1025-00006 · Graystone Forensics LLC · Engagement & Privilege

common-interest-agreement-atlas.docx DOCUMENT Data Privacy

30 / 88 ← → ✕

COMMON INTEREST AGREEMENT

Privileged and Confidential — Subject to Attorney-Client Privilege, Work Product Doctrine, and Common Interest Doctrine

May 10, 2023

This Common Interest Agreement (this "Agreement") is entered into as of May 10, 2023 (the "Effective Date"), by and between:

QUORUM INSURANCE HOLDINGS CORP., a corporation organized and existing under the laws of the State of Delaware, with its principal place of business at 400 Constitution Plaza, Suite 2200, Hartford, Connecticut 06103 ("Quorum" or the "Insured"), acting through its General Counsel, Thomas R. Whitfield, and its outside counsel, Calderwood & Harkness LLP, a Delaware limited liability partnership, with offices at 1700 K Street NW, Suite 900, Washington, D.C. 20006 ("Outside Counsel" or "C&H"), represented by Kevin Ostrowski, Responsible Partner, Privacy & Data Security Practice Group;

and

ATLAS MUTUAL INSURANCE COMPANY, a domestic mutual insurance company organized and existing under the laws of the State of Illinois, with its principal place of business at 120 South LaSalle Street, Suite 3200, Chicago, Illinois 60603 ("Atlas" or the "Insurer"), acting through its Claims Adjuster, Paul Enriquez, and such internal or external legal counsel as Atlas may designate from time to time in accordance with the terms of this Agreement.

Quorum and Atlas are referred to collectively herein as the "Parties" and individually as a "Party."

RECITALS

WHEREAS:

A. The Insurance Relationship. Atlas issued to Quorum a cyber-liability insurance policy bearing Policy No. CYB-2023-041587 (the "Policy"), with a coverage period commencing on January 1, 2023 and expiring on January 1, 2024. The Policy provides a per-occurrence limit of liability of Fifteen Million Dollars ($15,000,000) and an aggregate limit of liability of Fifteen Million Dollars ($15,000,000), in each case subject to a self-insured retention ("SIR") of Two Million Five Hundred Thousand Dollars ($2,500,000). The Policy covers, among other things, first-party forensic investigation costs, notification costs, credit monitoring costs, crisis communications expenses, regulatory defense costs, and regulatory fines and penalties (where insurable by applicable law), all subject to the terms, conditions, exclusions, and limitations set forth in the Policy.

B. The Underlying Incident. On or about March 14, 2023, a threat actor exploited a known remote code execution vulnerability, designated as CVE-2023-0669, in a managed file transfer appliance operated by Palomar Data Solutions, Inc. ("Palomar"), a third-party claims-processing vendor retained by Quorum pursuant to a Master Services Agreement dated November 12, 2019 (as subsequently amended from time to time). Through exploitation of the aforementioned vulnerability, Palomar's network environment was compromised, and data exfiltration occurred during an approximately thirty-five (35) day window extending from on or about March 14, 2023 through on or about April 18, 2023. On April 21, 2023, Palomar notified Quorum of the security incident. The incident resulted in the potential compromise of personally identifiable information ("PII"), protected health information ("PHI"), and financial data pertaining to approximately 318,247 Quorum policyholders and claimants across twenty-nine (29) states and the District of Columbia (the "Incident").

C. Notice of Claim. On May 8, 2023, Quorum, through its Outside Counsel, submitted a formal notice of claim to Atlas under the Policy with respect to the Incident. Atlas assigned Claim No. CYB-CLM-2023-05892 to the notice of claim (the "Claim"). Atlas has acknowledged receipt of the notice of Claim and is currently evaluating coverage under the Policy in connection with the Claim.

D. Engagement of Counsel and Forensic Investigators. Quorum engaged Calderwood & Harkness LLP as outside counsel effective May 4, 2023 (C&H Matter No. 1025-00006) to coordinate the incident response, forensic investigation, regulatory notification compliance, regulatory defense, and vendor accountability negotiations arising from the Incident. Calderwood & Harkness, at the direction of counsel and under the umbrella of the attorney-client privilege, retained Graystone Forensics LLC, a Virginia limited liability company headquartered at 1950 Old Gallows Road, Suite 600, Tysons Corner, Virginia 22182, effective May 5, 2023, to conduct the forensic investigation of the Incident (the "Forensic Investigation").

E. Common Legal Interest. The Parties share a common legal interest in: (a) investigating the nature, scope, and cause of the Incident; (b) evaluating and defending against potential regulatory enforcement actions, litigation, and claims by affected individuals or governmental authorities arising from or related to the Incident; (c) assessing and quantifying covered losses under the Policy; (d) preserving and protecting all applicable privileges, including the attorney-client privilege and the work product doctrine, with respect to communications, documents, and analyses generated in connection with the Incident; and (e) achieving an efficient, coordinated response to the Incident that minimizes exposure for both Parties. The Parties wish to share certain privileged and confidential information in furtherance of this common legal interest without waiving any applicable privilege or protection that would otherwise attach to such information.

F. Legal Basis. The Parties enter into this Agreement based upon the common interest doctrine (also referred to as the "joint defense privilege" or "community of interest" doctrine), as recognized under applicable federal and state law, which permits parties sharing a common legal interest to exchange privileged communications and work product without waiving the protections that would otherwise apply to such communications and work product. The Parties intend this Agreement to memorialize the basis for and the terms governing the sharing of privileged materials, and to ensure that such sharing is conducted in a manner consistent with the requirements of the common interest doctrine.

NOW, THEREFORE, in consideration of the mutual covenants, agreements, and understandings set forth herein, and for other good and valuable consideration, the receipt and sufficiency of which are hereby acknowledged, the Parties agree as follows:

ARTICLE I — DEFINITIONS

Section 1.1 — "Common Interest Materials." As used in this Agreement, "Common Interest Materials" means all documents, communications, memoranda, reports, analyses, forensic findings, legal assessments, correspondence, notes, summaries, and other materials, in any form or medium (including electronic, hard copy, oral, or any other format), that are: (a) protected by the attorney-client privilege, the work product doctrine, or any other applicable privilege, protection, or immunity under federal or state law; and (b) shared between or among the Parties or their respective Counsel in connection with the Incident, the Claim, or any Related Proceeding.

Common Interest Materials include, without limitation, the following categories of materials:

(a) privileged forensic investigation reports and findings, whether preliminary, interim, or final, prepared by Graystone Forensics LLC at the direction of Calderwood & Harkness LLP;

(b) legal memoranda and analyses prepared by Calderwood & Harkness LLP concerning the Incident, the Claim, regulatory obligations, potential liability exposure, or vendor accountability;

(c) regulatory notification strategies, draft notification letters, and regulatory filings prepared in connection with the Incident;

(d) regulatory defense submissions, responses to regulatory inquiries, and correspondence with regulatory authorities;

(e) vendor accountability analyses, demand letters, draft claims, and settlement negotiations or communications involving Palomar Data Solutions, Inc.;

(f) privileged communications between Counsel for the Parties regarding any of the foregoing matters; and

(g) any other document or communication that is designated by the disclosing Party as a Common Interest Material at the time of disclosure.

Section 1.2 — "Counsel." As used in this Agreement, "Counsel" means:

(a) With respect to Quorum: Calderwood & Harkness LLP, including but not limited to the following attorneys: Kevin Ostrowski (Responsible Partner), Rachel Bernstein (Billing Partner), Alan Burke (Lead Associate), Sara Hendricks (Working Associate), and such other attorneys of Calderwood & Harkness LLP as C&H may designate from time to time in connection with C&H Matter No. 1025-00006. The attorneys currently designated as Counsel for Quorum are further identified in Exhibit A attached hereto.

