1025-00006 · Graystone Forensics LLC · Board & Management Reporting

board-briefing-memo-regulatory-update.docx DOCUMENT Data Privacy

4 / 88 ← → ✕

PRIVILEGED AND CONFIDENTIAL — ATTORNEY-CLIENT COMMUNICATION — ATTORNEY WORK PRODUCT

MEMORANDUM

Date: October 16, 2023

To: Franklin Reeves, Chair, Audit Committee, Board of Directors, Quorum Insurance Holdings Corp.

From: Kevin Ostrowski, Partner, Calderwood & Harkness LLP

CC: Thomas R. Whitfield, General Counsel, Quorum Insurance Holdings Corp. Jennifer Liang, Chief Privacy Officer, Quorum Insurance Holdings Corp. Margaret D. Calloway, Chief Executive Officer, Quorum Insurance Holdings Corp.

Re: Data Security Incident — Regulatory Engagement Update (Calderwood & Harkness Matter No. 1025-00006)

PRIVILEGE NOTICE: This memorandum is a privileged and confidential attorney-client communication and contains attorney work product prepared in anticipation of litigation and regulatory proceedings. It is provided solely for the use of the Audit Committee of the Board of Directors of Quorum Insurance Holdings Corp. ("Quorum" or the "Company") in connection with the data security incident originating from Palomar Data Solutions, Inc. ("Palomar"). This memorandum should not be disclosed to any third party without prior consultation with counsel. Inadvertent disclosure of this memorandum does not constitute a waiver of any applicable privilege.

I. Executive Summary

This memorandum constitutes Calderwood & Harkness LLP's ("Calderwood & Harkness" or the "Firm") third periodic briefing to the Audit Committee of the Board of Directors (the "Audit Committee") on the status of the Company's response to the vendor-originated data breach involving Palomar Data Solutions, Inc. This briefing follows the Initial Incident Report presented on May 11, 2023, and the Forensic Findings and Notification Plan briefing presented on July 21, 2023. Since the July 21 briefing, significant progress has been made across all workstreams, including the completion of consumer and regulatory notifications, engagement with multiple regulatory bodies, and advancement of vendor indemnification negotiations.

Consumer and Regulatory Notifications. Calderwood & Harkness, working in coordination with Quorum's internal privacy and legal teams, has completed all consumer notification mailings to the full population of 318,247 affected individuals across 29 states and the District of Columbia. These mailings were executed on a rolling basis between August 18 and September 15, 2023. All regulatory notifications were filed between August 14 and August 25, 2023, and each filing was timely under the applicable state breach notification statutes and federal requirements. No late filings occurred in any jurisdiction.

Multistate Attorney General Inquiry. On September 8, 2023, Quorum received a joint demand letter from a 29-state multistate attorney general coalition led by the Connecticut and New York Attorneys General. The demand letter requested detailed information regarding the incident, the Company's response measures, vendor oversight practices, consumer protections offered, and remediation steps undertaken. Calderwood & Harkness submitted a comprehensive written response with four supporting exhibits on October 13, 2023. No response has yet been received from the coalition, and no enforcement action has been threatened.

Connecticut Insurance Department. The Connecticut Insurance Department has opened an inquiry into Quorum's compliance with the Connecticut Insurance Data Security Law. Calderwood & Harkness submitted a formal response on September 22, 2023, and anticipates filing a supplemental submission on or about October 20, 2023. The inquiry remains open, and no adverse findings have been indicated.

HHS Office for Civil Rights. HHS-OCR has acknowledged receipt of the Company's HIPAA breach notification and issued a follow-up inquiry. Calderwood & Harkness submitted a formal response on October 5, 2023. The inquiry remains open, and no adverse findings or enforcement actions have been indicated.

Vendor Indemnification. Negotiations with Palomar Data Solutions regarding contractual indemnification are progressing and are expected to reach resolution in the near term. Calderwood & Harkness circulated a draft settlement term sheet on September 18, 2023, and is engaged in active discussions with Palomar's outside counsel. Resolution before year-end remains the target.

Financial Summary. No enforcement action has been threatened or commenced by any regulator to date. Total incident response costs are currently estimated at approximately $8,230,250. Insurance coverage under Quorum's cyber insurance policy with Atlas Mutual Insurance Company is responding above the $2,500,000 self-insured retention, and total costs remain well within the $15,000,000 per-occurrence policy limit.

The sections below provide detailed analysis of each of these workstreams.

II. Status of Consumer Notifications

A. Notification Mailing Completion

All consumer notification letters have been printed and mailed to the full population of affected individuals. Mailings were executed on a rolling basis commencing August 18, 2023, and concluding September 15, 2023 — a mailing window of approximately 28 calendar days. The total number of individuals notified is 318,247, spanning 29 states and the District of Columbia. This figure is consistent with the scope identified in the Graystone Forensics LLC forensic investigation report, as presented to the Audit Committee during the July 21, 2023 briefing.

Three primary versions of the notification letter were prepared and deployed, each tailored to the category of personal information compromised for the relevant subset of affected individuals:

1. General PII Version. This version was sent to the broadest population of affected individuals whose compromised information included names, dates of birth, Social Security numbers, and driver's license numbers. This version constituted the majority of all notification mailings.

2. Enhanced Financial Information Version. This version was sent to the 84,619 individuals whose compromised information also included financial account data, specifically bank account numbers and/or payment card numbers. This version included enhanced disclosures regarding the potential for financial fraud and recommended additional protective steps, including monitoring of bank and credit card statements.

3. HIPAA-Compliant PHI Version. This version was sent to the 41,203 individuals whose compromised information included protected health information, including health conditions, diagnosis codes, and treatment information derived from workers' compensation claims and health-related insurance claims. This version was drafted to comply with the content requirements of 45 C.F.R. § 164.404(c) and included a description of the types of PHI compromised, steps individuals should take to protect themselves, a brief description of the investigation and mitigation measures, and contact information for further questions.

In addition to the three primary versions, state-specific notification letters were prepared for two jurisdictions with heightened content and formatting requirements:

• California. A California-specific version was prepared for 38,206 California residents, incorporating the requirements of Cal. Civ. Code § 1798.82, including prescribed heading and formatting specifications, as well as the California Confidentiality of Medical Information Act ("CMIA") requirements applicable to the PHI subset of California residents.

• Massachusetts. A Massachusetts-specific version was prepared for 10,217 Massachusetts residents, incorporating the requirements of Mass. Gen. Laws ch. 93H, § 3 and the implementing regulations at 201 CMR 17.00, including the prescribed form and content requirements under Massachusetts law.

In total, five distinct notification letter versions were finalized and deployed. All versions were reviewed and approved by Calderwood & Harkness, Quorum's General Counsel's office, and the Chief Privacy Officer prior to mailing.

Separately, a substitute notice posting was published on Quorum's corporate website (www.quoruminsurance.com/security-incident) on August 15, 2023, in advance of the first mailing, consistent with the substitute notice provisions of applicable state breach notification statutes. The substitute notice remains active and accessible on the Company's website.

B. Clearfield Notification Services — Operational Status

Clearfield Notification Services LLC ("Clearfield") is managing all notification logistics, call center operations, and credit monitoring enrollment under its engagement by Quorum, with oversight from Calderwood & Harkness. The Clearfield engagement is led by Account Manager Jerome Tillman, who has been responsive and effective throughout the engagement.

Call Center Operations. The Clearfield-operated toll-free call center commenced operations on August 18, 2023, coinciding with the first wave of notification mailings. The call center is staffed with trained representatives capable of responding to inquiries regarding the incident, the types of information compromised, the credit monitoring and identity theft protection services being offered, and general data security questions. Call center operations are operating within the planned 12-week window and are expected to conclude on or about November 10, 2023, unless extended based on call volume.

Credit Monitoring Enrollment. Quorum is offering all 318,247 affected individuals 24 months of complimentary credit monitoring and identity theft protection services. As of the date of this memorandum, the estimated take-rate is approximately 40%, corresponding to approximately 127,299 enrollees. This take-rate is tracking in line with industry projections and with the assumptions used in the cost modeling presented to the Audit Committee at the July 21 briefing.

Clearfield Contract Value. The total contract value for Clearfield's services is $3,214,500, broken down as follows:

The $2,100,000 credit monitoring fee was negotiated as a flat fee rather than a per-enrollee fee, which provides cost certainty and is favorable to Quorum given the current enrollment trajectory.

C. States with Largest Affected Populations

The following table sets forth the ten states with the largest populations of affected individuals, along with the combined total for the remaining 19 states and the District of Columbia:

The geographic distribution of the affected population is consistent with Quorum's policyholder base and the nature of Palomar's claims processing activities on behalf of the Company. Connecticut and New York account for the largest shares of affected individuals, which is consistent with Quorum's headquarters location in Hartford, Connecticut and significant operations in New York.

III. Status of Regulatory Notifications

A. Summary of Filings

All regulatory notifications required under applicable state breach notification statutes and federal law have been filed and confirmed received by the applicable regulatory authorities. Filings were submitted on a rolling basis between August 14 and August 25, 2023. Calderwood & Harkness carefully tracked each jurisdiction's applicable notification deadline and can confirm that all filings were timely under the applicable statutes. No jurisdiction has indicated that a filing was late, incomplete, or deficient in any respect.

Where a state required that a copy of the consumer notification letter be submitted with the regulatory filing, such copies were included. Where a state required submission through a dedicated online portal (as opposed to mail or email), those requirements were followed. Calderwood & Harkness prepared and reviewed each jurisdiction-specific filing to ensure compliance with the relevant state's procedural and substantive requirements.

B. Filing Detail

The following table summarizes the regulatory filings made in connection with the incident. For clarity, the filings in the largest jurisdictions and the federal filings are listed individually, while the remaining state filings are aggregated.

In addition to the regulatory filings listed above, a media notice required under 45 C.F.R. § 164.406 — applicable to breaches of unsecured protected health information affecting more than 500 individuals — was distributed to prominent media outlets on August 15, 2023. This media notice was distributed contemporaneously with the HHS-OCR filing and in advance of the consumer notification mailings.

A full confirmation log documenting each filing, including the date of submission, method of submission, confirmation number or receipt (where applicable), and the name of the individual who submitted the filing, is maintained by Sara Hendricks, Working Associate at Calderwood & Harkness. This log is available for review by the Audit Committee upon request.

IV. Multistate Attorney General Inquiry

A. Receipt of Joint Demand Letter

On September 8, 2023, Quorum received a joint demand letter from a multistate attorney general coalition comprising 29 states (the "Multistate Coalition" or the "Coalition"). The letter was issued on the joint letterhead of the lead states and was signed by the following lead representatives:

• Connecticut Attorney General's Office — Consumer Protection Division, Assistant Attorney General Diane Marchetti (lead contact); and

• New York Attorney General's Office — Bureau of Internet and Technology, Assistant Attorney General Mark Petrosian (co-lead contact).

The 27 additional participating states in the Coalition are: Massachusetts, California, Illinois, Pennsylvania, New Jersey, Ohio, Texas, Florida, Georgia, Virginia, Maryland, North Carolina, South Carolina, Michigan, Minnesota, Indiana, Wisconsin, Colorado, Arizona, Oregon, Washington, Tennessee, Missouri, Louisiana, Nevada, Iowa, and New Hampshire. The breadth of the Coalition reflects the geographic distribution of Quorum's affected policyholder base.

