regulatory engagement:
All three regulatory tracks have concluded with no adverse action of any kind against Quorum. Calderwood & Harkness attributes this outcome to four principal factors: (1) the vendor-originated nature of the breach, which demonstrated that the vulnerability and security failure were attributable to Palomar rather than Quorum; (2) Quorum's strong compliance posture, including timely and complete notifications to all affected individuals and regulators, and a robust enterprise information security program; (3) Quorum's proactive vendor accountability efforts, which demonstrated to regulators that the Company took seriously its obligation to hold its vendor responsible; and (4) the cooperative and transparent engagement strategy pursued with all regulators, which fostered a constructive dialogue and facilitated efficient resolution of each inquiry.
V. VENDOR ACCOUNTABILITY — PALOMAR DATA SOLUTIONS SETTLEMENT
A. Contractual Basis for Claims
As detailed in prior briefings, Quorum identified two distinct breaches of the MSA by Palomar that formed the basis for Quorum's indemnification claims:
First, Palomar breached its obligation under Exhibit D (the Data Security Exhibit), as amended by Amendment 2 (executed September 15, 2022), to patch critical and high-severity vulnerabilities within 30 days of the vendor's release of a patch. CVE-2023-0669 was publicly disclosed in early February 2023, and a vendor patch was made available shortly thereafter. Palomar failed to apply the patch within the 30-day window, and the vulnerability was exploited on or about March 14, 2023 — well after the contractual patching deadline had passed. This failure was the direct and proximate cause of the data breach.
Second, Palomar breached Section 9.4 of the MSA, which requires Palomar to notify Quorum of any suspected or confirmed data security incident involving Quorum data within 48 hours of discovery. Palomar's SOC detected the anomalous outbound data transfers on April 18, 2023, but Palomar did not notify Quorum until April 21, 2023 — approximately 72 hours after detection, or roughly 24 hours past the contractual notification deadline. While this delay did not ultimately affect the scope of data compromised (the exfiltration had already concluded by the time Palomar detected the anomalous activity), the late notification delayed the commencement of Quorum's incident response and forensic investigation.
Demand Letter. On June 20, 2023, Calderwood & Harkness issued a formal breach of contract demand letter to Palomar's outside counsel, Catherine Langford, Partner at Mercer, Haight & Dunlop LLP, demanding full indemnification of $8,230,250 (the estimated total incident response costs) under Section 12.2 of the MSA. Section 12.2 contains a broad indemnification obligation requiring Palomar to indemnify, defend, and hold harmless Quorum from and against all losses, damages, costs, expenses (including reasonable attorneys' fees), and liabilities arising from or related to Palomar's breach of its obligations under the MSA, including its data security obligations. The indemnification cap under the MSA is $32,600,000, calculated as two times the trailing twelve-month fees paid to Palomar ($16,300,000 × 2), which significantly exceeded Quorum's total claimed damages.
Palomar's Initial Response. Palomar, through Ms. Langford, responded on July 7, 2023. Palomar's response disputed certain aspects of causation and the scope of damages, and offered a $1,500,000 "goodwill credit" in lieu of a formal indemnification payment. Calderwood & Harkness assessed this offer as inadequate, both in quantum and in its characterization as a goodwill gesture rather than a contractual obligation.
Negotiations. Calderwood & Harkness prepared and submitted a detailed rebuttal to Palomar's position on July 25, 2023, addressing each of Palomar's arguments regarding causation and damages. Following this exchange, the parties engaged in extensive settlement negotiations through September and October 2023. These negotiations were conducted principally between Mr. Ostrowski and Ms. Langford, with the involvement of Mr. Whitfield and Palomar's senior management at key junctures. The negotiations were informed by the strength of Quorum's contractual position, the clear evidence of Palomar's breaches, and the practical considerations of maintaining the ongoing commercial relationship between the parties for the remaining term of the MSA.
B. Settlement Terms (Executed October 27, 2023)
On October 27, 2023, Quorum and Palomar executed a Settlement Agreement and Mutual Release (the "Settlement Agreement") resolving all indemnification claims arising from the incident. The principal terms of the Settlement Agreement are as follows:
(a) Cash Payment. Palomar agreed to pay Quorum $4,200,000 in cash, payable within 30 calendar days of the execution date (i.e., on or before approximately November 26, 2023).