(b) With respect to Atlas: such internal legal counsel and external legal counsel as Atlas may retain or designate from time to time in connection with the Claim and the Incident; provided, however, that Atlas shall notify Quorum's Outside Counsel in writing of the identity of any such external counsel prior to sharing any Common Interest Materials with such counsel. The attorneys designated as Counsel for Atlas shall be identified in Exhibit A attached hereto, as supplemented by Atlas from time to time in accordance with the notice provisions set forth herein.

Section 1.3 — "Related Proceedings." As used in this Agreement, "Related Proceedings" means any and all regulatory inquiries, investigations, examinations, enforcement actions, civil litigation, class actions, mass tort proceedings, arbitration proceedings, governmental proceedings, administrative proceedings, or other legal or administrative proceedings arising out of, relating to, or in connection with the Incident, including without limitation:

(a) inquiries, investigations, or enforcement actions initiated by state attorneys general in any of the twenty-nine (29) affected states or the District of Columbia;

(b) inquiries, investigations, examinations, or enforcement actions initiated by the Connecticut Insurance Department, including any examination conducted by Richard Nakamura, Examiner, or any other representative of the Connecticut Insurance Department;

(c) inquiries, investigations, or enforcement actions initiated by the U.S. Department of Health and Human Services, Office for Civil Rights ("HHS-OCR"), in connection with potential violations of the Health Insurance Portability and Accountability Act of 1996, as amended ("HIPAA"), and its implementing regulations;

(d) any class action, consolidated action, multi-district litigation, or individual civil litigation brought by or on behalf of affected Quorum policyholders, claimants, or other data subjects;

(e) any vendor indemnification claims, breach of contract claims, contribution claims, or other proceedings involving Palomar Data Solutions, Inc. and/or its counsel, Mercer, Haight & Dunlop LLP (Catherine Langford, Partner); and

(f) any other legal, regulatory, or administrative proceeding that either Party reasonably determines to be related to the Incident, the Claim, or the subject matter of this Agreement.

ARTICLE II — PURPOSE AND SCOPE

Section 2.1 — Purpose. The purpose of this Agreement is to establish a framework for the sharing of Common Interest Materials between the Parties in furtherance of their shared legal interests in the investigation of, response to, and defense of the Incident and any Related Proceedings, and to ensure that such sharing does not constitute, and is not construed as constituting, a waiver of any applicable privilege, protection, or immunity. The Parties recognize that the efficient coordination of their respective legal efforts with respect to the Incident and Related Proceedings will be materially advanced by the exchange of certain privileged and confidential information, and that such exchange can and should be accomplished in a manner that preserves the full scope of all applicable privileges and protections.

Section 2.2 — Scope of Sharing. Each Party may, in its sole and absolute discretion, share Common Interest Materials with the other Party or the other Party's Counsel to the extent such sharing is reasonably necessary to advance the Parties' common legal interest as described in Recital E above. The determination of what information to share, and the timing and manner of such sharing, shall be within the sole discretion of each disclosing Party.

Nothing in this Agreement shall be construed to require either Party to share any particular information, document, or material with the other Party. Each Party retains sole discretion over what information it elects to share, and neither Party shall be liable to the other for any failure or refusal to share any particular information, material, or communication. The decision by either Party not to share any particular item shall not give rise to any adverse inference, presumption, or claim by the other Party.

This Agreement covers the Incident as described in Recital B above, the Claim as described in Recital C above, and all Related Proceedings as defined in Section 1.3 above. To the extent that additional incidents, claims, or proceedings arise that the Parties mutually agree are related to the Incident and would benefit from the common interest framework established herein, the Parties may extend the scope of this Agreement by written amendment in accordance with Section 7.3.

Section 2.3 — Categories of Information Anticipated to Be Shared. Without limiting the generality of the foregoing, the Parties anticipate that the following categories of information may be shared as Common Interest Materials under this Agreement:

(a) Forensic Investigation Reports. Reports, findings, and analyses, whether preliminary, interim, or final, prepared by Graystone Forensics LLC under the direction and supervision of Calderwood & Harkness LLP, relating to the forensic investigation of the Incident, including analyses of the attack vector, indicators of compromise, scope of data exfiltration, affected systems, and threat actor attribution.

(b) Legal Analyses of Notification Obligations. Legal analyses and memoranda prepared by Calderwood & Harkness LLP assessing breach notification obligations under the applicable data breach notification statutes and regulations of the twenty-nine (29) affected states and the District of Columbia, as well as any federal notification obligations under HIPAA or other applicable federal law.

(c) Regulatory Notification Filings and Strategy. Draft and final regulatory notification filings, individual notification letters, and associated legal strategy memoranda, including analyses of notification timing requirements, content requirements, and safe-harbor provisions.

(d) Regulatory Defense Materials. Regulatory defense submissions, responses to subpoenas, civil investigative demands, or other process, and privileged correspondence with state attorneys general, the Connecticut Insurance Department (including examinations conducted by Richard Nakamura, Examiner), HHS-OCR, and any other governmental or regulatory body, together with related legal strategy memoranda and analyses.

(e) Vendor Accountability Materials. Legal analyses of Quorum's contractual rights and remedies against Palomar Data Solutions, Inc. under the Master Services Agreement dated November 12, 2019 (as amended), including indemnification obligations, limitation of liability provisions, and breach of security representations and warranties, as well as demand letters, pre-litigation correspondence, and settlement negotiations or communications with Palomar and its counsel, Mercer, Haight & Dunlop LLP (Catherine Langford, Partner).

(f) Loss Quantification and Cost Documentation. Documentation and analyses relevant to the quantification of losses, costs, and expenses incurred or expected to be incurred in connection with the Incident, to the extent relevant to the Parties' common legal interest and to coverage under the Policy, including forensic investigation costs, consumer notification and credit monitoring costs, crisis communications expenses (including costs incurred through BrightPath Consulting Group Inc.), legal fees, regulatory defense costs, and internal Quorum remediation costs.

(g) Internal Quorum Communications. Internal Quorum communications to the extent prepared at the direction of counsel, subject to the attorney-client privilege, and relevant to the common legal interest of the Parties under this Agreement.

ARTICLE III — PRESERVATION OF PRIVILEGE

Section 3.1 — No Waiver. The sharing of Common Interest Materials pursuant to this Agreement shall not constitute a waiver of, and shall not be deemed to waive, the attorney-client privilege, the work product doctrine, or any other applicable privilege, protection, or immunity under federal or state law. The Parties expressly intend that the sharing of Common Interest Materials hereunder shall be undertaken in furtherance of their common legal interest as described in Recital E and that such sharing shall be protected by the common interest doctrine.

Each Party expressly reserves all rights to assert any applicable privilege, protection, or immunity with respect to any Common Interest Materials shared under this Agreement, in any Related Proceeding, coverage dispute, or other legal, regulatory, or administrative proceeding, whether pending or hereafter commenced. No disclosure of Common Interest Materials pursuant to this Agreement shall be construed as an admission that any particular material is or is not privileged, or as a concession regarding the scope or applicability of any privilege.

The Parties intend that all Common Interest Materials shared hereunder shall remain fully protected by all applicable privileges, protections, and immunities to the same extent as if such materials had not been shared with the other Party. In the event that any court, tribunal, or governmental body determines that the common interest doctrine does not apply to any particular communication or material shared under this Agreement, the Parties agree to cooperate in asserting all other available bases for privilege or protection with respect to such communication or material.