The demand letter requested detailed information in the following areas:

• A comprehensive description of the data security incident, including the timeline of events, the nature and scope of the unauthorized access, and the types of personal information compromised;

• A detailed account of Quorum's incident response measures, including forensic investigation, containment, and remediation steps;

• Information regarding Quorum's vendor oversight practices, including the contractual data security requirements imposed on Palomar and the due diligence conducted prior to and during the engagement;

• A description of the consumer protections offered to affected individuals, including credit monitoring and identity theft protection services; and

• A summary of the remediation measures implemented or planned to prevent future incidents.

The demand letter did not threaten enforcement action and did not include a subpoena or civil investigative demand. It was characterized as an informational request, though its substance and breadth indicated the seriousness with which the Coalition is treating the matter.

B. Calderwood & Harkness Response — October 13, 2023

Calderwood & Harkness submitted a comprehensive written response to the Multistate Coalition on October 13, 2023. The response was addressed jointly to AAG Diane Marchetti (Connecticut) and AAG Mark Petrosian (New York), with copies transmitted to the other 27 participating state offices. The response was prepared over a period of approximately five weeks, with significant input from Quorum's General Counsel, Chief Privacy Officer, information security team, and vendor risk management function.

The response was accompanied by four exhibits, each of which was carefully prepared to provide the Coalition with a clear, organized, and transparent presentation of the relevant facts and the Company's response measures:

Exhibit A: Incident Timeline and Remedial Measures Summary. This exhibit provided a detailed chronological account of the incident from the date of initial unauthorized access (March 14, 2023, as determined by Graystone Forensics LLC) through the completion of consumer notifications on September 15, 2023. The timeline included all key milestones, including Palomar's detection of anomalous activity (April 18, 2023), Palomar's notification to Quorum (April 21, 2023), Quorum's engagement of Calderwood & Harkness (May 4, 2023), the retention of Graystone Forensics under privilege (May 5, 2023), the filing of the insurance claim with Atlas Mutual (May 8, 2023), the completion of the forensic investigation, the determination of the scope of compromised data, and the execution of the notification plan. The exhibit also set forth all remedial measures taken by Quorum, including enhanced vendor monitoring, supplemental security controls, and the contractual measures being required of Palomar.

Exhibit B: Consumer Notification Samples and Compliance Checklist. This exhibit included copies of all five consumer notification letter versions (general PII, enhanced financial data, PHI/HIPAA, California-specific, and Massachusetts-specific), demonstrating the content and formatting of the notifications sent to affected individuals. The exhibit also included a compliance checklist cross-referencing each of the 29 states' and the District of Columbia's notification requirements and demonstrating that each requirement was satisfied, including content elements, timing, and method of delivery.

Exhibit C: Palomar Vendor Accountability Summary. This exhibit described Quorum's contractual indemnification demand against Palomar, Palomar's specific breaches of the Master Services Agreement ("MSA"), and the ongoing negotiations for accountability. The exhibit addressed Palomar's failure to patch CVE-2023-0669 (the GoAnywhere MFT remote code execution vulnerability) within the contractual 30-day critical vulnerability patching window required by Exhibit D to the MSA (Data Security Exhibit, as amended by Amendment 2, effective September 15, 2022). It also addressed Palomar's late breach notification — specifically, that Palomar discovered anomalous activity on April 18, 2023 but did not notify Quorum until April 21, 2023, approximately 24 hours past the 48-hour notification requirement in Section 9.4 of the MSA. The exhibit was designed to demonstrate to the Coalition that Quorum is actively holding its vendor accountable for the failures that gave rise to the incident.

Exhibit D: Quorum Information Security Program Overview. This exhibit provided a comprehensive description of Quorum's enterprise information security program, governance structure, and technical safeguards. The exhibit covered Quorum's information security governance framework, including the roles of the Chief Information Security Officer, the Chief Privacy Officer, and the VP of Vendor Risk Management (Priya Deshmukh). It described the Company's technical controls, including network segmentation, multi-factor authentication, encryption protocols, intrusion detection systems, and endpoint protection. It addressed Quorum's vendor risk management program, including the due diligence process for onboarding third-party service providers, ongoing monitoring, contractual security requirements, and audit rights. The exhibit also described Quorum's incident response plan, employee security awareness training program, and the post-incident enhancements being implemented in response to the Palomar breach.

C. Key Themes of the Response

Calderwood & Harkness structured the response around several key themes, each of which is designed to position Quorum favorably with the Coalition and to demonstrate the Company's responsible handling of the incident:

Vendor-Originated Breach. The response made clear that the compromise occurred entirely within Palomar Data Solutions' network environment and was caused by Palomar's failure to timely patch a known critical vulnerability — CVE-2023-0669, a remote code execution vulnerability in the GoAnywhere MFT file transfer platform. Quorum's own systems were not compromised, and the forensic investigation by Graystone Forensics confirmed that the unauthorized access was limited to data residing on Palomar's systems. This framing is critical to distinguishing Quorum's culpability from that of its vendor.

Prompt and Comprehensive Response. The response demonstrated that Quorum acted promptly and responsibly upon learning of the incident. Upon receiving notification from Palomar on April 21, 2023, Quorum immediately initiated its incident response plan. Calderwood & Harkness was engaged on May 4, 2023. Graystone Forensics LLC was retained under privilege on May 5, 2023, to conduct the forensic investigation. The insurance claim was filed with Atlas Mutual Insurance Company on May 8, 2023. All subsequent response activities — forensic investigation, scope determination, notification drafting, and notification execution — were completed in an organized and timely manner.

Timely Notifications. The response emphasized that all consumer and regulatory notifications were timely under the applicable laws of each jurisdiction. No late filings occurred, and no jurisdiction has questioned the timeliness of any notification.

Robust Consumer Protections. The response highlighted that Quorum offered 24 months of complimentary credit monitoring and identity theft protection services to all 318,247 affected individuals — a level of consumer protection that exceeds the minimums required by most state statutes and reflects the Company's commitment to mitigating potential harm.

Vendor Accountability. The response demonstrated that Quorum is holding Palomar accountable through contractual indemnification and enhanced security requirements, underscoring that the Company is not simply absorbing the consequences of its vendor's failures.

Cooperative Engagement. The overall tone of the response was cooperative and transparent, consistent with Calderwood & Harkness's engagement strategy of fostering constructive relationships with the regulatory authorities involved.

D. Current Status and Next Steps

As of the date of this memorandum, no response has been received from the Multistate Coalition to Calderwood & Harkness's October 13 submission. Calderwood & Harkness anticipates that the Coalition may take several weeks to review the submission and may thereafter request supplemental information or documentation. Such follow-up requests are common in multistate AG investigations of this nature and do not, standing alone, indicate any adverse inclination by the Coalition.

Calderwood & Harkness's engagement strategy will continue to be cooperative and transparent, with the overarching goal of achieving closure of the inquiry without enforcement action, fines, or penalties. To date, no enforcement action has been threatened by any state within the Coalition. Calderwood & Harkness will promptly advise the Audit Committee of any response received from the Coalition or any change in the posture of the inquiry.

V. Connecticut Insurance Department Inquiry

A. Background. The Connecticut Insurance Department (the "Department") opened an inquiry into the incident following receipt of Quorum's notification filing on August 14, 2023 under the Connecticut Insurance Data Security Law, Conn. Gen. Stat. § 38a-999b. The inquiry is being handled by Richard Nakamura, Examiner, Financial Analysis Division, Cybersecurity Unit. This inquiry is distinct from, and runs parallel to, the broader multistate attorney general inquiry addressed in Section IV above.

The Department's inquiry focuses on three principal areas: (i) Quorum's compliance with the Connecticut Insurance Data Security Law, including the Company's obligations with respect to its information security program, vendor oversight, and breach notification; (ii) the adequacy of Quorum's vendor oversight practices as they relate to Palomar Data Solutions, including pre-engagement due diligence, contractual data security requirements, and ongoing monitoring; and (iii) the adequacy of the remediation measures implemented or planned in response to the incident.

B. Response Filed

Calderwood & Harkness submitted a formal written response to the Department's inquiry on September 22, 2023. The response provided the Department with a detailed account of the incident, the types of personal information compromised, the forensic investigation findings, the notification process, and the remediation measures undertaken. The response also addressed Quorum's compliance with the requirements of Conn. Gen. Stat. § 38a-999b, including the maintenance of a comprehensive written information security program, the conduct of risk assessments, the implementation of appropriate safeguards, and the oversight of third-party service providers.

Calderwood & Harkness anticipates filing a supplemental submission on or about October 20, 2023 (the "Supplemental Submission"), providing additional information responsive to specific follow-up questions from Mr. Nakamura. The Supplemental Submission is expected to address the following topics in greater detail:

• Quorum's vendor risk management program, including the due diligence process applied to Palomar at the time of initial engagement and at each MSA renewal and amendment;

• The data security provisions of the Palomar MSA, including the requirements set forth in Exhibit D (Data Security Exhibit), as amended by Amendment 2 (effective September 15, 2022), which added, among other things, a requirement for Palomar to obtain and maintain a SOC 2 Type II audit report and provide such report to Quorum annually;

• Palomar's most recent SOC 2 Type II audit report, prepared by Kessler, Park & Associates CPA, PLLC (Engagement Partner: Vivian Park, Dallas, Texas), which was provided to Quorum in the ordinary course prior to the incident; and

• Post-incident remediation measures, including the enhanced contractual provisions being negotiated as part of MSA Amendment 3 (described in Section VII.D below).

The Supplemental Submission may also reference Quorum's external auditor, Halstead & Monroe LLP (Engagement Partner: Gregory Chin, Philadelphia, Pennsylvania), to the extent relevant to the Department's assessment of Quorum's information security governance and internal controls.

C. Current Status

The Department's inquiry remains open. Calderwood & Harkness is engaged in constructive dialogue with Mr. Nakamura, and the tone of the Department's communications has been professional and cooperative. No adverse findings, deficiency determinations, or enforcement actions have been indicated. Calderwood & Harkness expects that the inquiry will close upon the Department's satisfactory receipt and review of all requested information, including the Supplemental Submission anticipated for October 20, 2023. Calderwood & Harkness will promptly advise the Audit Committee of any material developments in this inquiry.

VI. HHS Office for Civil Rights (HHS-OCR) Inquiry

A. Background. The Company's HIPAA breach notification was filed with HHS-OCR Region I (Boston regional office) on August 15, 2023, consistent with the reporting requirements of 45 C.F.R. § 164.408, which requires covered entities to notify HHS of breaches of unsecured protected health information affecting 500 or more individuals without unreasonable delay and in no case later than 60 days following discovery of the breach. The notification reported the breach of unsecured protected health information affecting 41,203 individuals. The categories of PHI compromised included health conditions, diagnosis codes, and treatment information associated with workers' compensation claims and health-related insurance claims administered by Quorum through its relationship with Palomar.

Following receipt of the notification, HHS-OCR acknowledged the filing and subsequently issued a follow-up inquiry requesting additional information regarding the incident, the scope of PHI compromised, and Quorum's HIPAA compliance measures.