(b) Fee Reduction. Palomar agreed to a reduction of 8% on the annual contract value of $16,300,000 for a period of 18 months, effective November 1, 2023. This fee reduction yields total savings to Quorum of $1,956,000 over the 18-month period ($16,300,000 × 8% = $1,304,000 per year × 1.5 years = $1,956,000).
(c) Independent Third-Party Security Assessor. Palomar agreed to engage, at its own expense, an independent third-party security assessor to conduct enhanced annual security audits of Palomar's information security environment, with the scope to include the systems and controls relevant to Palomar's processing of Quorum data. The results of these audits are to be shared with Quorum.
(d) Enhanced Security Measures. Palomar agreed to implement enhanced patch management procedures and deploy endpoint detection and response ("EDR") capabilities across its environment within 90 days of the settlement execution date.
(e) Mutual Release. The parties exchanged mutual releases of all claims related to the incident, including Quorum's release of any further indemnification claims and Palomar's release of any counterclaims or cross-claims.
The total effective recovery to Quorum under the Settlement Agreement is $6,156,000, comprising $4,200,000 in cash and $1,956,000 in fee savings. A copy of the Settlement Agreement is attached hereto as Enclosure 4.
C. MSA Amendment 3
Concurrent with the execution of the Settlement Agreement, Quorum and Palomar executed Amendment 3 to the Master Services Agreement (the "MSA Amendment 3"), dated October 27, 2023. MSA Amendment 3 amends the MSA (as previously amended by Amendment 1, effective April 1, 2021, and Amendment 2, executed September 15, 2022) to incorporate the following enhanced security and oversight provisions:
• Enhanced Patching Requirements: The patching window for critical and high-severity vulnerabilities has been reduced from 30 days to 14 days from the date of vendor patch release.
• Mandatory Endpoint Detection and Response: Palomar is required to deploy and maintain EDR solutions across all systems involved in the processing, storage, or transmission of Quorum data.
• Quarterly Vulnerability Scanning: Palomar is required to conduct quarterly vulnerability scans of its environment and provide reports of scan results to Quorum within 15 business days of each scan completion.
• Annual Independent Security Assessment: Palomar is required to engage, at its own expense, an independent third-party assessor to conduct an annual security assessment. The assessment scope, methodology, and assessor selection are subject to Quorum's reasonable approval.
• Enhanced Incident Notification Requirement: The notification window for suspected or confirmed data security incidents has been reduced from 48 hours to 24 hours from the time of discovery.
• Fee Reduction: The 18-month 8% fee reduction agreed to in the Settlement Agreement has been incorporated into the MSA as a formal amendment to the pricing schedule.
The MSA continues in effect through its original five-year term, which expires on November 11, 2024. A copy of MSA Amendment 3 is attached hereto as Enclosure 5.
VI. FINANCIAL SUMMARY — TOTAL COSTS, INSURANCE RECOVERY, AND NET IMPACT
A. Total Incident Response Costs
The following table summarizes the total incident response costs incurred in connection with the Palomar data security incident:
For transparency and in accordance with our standard billing disclosure practices for Board-level engagements, we provide the following summary of Calderwood & Harkness's fees:
Calderwood & Harkness billed approximately 2,400 total hours across the engagement team over the course of the matter. The engagement team consisted of the following timekeepers: Kevin Ostrowski, Partner (billing rate: $1,250/hour); Rachel Bernstein, Of Counsel (billing rate: $1,175/hour); Alan Burke, Senior Associate (billing rate: $825/hour); and Sara Hendricks, Associate (billing rate: $650/hour). The blended effective rate across all timekeepers was approximately $901.56 per hour. The total engagement duration was approximately 212 days (May 4, 2023 through December 1, 2023), spanning approximately seven months.
A detailed final cost summary, broken down by cost category, vendor, and billing period, is attached hereto as Enclosure 6.
B. Cyber-Insurance Recovery
Quorum maintains a cyber-insurance program consisting of the following policies:
• Primary Policy: Atlas Mutual Insurance Company, Policy No. CYB-2023-041587. The policy provides a per-occurrence limit of $15,000,000, subject to a self-insured retention ("SIR") of $2,500,000.