Section 3.2 — Ownership of Privilege. The disclosure of Common Interest Materials by one Party to the other pursuant to this Agreement shall not transfer ownership of the underlying privilege from the disclosing Party to the receiving Party. The privilege attaching to any particular communication or material shall remain the property of the Party (or its Counsel) that generated such communication or material, and shall be subject to assertion or waiver only by such Party (or its Counsel), subject to the limitations set forth in Section 3.3 below.

Each Party retains the right to assert or waive its own privilege with respect to materials it has generated or received from its own Counsel, provided that any such waiver shall not operate to waive the privilege of the other Party with respect to Common Interest Materials received from the other Party under this Agreement.

Section 3.3 — Consent Required for Waiver or Disclosure to Third Parties. Neither Party shall disclose, produce, transmit, or otherwise make available any Common Interest Materials received from the other Party to any third party, including without limitation any governmental authority, regulatory body, court, tribunal, arbitrator, opposing party, co-party, or any other person or entity, without the prior written consent of the Party that originally shared such materials. Such consent may be granted or withheld in the sole and absolute discretion of the disclosing Party.

A Party seeking to disclose Common Interest Materials received from the other Party shall provide no fewer than ten (10) business days' prior written notice to the other Party, which notice shall: (i) identify with reasonable particularity the materials at issue; (ii) identify the proposed recipient and the reason for the proposed disclosure; and (iii) describe any protective measures (including but not limited to protective orders, confidentiality agreements, or in camera review) that the disclosing Party proposes to employ in connection with such disclosure. The receiving Party shall cooperate with the disclosing Party's efforts to assert applicable privileges or seek protective orders to prevent or limit such disclosure.

Section 3.4 — Compelled Disclosure. In the event that either Party receives a subpoena, court order, civil investigative demand, regulatory demand, or other compulsory legal process requiring the production or disclosure of Common Interest Materials received from the other Party, the receiving Party shall:

(a) promptly, and in no event later than three (3) business days after receipt of such compulsory process, notify the disclosing Party in writing of the existence and terms of such process, including a description of the materials sought;

(b) cooperate fully with the disclosing Party's efforts to resist, quash, or limit such compelled disclosure, including joining in or supporting any motion for a protective order, motion to quash, or other appropriate procedural mechanism;

(c) assert on behalf of the disclosing Party, to the fullest extent permitted by law, all applicable privileges and protections with respect to the materials at issue; and

(d) disclose only such materials as are strictly required by final, non-appealable court order or other binding legal process, after exhausting all reasonable efforts to resist or limit such disclosure.

The costs and expenses incurred by either Party in connection with efforts to resist or limit compelled disclosure of Common Interest Materials shall be borne by the Party asserting the privilege, unless the Parties otherwise agree in writing.

ARTICLE IV — CONFIDENTIALITY OBLIGATIONS

Section 4.1 — Confidential Treatment. All Common Interest Materials shared under this Agreement shall be treated as strictly confidential by the receiving Party. The receiving Party shall safeguard all Common Interest Materials with the same degree of care it employs to protect its own most sensitive privileged and confidential information, and in no event less than a reasonable degree of care.

Access to Common Interest Materials shall be limited to the following categories of authorized recipients:

(a) in-house legal counsel of the receiving Party who have a need to know in connection with the Incident, the Claim, or any Related Proceeding;

(b) outside counsel designated under Section 1.2 of this Agreement;

(c) such officers, employees, or agents of the receiving Party as have a demonstrable need to know in connection with the Incident, the Claim, or any Related Proceeding, and who are subject to confidentiality obligations at least as protective as those set forth in this Agreement (whether by virtue of employment, contract, or professional obligation).

For Quorum, authorized recipients of Common Interest Materials received from Atlas shall include the following individuals: Thomas R. Whitfield (General Counsel), Jennifer Liang (Chief Privacy Officer), David Naranjo (Chief Information Security Officer), and such other Quorum personnel as Outside Counsel may designate in writing with Atlas's prior written consent, which consent shall not be unreasonably withheld.

For Atlas, authorized recipients of Common Interest Materials received from Quorum shall include the following individuals: Paul Enriquez (Claims Adjuster), and such other Atlas claims, underwriting, legal, or actuarial personnel as Atlas may designate in writing in accordance with the notice provisions set forth in this Agreement.

Each Party shall maintain a record of the individuals within its organization who have been granted access to Common Interest Materials received from the other Party, and shall make such record available to the other Party upon reasonable request.

Section 4.2 — No Use for Coverage Dispute. Neither Party shall use Common Interest Materials obtained from the other Party under this Agreement for the purpose of establishing, contesting, or litigating any coverage dispute between the Parties under the Policy, unless both Parties expressly consent in writing to such use. This restriction applies to all Common Interest Materials, regardless of the form or medium in which such materials exist, and includes the use of any derivative analyses or summaries based upon Common Interest Materials received from the other Party.

For the avoidance of doubt, this restriction shall not limit either Party's right to use its own independently generated materials, information, analyses, or work product in any coverage dispute. Nor shall this restriction preclude either Party from independently developing or obtaining, through its own investigation or from sources other than the other Party, information that is similar or identical to information contained in Common Interest Materials received under this Agreement.

Section 4.3 — Marking of Materials. To the extent practicable, Common Interest Materials shared under this Agreement shall be marked or labeled with the following legend, or substantially equivalent language, at the time of disclosure:

"PRIVILEGED AND CONFIDENTIAL — SUBJECT TO COMMON INTEREST AGREEMENT"

The failure to mark or label any particular material with the foregoing legend shall not affect the privileged or confidential status of such material, provided that the material otherwise qualifies as a Common Interest Material under this Agreement. Either Party may request that the other Party retroactively apply appropriate markings to previously shared materials that were not marked at the time of disclosure.

ARTICLE V — RESERVATION OF RIGHTS

Section 5.1 — No Admission of Liability or Coverage. This Agreement shall not be construed as an admission by Atlas of coverage or liability under the Policy for any particular loss, cost, expense, or claim, nor as a waiver of any coverage defenses, exclusions, conditions, sublimits, or limitations under the Policy. Atlas expressly reserves all of its rights under the Policy, including without limitation the right to deny coverage, disclaim liability, assert any defense to coverage, invoke any exclusion or condition, or take any other position with respect to the Claim or the Policy, and nothing contained in this Agreement shall be deemed to expand, alter, modify, or amend the coverage provided by the Policy or to create any coverage obligation not expressly set forth in the Policy.

Atlas's participation in this Agreement, its review of Common Interest Materials, and its communications with Quorum or Quorum's Counsel in connection with this Agreement shall not be construed as an acceptance of coverage, an assumption of a duty to defend, an estoppel, or a waiver of any rights or defenses under the Policy, at law, or in equity.

Section 5.2 — No Admission by Quorum. This Agreement shall not be construed as an admission by Quorum of liability, fault, negligence, or wrongdoing to any third party, regulator, governmental authority, or affected individual in connection with the Incident. Quorum expressly reserves all of its rights and defenses with respect to any claims, regulatory actions, or proceedings arising from or related to the Incident, including without limitation any defenses based on the acts or omissions of Palomar Data Solutions, Inc. or any other third party.

Section 5.3 — Independent Legal Interests. Notwithstanding their common legal interest as described in Recital E and elsewhere in this Agreement, each Party acknowledges and agrees that it may have separate and independent legal interests with respect to certain matters, including without limitation:

(a) the scope, applicability, and interpretation of coverage under the Policy;

(b) the amount and characterization of insured losses, costs, and expenses;

(d) the allocation of losses between covered and non-covered categories;

(e) the reasonableness and necessity of expenses incurred in connection with the Incident; and

(f) any other matter on which the interests of the insured and the insurer may diverge.