B. Response Filed

Calderwood & Harkness submitted a formal written response to HHS-OCR's inquiry on October 5, 2023. The response provided detailed information regarding the following:

• The 41,203 individuals whose PHI was compromised, including the types of PHI involved and the circumstances of the breach;

• Quorum's HIPAA compliance measures, including its designation of a HIPAA Privacy Officer and Security Officer, workforce training, policies and procedures for safeguarding PHI, and risk analysis protocols;

• The business associate agreement ("BAA") between Quorum and Palomar, including the data security obligations imposed on Palomar as a business associate under the BAA, and Palomar's failure to comply with those obligations;

• The consumer notification process, demonstrating that HIPAA-compliant notification letters were mailed to all 41,203 affected individuals within 60 days of the determination of the breach scope, consistent with the individual notification requirements of 45 C.F.R. § 164.404; and

• Post-incident remediation steps, including enhanced monitoring of Palomar, additional contractual security requirements being negotiated, and internal enhancements to Quorum's HIPAA compliance program.

The response was designed to demonstrate full compliance with the HIPAA Breach Notification Rule and to provide HHS-OCR with confidence that Quorum has taken appropriate steps to mitigate the breach and prevent recurrence.

C. Current Status

The HHS-OCR inquiry remains open, which is typical during the review period following submission of a comprehensive response. No adverse findings, corrective action plans, or enforcement actions have been indicated. HHS-OCR has not requested any additional information at this time. Calderwood & Harkness anticipates that OCR will complete its review of the submitted information and, based on the strength of the response and the facts of the incident, expects that the inquiry will result in closure with no further action. Calderwood & Harkness will promptly notify the Audit Committee of any developments in this inquiry.

VII. Palomar Data Solutions — Vendor Indemnification Negotiations

A. Contractual Basis

Quorum's indemnification claim against Palomar is grounded in Section 12.2 of the Master Services Agreement dated November 12, 2019, between Quorum and Palomar (the "MSA"), as amended by Amendment 1 (effective March 8, 2021) and Amendment 2 (effective September 15, 2022). Section 12.2 provides that Palomar shall indemnify, defend, and hold harmless Quorum and its affiliates, officers, directors, and employees from and against all losses, damages, liabilities, costs, and expenses (including reasonable attorneys' fees) arising from or related to Palomar's breach of its data security obligations under the MSA and the Data Security Exhibit (Exhibit D).

The liability cap under the MSA is two times (2×) the trailing twelve-month fees paid by Quorum to Palomar, which equals $32,600,000 (2 × $16,300,000 in annual contract value). The current total of incident response costs ($8,230,250) is well within this cap.

Calderwood & Harkness has identified two clear breaches of the MSA by Palomar that form the basis of Quorum's indemnification claim:

1. Failure to Patch CVE-2023-0669. Palomar failed to apply the available patch for CVE-2023-0669, a critical remote code execution vulnerability in the GoAnywhere MFT file transfer platform, within the 30-day critical vulnerability patching window required by Section 3.2(a) of Exhibit D (Data Security Exhibit), as amended by Amendment 2 (effective September 15, 2022). The Graystone Forensics investigation confirmed that this unpatched vulnerability was the attack vector used to gain unauthorized access to Palomar's systems beginning on March 14, 2023. The patch for CVE-2023-0669 was publicly available as of February 7, 2023, meaning Palomar had more than 35 days prior to the initial compromise — well in excess of the contractual patching window — yet failed to apply the patch.

2. Late Breach Notification. Palomar discovered anomalous activity on its network on April 18, 2023, but did not notify Quorum until April 21, 2023. This delay of approximately 72 hours exceeded the 48-hour notification requirement set forth in Section 9.4 of the MSA by approximately 24 hours. This late notification delayed Quorum's ability to initiate its own incident response, engage counsel, and begin the forensic investigation.

Both of these breaches are well-documented by the Graystone Forensics investigation report and contemporaneous communications between Quorum and Palomar.

B. Demand and Counterparty Position

Calderwood & Harkness sent a formal breach of contract and indemnification demand letter to Palomar's outside counsel, Mercer, Haight & Dunlop LLP ("Mercer Haight"), on June 20, 2023. The letter was directed to Catherine Langford, Partner, and Brian Soto, Associate. The demand letter set forth the two MSA breaches, cited the relevant contractual provisions, summarized the Graystone Forensics findings, and demanded full indemnification of $8,230,250, representing Quorum's total incident response costs.

Palomar's initial response was received on July 7, 2023, via letter from Catherine Langford. In that response, Palomar disputed both causation and the scope of its liability. Palomar contended that the exploitation of CVE-2023-0669 constituted a "sophisticated and unprecedented attack" that should not be attributed to a failure to patch within the contractual window, and that certain categories of Quorum's claimed costs — particularly internal costs and a portion of the legal fees — were not recoverable under the MSA's indemnification provision. In lieu of full indemnification, Palomar offered a $1,500,000 "goodwill credit" against future service fees.

Calderwood & Harkness sent a detailed rebuttal letter on July 25, 2023, rejecting the $1,500,000 offer as wholly inadequate. The rebuttal letter addressed each of Palomar's arguments, demonstrating that: (i) CVE-2023-0669 was a widely publicized vulnerability with a readily available patch, and the threat actor's exploitation of it was foreseeable, not "unprecedented"; (ii) the Graystone Forensics report conclusively established that the unpatched vulnerability was the attack vector; (iii) all categories of costs claimed by Quorum — including forensic investigation, notification, credit monitoring, legal fees, crisis communications, and internal costs — are recoverable losses under Section 12.2 of the MSA; and (iv) the $1,500,000 credit proposal failed to account for the magnitude of the breach and its consequences.

C. Negotiation Status

Active negotiations are ongoing between Calderwood & Harkness and Mercer, Haight & Dunlop. Following the exchange of the initial demand, Palomar's response, and Calderwood & Harkness's rebuttal, the parties engaged in telephonic discussions during August and September 2023 to narrow the issues in dispute and explore the parameters of a potential resolution.

Calderwood & Harkness circulated a draft settlement term sheet to Mercer Haight on September 18, 2023. The key elements under negotiation include:

• Cash Indemnification Payment Amount. The amount of a lump-sum cash payment from Palomar to Quorum in satisfaction of the indemnification claim. Calderwood & Harkness's position is that the full $8,230,250 in incident response costs should be recovered; Palomar's last communicated position reflects a lower figure that Calderwood & Harkness considers insufficient.

• Fee Reduction or Credit. As a potential component of the settlement, the parties are discussing a reduction in or credit against Palomar's service fees for the remaining term of the MSA. This element would supplement, not replace, the cash indemnification payment.

• Enhanced Security Requirements and Audit Provisions. The settlement is expected to include Palomar's agreement to enhanced data security requirements, as described in Section VII.D below (MSA Amendment 3).

• Mutual Release Scope. The scope of any mutual release of claims is under negotiation, including whether the release would extend to potential future claims arising from the same incident (e.g., litigation exposure) and whether it would be conditioned upon Palomar's compliance with the enhanced security requirements.

Calderwood & Harkness provided Thomas R. Whitfield, Quorum's General Counsel, with a detailed negotiation strategy memorandum on August 28, 2023, analyzing Quorum's leverage points, the strengths and weaknesses of each party's position, and recommending a target settlement range. The contents of that memorandum are protected by attorney-client privilege and attorney work product protection and are not further described herein, but are available to the Audit Committee upon request through Mr. Whitfield.

An important consideration in the negotiation is the preservation of the vendor relationship. The MSA has a remaining term through November 11, 2024, and Palomar serves as Quorum's second-largest client claims processing vendor, with an annual contract value of $16,300,000. While Quorum's contractual position is strong and the Company is prepared to pursue formal dispute resolution if necessary, a negotiated resolution that preserves the vendor relationship (with substantially enhanced security protections) is the preferred outcome, subject to achieving an appropriate level of financial recovery.

A revised term sheet reflecting Palomar's counterproposals is expected from Mercer Haight in the coming weeks. Calderwood & Harkness is optimistic that a resolution can be reached before year-end 2023. Calderwood & Harkness will keep the Audit Committee informed of significant developments in the negotiation.

D. MSA Amendment 3 — Enhanced Security Provisions

As part of the anticipated settlement, Calderwood & Harkness is drafting a proposed MSA Amendment 3, which would substantially enhance the data security, monitoring, and audit provisions of the MSA. The key provisions under drafting include:

• Reduced Critical Vulnerability Patching Window. The patching window for critical vulnerabilities (as defined by CVSS score of 9.0 or above) would be reduced from 30 calendar days to 14 calendar days.

• Mandatory Endpoint Detection and Response (EDR). Palomar would be required to deploy and maintain an endpoint detection and response solution across all systems that process, store, or transmit Quorum data.

• Quarterly Vulnerability Scanning. Palomar would be required to conduct quarterly vulnerability scans of all systems that process, store, or transmit Quorum data and provide the results of such scans to Quorum within 10 business days of completion.

• Annual Independent Security Assessment. Palomar would be required to undergo an annual independent security assessment conducted by a qualified third-party assessor, at Palomar's expense, with the assessment report provided to Quorum within 30 days of completion.

• Reduced Incident Notification Window. The incident notification window would be reduced from 48 hours to 24 hours following Palomar's discovery of any actual or suspected security incident affecting Quorum data.

These enhanced provisions are designed to address the specific failures that gave rise to the current incident and to provide Quorum with significantly greater visibility into and control over Palomar's security posture for the remainder of the MSA term.

VIII. Insurance Coverage Update

A. Primary Policy — Atlas Mutual Insurance Company

Quorum maintains a cyber liability insurance policy with Atlas Mutual Insurance Company under Policy No. CYB-2023-041587. The claim arising from the Palomar data security incident has been assigned Claim No. CYB-CLM-2023-05892. The key terms of the policy are as follows:

• Per-Occurrence Limit: $15,000,000

• Self-Insured Retention (SIR): $2,500,000

• Coverage Period: January 1, 2023 – January 1, 2024

• Claims Adjuster: Paul Enriquez, Atlas Mutual Insurance Company

Atlas Mutual has acknowledged the claim and has accepted coverage for the following categories of incident response costs in excess of the $2,500,000 SIR: forensic investigation costs, notification costs, credit monitoring and identity theft protection costs, crisis communications and public relations costs, and regulatory defense costs (including legal fees incurred in connection with regulatory inquiries and proceedings). Atlas Mutual's acceptance of coverage has been communicated in writing and is not subject to any reservation of rights that would limit coverage for the categories of costs currently being incurred.

Quorum's cyber insurance broker, Whitmore Risk Advisors Inc. (Sandra Whitmore-Kim, lead broker), is coordinating with Atlas Mutual on all claims-related matters, including the submission of invoices, documentation of covered costs, and periodic claims status discussions.

B. Cost Summary and Coverage Application

Total incident response costs incurred to date are estimated at approximately $8,230,250, broken down as follows:

The application of insurance coverage to these costs is as follows:

• Amount within SIR (Quorum's responsibility): $2,500,000

• Amount covered by Atlas Mutual primary policy (above SIR): $5,730,250

• Remaining available primary policy limit: $9,269,750

Total costs remain well within the $15,000,000 per-occurrence limit of the Atlas Mutual primary policy. Quorum also maintains an excess cyber liability policy with Pinnacle Surplus Lines Insurance Corp. (Policy No. XS-CYB-2023-7812), providing $25,000,000 in excess coverage above the Atlas Mutual primary policy. Based on current cost projections, the Pinnacle excess policy is unlikely to be implicated.