• Excess Policy: Pinnacle Surplus Lines Insurance Corp., Policy No. XS-CYB-2023-7812. The excess policy provides $25,000,000 in coverage excess of the $15,000,000 primary policy limit, for a total cyber-insurance tower of $40,000,000.
Quorum filed an insurance claim under the Atlas Mutual primary policy on May 8, 2023, bearing Claim No. CYB-CLM-2023-05892. Atlas Mutual acknowledged the claim and accepted coverage for forensic investigation costs, consumer notification costs, call center operations, credit monitoring services, crisis communications expenses, and regulatory defense legal fees incurred in excess of the SIR. Coverage was confirmed without reservation for these categories of expense.
A proof of loss and final cost summary was submitted to Atlas Mutual on November 15, 2023, reflecting the total incident response costs of $8,230,250. The insurance recovery analysis is as follows:
• Amount within SIR (Quorum's responsibility): $2,500,000
• Amount covered by Atlas Mutual primary policy: $5,730,250 ($8,230,250 total costs minus $2,500,000 SIR)
• Pinnacle excess layer: Not implicated. Total costs of $8,230,250 are well within the $15,000,000 primary policy limit, and accordingly, no claim was made against the Pinnacle excess layer.
Atlas Mutual's reimbursement of the $5,730,250 is currently in process. Quorum's insurance broker for the cyber-insurance program is Whitmore Risk Advisors Inc. (Sandra Whitmore-Kim, Lead Broker), located at 390 Park Avenue, 18th Floor, New York, NY 10022. Ms. Whitmore-Kim has been instrumental in facilitating the claims process and maintaining productive communications with Atlas Mutual throughout the engagement.
C. Palomar Indemnification Recovery
As described in Section V above, the total effective recovery from Palomar under the Settlement Agreement is $6,156,000, consisting of:
• Cash payment: $4,200,000 (payable within 30 days of the October 27, 2023 execution date)
• 18-month fee reduction: $1,956,000 (8% reduction on $16,300,000 ACV, realized prospectively over the 18-month period commencing November 1, 2023)
D. Net Financial Impact to Quorum
The net financial impact to Quorum, taking into account all costs, insurance recoveries, and vendor indemnification recoveries, is summarized as follows:
The combined total of insurance and Palomar recoveries is $11,886,250 ($5,730,250 + $6,156,000), which exceeds the total incident response costs of $8,230,250 by $3,656,000. However, it is important to note that the timing of cash flows differs: Quorum bore the SIR obligation of $2,500,000 and other costs as they were incurred, the insurance reimbursement is currently in process, the Palomar cash payment was due approximately November 26, 2023, and the fee reduction savings will be realized prospectively over the 18-month period. Accordingly, while the net financial impact is effectively favorable when all recoveries are taken into account, the Company did experience interim cash outlays that will be recovered through a combination of insurance reimbursement, the Palomar cash payment, and the prospective fee savings.
For context, Quorum's fiscal year 2022 annual revenue was $4.82 billion, and the Company's market capitalization as of May 2023 was approximately $6.1 billion. Total incident response costs of $8,230,250 represent approximately 0.17% of annual revenue. The financial impact of this incident, even before accounting for recoveries, is not individually material to Quorum's financial statements or overall financial position.
VII. SEC DISCLOSURE STATUS
As analyzed in the separate SEC Disclosure Analysis Memorandum prepared by Calderwood & Harkness and dated July 19, 2023, the Firm evaluated Quorum's disclosure obligations arising from the incident under the Securities and Exchange Commission's cybersecurity disclosure rules, including Item 1.05 of Form 8-K (requiring disclosure of material cybersecurity incidents) and periodic reporting obligations under Forms 10-Q and 10-K (requiring updated risk factor disclosures).
Materiality Assessment. Based on the totality of circumstances, including the total incident response costs of $8,230,250 measured against Quorum's $4.82 billion in annual revenue (approximately 0.17%), the availability of substantial insurance coverage, and the anticipated vendor indemnification recovery, Calderwood & Harkness assessed the financial impact of the incident as not individually material to Quorum's financial statements or to a reasonable investor's assessment of the Company's financial condition or results of operations. This assessment was consistent with the views of Quorum's General Counsel and management team.