The existence of this Agreement shall not preclude either Party from asserting any claim, defense, right, or position in any coverage dispute or other proceeding between the Parties, subject to the limitations on use of Common Interest Materials set forth in Section 4.2 of this Agreement. Neither Party shall be estopped, by virtue of its participation in this Agreement or the exchange of Common Interest Materials hereunder, from taking any position in any coverage dispute that it would otherwise be entitled to take.

ARTICLE VI — TERM AND TERMINATION

Section 6.1 — Effective Date. This Agreement shall be effective as of the date first written above, May 10, 2023.

Section 6.2 — Term. This Agreement shall remain in effect until the earliest of:

(a) the date upon which both Parties execute a written agreement to terminate this Agreement;

(b) the date of final resolution (including the exhaustion or expiration of all applicable appeal periods) of all Related Proceedings; or

(c) the date that is thirty (30) calendar days following the date on which either Party delivers written notice to the other Party of its intention to withdraw from this Agreement;

provided, however, that the withdrawal of either Party pursuant to clause (c) above shall not affect the protections afforded to Common Interest Materials shared prior to the effective date of such withdrawal. All Common Interest Materials shared prior to withdrawal shall continue to be governed by the terms of this Agreement, including the privilege-preservation and confidentiality obligations set forth herein, notwithstanding the termination of this Agreement.

Section 6.3 — Survival. The obligations set forth in Article III (Preservation of Privilege), Article IV (Confidentiality Obligations), and Article V (Reservation of Rights) shall survive the termination, expiration, or withdrawal from this Agreement in perpetuity, or for such shorter period as may be required by the final resolution of all Related Proceedings and the expiration of all applicable statutes of limitations, whichever is later.

Section 6.4 — Return or Destruction of Materials. Upon termination of this Agreement for any reason, each Party shall, at the written request of the disclosing Party, promptly return to the disclosing Party or destroy all Common Interest Materials received from the disclosing Party, including all copies, summaries, extracts, and derivative works thereof, in whatever form or medium. Within thirty (30) calendar days of such request, the receiving Party shall certify in writing, through a duly authorized officer or Counsel, that it has complied with this obligation.

Notwithstanding the foregoing, the receiving Party shall not be required to return or destroy Common Interest Materials to the extent that retention of such materials is required by applicable law, regulation, court order, or regulatory directive, or to the extent that such materials are contained in routine electronic backup systems that are not reasonably accessible in the ordinary course of business. Any materials retained pursuant to this exception shall continue to be subject to the confidentiality and privilege-preservation obligations of this Agreement.

ARTICLE VII — GENERAL PROVISIONS

Section 7.1 — Governing Law. This Agreement shall be governed by and construed in accordance with the laws of the State of Connecticut, without regard to its conflict of laws principles. The State of Connecticut has been selected as the governing jurisdiction because it is the jurisdiction of Quorum's headquarters and principal regulatory nexus, and because a substantial number of the regulatory and legal matters arising from the Incident will involve Connecticut law and Connecticut regulatory authorities, including the Connecticut Insurance Department.

Section 7.2 — Entire Agreement. This Agreement, including all exhibits attached hereto and incorporated herein by reference, constitutes the entire agreement between the Parties with respect to the subject matter hereof and supersedes all prior or contemporaneous oral or written agreements, understandings, representations, negotiations, or communications between the Parties relating to the sharing of privileged or confidential materials in connection with the Incident, the Claim, or any Related Proceeding. No representation, warranty, promise, inducement, or statement of intention has been made by either Party that is not embodied in this Agreement, and neither Party shall be bound by or liable for any alleged representation, warranty, promise, inducement, or statement of intention not set forth herein.

Section 7.3 — Amendments. This Agreement may be amended, modified, or supplemented only by a written instrument signed by both Parties or their duly authorized Counsel. No oral modification or waiver of any provision of this Agreement shall be effective. Any amendment extending the scope of this Agreement to cover additional incidents, claims, or parties shall be set forth in a written amendment that specifically identifies the additional subject matter and is executed by all relevant parties.

Section 7.4 — No Third-Party Beneficiaries. This Agreement is for the sole and exclusive benefit of the Parties and their respective Counsel and shall not confer any rights, remedies, benefits, claims, or causes of action on any third party, whether by virtue of the common interest doctrine or otherwise.

For the avoidance of doubt, Palomar Data Solutions, Inc., Mercer, Haight & Dunlop LLP, Graystone Forensics LLC, BrightPath Consulting Group Inc., Pinnacle Surplus Lines Insurance Corp., and any other person or entity are not parties to, and are not intended to be beneficiaries of, this Agreement, and no provision of this Agreement shall be enforceable by any such person or entity.

Section 7.5 — Notices. All notices, requests, consents, demands, and other communications under this Agreement shall be in writing and shall be deemed to have been duly given when delivered by hand, when sent by nationally recognized overnight courier service, or when sent by email (with confirmation of receipt), addressed as follows:

If to Quorum:

Thomas R. Whitfield General Counsel Quorum Insurance Holdings Corp. 400 Constitution Plaza, Suite 2200 Hartford, Connecticut 06103

Email: twhitfield@quoruminsurance.com

with a copy (which shall not constitute notice) to:

Kevin Ostrowski Partner, Privacy & Data Security Calderwood & Harkness LLP 1700 K Street NW, Suite 900 Washington, D.C. 20006

Email: kostrowski@calderwoodharkness.com

If to Atlas:

Paul Enriquez Claims Adjuster Atlas Mutual Insurance Company 120 South LaSalle Street, Suite 3200 Chicago, Illinois 60603

Email: penriquez@atlasmutual.com

Either Party may change its notice address by providing written notice to the other Party in accordance with this Section 7.5.

Section 7.6 — Counterparts. This Agreement may be executed in two or more counterparts, each of which shall be deemed an original and all of which together shall constitute one and the same instrument. Delivery of an executed counterpart by electronic mail (including PDF) or by facsimile transmission shall be equally as effective as delivery of a manually executed counterpart. Electronic or facsimile signatures shall have the same force and effect as original ink signatures for all purposes of this Agreement.

Section 7.7 — Severability. If any provision of this Agreement is held by a court of competent jurisdiction or other tribunal to be invalid, illegal, or unenforceable for any reason, such invalidity, illegality, or unenforceability shall not affect any other provision of this Agreement, and the remaining provisions shall continue in full force and effect. The Parties shall negotiate in good faith to replace any invalid, illegal, or unenforceable provision with a valid provision that, to the greatest extent possible, achieves the original intent and economic effect of the invalid provision.

Section 7.8 — Relationship to Policy. This Agreement is supplemental to, and does not modify, amend, alter, or supersede, the terms and conditions of Policy No. CYB-2023-041587, including without limitation any cooperation obligations, consent provisions, notification provisions, voluntary payment clauses, or other conditions precedent to coverage set forth in the Policy. In the event of any conflict or inconsistency between any provision of this Agreement and any provision of the Policy, the terms of the Policy shall control with respect to the rights and obligations of the Parties under the Policy. Nothing in this Agreement shall be construed to impose upon Atlas any obligation that is inconsistent with or in addition to Atlas's obligations under the Policy, nor shall anything in this Agreement be construed to relieve Quorum of any obligation or condition imposed upon it under the Policy.

Section 7.9 — Excess Carrier. The Parties acknowledge that Pinnacle Surplus Lines Insurance Corp. ("Pinnacle") has issued an excess cyber-liability insurance policy bearing Policy No. XS-CYB-2023-7812, which provides Twenty-Five Million Dollars ($25,000,000) in excess cyber-liability coverage above the Atlas primary layer, for a total insurance tower of Forty Million Dollars ($40,000,000). Pinnacle is not a party to this Agreement, and nothing in this Agreement shall be construed to create any obligation on the part of Pinnacle or to confer any rights or benefits on Pinnacle.