C. Palomar Recovery Impact

Any financial recovery obtained from Palomar through the indemnification settlement negotiations will offset Quorum's overall net exposure related to the incident. Depending on the structure and amount of any settlement, such recovery may reduce Quorum's out-of-pocket costs to below the $2,500,000 SIR, or may give rise to subrogation-related considerations under the Atlas Mutual policy.

Calderwood & Harkness will coordinate with Atlas Mutual regarding the carrier's subrogation rights as part of any settlement with Palomar. Under the terms of the Atlas Mutual policy, Quorum is required to preserve Atlas Mutual's subrogation rights and to cooperate with the carrier in connection with any recovery from third parties. The structure of any Palomar settlement will be designed to comply with these obligations while maximizing Quorum's net financial recovery.

IX. Crisis Communications Update

BrightPath Consulting Group Inc. ("BrightPath") continues to manage the external and internal communications strategy related to the incident under the direction of Managing Director Meredith Ashford. BrightPath was retained on May 9, 2023, and has been instrumental in managing the Company's public messaging and internal employee communications throughout the incident response.

External Communications. Press statements were issued contemporaneously with the commencement of consumer notification mailings in August 2023. The press statements were coordinated with Calderwood & Harkness and Quorum's General Counsel's office to ensure accuracy and consistency with the Company's regulatory filings and consumer notifications. Media coverage of the incident has been moderate and has been largely factual in nature, with no significant negative editorializing or viral social media activity. No significant reputational impact has been observed to date, and BrightPath continues to monitor media coverage and social media sentiment.

Internal Communications. Employee-facing communications were distributed to Quorum's approximately 11,400 employees to inform them of the incident, the Company's response, and the steps being taken to protect affected individuals. These communications were designed to maintain employee confidence, provide clear guidance to employees who may receive inquiries from customers or other stakeholders, and reinforce the Company's commitment to data security.

Investor-Facing Disclosures. BrightPath and Calderwood & Harkness coordinated with Quorum's legal team on investor-facing disclosures, including the preparation of talking points for use in investor communications. These disclosures were prepared in coordination with the SEC disclosure analysis discussed in Section X below.

Fees. Total BrightPath fees to date are $385,000, which is within the budgeted amount for crisis communications services.

X. SEC Disclosure Considerations

Calderwood & Harkness previously provided Quorum's General Counsel, Thomas R. Whitfield, with a written analysis dated July 19, 2023, addressing the Company's SEC disclosure obligations in connection with the data security incident. That analysis addressed the requirements of Item 1.05 of Form 8-K, which was adopted by the SEC in July 2023 and requires registrants to disclose material cybersecurity incidents within four business days of determining that the incident is material. The analysis also addressed the Company's obligations to update risk factor disclosures in its periodic reports on Form 10-Q and Form 10-K.

The materiality analysis considered the following factors:

• The incident's total financial impact ($8,230,250 in incurred costs) relative to Quorum's $4.82 billion fiscal year 2022 annual revenue and approximately $6.1 billion market capitalization (as of May 2023);

• The availability of insurance coverage under the Atlas Mutual primary policy, which is covering a substantial portion of the costs above the SIR;

• The potential for financial recovery through the Palomar vendor indemnification negotiations, which could further reduce Quorum's net financial exposure;

• The absence of any threatened or commenced enforcement action by any regulator;

• The absence of any known litigation filed by affected individuals as of the date of this memorandum; and

• The moderate and largely factual nature of media coverage, with no significant reputational impact observed.

Based on these factors, Calderwood & Harkness's preliminary assessment, as communicated in the July 19, 2023 analysis, was that the incident did not, at that time, meet the materiality threshold for a Form 8-K filing under Item 1.05. However, Calderwood & Harkness cautioned that materiality is a dynamic assessment that must be revisited as circumstances evolve, particularly if enforcement actions are threatened or commenced, if class action litigation is filed, or if the total financial impact increases significantly.

Calderwood & Harkness continues to monitor developments and will update its disclosure analysis as the regulatory engagements and indemnification negotiations progress. Calderwood & Harkness recommends that Quorum (Nasdaq: QIHC) coordinate with its external auditor, Halstead & Monroe LLP (Engagement Partner: Gregory Chin, Philadelphia, Pennsylvania), regarding any required financial statement disclosures, loss contingency accruals, or contingency footnotes in connection with the Company's upcoming Form 10-Q filing. Depending on the outcome of the multistate AG inquiry and the Palomar indemnification negotiations, additional disclosure considerations may arise.

XI. Upcoming Milestones and Action Items

The following is a summary of the key upcoming milestones and action items for each workstream:

1. Multistate Attorney General Inquiry. Await response from the 29-state Coalition to Calderwood & Harkness's October 13, 2023 submission. Prepare supplemental information if requested by the Coalition. Continue cooperative engagement with the goal of achieving closure without enforcement action. No response deadline is currently pending.

2. Connecticut Insurance Department Inquiry. File Supplemental Submission (anticipated on or about October 20, 2023) providing additional information regarding Quorum's vendor oversight program, the Palomar MSA security provisions, and post-incident remediation measures. Target closure of the inquiry upon the Department's satisfactory review of all submitted materials.

3. HHS Office for Civil Rights Inquiry. Await HHS-OCR's completion of its review of the October 5, 2023 submission and any additional requests for information. Target a determination of no further action based on the strength of Quorum's HIPAA compliance and notification efforts.

4. Palomar Indemnification Negotiations. Finalize the revised settlement term sheet upon receipt of Palomar's counterproposals. Negotiate to resolution. Execute a settlement agreement and MSA Amendment 3 incorporating enhanced security provisions. Target resolution before year-end 2023.

5. Insurance Coverage. Prepare and submit a proof of loss and final cost summary to Atlas Mutual Insurance Company once total incident response costs are finalized. Coordinate with Atlas Mutual regarding subrogation rights in connection with any Palomar settlement.

6. Credit Monitoring and Call Center. Continue monitoring credit monitoring enrollment rates and call center operations through the planned 12-week window (expected conclusion on or about November 10, 2023). Evaluate whether any extension is warranted based on call volume and enrollment activity.

7. Board Reporting. The next Audit Committee briefing is anticipated following resolution of the multistate AG inquiry and the Palomar settlement, expected in late November 2023. Calderwood & Harkness will provide interim updates to Mr. Whitfield as material developments occur, and Mr. Whitfield will communicate those updates to the Audit Committee as appropriate.

XII. Assessment and Recommendation

Overall Assessment. The overall trajectory of this matter remains favorable. All regulatory engagements to date have been constructive in tone, and no enforcement action, fine, penalty, or corrective action plan has been threatened or commenced by any regulator. The consumer notification process has been completed in its entirety, and the credit monitoring and call center operations are performing within expectations. Media coverage has been moderate and has not resulted in significant reputational impact. No litigation by affected individuals has been filed as of the date of this memorandum.

Regulatory Outlook. Calderwood & Harkness's strategy of cooperative, transparent engagement with all regulatory bodies — combined with comprehensive documentation of Quorum's prompt and thorough response, timely notifications, robust consumer protections, and vendor accountability measures — positions Quorum well for closure of all regulatory inquiries without penalties or enforcement actions. While the multistate AG inquiry and the Connecticut Insurance Department inquiry remain open, the interactions to date have been professional and constructive, and Calderwood & Harkness has not identified any indications of an adverse disposition by any regulatory body.

Vendor Indemnification. The Palomar indemnification negotiation is expected to produce meaningful financial recovery for Quorum, partially offsetting the Company's incident response costs and reducing its net financial exposure. Quorum's contractual position is strong, supported by clearly documented MSA breaches and the findings of the Graystone Forensics investigation. Calderwood & Harkness is cautiously optimistic that a resolution acceptable to Quorum can be reached before year-end 2023.

Recommendation. Calderwood & Harkness recommends continued execution of the current strategy across all workstreams. No changes in strategy or approach are recommended at this time. Calderwood & Harkness will provide the Audit Committee with an updated briefing upon the occurrence of any material development, including receipt of a response from the multistate AG coalition, resolution of the Palomar indemnification negotiations, or any change in the posture of any regulatory inquiry.

Closing

Should any member of the Audit Committee have questions regarding this memorandum or any aspect of the Company's data security incident response, please direct such questions through Thomas R. Whitfield, General Counsel, or through the undersigned, in order to preserve the attorney-client privilege and work product protection applicable to these communications.

Respectfully submitted,

CALDERWOOD & HARKNESS LLP

By: ________

Kevin Ostrowski Partner

Calderwood & Harkness LLP 1700 K Street NW, Suite 900 Washington, D.C. 20006 Telephone: (202) 555-4100

Email: kostrowski@calderwoodharkness.com

CONFIDENTIALITY NOTICE: This memorandum is a privileged and confidential attorney-client communication and contains attorney work product. It is intended solely for the use of the Audit Committee of the Board of Directors of Quorum Insurance Holdings Corp. and should not be disclosed, distributed, or copied to any third party without the prior written consent of Calderwood & Harkness LLP. Inadvertent disclosure does not constitute a waiver of any applicable privilege or protection.

Service Component	Cost
Notification printing and mailing	$636,000
Call center operations (12-week window)	$478,500
Credit monitoring and identity theft protection (24-month, flat fee)	$2,100,000
Total	$3,214,500
Jurisdiction	Affected Individuals
Connecticut	52,114
New York	47,831
California	38,206
Texas	29,477
Florida	22,913
Pennsylvania	18,640
Illinois	16,502
New Jersey	14,388
Ohio	11,743
Massachusetts	10,217
Remaining 19 states + D.C. (combined)	56,216
Total	318,247
Jurisdiction / Regulator	Date Filed	Statutory Basis	Timely?
Connecticut Attorney General	August 14, 2023	Conn. Gen. Stat. § 36a-701b	Yes
Connecticut Insurance Department	August 14, 2023	CT Insurance Data Security Law (Conn. Gen. Stat. § 38a-999b)	Yes
HHS Office for Civil Rights (HIPAA)	August 15, 2023	45 C.F.R. § 164.408 (>500 individuals)	Yes
New York Attorney General	August 16, 2023	N.Y. Gen. Bus. Law § 899-aa	Yes
California Attorney General	August 16, 2023	Cal. Civ. Code § 1798.82 (>500 CA residents)	Yes
Massachusetts Attorney General	August 17, 2023	Mass. Gen. Laws ch. 93H, § 3	Yes

Remaining 24 states	August 17–25, 2023	Various state breach notification statutes	Yes — all timely
Cost Category	Provider	Amount
Forensic investigation	Graystone Forensics LLC	$1,847,000
Notification services (printing, mailing, call center, credit monitoring)	Clearfield Notification Services LLC	$3,214,500
Crisis communications and public relations	BrightPath Consulting Group Inc.	$385,000
Legal fees (regulatory defense, notification, vendor negotiations)	Calderwood & Harkness LLP	$2,163,750
Internal costs (IT remediation, employee overtime, infrastructure)	Quorum Insurance Holdings Corp.	$620,000 (est.)
Total	$8,230,250