External Auditor Consultation. Quorum's external auditor, Halstead & Monroe LLP (Gregory Chin, Engagement Partner, located at 1600 Market Street, Suite 2800, Philadelphia, PA 19103), was consulted regarding the financial statement treatment of the incident costs and anticipated recoveries. Halstead & Monroe concurred that the incident costs did not require disclosure as a separately identified line item in Quorum's financial statements and that the Company's existing disclosures regarding cybersecurity risk were adequate, subject to appropriate updates to risk factor language in periodic filings.
Risk Factor Disclosures. Appropriate risk factor disclosures addressing cybersecurity risks, including the potential for vendor-originated data security incidents, were included in Quorum's periodic SEC filings following the incident, consistent with the Company's existing risk factor framework and the SEC's guidance on cybersecurity disclosure.
Forward-Looking Assessment. With all three regulatory tracks now closed without enforcement action, no fine or penalty imposed, and the Palomar settlement executed, Calderwood & Harkness does not anticipate that any further disclosure updates will be necessary beyond standard risk factor language in future periodic filings. No Form 8-K filing under Item 1.05 was required or made in connection with this incident, and no additional 8-K filing is anticipated.
VIII. POST-INCIDENT REMEDIATION AND LESSONS LEARNED
Calderwood & Harkness has prepared a separate Post-Incident Lessons Learned & Remediation Recommendations Memorandum, dated November 30, 2023, which will be provided to the Audit Committee and Board under separate cover. That memorandum contains a detailed analysis of the incident response process, identifies areas for improvement, and sets forth specific recommendations for enhancing Quorum's information security and vendor risk management programs. The following is a summary of the key recommendations:
Enterprise-Level Recommendations:
• Enhancement of Vendor Risk Management Program: Quorum's vendor risk management program, overseen by Priya Deshmukh, Vice President, Vendor Risk Management, should be enhanced to include more rigorous vendor security due diligence at the onboarding stage, shorter contractual notification windows for security incidents (24 hours or less for all critical vendors), expanded third-party audit rights, and more frequent reassessment of vendor security posture throughout the vendor lifecycle.
• Incident Response Plan Update: Quorum's enterprise incident response plan should be reviewed and updated to incorporate lessons learned from this incident, including refinements to the escalation procedures, external counsel engagement protocols, and regulatory notification workflows. The Company should also implement a regular tabletop exercise program, conducting at least two exercises per year involving cross-functional stakeholders and external counsel.
• Data Minimization Practices: Quorum should review its data-sharing practices with third-party vendors to ensure that only the minimum necessary data is provided to vendors to perform their contracted services. This review should focus in particular on whether the volume and sensitivity of data shared with Palomar and other claims-processing vendors can be reduced without adversely affecting service delivery.
• Cyber-Insurance Program Reassessment: Quorum should periodically reassess the adequacy of its cyber-insurance tower in light of the evolving threat landscape and the Company's vendor ecosystem. While the current tower ($40,000,000 total) was more than adequate for this incident, the Company should ensure that its coverage remains commensurate with its risk profile.
Palomar-Specific Enhancements: The following enhanced security measures have already been implemented or are in progress pursuant to the Settlement Agreement and MSA Amendment 3:
• Critical and high-severity patching window reduced from 30 days to 14 days from vendor patch release.
• Mandatory endpoint detection and response deployment across all systems processing, storing, or transmitting Quorum data.
• Quarterly vulnerability scanning with reports provided to Quorum within 15 business days of each scan.
• Annual independent security assessment at Palomar's expense, with scope and assessor selection subject to Quorum's reasonable approval.
• Incident notification window reduced from 48 hours to 24 hours.
In addition, Palomar's next SOC 2 Type II audit, performed by Kessler, Park & Associates CPA, PLLC (Vivian Park, Engagement Partner, 3000 Oak Lawn Avenue, Suite 700, Dallas, TX 75219), is expected to incorporate the enhanced controls implemented pursuant to the Settlement Agreement and MSA Amendment 3. Quorum should request and review the updated SOC 2 Type II report upon its completion to verify that the enhanced controls have been appropriately designed and are operating effectively.
IX. ENGAGEMENT CLOSURE
Calderwood & Harkness recommends that the engagement in connection with the Palomar data security incident (Matter No. 1025-00006) be formally closed effective December 1, 2023. All substantive workstreams have been concluded, as summarized below:
Document Retention and Privilege Log Protocol. A separate Document Retention & Privilege Log Protocol Memorandum will be issued by Calderwood & Harkness on December 1, 2023. This memorandum will address the retention, organization, and cataloguing of all privileged and non-privileged documents generated or collected in connection with this matter, the maintenance of the engagement privilege log, and procedures for responding to any future document requests, subpoenas, or discovery demands that may be received in connection with this incident.