To the extent the Parties determine that it is advisable or necessary to extend the common interest framework established by this Agreement to include Pinnacle, the Parties may enter into a separate common interest agreement with Pinnacle or amend this Agreement to include Pinnacle as an additional party, in either case with the prior written consent of all relevant parties. Any such extension or amendment shall be documented in writing and executed in accordance with the requirements of Section 7.3 of this Agreement.

[SIGNATURE PAGE FOLLOWS]

IN WITNESS WHEREOF, the undersigned Parties have caused this Common Interest Agreement to be executed by their duly authorized representatives as of the date first written above.

QUORUM INSURANCE HOLDINGS CORP.

By: ________

Name: Thomas R. Whitfield

Title: General Counsel

Date: ________

Acknowledged and agreed by Outside Counsel:

CALDERWOOD & HARKNESS LLP

By: ________

Name: Kevin Ostrowski

Title: Partner, Privacy & Data Security

Date: ________

ATLAS MUTUAL INSURANCE COMPANY

By: ________

Name: Paul Enriquez

Title: Claims Adjuster, Authorized Representative

Date: ________

EXHIBIT A

IDENTIFICATION OF COUNSEL

(Referenced in Section 1.2)

I. Counsel for Quorum Insurance Holdings Corp.

Firm: Calderwood & Harkness LLP

Office Addresses:

1700 K Street NW, Suite 900 Washington, D.C. 20006 Telephone: (202) 555-8400 Facsimile: (202) 555-8401

51 West 52nd Street, 34th Floor New York, New York 10019 Telephone: (212) 555-7300 Facsimile: (212) 555-7301

Designated Attorneys:

C&H Matter No.: 1025-00006

Calderwood & Harkness LLP may designate additional attorneys to serve as Counsel for Quorum from time to time in connection with C&H Matter No. 1025-00006, upon written notice to Atlas's designated representative.

II. Counsel for Atlas Mutual Insurance Company

Atlas Mutual Insurance Company shall designate its internal and/or external legal counsel by completing the information below and providing written notice thereof to Calderwood & Harkness LLP in accordance with Section 7.5 of the Agreement. Atlas shall provide such written notice prior to sharing any Common Interest Materials with any designated counsel.

Internal Counsel (if applicable):

External Counsel (if applicable):

Firm: _______

Address: _______

Designated Attorneys:

Atlas shall promptly notify Calderwood & Harkness LLP in writing of any changes to the foregoing designations, including the addition or removal of any attorney, in accordance with Section 7.5 of the Agreement.

EXHIBIT B

DESCRIPTION OF THE INCIDENT AND CLAIM

(Referenced in Recitals B and C)

I. Summary Description of the Incident

On or about March 14, 2023, a threat actor exploited a known remote code execution vulnerability designated as CVE-2023-0669 in a GoAnywhere MFT (Managed File Transfer) file transfer appliance operated by Palomar Data Solutions, Inc. ("Palomar"), a third-party claims-processing vendor retained by Quorum Insurance Holdings Corp. ("Quorum") pursuant to a Master Services Agreement dated November 12, 2019, as subsequently amended. The vulnerability permitted the threat actor to gain unauthorized access to Palomar's network environment and to execute commands on the affected file transfer appliance.

Unauthorized access to Palomar's systems was maintained during an approximately thirty-five (35) day window, from on or about March 14, 2023 through on or about April 18, 2023. During this period, the threat actor exfiltrated structured data files from the affected file transfer appliance, including files containing the following categories of personal and financial data pertaining to Quorum policyholders and claimants:

• Personally Identifiable Information (PII): Full names, dates of birth, Social Security numbers, driver's license numbers, mailing addresses, email addresses, and telephone numbers.

• Protected Health Information (PHI): Health insurance claim information, medical record numbers, diagnosis codes, treatment information, and health plan beneficiary identifiers.

• Financial Data: Bank account numbers, payment card information (in limited instances), policy premium payment records, and claims payment history.

The compromised data pertained to approximately 318,247 Quorum policyholders and claimants located across twenty-nine (29) states and the District of Columbia.

II. Palomar's Notification to Quorum

On April 21, 2023, Palomar Data Solutions, Inc. notified Quorum of the security incident. Palomar's notification indicated that it had become aware of anomalous activity on its GoAnywhere MFT appliance on or about April 18, 2023, that it had engaged a third-party forensic investigation firm to assess the scope of the compromise, and that preliminary findings indicated that data files belonging to Quorum had been accessed and potentially exfiltrated by an unauthorized third party.

III. Engagement of Counsel and Forensic Investigators

On May 4, 2023, Quorum engaged Calderwood & Harkness LLP ("C&H") as outside counsel to coordinate the incident response, forensic investigation, regulatory notification compliance, regulatory defense, and vendor accountability negotiations arising from the Incident. The engagement was assigned C&H Matter No. 1025-00006.

On May 5, 2023, Calderwood & Harkness LLP, at the direction of counsel and under the umbrella of the attorney-client privilege, retained Graystone Forensics LLC, a Virginia limited liability company headquartered at 1950 Old Gallows Road, Suite 600, Tysons Corner, Virginia 22182, to conduct an independent forensic investigation of the Incident (the "Forensic Investigation"). Graystone Forensics was retained by and reports to Calderwood & Harkness LLP in order to preserve the privileged nature of its findings, analyses, and reports.

IV. Filing of Claim with Atlas

On May 8, 2023, Quorum, through its Outside Counsel, submitted a formal notice of claim to Atlas Mutual Insurance Company under Policy No. CYB-2023-041587. Atlas assigned Claim No. CYB-CLM-2023-05892 to the notice of claim.

V. Anticipated Cost Categories

Based on preliminary assessments as of the date of this Agreement, the following categories of costs and expenses are anticipated to be incurred in connection with the Incident, subject to further investigation, analysis, and adjustment:

The foregoing cost categories are provided for illustrative purposes and do not represent an exhaustive list of all costs and expenses that may be incurred. The inclusion of any cost category in this Exhibit B does not constitute an admission by Atlas that such costs are covered under the Policy, nor does it constitute a waiver of any coverage defenses, exclusions, or limitations.

VI. Policy Terms Applicable to the Claim

• Policy Number: CYB-2023-041587

• Coverage Period: January 1, 2023 through January 1, 2024

• Per-Occurrence Limit: $15,000,000

• Aggregate Limit: $15,000,000

• Self-Insured Retention (SIR): $2,500,000

• Excess Coverage: Pinnacle Surplus Lines Insurance Corp., Policy No. XS-CYB-2023-7812, providing $25,000,000 excess of the Atlas primary layer

• Total Insurance Tower: $40,000,000

This Exhibit B is provided for reference and informational purposes in connection with the Common Interest Agreement to which it is attached. The information contained herein is based on preliminary assessments as of May 10, 2023 and is subject to revision as the investigation and response to the Incident progress. Nothing in this Exhibit B shall be construed as an admission of coverage, liability, fault, or wrongdoing by either Party.