PRIVILEGED AND CONFIDENTIAL — ATTORNEY-CLIENT COMMUNICATION — ATTORNEY WORK PRODUCT
MEMORANDUM
Date: October 16, 2023
To: Franklin Reeves, Chair, Audit Committee, Board of Directors, Quorum Insurance Holdings Corp.
From: Kevin Ostrowski, Partner, Calderwood & Harkness LLP
CC: Thomas R. Whitfield, General Counsel, Quorum Insurance Holdings Corp. Jennifer Liang, Chief Privacy Officer, Quorum Insurance Holdings Corp. Margaret D. Calloway, Chief Executive Officer, Quorum Insurance Holdings Corp.
Re: Data Security Incident — Regulatory Engagement Update (Calderwood & Harkness Matter No. 1025-00006)
PRIVILEGE NOTICE: This memorandum is a privileged and confidential attorney-client communication and contains attorney work product prepared in anticipation of litigation and regulatory proceedings. It is provided solely for the use of the Audit Committee of the Board of Directors of Quorum Insurance Holdings Corp. ("Quorum" or the "Company") in connection with the data security incident originating from Palomar Data Solutions, Inc. ("Palomar"). This memorandum should not be disclosed to any third party without prior consultation with counsel. Inadvertent disclosure of this memorandum does not constitute a waiver of any applicable privilege.
I. Executive Summary
This memorandum constitutes Calderwood & Harkness LLP's ("Calderwood & Harkness" or the "Firm") third periodic briefing to the Audit Committee of the Board of Directors (the "Audit Committee") on the status of the Company's response to the vendor-originated data breach involving Palomar Data Solutions, Inc. This briefing follows the Initial Incident Report presented on May 11, 2023, and the Forensic Findings and Notification Plan briefing presented on July 21, 2023. Since the July 21 briefing, significant progress has been made across all workstreams, including the completion of consumer and regulatory notifications, engagement with multiple regulatory bodies, and advancement of vendor indemnification negotiations.
Consumer and Regulatory Notifications. Calderwood & Harkness, working in coordination with Quorum's internal privacy and legal teams, has completed all consumer notification mailings to the full population of 318,247 affected individuals across 29 states and the District of Columbia. These mailings were executed on a rolling basis between August 18 and September 15, 2023. All regulatory notifications were filed between August 14 and August 25, 2023, and each filing was timely under the applicable state breach notification statutes and federal requirements. No late filings occurred in any jurisdiction.
Multistate Attorney General Inquiry. On September 8, 2023, Quorum received a joint demand letter from a 29-state multistate attorney general coalition led by the Connecticut and New York Attorneys General. The demand letter requested detailed information regarding the incident, the Company's response measures, vendor oversight practices, consumer protections offered, and remediation steps undertaken. Calderwood & Harkness submitted a comprehensive written response with four supporting exhibits on October 13, 2023. No response has yet been received from the coalition, and no enforcement action has been threatened.
Connecticut Insurance Department. The Connecticut Insurance Department has opened an inquiry into Quorum's compliance with the Connecticut Insurance Data Security Law. Calderwood & Harkness submitted a formal response on September 22, 2023, and anticipates filing a supplemental submission on or about October 20, 2023. The inquiry remains open, and no adverse findings have been indicated.
HHS Office for Civil Rights. HHS-OCR has acknowledged receipt of the Company's HIPAA breach notification and issued a follow-up inquiry. Calderwood & Harkness submitted a formal response on October 5, 2023. The inquiry remains open, and no adverse findings or enforcement actions have been indicated.
Vendor Indemnification. Negotiations with Palomar Data Solutions regarding contractual indemnification are progressing and are expected to reach resolution in the near term. Calderwood & Harkness circulated a draft settlement term sheet on September 18, 2023, and is engaged in active discussions with Palomar's outside counsel. Resolution before year-end remains the target.
Financial Summary. No enforcement action has been threatened or commenced by any regulator to date. Total incident response costs are currently estimated at approximately $8,230,250. Insurance coverage under Quorum's cyber insurance policy with Atlas Mutual Insurance Company is responding above the $2,500,000 self-insured retention, and total costs remain well within the $15,000,000 per-occurrence policy limit.
The sections below provide detailed analysis of each of these workstreams.
II. Status of Consumer Notifications
A. Notification Mailing Completion
All consumer notification letters have been printed and mailed to the full population of affected individuals. Mailings were executed on a rolling basis commencing August 18, 2023, and concluding September 15, 2023 — a mailing window of approximately 28 calendar days. The total number of individuals notified is 318,247, spanning 29 states and the District of Columbia. This figure is consistent with the scope identified in the Graystone Forensics LLC forensic investigation report, as presented to the Audit Committee during the July 21, 2023 briefing.
Three primary versions of the notification letter were prepared and deployed, each tailored to the category of personal information compromised for the relevant subset of affected individuals:
1.  General PII Version. This version was sent to the broadest population of affected individuals whose compromised information included names, dates of birth, Social Security numbers, and driver's license numbers. This version constituted the majority of all notification mailings.
2.  Enhanced Financial Information Version. This version was sent to the 84,619 individuals whose compromised information also included financial account data, specifically bank account numbers and/or payment card numbers. This version included enhanced disclosures regarding the potential for financial fraud and recommended additional protective steps, including monitoring of bank and credit card statements.
3.  HIPAA-Compliant PHI Version. This version was sent to the 41,203 individuals whose compromised information included protected health information, including health conditions, diagnosis codes, and treatment information derived from workers' compensation claims and health-related insurance claims. This version was drafted to comply with the content requirements of 45 C.F.R. § 164.404(c) and included a description of the types of PHI compromised, steps individuals should take to protect themselves, a brief description of the investigation and mitigation measures, and contact information for further questions.
In addition to the three primary versions, state-specific notification letters were prepared for two jurisdictions with heightened content and formatting requirements:
•  California. A California-specific version was prepared for 38,206 California residents, incorporating the requirements of Cal. Civ. Code § 1798.82, including prescribed heading and formatting specifications, as well as the California Confidentiality of Medical Information Act ("CMIA") requirements applicable to the PHI subset of California residents.
•  Massachusetts. A Massachusetts-specific version was prepared for 10,217 Massachusetts residents, incorporating the requirements of Mass. Gen. Laws ch. 93H, § 3 and the implementing regulations at 201 CMR 17.00, including the prescribed form and content requirements under Massachusetts law.
In total, five distinct notification letter versions were finalized and deployed. All versions were reviewed and approved by Calderwood & Harkness, Quorum's General Counsel's office, and the Chief Privacy Officer prior to mailing.
Separately, a substitute notice posting was published on Quorum's corporate website (www.quoruminsurance.com/security-incident) on August 15, 2023, in advance of the first mailing, consistent with the substitute notice provisions of applicable state breach notification statutes. The substitute notice remains active and accessible on the Company's website.
B. Clearfield Notification Services — Operational Status
Clearfield Notification Services LLC ("Clearfield") is managing all notification logistics, call center operations, and credit monitoring enrollment under its engagement by Quorum, with oversight from Calderwood & Harkness. The Clearfield engagement is led by Account Manager Jerome Tillman, who has been responsive and effective throughout the engagement.
Call Center Operations. The Clearfield-operated toll-free call center commenced operations on August 18, 2023, coinciding with the first wave of notification mailings. The call center is staffed with trained representatives capable of responding to inquiries regarding the incident, the types of information compromised, the credit monitoring and identity theft protection services being offered, and general data security questions. Call center operations are operating within the planned 12-week window and are expected to conclude on or about November 10, 2023, unless extended based on call volume.
Credit Monitoring Enrollment. Quorum is offering all 318,247 affected individuals 24 months of complimentary credit monitoring and identity theft protection services. As of the date of this memorandum, the estimated take-rate is approximately 40%, corresponding to approximately 127,299 enrollees. This take-rate is tracking in line with industry projections and with the assumptions used in the cost modeling presented to the Audit Committee at the July 21 briefing.
Clearfield Contract Value. The total contract value for Clearfield's services is $3,214,500, broken down as follows:
The $2,100,000 credit monitoring fee was negotiated as a flat fee rather than a per-enrollee fee, which provides cost certainty and is favorable to Quorum given the current enrollment trajectory.
C. States with Largest Affected Populations
The following table sets forth the ten states with the largest populations of affected individuals, along with the combined total for the remaining 19 states and the District of Columbia:
The geographic distribution of the affected population is consistent with Quorum's policyholder base and the nature of Palomar's claims processing activities on behalf of the Company. Connecticut and New York account for the largest shares of affected individuals, which is consistent with Quorum's headquarters location in Hartford, Connecticut and significant operations in New York.
III. Status of Regulatory Notifications
A. Summary of Filings
All regulatory notifications required under applicable state breach notification statutes and federal law have been filed and confirmed received by the applicable regulatory authorities. Filings were submitted on a rolling basis between August 14 and August 25, 2023. Calderwood & Harkness carefully tracked each jurisdiction's applicable notification deadline and can confirm that all filings were timely under the applicable statutes. No jurisdiction has indicated that a filing was late, incomplete, or deficient in any respect.
Where a state required that a copy of the consumer notification letter be submitted with the regulatory filing, such copies were included. Where a state required submission through a dedicated online portal (as opposed to mail or email), those requirements were followed. Calderwood & Harkness prepared and reviewed each jurisdiction-specific filing to ensure compliance with the relevant state's procedural and substantive requirements.
B. Filing Detail
The following table summarizes the regulatory filings made in connection with the incident. For clarity, the filings in the largest jurisdictions and the federal filings are listed individually, while the remaining state filings are aggregated.
In addition to the regulatory filings listed above, a media notice required under 45 C.F.R. § 164.406 — applicable to breaches of unsecured protected health information affecting more than 500 individuals — was distributed to prominent media outlets on August 15, 2023. This media notice was distributed contemporaneously with the HHS-OCR filing and in advance of the consumer notification mailings.
A full confirmation log documenting each filing, including the date of submission, method of submission, confirmation number or receipt (where applicable), and the name of the individual who submitted the filing, is maintained by Sara Hendricks, Working Associate at Calderwood & Harkness. This log is available for review by the Audit Committee upon request.
IV. Multistate Attorney General Inquiry
A. Receipt of Joint Demand Letter
On September 8, 2023, Quorum received a joint demand letter from a multistate attorney general coalition comprising 29 states (the "Multistate Coalition" or the "Coalition"). The letter was issued on the joint letterhead of the lead states and was signed by the following lead representatives:
•  Connecticut Attorney General's Office — Consumer Protection Division, Assistant Attorney General Diane Marchetti (lead contact); and
•  New York Attorney General's Office — Bureau of Internet and Technology, Assistant Attorney General Mark Petrosian (co-lead contact).
The 27 additional participating states in the Coalition are: Massachusetts, California, Illinois, Pennsylvania, New Jersey, Ohio, Texas, Florida, Georgia, Virginia, Maryland, North Carolina, South Carolina, Michigan, Minnesota, Indiana, Wisconsin, Colorado, Arizona, Oregon, Washington, Tennessee, Missouri, Louisiana, Nevada, Iowa, and New Hampshire. The breadth of the Coalition reflects the geographic distribution of Quorum's affected policyholder base.
