ATTORNEY-CLIENT PRIVILEGED AND CONFIDENTIAL ATTORNEY WORK PRODUCT This communication is protected by the attorney-client privilege, the work product doctrine, and/or other applicable protections. It is intended solely for the use of the addressee(s). If you have received this communication in error, please notify the sender immediately and delete all copies.
Tom,
Thank you for engaging Calderwood & Harkness to advise Quorum Insurance Company in connection with the security incident involving Palomar Data Solutions. I can confirm that the engagement letter was fully executed earlier today, May 4, 2023 (Calderwood & Harkness Matter No. 1025-00006). Our engagement team consists of myself as responsible partner, Rachel Bernstein (billing partner, New York office), Alan Burke (lead associate), and Sara Hendricks (working associate), all from our Privacy & Data Security practice group.
Based on Palomar's April 21, 2023 notification to you and David Naranjo regarding the security incident discovered on April 18, 2023, time is of the essence in standing up a comprehensive response. I have outlined below the immediate action items and workstreams we recommend initiating without delay.
**1. Forensic Investigation — Graystone Forensics Retention**
We recommend retaining Graystone Forensics LLC to conduct the forensic investigation into the Palomar incident. The engagement would be led by Dr. Nolan Briggs, Managing Director of Incident Response, based in Graystone's Tysons Corner, Virginia office. Dr. Briggs and his team have deep experience in matters of this nature.
Critically, Graystone will be retained under the attorney-client privilege umbrella — engaged by and reporting directly to Calderwood & Harkness, not directly to Quorum. This structure is essential to protect privilege over the investigation's findings, analysis, and work product.
Alan Burke will finalize the retention letter and scope of work with Dr. Briggs tomorrow, May 5, 2023. The investigation priorities will include:
(a) Confirming the threat actor's entry vector. Initial reporting from Palomar references exploitation of a vulnerability in their GoAnywhere MFT file transfer appliance (CVE-2023-0669);
(b) Determining the complete timeline of unauthorized access. Our current understanding is that access occurred from approximately March 14, 2023 through April 18, 2023 — a window of roughly 35 days;
(c) Identifying what data was accessed or exfiltrated; and
(d) Determining the scope of affected individuals and the categories of data types involved.
I will send a separate internal privilege protocol memo to the Calderwood & Harkness team outlining detailed procedures for maintaining privilege over all forensic work product and related communications.
**2. Legal Hold**
We will prepare a draft legal hold notice for your issuance to Quorum's IT department (David Naranjo, CISO) and Claims Operations (Robert Wentworth, SVP, Claims Operations). The hold should cover all documents, communications, and electronic records related to the Palomar security incident, including:
- All communications with Palomar Data Solutions regarding the breach; - All data shared with or processed by Palomar; - All records relating to the Master Services Agreement dated November 12, 2019, as amended.
We are targeting circulation of the draft legal hold notice to you for review by Saturday, May 6, 2023.
**3. Insurance Notification**
We recommend promptly notifying Quorum's cyber-liability insurer, Atlas Mutual Insurance Company, under Quorum's primary cyber-liability policy (Policy No. CYB-2023-041587; $15 million per-occurrence limit; $2.5 million self-insured retention). Rachel Bernstein will prepare and submit the formal notice of claim to Paul Enriquez, Claims Adjuster at Atlas Mutual, with a target filing date of May 8, 2023.
We also recommend providing precautionary notice to Pinnacle Surplus Lines Insurance Corp. under the excess policy (Policy No. XS-CYB-2023-7812; $25 million excess coverage sitting above the Atlas primary layer, bringing the total tower to $40 million). While it is too early to know whether costs will reach the excess layer, timely notice will preserve Quorum's rights under that coverage. The contact there is Lisa Garner.
I would suggest coordinating these filings with Sandra Whitmore-Kim at Whitmore Risk Advisors Inc., Quorum's cyber insurance broker, to ensure notice is handled properly and all coverage is preserved. Please let us know if you would like us to reach out to Sandra directly.
Additionally, Rachel will prepare a preliminary coverage analysis memo identifying covered cost categories — including forensic investigation costs, notification expenses, credit monitoring, crisis communications, regulatory defense costs, and related items — as well as any consent or cooperation requirements under the policies that we need to be mindful of as the response proceeds.
**4. Privilege Protocol and Communications Discipline**
I want to emphasize the critical importance of maintaining attorney-client privilege over all aspects of the incident response, particularly the forensic investigation. We recommend the following protocols:
- All communications regarding the incident should be channeled through Calderwood & Harkness or clearly marked as privileged and prepared at the direction of counsel. - Internal Quorum communications about the incident should include appropriate privilege headers (we will provide template language). - All forensic reports, findings, and analyses will flow from Graystone to Calderwood & Harkness, and we will in turn provide legal analysis and advice to Quorum — preserving the privilege chain at each link.