Name	Role	Email
Kevin Ostrowski	Responsible Partner, Privacy & Data Security	kostrowski@calderwoodharkness.com
Rachel Bernstein	Billing Partner	rbernstein@calderwoodharkness.com
Alan Burke	Lead Associate	aburke@calderwoodharkness.com
Sara Hendricks	Working Associate	shendricks@calderwoodharkness.com
Name	Title	Email
_______	_______	_______
Name	Role	Email
_______	_______	_______
_______	_______	_______
Category	Vendor / Provider	Estimated Range
Forensic Investigation	Graystone Forensics LLC	To be determined
Consumer Notification and Credit Monitoring	Notification vendor (to be selected)	To be determined
Crisis Communications	BrightPath Consulting Group Inc.	To be determined
Legal Fees — Incident Response, Regulatory Defense, and Vendor Accountability	Calderwood & Harkness LLP	To be determined
Regulatory Defense Costs	Calderwood & Harkness LLP / local regulatory counsel as needed	To be determined
Internal Quorum Remediation Costs	Quorum Insurance Holdings Corp. (internal resources)	To be determined

COMMON INTEREST AGREEMENT
Privileged and Confidential — Subject to Attorney-Client Privilege, Work Product Doctrine, and Common Interest Doctrine
May 10, 2023
This Common Interest Agreement (this "Agreement") is entered into as of May 10, 2023 (the "Effective Date"), by and between:
QUORUM INSURANCE HOLDINGS CORP., a corporation organized and existing under the laws of the State of Delaware, with its principal place of business at 400 Constitution Plaza, Suite 2200, Hartford, Connecticut 06103 ("Quorum" or the "Insured"), acting through its General Counsel, Thomas R. Whitfield, and its outside counsel, Calderwood & Harkness LLP, a Delaware limited liability partnership, with offices at 1700 K Street NW, Suite 900, Washington, D.C. 20006 ("Outside Counsel" or "C&H"), represented by Kevin Ostrowski, Responsible Partner, Privacy & Data Security Practice Group;
and
ATLAS MUTUAL INSURANCE COMPANY, a domestic mutual insurance company organized and existing under the laws of the State of Illinois, with its principal place of business at 120 South LaSalle Street, Suite 3200, Chicago, Illinois 60603 ("Atlas" or the "Insurer"), acting through its Claims Adjuster, Paul Enriquez, and such internal or external legal counsel as Atlas may designate from time to time in accordance with the terms of this Agreement.
Quorum and Atlas are referred to collectively herein as the "Parties" and individually as a "Party."
RECITALS
WHEREAS:
A. The Insurance Relationship. Atlas issued to Quorum a cyber-liability insurance policy bearing Policy No. CYB-2023-041587 (the "Policy"), with a coverage period commencing on January 1, 2023 and expiring on January 1, 2024. The Policy provides a per-occurrence limit of liability of Fifteen Million Dollars ($15,000,000) and an aggregate limit of liability of Fifteen Million Dollars ($15,000,000), in each case subject to a self-insured retention ("SIR") of Two Million Five Hundred Thousand Dollars ($2,500,000). The Policy covers, among other things, first-party forensic investigation costs, notification costs, credit monitoring costs, crisis communications expenses, regulatory defense costs, and regulatory fines and penalties (where insurable by applicable law), all subject to the terms, conditions, exclusions, and limitations set forth in the Policy.
B. The Underlying Incident. On or about March 14, 2023, a threat actor exploited a known remote code execution vulnerability, designated as CVE-2023-0669, in a managed file transfer appliance operated by Palomar Data Solutions, Inc. ("Palomar"), a third-party claims-processing vendor retained by Quorum pursuant to a Master Services Agreement dated November 12, 2019 (as subsequently amended from time to time). Through exploitation of the aforementioned vulnerability, Palomar's network environment was compromised, and data exfiltration occurred during an approximately thirty-five (35) day window extending from on or about March 14, 2023 through on or about April 18, 2023. On April 21, 2023, Palomar notified Quorum of the security incident. The incident resulted in the potential compromise of personally identifiable information ("PII"), protected health information ("PHI"), and financial data pertaining to approximately 318,247 Quorum policyholders and claimants across twenty-nine (29) states and the District of Columbia (the "Incident").
C. Notice of Claim. On May 8, 2023, Quorum, through its Outside Counsel, submitted a formal notice of claim to Atlas under the Policy with respect to the Incident. Atlas assigned Claim No. CYB-CLM-2023-05892 to the notice of claim (the "Claim"). Atlas has acknowledged receipt of the notice of Claim and is currently evaluating coverage under the Policy in connection with the Claim.
D. Engagement of Counsel and Forensic Investigators. Quorum engaged Calderwood & Harkness LLP as outside counsel effective May 4, 2023 (C&H Matter No. 1025-00006) to coordinate the incident response, forensic investigation, regulatory notification compliance, regulatory defense, and vendor accountability negotiations arising from the Incident. Calderwood & Harkness, at the direction of counsel and under the umbrella of the attorney-client privilege, retained Graystone Forensics LLC, a Virginia limited liability company headquartered at 1950 Old Gallows Road, Suite 600, Tysons Corner, Virginia 22182, effective May 5, 2023, to conduct the forensic investigation of the Incident (the "Forensic Investigation").
E. Common Legal Interest. The Parties share a common legal interest in: (a) investigating the nature, scope, and cause of the Incident; (b) evaluating and defending against potential regulatory enforcement actions, litigation, and claims by affected individuals or governmental authorities arising from or related to the Incident; (c) assessing and quantifying covered losses under the Policy; (d) preserving and protecting all applicable privileges, including the attorney-client privilege and the work product doctrine, with respect to communications, documents, and analyses generated in connection with the Incident; and (e) achieving an efficient, coordinated response to the Incident that minimizes exposure for both Parties. The Parties wish to share certain privileged and confidential information in furtherance of this common legal interest without waiving any applicable privilege or protection that would otherwise attach to such information.
F. Legal Basis. The Parties enter into this Agreement based upon the common interest doctrine (also referred to as the "joint defense privilege" or "community of interest" doctrine), as recognized under applicable federal and state law, which permits parties sharing a common legal interest to exchange privileged communications and work product without waiving the protections that would otherwise apply to such communications and work product. The Parties intend this Agreement to memorialize the basis for and the terms governing the sharing of privileged materials, and to ensure that such sharing is conducted in a manner consistent with the requirements of the common interest doctrine.
NOW, THEREFORE, in consideration of the mutual covenants, agreements, and understandings set forth herein, and for other good and valuable consideration, the receipt and sufficiency of which are hereby acknowledged, the Parties agree as follows:
ARTICLE I — DEFINITIONS
Section 1.1 — "Common Interest Materials." As used in this Agreement, "Common Interest Materials" means all documents, communications, memoranda, reports, analyses, forensic findings, legal assessments, correspondence, notes, summaries, and other materials, in any form or medium (including electronic, hard copy, oral, or any other format), that are: (a) protected by the attorney-client privilege, the work product doctrine, or any other applicable privilege, protection, or immunity under federal or state law; and (b) shared between or among the Parties or their respective Counsel in connection with the Incident, the Claim, or any Related Proceeding.
Common Interest Materials include, without limitation, the following categories of materials:
(a) privileged forensic investigation reports and findings, whether preliminary, interim, or final, prepared by Graystone Forensics LLC at the direction of Calderwood & Harkness LLP;
(b) legal memoranda and analyses prepared by Calderwood & Harkness LLP concerning the Incident, the Claim, regulatory obligations, potential liability exposure, or vendor accountability;
(c) regulatory notification strategies, draft notification letters, and regulatory filings prepared in connection with the Incident;
(d) regulatory defense submissions, responses to regulatory inquiries, and correspondence with regulatory authorities;
(e) vendor accountability analyses, demand letters, draft claims, and settlement negotiations or communications involving Palomar Data Solutions, Inc.;
(f) privileged communications between Counsel for the Parties regarding any of the foregoing matters; and
(g) any other document or communication that is designated by the disclosing Party as a Common Interest Material at the time of disclosure.
Section 1.2 — "Counsel." As used in this Agreement, "Counsel" means:
(a) With respect to Quorum: Calderwood & Harkness LLP, including but not limited to the following attorneys: Kevin Ostrowski (Responsible Partner), Rachel Bernstein (Billing Partner), Alan Burke (Lead Associate), Sara Hendricks (Working Associate), and such other attorneys of Calderwood & Harkness LLP as C&H may designate from time to time in connection with C&H Matter No. 1025-00006. The attorneys currently designated as Counsel for Quorum are further identified in Exhibit A attached hereto.