The demand letter requested detailed information in the following areas:
•  A comprehensive description of the data security incident, including the timeline of events, the nature and scope of the unauthorized access, and the types of personal information compromised;
•  A detailed account of Quorum's incident response measures, including forensic investigation, containment, and remediation steps;
•  Information regarding Quorum's vendor oversight practices, including the contractual data security requirements imposed on Palomar and the due diligence conducted prior to and during the engagement;
•  A description of the consumer protections offered to affected individuals, including credit monitoring and identity theft protection services; and
•  A summary of the remediation measures implemented or planned to prevent future incidents.
The demand letter did not threaten enforcement action and did not include a subpoena or civil investigative demand. It was characterized as an informational request, though its substance and breadth indicated the seriousness with which the Coalition is treating the matter.
B. Calderwood & Harkness Response — October 13, 2023
Calderwood & Harkness submitted a comprehensive written response to the Multistate Coalition on October 13, 2023. The response was addressed jointly to AAG Diane Marchetti (Connecticut) and AAG Mark Petrosian (New York), with copies transmitted to the other 27 participating state offices. The response was prepared over a period of approximately five weeks, with significant input from Quorum's General Counsel, Chief Privacy Officer, information security team, and vendor risk management function.
The response was accompanied by four exhibits, each of which was carefully prepared to provide the Coalition with a clear, organized, and transparent presentation of the relevant facts and the Company's response measures:
Exhibit A: Incident Timeline and Remedial Measures Summary. This exhibit provided a detailed chronological account of the incident from the date of initial unauthorized access (March 14, 2023, as determined by Graystone Forensics LLC) through the completion of consumer notifications on September 15, 2023. The timeline included all key milestones, including Palomar's detection of anomalous activity (April 18, 2023), Palomar's notification to Quorum (April 21, 2023), Quorum's engagement of Calderwood & Harkness (May 4, 2023), the retention of Graystone Forensics under privilege (May 5, 2023), the filing of the insurance claim with Atlas Mutual (May 8, 2023), the completion of the forensic investigation, the determination of the scope of compromised data, and the execution of the notification plan. The exhibit also set forth all remedial measures taken by Quorum, including enhanced vendor monitoring, supplemental security controls, and the contractual measures being required of Palomar.
Exhibit B: Consumer Notification Samples and Compliance Checklist. This exhibit included copies of all five consumer notification letter versions (general PII, enhanced financial data, PHI/HIPAA, California-specific, and Massachusetts-specific), demonstrating the content and formatting of the notifications sent to affected individuals. The exhibit also included a compliance checklist cross-referencing each of the 29 states' and the District of Columbia's notification requirements and demonstrating that each requirement was satisfied, including content elements, timing, and method of delivery.
Exhibit C: Palomar Vendor Accountability Summary. This exhibit described Quorum's contractual indemnification demand against Palomar, Palomar's specific breaches of the Master Services Agreement ("MSA"), and the ongoing negotiations for accountability. The exhibit addressed Palomar's failure to patch CVE-2023-0669 (the GoAnywhere MFT remote code execution vulnerability) within the contractual 30-day critical vulnerability patching window required by Exhibit D to the MSA (Data Security Exhibit, as amended by Amendment 2, effective September 15, 2022). It also addressed Palomar's late breach notification — specifically, that Palomar discovered anomalous activity on April 18, 2023 but did not notify Quorum until April 21, 2023, approximately 24 hours past the 48-hour notification requirement in Section 9.4 of the MSA. The exhibit was designed to demonstrate to the Coalition that Quorum is actively holding its vendor accountable for the failures that gave rise to the incident.
Exhibit D: Quorum Information Security Program Overview. This exhibit provided a comprehensive description of Quorum's enterprise information security program, governance structure, and technical safeguards. The exhibit covered Quorum's information security governance framework, including the roles of the Chief Information Security Officer, the Chief Privacy Officer, and the VP of Vendor Risk Management (Priya Deshmukh). It described the Company's technical controls, including network segmentation, multi-factor authentication, encryption protocols, intrusion detection systems, and endpoint protection. It addressed Quorum's vendor risk management program, including the due diligence process for onboarding third-party service providers, ongoing monitoring, contractual security requirements, and audit rights. The exhibit also described Quorum's incident response plan, employee security awareness training program, and the post-incident enhancements being implemented in response to the Palomar breach.
C. Key Themes of the Response
Calderwood & Harkness structured the response around several key themes, each of which is designed to position Quorum favorably with the Coalition and to demonstrate the Company's responsible handling of the incident:
Vendor-Originated Breach. The response made clear that the compromise occurred entirely within Palomar Data Solutions' network environment and was caused by Palomar's failure to timely patch a known critical vulnerability — CVE-2023-0669, a remote code execution vulnerability in the GoAnywhere MFT file transfer platform. Quorum's own systems were not compromised, and the forensic investigation by Graystone Forensics confirmed that the unauthorized access was limited to data residing on Palomar's systems. This framing is critical to distinguishing Quorum's culpability from that of its vendor.
Prompt and Comprehensive Response. The response demonstrated that Quorum acted promptly and responsibly upon learning of the incident. Upon receiving notification from Palomar on April 21, 2023, Quorum immediately initiated its incident response plan. Calderwood & Harkness was engaged on May 4, 2023. Graystone Forensics LLC was retained under privilege on May 5, 2023, to conduct the forensic investigation. The insurance claim was filed with Atlas Mutual Insurance Company on May 8, 2023. All subsequent response activities — forensic investigation, scope determination, notification drafting, and notification execution — were completed in an organized and timely manner.
Timely Notifications. The response emphasized that all consumer and regulatory notifications were timely under the applicable laws of each jurisdiction. No late filings occurred, and no jurisdiction has questioned the timeliness of any notification.
Robust Consumer Protections. The response highlighted that Quorum offered 24 months of complimentary credit monitoring and identity theft protection services to all 318,247 affected individuals — a level of consumer protection that exceeds the minimums required by most state statutes and reflects the Company's commitment to mitigating potential harm.
Vendor Accountability. The response demonstrated that Quorum is holding Palomar accountable through contractual indemnification and enhanced security requirements, underscoring that the Company is not simply absorbing the consequences of its vendor's failures.
Cooperative Engagement. The overall tone of the response was cooperative and transparent, consistent with Calderwood & Harkness's engagement strategy of fostering constructive relationships with the regulatory authorities involved.
D. Current Status and Next Steps
As of the date of this memorandum, no response has been received from the Multistate Coalition to Calderwood & Harkness's October 13 submission. Calderwood & Harkness anticipates that the Coalition may take several weeks to review the submission and may thereafter request supplemental information or documentation. Such follow-up requests are common in multistate AG investigations of this nature and do not, standing alone, indicate any adverse inclination by the Coalition.
Calderwood & Harkness's engagement strategy will continue to be cooperative and transparent, with the overarching goal of achieving closure of the inquiry without enforcement action, fines, or penalties. To date, no enforcement action has been threatened by any state within the Coalition. Calderwood & Harkness will promptly advise the Audit Committee of any response received from the Coalition or any change in the posture of the inquiry.
V. Connecticut Insurance Department Inquiry
A. Background.  The Connecticut Insurance Department (the "Department") opened an inquiry into the incident following receipt of Quorum's notification filing on August 14, 2023 under the Connecticut Insurance Data Security Law, Conn. Gen. Stat. § 38a-999b. The inquiry is being handled by Richard Nakamura, Examiner, Financial Analysis Division, Cybersecurity Unit. This inquiry is distinct from, and runs parallel to, the broader multistate attorney general inquiry addressed in Section IV above.
The Department's inquiry focuses on three principal areas: (i) Quorum's compliance with the Connecticut Insurance Data Security Law, including the Company's obligations with respect to its information security program, vendor oversight, and breach notification; (ii) the adequacy of Quorum's vendor oversight practices as they relate to Palomar Data Solutions, including pre-engagement due diligence, contractual data security requirements, and ongoing monitoring; and (iii) the adequacy of the remediation measures implemented or planned in response to the incident.
B. Response Filed
Calderwood & Harkness submitted a formal written response to the Department's inquiry on September 22, 2023. The response provided the Department with a detailed account of the incident, the types of personal information compromised, the forensic investigation findings, the notification process, and the remediation measures undertaken. The response also addressed Quorum's compliance with the requirements of Conn. Gen. Stat. § 38a-999b, including the maintenance of a comprehensive written information security program, the conduct of risk assessments, the implementation of appropriate safeguards, and the oversight of third-party service providers.
Calderwood & Harkness anticipates filing a supplemental submission on or about October 20, 2023 (the "Supplemental Submission"), providing additional information responsive to specific follow-up questions from Mr. Nakamura. The Supplemental Submission is expected to address the following topics in greater detail:
•  Quorum's vendor risk management program, including the due diligence process applied to Palomar at the time of initial engagement and at each MSA renewal and amendment;
•  The data security provisions of the Palomar MSA, including the requirements set forth in Exhibit D (Data Security Exhibit), as amended by Amendment 2 (effective September 15, 2022), which added, among other things, a requirement for Palomar to obtain and maintain a SOC 2 Type II audit report and provide such report to Quorum annually;
•  Palomar's most recent SOC 2 Type II audit report, prepared by Kessler, Park & Associates CPA, PLLC (Engagement Partner: Vivian Park, Dallas, Texas), which was provided to Quorum in the ordinary course prior to the incident; and
•  Post-incident remediation measures, including the enhanced contractual provisions being negotiated as part of MSA Amendment 3 (described in Section VII.D below).
The Supplemental Submission may also reference Quorum's external auditor, Halstead & Monroe LLP (Engagement Partner: Gregory Chin, Philadelphia, Pennsylvania), to the extent relevant to the Department's assessment of Quorum's information security governance and internal controls.
C. Current Status
The Department's inquiry remains open. Calderwood & Harkness is engaged in constructive dialogue with Mr. Nakamura, and the tone of the Department's communications has been professional and cooperative. No adverse findings, deficiency determinations, or enforcement actions have been indicated. Calderwood & Harkness expects that the inquiry will close upon the Department's satisfactory receipt and review of all requested information, including the Supplemental Submission anticipated for October 20, 2023. Calderwood & Harkness will promptly advise the Audit Committee of any material developments in this inquiry.
VI. HHS Office for Civil Rights (HHS-OCR) Inquiry
A. Background.  The Company's HIPAA breach notification was filed with HHS-OCR Region I (Boston regional office) on August 15, 2023, consistent with the reporting requirements of 45 C.F.R. § 164.408, which requires covered entities to notify HHS of breaches of unsecured protected health information affecting 500 or more individuals without unreasonable delay and in no case later than 60 days following discovery of the breach. The notification reported the breach of unsecured protected health information affecting 41,203 individuals. The categories of PHI compromised included health conditions, diagnosis codes, and treatment information associated with workers' compensation claims and health-related insurance claims administered by Quorum through its relationship with Palomar.