Ongoing Availability. While Calderwood & Harkness recommends formal closure of the active engagement, the Firm remains available to Quorum for any follow-up matters that may arise in connection with the incident. In particular, we note that while no litigation has been filed against Quorum to date — including no class action complaints, individual lawsuits, or regulatory enforcement actions — the applicable statutes of limitations have not expired in all jurisdictions. Calderwood & Harkness will continue to monitor for any litigation developments and is prepared to provide defense representation if any claims are asserted. The Company's cyber-insurance policy with Atlas Mutual includes coverage for defense costs and indemnification in connection with third-party claims, subject to the terms and conditions of the policy.
X. CONCLUSION AND RECOMMENDATION
The Palomar data security incident has been resolved with what Calderwood & Harkness considers to be the most favorable outcome achievable under the circumstances. The key outcomes are:
• No enforcement action from any regulator — the multistate AG coalition (29 states), the Connecticut Insurance Department, and HHS-OCR have all closed their respective inquiries without imposing any fine, penalty, consent decree, corrective action plan, or other adverse enforcement mechanism against Quorum.
• A substantial vendor indemnification recovery of $6,156,000 ($4,200,000 cash plus $1,956,000 in fee savings) from Palomar, reflecting Quorum's strong contractual position and effective negotiation strategy.
• Full insurance coverage for all incident response costs exceeding the $2,500,000 self-insured retention, with the total insurance recovery of $5,730,250 well within the primary policy limit.
• Enhanced contractual protections for the remaining term of the Palomar MSA, including shortened patching windows, mandatory EDR deployment, quarterly vulnerability scanning, annual independent security assessments, and accelerated incident notification requirements.
• A net favorable financial outcome when all recoveries are taken into account, with combined insurance and vendor recoveries exceeding total incident response costs.
Calderwood & Harkness extends its sincere commendation to the Quorum management team for their exceptional cooperation and responsiveness throughout this engagement. In particular, we recognize the contributions of Thomas R. Whitfield, General Counsel, whose leadership and judgment were instrumental in guiding the Company's response from the outset; Jennifer Liang, Chief Privacy Officer, whose deep expertise in privacy law and regulatory requirements ensured the accuracy and completeness of all notifications; David Naranjo, Chief Information Security Officer, whose technical knowledge and operational responsiveness facilitated the forensic investigation and remediation efforts; Priya Deshmukh, Vice President, Vendor Risk Management, whose diligence in managing the Palomar relationship and driving the MSA amendments was essential to the vendor accountability workstream; and Robert Wentworth, Senior Vice President, Claims Operations, whose coordination of internal resources and data access enabled the efficient identification of affected individuals and data types.
Recommendation. Calderwood & Harkness respectfully recommends that the Audit Committee take the following actions:
1. Approve formal closure of the matter, Matter No. 1025-00006, effective December 1, 2023, and direct that Calderwood & Harkness issue the Document Retention & Privilege Log Protocol Memorandum to ensure the preservation and organization of all matter-related documents.
2. Review and adopt the post-incident remediation recommendations set forth in the Post-Incident Lessons Learned & Remediation Recommendations Memorandum (to be provided under separate cover), and direct management to develop an implementation timeline and report back to the Audit Committee on progress.
3. Consider the adequacy of Quorum's cyber-insurance program in light of the incident, including whether the current tower limits, SIR levels, and coverage terms remain appropriate for the Company's evolving risk profile. Calderwood & Harkness recommends that management, in consultation with Whitmore Risk Advisors, conduct a comprehensive coverage review in connection with the next policy renewal cycle.
Calderwood & Harkness is available to answer any questions from the Audit Committee or individual Board members regarding the contents of this memorandum, the enclosed documents, or any other aspect of the matter. We welcome the opportunity to discuss this report at the next scheduled Audit Committee meeting or at such other time as may be convenient.