(b) With respect to Atlas: such internal legal counsel and external legal counsel as Atlas may retain or designate from time to time in connection with the Claim and the Incident; provided, however, that Atlas shall notify Quorum's Outside Counsel in writing of the identity of any such external counsel prior to sharing any Common Interest Materials with such counsel. The attorneys designated as Counsel for Atlas shall be identified in Exhibit A attached hereto, as supplemented by Atlas from time to time in accordance with the notice provisions set forth herein.
Section 1.3 — "Related Proceedings." As used in this Agreement, "Related Proceedings" means any and all regulatory inquiries, investigations, examinations, enforcement actions, civil litigation, class actions, mass tort proceedings, arbitration proceedings, governmental proceedings, administrative proceedings, or other legal or administrative proceedings arising out of, relating to, or in connection with the Incident, including without limitation:
(a) inquiries, investigations, or enforcement actions initiated by state attorneys general in any of the twenty-nine (29) affected states or the District of Columbia;
(b) inquiries, investigations, examinations, or enforcement actions initiated by the Connecticut Insurance Department, including any examination conducted by Richard Nakamura, Examiner, or any other representative of the Connecticut Insurance Department;
(c) inquiries, investigations, or enforcement actions initiated by the U.S. Department of Health and Human Services, Office for Civil Rights ("HHS-OCR"), in connection with potential violations of the Health Insurance Portability and Accountability Act of 1996, as amended ("HIPAA"), and its implementing regulations;
(d) any class action, consolidated action, multi-district litigation, or individual civil litigation brought by or on behalf of affected Quorum policyholders, claimants, or other data subjects;
(e) any vendor indemnification claims, breach of contract claims, contribution claims, or other proceedings involving Palomar Data Solutions, Inc. and/or its counsel, Mercer, Haight & Dunlop LLP (Catherine Langford, Partner); and
(f) any other legal, regulatory, or administrative proceeding that either Party reasonably determines to be related to the Incident, the Claim, or the subject matter of this Agreement.
ARTICLE II — PURPOSE AND SCOPE
Section 2.1 — Purpose. The purpose of this Agreement is to establish a framework for the sharing of Common Interest Materials between the Parties in furtherance of their shared legal interests in the investigation of, response to, and defense of the Incident and any Related Proceedings, and to ensure that such sharing does not constitute, and is not construed as constituting, a waiver of any applicable privilege, protection, or immunity. The Parties recognize that the efficient coordination of their respective legal efforts with respect to the Incident and Related Proceedings will be materially advanced by the exchange of certain privileged and confidential information, and that such exchange can and should be accomplished in a manner that preserves the full scope of all applicable privileges and protections.
Section 2.2 — Scope of Sharing. Each Party may, in its sole and absolute discretion, share Common Interest Materials with the other Party or the other Party's Counsel to the extent such sharing is reasonably necessary to advance the Parties' common legal interest as described in Recital E above. The determination of what information to share, and the timing and manner of such sharing, shall be within the sole discretion of each disclosing Party.
Nothing in this Agreement shall be construed to require either Party to share any particular information, document, or material with the other Party. Each Party retains sole discretion over what information it elects to share, and neither Party shall be liable to the other for any failure or refusal to share any particular information, material, or communication. The decision by either Party not to share any particular item shall not give rise to any adverse inference, presumption, or claim by the other Party.
This Agreement covers the Incident as described in Recital B above, the Claim as described in Recital C above, and all Related Proceedings as defined in Section 1.3 above. To the extent that additional incidents, claims, or proceedings arise that the Parties mutually agree are related to the Incident and would benefit from the common interest framework established herein, the Parties may extend the scope of this Agreement by written amendment in accordance with Section 7.3.
Section 2.3 — Categories of Information Anticipated to Be Shared. Without limiting the generality of the foregoing, the Parties anticipate that the following categories of information may be shared as Common Interest Materials under this Agreement:
(a) Forensic Investigation Reports. Reports, findings, and analyses, whether preliminary, interim, or final, prepared by Graystone Forensics LLC under the direction and supervision of Calderwood & Harkness LLP, relating to the forensic investigation of the Incident, including analyses of the attack vector, indicators of compromise, scope of data exfiltration, affected systems, and threat actor attribution.
(b) Legal Analyses of Notification Obligations. Legal analyses and memoranda prepared by Calderwood & Harkness LLP assessing breach notification obligations under the applicable data breach notification statutes and regulations of the twenty-nine (29) affected states and the District of Columbia, as well as any federal notification obligations under HIPAA or other applicable federal law.
(c) Regulatory Notification Filings and Strategy. Draft and final regulatory notification filings, individual notification letters, and associated legal strategy memoranda, including analyses of notification timing requirements, content requirements, and safe-harbor provisions.
(d) Regulatory Defense Materials. Regulatory defense submissions, responses to subpoenas, civil investigative demands, or other process, and privileged correspondence with state attorneys general, the Connecticut Insurance Department (including examinations conducted by Richard Nakamura, Examiner), HHS-OCR, and any other governmental or regulatory body, together with related legal strategy memoranda and analyses.
(e) Vendor Accountability Materials. Legal analyses of Quorum's contractual rights and remedies against Palomar Data Solutions, Inc. under the Master Services Agreement dated November 12, 2019 (as amended), including indemnification obligations, limitation of liability provisions, and breach of security representations and warranties, as well as demand letters, pre-litigation correspondence, and settlement negotiations or communications with Palomar and its counsel, Mercer, Haight & Dunlop LLP (Catherine Langford, Partner).
(f) Loss Quantification and Cost Documentation. Documentation and analyses relevant to the quantification of losses, costs, and expenses incurred or expected to be incurred in connection with the Incident, to the extent relevant to the Parties' common legal interest and to coverage under the Policy, including forensic investigation costs, consumer notification and credit monitoring costs, crisis communications expenses (including costs incurred through BrightPath Consulting Group Inc.), legal fees, regulatory defense costs, and internal Quorum remediation costs.
(g) Internal Quorum Communications. Internal Quorum communications to the extent prepared at the direction of counsel, subject to the attorney-client privilege, and relevant to the common legal interest of the Parties under this Agreement.
ARTICLE III — PRESERVATION OF PRIVILEGE
Section 3.1 — No Waiver. The sharing of Common Interest Materials pursuant to this Agreement shall not constitute a waiver of, and shall not be deemed to waive, the attorney-client privilege, the work product doctrine, or any other applicable privilege, protection, or immunity under federal or state law. The Parties expressly intend that the sharing of Common Interest Materials hereunder shall be undertaken in furtherance of their common legal interest as described in Recital E and that such sharing shall be protected by the common interest doctrine.
Each Party expressly reserves all rights to assert any applicable privilege, protection, or immunity with respect to any Common Interest Materials shared under this Agreement, in any Related Proceeding, coverage dispute, or other legal, regulatory, or administrative proceeding, whether pending or hereafter commenced. No disclosure of Common Interest Materials pursuant to this Agreement shall be construed as an admission that any particular material is or is not privileged, or as a concession regarding the scope or applicability of any privilege.
The Parties intend that all Common Interest Materials shared hereunder shall remain fully protected by all applicable privileges, protections, and immunities to the same extent as if such materials had not been shared with the other Party. In the event that any court, tribunal, or governmental body determines that the common interest doctrine does not apply to any particular communication or material shared under this Agreement, the Parties agree to cooperate in asserting all other available bases for privilege or protection with respect to such communication or material.