Following receipt of the notification, HHS-OCR acknowledged the filing and subsequently issued a follow-up inquiry requesting additional information regarding the incident, the scope of PHI compromised, and Quorum's HIPAA compliance measures.
B. Response Filed
Calderwood & Harkness submitted a formal written response to HHS-OCR's inquiry on October 5, 2023. The response provided detailed information regarding the following:
•  The 41,203 individuals whose PHI was compromised, including the types of PHI involved and the circumstances of the breach;
•  Quorum's HIPAA compliance measures, including its designation of a HIPAA Privacy Officer and Security Officer, workforce training, policies and procedures for safeguarding PHI, and risk analysis protocols;
•  The business associate agreement ("BAA") between Quorum and Palomar, including the data security obligations imposed on Palomar as a business associate under the BAA, and Palomar's failure to comply with those obligations;
•  The consumer notification process, demonstrating that HIPAA-compliant notification letters were mailed to all 41,203 affected individuals within 60 days of the determination of the breach scope, consistent with the individual notification requirements of 45 C.F.R. § 164.404; and
•  Post-incident remediation steps, including enhanced monitoring of Palomar, additional contractual security requirements being negotiated, and internal enhancements to Quorum's HIPAA compliance program.
The response was designed to demonstrate full compliance with the HIPAA Breach Notification Rule and to provide HHS-OCR with confidence that Quorum has taken appropriate steps to mitigate the breach and prevent recurrence.
C. Current Status
The HHS-OCR inquiry remains open, which is typical during the review period following submission of a comprehensive response. No adverse findings, corrective action plans, or enforcement actions have been indicated. HHS-OCR has not requested any additional information at this time. Calderwood & Harkness anticipates that OCR will complete its review of the submitted information and, based on the strength of the response and the facts of the incident, expects that the inquiry will result in closure with no further action. Calderwood & Harkness will promptly notify the Audit Committee of any developments in this inquiry.
VII. Palomar Data Solutions — Vendor Indemnification Negotiations
A. Contractual Basis
Quorum's indemnification claim against Palomar is grounded in Section 12.2 of the Master Services Agreement dated November 12, 2019, between Quorum and Palomar (the "MSA"), as amended by Amendment 1 (effective March 8, 2021) and Amendment 2 (effective September 15, 2022). Section 12.2 provides that Palomar shall indemnify, defend, and hold harmless Quorum and its affiliates, officers, directors, and employees from and against all losses, damages, liabilities, costs, and expenses (including reasonable attorneys' fees) arising from or related to Palomar's breach of its data security obligations under the MSA and the Data Security Exhibit (Exhibit D).
The liability cap under the MSA is two times (2×) the trailing twelve-month fees paid by Quorum to Palomar, which equals $32,600,000 (2 × $16,300,000 in annual contract value). The current total of incident response costs ($8,230,250) is well within this cap.
Calderwood & Harkness has identified two clear breaches of the MSA by Palomar that form the basis of Quorum's indemnification claim:
1.  Failure to Patch CVE-2023-0669. Palomar failed to apply the available patch for CVE-2023-0669, a critical remote code execution vulnerability in the GoAnywhere MFT file transfer platform, within the 30-day critical vulnerability patching window required by Section 3.2(a) of Exhibit D (Data Security Exhibit), as amended by Amendment 2 (effective September 15, 2022). The Graystone Forensics investigation confirmed that this unpatched vulnerability was the attack vector used to gain unauthorized access to Palomar's systems beginning on March 14, 2023. The patch for CVE-2023-0669 was publicly available as of February 7, 2023, meaning Palomar had more than 35 days prior to the initial compromise — well in excess of the contractual patching window — yet failed to apply the patch.
2.  Late Breach Notification. Palomar discovered anomalous activity on its network on April 18, 2023, but did not notify Quorum until April 21, 2023. This delay of approximately 72 hours exceeded the 48-hour notification requirement set forth in Section 9.4 of the MSA by approximately 24 hours. This late notification delayed Quorum's ability to initiate its own incident response, engage counsel, and begin the forensic investigation.
Both of these breaches are well-documented by the Graystone Forensics investigation report and contemporaneous communications between Quorum and Palomar.
B. Demand and Counterparty Position
Calderwood & Harkness sent a formal breach of contract and indemnification demand letter to Palomar's outside counsel, Mercer, Haight & Dunlop LLP ("Mercer Haight"), on June 20, 2023. The letter was directed to Catherine Langford, Partner, and Brian Soto, Associate. The demand letter set forth the two MSA breaches, cited the relevant contractual provisions, summarized the Graystone Forensics findings, and demanded full indemnification of $8,230,250, representing Quorum's total incident response costs.
Palomar's initial response was received on July 7, 2023, via letter from Catherine Langford. In that response, Palomar disputed both causation and the scope of its liability. Palomar contended that the exploitation of CVE-2023-0669 constituted a "sophisticated and unprecedented attack" that should not be attributed to a failure to patch within the contractual window, and that certain categories of Quorum's claimed costs — particularly internal costs and a portion of the legal fees — were not recoverable under the MSA's indemnification provision. In lieu of full indemnification, Palomar offered a $1,500,000 "goodwill credit" against future service fees.
Calderwood & Harkness sent a detailed rebuttal letter on July 25, 2023, rejecting the $1,500,000 offer as wholly inadequate. The rebuttal letter addressed each of Palomar's arguments, demonstrating that: (i) CVE-2023-0669 was a widely publicized vulnerability with a readily available patch, and the threat actor's exploitation of it was foreseeable, not "unprecedented"; (ii) the Graystone Forensics report conclusively established that the unpatched vulnerability was the attack vector; (iii) all categories of costs claimed by Quorum — including forensic investigation, notification, credit monitoring, legal fees, crisis communications, and internal costs — are recoverable losses under Section 12.2 of the MSA; and (iv) the $1,500,000 credit proposal failed to account for the magnitude of the breach and its consequences.
C. Negotiation Status
Active negotiations are ongoing between Calderwood & Harkness and Mercer, Haight & Dunlop. Following the exchange of the initial demand, Palomar's response, and Calderwood & Harkness's rebuttal, the parties engaged in telephonic discussions during August and September 2023 to narrow the issues in dispute and explore the parameters of a potential resolution.
Calderwood & Harkness circulated a draft settlement term sheet to Mercer Haight on September 18, 2023. The key elements under negotiation include:
•  Cash Indemnification Payment Amount. The amount of a lump-sum cash payment from Palomar to Quorum in satisfaction of the indemnification claim. Calderwood & Harkness's position is that the full $8,230,250 in incident response costs should be recovered; Palomar's last communicated position reflects a lower figure that Calderwood & Harkness considers insufficient.
•  Fee Reduction or Credit. As a potential component of the settlement, the parties are discussing a reduction in or credit against Palomar's service fees for the remaining term of the MSA. This element would supplement, not replace, the cash indemnification payment.
•  Enhanced Security Requirements and Audit Provisions. The settlement is expected to include Palomar's agreement to enhanced data security requirements, as described in Section VII.D below (MSA Amendment 3).
•  Mutual Release Scope. The scope of any mutual release of claims is under negotiation, including whether the release would extend to potential future claims arising from the same incident (e.g., litigation exposure) and whether it would be conditioned upon Palomar's compliance with the enhanced security requirements.
Calderwood & Harkness provided Thomas R. Whitfield, Quorum's General Counsel, with a detailed negotiation strategy memorandum on August 28, 2023, analyzing Quorum's leverage points, the strengths and weaknesses of each party's position, and recommending a target settlement range. The contents of that memorandum are protected by attorney-client privilege and attorney work product protection and are not further described herein, but are available to the Audit Committee upon request through Mr. Whitfield.
An important consideration in the negotiation is the preservation of the vendor relationship. The MSA has a remaining term through November 11, 2024, and Palomar serves as Quorum's second-largest client claims processing vendor, with an annual contract value of $16,300,000. While Quorum's contractual position is strong and the Company is prepared to pursue formal dispute resolution if necessary, a negotiated resolution that preserves the vendor relationship (with substantially enhanced security protections) is the preferred outcome, subject to achieving an appropriate level of financial recovery.
A revised term sheet reflecting Palomar's counterproposals is expected from Mercer Haight in the coming weeks. Calderwood & Harkness is optimistic that a resolution can be reached before year-end 2023. Calderwood & Harkness will keep the Audit Committee informed of significant developments in the negotiation.
D. MSA Amendment 3 — Enhanced Security Provisions
As part of the anticipated settlement, Calderwood & Harkness is drafting a proposed MSA Amendment 3, which would substantially enhance the data security, monitoring, and audit provisions of the MSA. The key provisions under drafting include:
•  Reduced Critical Vulnerability Patching Window. The patching window for critical vulnerabilities (as defined by CVSS score of 9.0 or above) would be reduced from 30 calendar days to 14 calendar days.
•  Mandatory Endpoint Detection and Response (EDR). Palomar would be required to deploy and maintain an endpoint detection and response solution across all systems that process, store, or transmit Quorum data.
•  Quarterly Vulnerability Scanning. Palomar would be required to conduct quarterly vulnerability scans of all systems that process, store, or transmit Quorum data and provide the results of such scans to Quorum within 10 business days of completion.
•  Annual Independent Security Assessment. Palomar would be required to undergo an annual independent security assessment conducted by a qualified third-party assessor, at Palomar's expense, with the assessment report provided to Quorum within 30 days of completion.
•  Reduced Incident Notification Window. The incident notification window would be reduced from 48 hours to 24 hours following Palomar's discovery of any actual or suspected security incident affecting Quorum data.
These enhanced provisions are designed to address the specific failures that gave rise to the current incident and to provide Quorum with significantly greater visibility into and control over Palomar's security posture for the remainder of the MSA term.
VIII. Insurance Coverage Update
A. Primary Policy — Atlas Mutual Insurance Company
Quorum maintains a cyber liability insurance policy with Atlas Mutual Insurance Company under Policy No. CYB-2023-041587. The claim arising from the Palomar data security incident has been assigned Claim No. CYB-CLM-2023-05892. The key terms of the policy are as follows:
•  Per-Occurrence Limit: $15,000,000
•  Self-Insured Retention (SIR): $2,500,000
•  Coverage Period: January 1, 2023 – January 1, 2024
•  Claims Adjuster: Paul Enriquez, Atlas Mutual Insurance Company
Atlas Mutual has acknowledged the claim and has accepted coverage for the following categories of incident response costs in excess of the $2,500,000 SIR: forensic investigation costs, notification costs, credit monitoring and identity theft protection costs, crisis communications and public relations costs, and regulatory defense costs (including legal fees incurred in connection with regulatory inquiries and proceedings). Atlas Mutual's acceptance of coverage has been communicated in writing and is not subject to any reservation of rights that would limit coverage for the categories of costs currently being incurred.
Quorum's cyber insurance broker, Whitmore Risk Advisors Inc. (Sandra Whitmore-Kim, lead broker), is coordinating with Atlas Mutual on all claims-related matters, including the submission of invoices, documentation of covered costs, and periodic claims status discussions.
B. Cost Summary and Coverage Application
Total incident response costs incurred to date are estimated at approximately $8,230,250, broken down as follows:
The application of insurance coverage to these costs is as follows:
•  Amount within SIR (Quorum's responsibility): $2,500,000
•  Amount covered by Atlas Mutual primary policy (above SIR): $5,730,250