Respectfully submitted,
CALDERWOOD & HARKNESS LLP
By: ________
Kevin Ostrowski Partner, Privacy & Data Security Practice Group Calderwood & Harkness LLP 1700 K Street NW, Suite 900 Washington, D.C. 20006 Direct: (202) 555-7438
Email: kostrowski@calderwoodharkness.com
ENCLOSURES
The following documents are enclosed with this memorandum:
Enclosure 1: Multistate Attorney General Closure Letter, dated November 22, 2023 (copy)
Enclosure 2: Connecticut Insurance Department Closure Letter, dated November 28, 2023 (copy)
Enclosure 3: HHS-OCR No Further Action Letter, dated November 30, 2023 (copy)
Enclosure 4: Settlement Agreement and Mutual Release between Quorum Insurance Holdings Corp. and Palomar Data Solutions, Inc., dated October 27, 2023 (copy)
Enclosure 5: Amendment No. 3 to the Master Services Agreement between Quorum Insurance Holdings Corp. and Palomar Data Solutions, Inc., dated October 27, 2023 (copy)
Enclosure 6: Final Incident Response Cost Summary
The following documents will be provided under separate cover:
Post-Incident Lessons Learned & Remediation Recommendations Memorandum, dated November 30, 2023
Document Retention & Privilege Log Protocol Memorandum, dated December 1, 2023
PRIVILEGED AND CONFIDENTIAL — ATTORNEY-CLIENT PRIVILEGED / ATTORNEY WORK PRODUCT. This document and all enclosures are protected by the attorney-client privilege and the attorney work product doctrine. Distribution is limited to the addressees and copy recipients identified on the first page of this memorandum. Do not copy, distribute, or disclose without the prior written consent of Calderwood & Harkness LLP.
Regulatory Body | Notification/Filing Date | Inquiry Received | Response(s) Submitted | Outcome | Closure Date
Multistate AG Coalition (29 States) | Aug. 14–25, 2023 | Sept. 8, 2023 | Oct. 13, 2023; Nov. 3, 2023 | Closed — No Action | Nov. 22, 2023
CT Insurance Department | Aug. 14, 2023 | Following notification | Sept. 22, 2023; Oct. 20, 2023 | Closed — No Action | Nov. 28, 2023
HHS-OCR (HIPAA) | Aug. 15, 2023 | Following notification | Oct. 5, 2023 | No Further Action | Nov. 30, 2023
Cost Category | Vendor/Provider | Amount
Forensic investigation | Graystone Forensics LLC | $1,847,000
Consumer notification, call center, credit monitoring | Clearfield Notification Services LLC | $3,214,500
— Notification printing and mailing (318,247 individuals) | Clearfield | $636,000
— Call center operations (12-week window) | Clearfield | $478,500
— Credit monitoring and identity protection (24-month term, negotiated flat fee) | Clearfield | $2,100,000
Crisis communications and public relations | BrightPath Consulting Group Inc. | $385,000
Legal fees | Calderwood & Harkness LLP | $2,163,750
Internal costs (IT remediation, employee overtime, related expenses) | Quorum Insurance Holdings Corp. (internal) | $620,000
TOTAL | $8,230,250
Item | Amount
Total incident response costs | $8,230,250
Less: Atlas Mutual insurance recovery (costs above SIR) | ($5,730,250)
Quorum SIR obligation | $2,500,000
Less: Palomar cash indemnification payment | ($4,200,000)
Net cash position after insurance and cash settlement | ($1,700,000)
Plus: Palomar fee reduction (realized over 18 months) | $1,956,000
Net financial impact after all recoveries | Favorable by approximately $256,000
Workstream | Status | Completion/Closure Date
Forensic investigation | Completed | July 14, 2023 (Graystone final report)
Consumer notifications | Completed | September 15, 2023 (mailing window closed)
Credit monitoring enrollment | Ongoing (administered by Clearfield) | Enrollment period extends through approximately September 2025
Regulatory notifications | All filed timely | August 14–25, 2023
Multistate AG engagement | Closed — No Action | November 22, 2023
CT Insurance Department inquiry | Closed — No Action | November 28, 2023
HHS-OCR inquiry | Closed — No Further Action | November 30, 2023
Vendor indemnification settlement | Executed | October 27, 2023
Palomar cash payment | Due within 30 days of execution | Approximately November 26, 2023
Insurance claim — proof of loss | Submitted | November 15, 2023
Insurance reimbursement | In process | Pending Atlas Mutual processing