I will circulate a detailed privilege protocol memo to our team shortly. Tom, I would ask that you reinforce communications discipline internally at Quorum as well, including with IT and business personnel who may be involved in the response. Careless emails or Meridian Solutions messages can undermine privilege, and we want to protect Quorum's position from the outset.
**5. Preliminary Contractual Review — Palomar Master Services Agreement**
Alan Burke will begin a detailed review of the Master Services Agreement dated November 12, 2019 between Quorum and Palomar Data Solutions, including Amendment 1 (dated March 3, 2021) and Amendment 2 (dated September 15, 2022). Our initial review will focus on:
- **Data Security Exhibit (Exhibit D, as amended):** Palomar's security obligations, patching requirements, and SOC 2 Type II audit requirements;
- **Breach Notification Clause (Section 9.4):** The contractual 48-hour notification window. We note that Palomar's April 21 notification came approximately three days after its April 18 discovery, which appears to be roughly 24 hours late against the contractual deadline — a point we will want to preserve;
- **Indemnification Provisions (Section 12.2):** Palomar's indemnification obligations for losses arising from its breach of data security obligations, subject to a liability cap of 2× trailing twelve-month fees;
- **Insurance Requirements (Exhibit E):** Palomar's required minimum cyber-liability coverage; and
- **Termination for Cause (Section 14.2).**
To support this analysis, I would ask that your team provide us with the following at your earliest convenience:
- Complete copies of the MSA and all amendments; - Any SOC 2 Type II reports received from Palomar or its auditor, Kessler, Park & Associates CPA, PLLC; - Any vendor risk assessment documentation maintained by Priya Deshmukh (VP, Vendor Risk Management).
**6. Internal Incident Response Team Coordination**
We recommend establishing a core incident response team at Quorum, consisting of:
- Thomas Whitfield — General Counsel - David Naranjo — CISO - Jennifer Liang — Chief Privacy Officer - Priya Deshmukh — VP, Vendor Risk Management - Robert Wentworth — SVP, Claims Operations
Calderwood & Harkness will serve as the legal quarterback for the overall response effort. I propose we establish a standing call cadence — daily calls during this initial phase, stepping down to twice weekly once the investigation stabilizes and we have better visibility into the facts.
At the appropriate time, the Audit Committee (Franklin Reeves, Chair) and CEO Margaret Calloway will need to be briefed on the incident and the response. I would suggest targeting a Board-level briefing once the initial forensic facts are more developed — tentatively the week of May 8. I am happy to discuss the appropriate timing and format for that briefing with you.
**7. Additional Near-Term Workstreams (Preview)**
I want to flag several additional workstreams that we will need to address in the near term as the investigation progresses:
- **Crisis Communications:** We recommend engaging a crisis communications firm to assist with messaging if and when the incident becomes public. BrightPath Consulting Group Inc. (Meredith Ashford, Managing Director) has significant experience with incidents of this nature. Does Quorum have a preferred crisis communications firm, or would you like our team to make the introduction to BrightPath?
- **Notification Obligations:** Once the forensic investigation provides sufficient clarity on the scope of compromised data, we will conduct a comprehensive state-by-state notification obligation analysis. Given that Quorum operates in all 50 states, we will need to determine which states have affected residents and evaluate the applicable notification triggers, timelines, and content requirements under each state's breach notification statute.
- **Regulatory Engagement:** Depending on the scope and nature of the compromised data, we may need to notify state attorneys general, the Connecticut Insurance Department (given Quorum's Connecticut headquarters and status as a regulated insurer), and potentially the HHS Office for Civil Rights if protected health information is involved.
We will address each of these workstreams in greater detail as the investigation progresses and the factual picture becomes clearer.
* * *
Tom, our team is fully mobilized and available to you around the clock. Please confirm that you are comfortable with the approach outlined above, and let me know if there are any additional internal stakeholders who should be looped into the response at this stage.
I would like to propose an initial call for tomorrow morning, Friday, May 5, with the core Quorum team to walk through each of these steps in detail and begin coordinating execution. Please let me know what time works on your end — we are flexible.
Do not hesitate to reach me directly at any hour.
Best regards,
Kevin
Kevin M. Ostrowski Partner, Privacy & Data Security Calderwood & Harkness LLP 1700 K Street NW, Suite 900 Washington, D.C. 20006 T: (202) 555-4180 M: (202) 555-7293 E: kostrowski@calderwoodharkness.com
CONFIDENTIALITY NOTICE: This email and any attachments are for the exclusive and confidential use of the intended recipient. This communication is protected by the attorney-client privilege, the work product doctrine, and/or other applicable protections. If you are not the intended recipient, please do not read, distribute, or take action based on this message. If you have received this communication in error, please notify the sender immediately by reply email and permanently delete all copies of this message and any attachments.