•  Remaining available primary policy limit: $9,269,750
Total costs remain well within the $15,000,000 per-occurrence limit of the Atlas Mutual primary policy. Quorum also maintains an excess cyber liability policy with Pinnacle Surplus Lines Insurance Corp. (Policy No. XS-CYB-2023-7812), providing $25,000,000 in excess coverage above the Atlas Mutual primary policy. Based on current cost projections, the Pinnacle excess policy is unlikely to be implicated.
C. Palomar Recovery Impact
Any financial recovery obtained from Palomar through the indemnification settlement negotiations will offset Quorum's overall net exposure related to the incident. Depending on the structure and amount of any settlement, such recovery may reduce Quorum's out-of-pocket costs to below the $2,500,000 SIR, or may give rise to subrogation-related considerations under the Atlas Mutual policy.
Calderwood & Harkness will coordinate with Atlas Mutual regarding the carrier's subrogation rights as part of any settlement with Palomar. Under the terms of the Atlas Mutual policy, Quorum is required to preserve Atlas Mutual's subrogation rights and to cooperate with the carrier in connection with any recovery from third parties. The structure of any Palomar settlement will be designed to comply with these obligations while maximizing Quorum's net financial recovery.
IX. Crisis Communications Update
BrightPath Consulting Group Inc. ("BrightPath") continues to manage the external and internal communications strategy related to the incident under the direction of Managing Director Meredith Ashford. BrightPath was retained on May 9, 2023, and has been instrumental in managing the Company's public messaging and internal employee communications throughout the incident response.
External Communications. Press statements were issued contemporaneously with the commencement of consumer notification mailings in August 2023. The press statements were coordinated with Calderwood & Harkness and Quorum's General Counsel's office to ensure accuracy and consistency with the Company's regulatory filings and consumer notifications. Media coverage of the incident has been moderate and has been largely factual in nature, with no significant negative editorializing or viral social media activity. No significant reputational impact has been observed to date, and BrightPath continues to monitor media coverage and social media sentiment.
Internal Communications. Employee-facing communications were distributed to Quorum's approximately 11,400 employees to inform them of the incident, the Company's response, and the steps being taken to protect affected individuals. These communications were designed to maintain employee confidence, provide clear guidance to employees who may receive inquiries from customers or other stakeholders, and reinforce the Company's commitment to data security.
Investor-Facing Disclosures. BrightPath and Calderwood & Harkness coordinated with Quorum's legal team on investor-facing disclosures, including the preparation of talking points for use in investor communications. These disclosures were prepared in coordination with the SEC disclosure analysis discussed in Section X below.
Fees. Total BrightPath fees to date are $385,000, which is within the budgeted amount for crisis communications services.
X. SEC Disclosure Considerations
Calderwood & Harkness previously provided Quorum's General Counsel, Thomas R. Whitfield, with a written analysis dated July 19, 2023, addressing the Company's SEC disclosure obligations in connection with the data security incident. That analysis addressed the requirements of Item 1.05 of Form 8-K, which was adopted by the SEC in July 2023 and requires registrants to disclose material cybersecurity incidents within four business days of determining that the incident is material. The analysis also addressed the Company's obligations to update risk factor disclosures in its periodic reports on Form 10-Q and Form 10-K.
The materiality analysis considered the following factors:
•  The incident's total financial impact ($8,230,250 in incurred costs) relative to Quorum's $4.82 billion fiscal year 2022 annual revenue and approximately $6.1 billion market capitalization (as of May 2023);
•  The availability of insurance coverage under the Atlas Mutual primary policy, which is covering a substantial portion of the costs above the SIR;
•  The potential for financial recovery through the Palomar vendor indemnification negotiations, which could further reduce Quorum's net financial exposure;
•  The absence of any threatened or commenced enforcement action by any regulator;
•  The absence of any known litigation filed by affected individuals as of the date of this memorandum; and
•  The moderate and largely factual nature of media coverage, with no significant reputational impact observed.
Based on these factors, Calderwood & Harkness's preliminary assessment, as communicated in the July 19, 2023 analysis, was that the incident did not, at that time, meet the materiality threshold for a Form 8-K filing under Item 1.05. However, Calderwood & Harkness cautioned that materiality is a dynamic assessment that must be revisited as circumstances evolve, particularly if enforcement actions are threatened or commenced, if class action litigation is filed, or if the total financial impact increases significantly.
Calderwood & Harkness continues to monitor developments and will update its disclosure analysis as the regulatory engagements and indemnification negotiations progress. Calderwood & Harkness recommends that Quorum (Nasdaq: QIHC) coordinate with its external auditor, Halstead & Monroe LLP (Engagement Partner: Gregory Chin, Philadelphia, Pennsylvania), regarding any required financial statement disclosures, loss contingency accruals, or contingency footnotes in connection with the Company's upcoming Form 10-Q filing. Depending on the outcome of the multistate AG inquiry and the Palomar indemnification negotiations, additional disclosure considerations may arise.
XI. Upcoming Milestones and Action Items
The following is a summary of the key upcoming milestones and action items for each workstream:
1.  Multistate Attorney General Inquiry. Await response from the 29-state Coalition to Calderwood & Harkness's October 13, 2023 submission. Prepare supplemental information if requested by the Coalition. Continue cooperative engagement with the goal of achieving closure without enforcement action. No response deadline is currently pending.
2.  Connecticut Insurance Department Inquiry. File Supplemental Submission (anticipated on or about October 20, 2023) providing additional information regarding Quorum's vendor oversight program, the Palomar MSA security provisions, and post-incident remediation measures. Target closure of the inquiry upon the Department's satisfactory review of all submitted materials.
3.  HHS Office for Civil Rights Inquiry. Await HHS-OCR's completion of its review of the October 5, 2023 submission and any additional requests for information. Target a determination of no further action based on the strength of Quorum's HIPAA compliance and notification efforts.
4.  Palomar Indemnification Negotiations. Finalize the revised settlement term sheet upon receipt of Palomar's counterproposals. Negotiate to resolution. Execute a settlement agreement and MSA Amendment 3 incorporating enhanced security provisions. Target resolution before year-end 2023.
5.  Insurance Coverage. Prepare and submit a proof of loss and final cost summary to Atlas Mutual Insurance Company once total incident response costs are finalized. Coordinate with Atlas Mutual regarding subrogation rights in connection with any Palomar settlement.
6.  Credit Monitoring and Call Center. Continue monitoring credit monitoring enrollment rates and call center operations through the planned 12-week window (expected conclusion on or about November 10, 2023). Evaluate whether any extension is warranted based on call volume and enrollment activity.
7.  Board Reporting. The next Audit Committee briefing is anticipated following resolution of the multistate AG inquiry and the Palomar settlement, expected in late November 2023. Calderwood & Harkness will provide interim updates to Mr. Whitfield as material developments occur, and Mr. Whitfield will communicate those updates to the Audit Committee as appropriate.
XII. Assessment and Recommendation
Overall Assessment. The overall trajectory of this matter remains favorable. All regulatory engagements to date have been constructive in tone, and no enforcement action, fine, penalty, or corrective action plan has been threatened or commenced by any regulator. The consumer notification process has been completed in its entirety, and the credit monitoring and call center operations are performing within expectations. Media coverage has been moderate and has not resulted in significant reputational impact. No litigation by affected individuals has been filed as of the date of this memorandum.
Regulatory Outlook. Calderwood & Harkness's strategy of cooperative, transparent engagement with all regulatory bodies — combined with comprehensive documentation of Quorum's prompt and thorough response, timely notifications, robust consumer protections, and vendor accountability measures — positions Quorum well for closure of all regulatory inquiries without penalties or enforcement actions. While the multistate AG inquiry and the Connecticut Insurance Department inquiry remain open, the interactions to date have been professional and constructive, and Calderwood & Harkness has not identified any indications of an adverse disposition by any regulatory body.
Vendor Indemnification. The Palomar indemnification negotiation is expected to produce meaningful financial recovery for Quorum, partially offsetting the Company's incident response costs and reducing its net financial exposure. Quorum's contractual position is strong, supported by clearly documented MSA breaches and the findings of the Graystone Forensics investigation. Calderwood & Harkness is cautiously optimistic that a resolution acceptable to Quorum can be reached before year-end 2023.
Recommendation. Calderwood & Harkness recommends continued execution of the current strategy across all workstreams. No changes in strategy or approach are recommended at this time. Calderwood & Harkness will provide the Audit Committee with an updated briefing upon the occurrence of any material development, including receipt of a response from the multistate AG coalition, resolution of the Palomar indemnification negotiations, or any change in the posture of any regulatory inquiry.
Closing
Should any member of the Audit Committee have questions regarding this memorandum or any aspect of the Company's data security incident response, please direct such questions through Thomas R. Whitfield, General Counsel, or through the undersigned, in order to preserve the attorney-client privilege and work product protection applicable to these communications.
Respectfully submitted,
CALDERWOOD & HARKNESS LLP
By: ________
Kevin Ostrowski Partner
Calderwood & Harkness LLP 1700 K Street NW, Suite 900 Washington, D.C. 20006 Telephone: (202) 555-4100
Email: kostrowski@calderwoodharkness.com
CONFIDENTIALITY NOTICE: This memorandum is a privileged and confidential attorney-client communication and contains attorney work product. It is intended solely for the use of the Audit Committee of the Board of Directors of Quorum Insurance Holdings Corp. and should not be disclosed, distributed, or copied to any third party without the prior written consent of Calderwood & Harkness LLP. Inadvertent disclosure does not constitute a waiver of any applicable privilege or protection.
Service Component | Cost
Notification printing and mailing | $636,000
Call center operations (12-week window) | $478,500
Credit monitoring and identity theft protection (24-month, flat fee) | $2,100,000
Total | $3,214,500
Jurisdiction | Affected Individuals
Connecticut | 52,114
New York | 47,831
California | 38,206
Texas | 29,477
Florida | 22,913
Pennsylvania | 18,640
Illinois | 16,502
New Jersey | 14,388
Ohio | 11,743
Massachusetts | 10,217
Remaining 19 states + D.C. (combined) | 56,216
Total | 318,247
Jurisdiction / Regulator | Date Filed | Statutory Basis | Timely?
Connecticut Attorney General | August 14, 2023 | Conn. Gen. Stat. § 36a-701b | Yes
Connecticut Insurance Department | August 14, 2023 | CT Insurance Data Security Law (Conn. Gen. Stat. § 38a-999b) | Yes
HHS Office for Civil Rights (HIPAA) | August 15, 2023 | 45 C.F.R. § 164.408 (>500 individuals) | Yes
New York Attorney General | August 16, 2023 | N.Y. Gen. Bus. Law § 899-aa | Yes
California Attorney General | August 16, 2023 | Cal. Civ. Code § 1798.82 (>500 CA residents) | Yes
Massachusetts Attorney General | August 17, 2023 | Mass. Gen. Laws ch. 93H, § 3 | Yes
Remaining 24 states | August 17–25, 2023 | Various state breach notification statutes | Yes — all timely
Cost Category | Provider | Amount
Forensic investigation | Graystone Forensics LLC | $1,847,000
Notification services (printing, mailing, call center, credit monitoring) | Clearfield Notification Services LLC | $3,214,500
Crisis communications and public relations | BrightPath Consulting Group Inc. | $385,000
Legal fees (regulatory defense, notification, vendor negotiations) | Calderwood & Harkness LLP | $2,163,750
Internal costs (IT remediation, employee overtime, infrastructure) | Quorum Insurance Holdings Corp. | $620,000 (est.)
Total | $8,230,250

PRIVILEGED AND CONFIDENTIAL — ATTORNEY-CLIENT COMMUNICATION — ATTORNEY WORK PRODUCT

MEMORANDUM

CALDERWOOD & HARKNESS LLP

Record

Parties

Dates

Amounts