Section 3.2 — Ownership of Privilege. The disclosure of Common Interest Materials by one Party to the other pursuant to this Agreement shall not transfer ownership of the underlying privilege from the disclosing Party to the receiving Party. The privilege attaching to any particular communication or material shall remain the property of the Party (or its Counsel) that generated such communication or material, and shall be subject to assertion or waiver only by such Party (or its Counsel), subject to the limitations set forth in Section 3.3 below.
Each Party retains the right to assert or waive its own privilege with respect to materials it has generated or received from its own Counsel, provided that any such waiver shall not operate to waive the privilege of the other Party with respect to Common Interest Materials received from the other Party under this Agreement.
Section 3.3 — Consent Required for Waiver or Disclosure to Third Parties. Neither Party shall disclose, produce, transmit, or otherwise make available any Common Interest Materials received from the other Party to any third party, including without limitation any governmental authority, regulatory body, court, tribunal, arbitrator, opposing party, co-party, or any other person or entity, without the prior written consent of the Party that originally shared such materials. Such consent may be granted or withheld in the sole and absolute discretion of the disclosing Party.
A Party seeking to disclose Common Interest Materials received from the other Party shall provide no fewer than ten (10) business days' prior written notice to the other Party, which notice shall: (i) identify with reasonable particularity the materials at issue; (ii) identify the proposed recipient and the reason for the proposed disclosure; and (iii) describe any protective measures (including but not limited to protective orders, confidentiality agreements, or in camera review) that the disclosing Party proposes to employ in connection with such disclosure. The receiving Party shall cooperate with the disclosing Party's efforts to assert applicable privileges or seek protective orders to prevent or limit such disclosure.
Section 3.4 — Compelled Disclosure. In the event that either Party receives a subpoena, court order, civil investigative demand, regulatory demand, or other compulsory legal process requiring the production or disclosure of Common Interest Materials received from the other Party, the receiving Party shall:
(a) promptly, and in no event later than three (3) business days after receipt of such compulsory process, notify the disclosing Party in writing of the existence and terms of such process, including a description of the materials sought;
(b) cooperate fully with the disclosing Party's efforts to resist, quash, or limit such compelled disclosure, including joining in or supporting any motion for a protective order, motion to quash, or other appropriate procedural mechanism;
(c) assert on behalf of the disclosing Party, to the fullest extent permitted by law, all applicable privileges and protections with respect to the materials at issue; and
(d) disclose only such materials as are strictly required by final, non-appealable court order or other binding legal process, after exhausting all reasonable efforts to resist or limit such disclosure.
The costs and expenses incurred by either Party in connection with efforts to resist or limit compelled disclosure of Common Interest Materials shall be borne by the Party asserting the privilege, unless the Parties otherwise agree in writing.
ARTICLE IV — CONFIDENTIALITY OBLIGATIONS
Section 4.1 — Confidential Treatment. All Common Interest Materials shared under this Agreement shall be treated as strictly confidential by the receiving Party. The receiving Party shall safeguard all Common Interest Materials with the same degree of care it employs to protect its own most sensitive privileged and confidential information, and in no event less than a reasonable degree of care.
Access to Common Interest Materials shall be limited to the following categories of authorized recipients:
(a) in-house legal counsel of the receiving Party who have a need to know in connection with the Incident, the Claim, or any Related Proceeding;
(b) outside counsel designated under Section 1.2 of this Agreement;
(c) such officers, employees, or agents of the receiving Party as have a demonstrable need to know in connection with the Incident, the Claim, or any Related Proceeding, and who are subject to confidentiality obligations at least as protective as those set forth in this Agreement (whether by virtue of employment, contract, or professional obligation).
For Quorum, authorized recipients of Common Interest Materials received from Atlas shall include the following individuals: Thomas R. Whitfield (General Counsel), Jennifer Liang (Chief Privacy Officer), David Naranjo (Chief Information Security Officer), and such other Quorum personnel as Outside Counsel may designate in writing with Atlas's prior written consent, which consent shall not be unreasonably withheld.
For Atlas, authorized recipients of Common Interest Materials received from Quorum shall include the following individuals: Paul Enriquez (Claims Adjuster), and such other Atlas claims, underwriting, legal, or actuarial personnel as Atlas may designate in writing in accordance with the notice provisions set forth in this Agreement.
Each Party shall maintain a record of the individuals within its organization who have been granted access to Common Interest Materials received from the other Party, and shall make such record available to the other Party upon reasonable request.
Section 4.2 — No Use for Coverage Dispute. Neither Party shall use Common Interest Materials obtained from the other Party under this Agreement for the purpose of establishing, contesting, or litigating any coverage dispute between the Parties under the Policy, unless both Parties expressly consent in writing to such use. This restriction applies to all Common Interest Materials, regardless of the form or medium in which such materials exist, and includes the use of any derivative analyses or summaries based upon Common Interest Materials received from the other Party.
For the avoidance of doubt, this restriction shall not limit either Party's right to use its own independently generated materials, information, analyses, or work product in any coverage dispute. Nor shall this restriction preclude either Party from independently developing or obtaining, through its own investigation or from sources other than the other Party, information that is similar or identical to information contained in Common Interest Materials received under this Agreement.
Section 4.3 — Marking of Materials. To the extent practicable, Common Interest Materials shared under this Agreement shall be marked or labeled with the following legend, or substantially equivalent language, at the time of disclosure:
"PRIVILEGED AND CONFIDENTIAL — SUBJECT TO COMMON INTEREST AGREEMENT"
The failure to mark or label any particular material with the foregoing legend shall not affect the privileged or confidential status of such material, provided that the material otherwise qualifies as a Common Interest Material under this Agreement. Either Party may request that the other Party retroactively apply appropriate markings to previously shared materials that were not marked at the time of disclosure.
ARTICLE V — RESERVATION OF RIGHTS
Section 5.1 — No Admission of Liability or Coverage. This Agreement shall not be construed as an admission by Atlas of coverage or liability under the Policy for any particular loss, cost, expense, or claim, nor as a waiver of any coverage defenses, exclusions, conditions, sublimits, or limitations under the Policy. Atlas expressly reserves all of its rights under the Policy, including without limitation the right to deny coverage, disclaim liability, assert any defense to coverage, invoke any exclusion or condition, or take any other position with respect to the Claim or the Policy, and nothing contained in this Agreement shall be deemed to expand, alter, modify, or amend the coverage provided by the Policy or to create any coverage obligation not expressly set forth in the Policy.
Atlas's participation in this Agreement, its review of Common Interest Materials, and its communications with Quorum or Quorum's Counsel in connection with this Agreement shall not be construed as an acceptance of coverage, an assumption of a duty to defend, an estoppel, or a waiver of any rights or defenses under the Policy, at law, or in equity.
Section 5.2 — No Admission by Quorum. This Agreement shall not be construed as an admission by Quorum of liability, fault, negligence, or wrongdoing to any third party, regulator, governmental authority, or affected individual in connection with the Incident. Quorum expressly reserves all of its rights and defenses with respect to any claims, regulatory actions, or proceedings arising from or related to the Incident, including without limitation any defenses based on the acts or omissions of Palomar Data Solutions, Inc. or any other third party.
Section 5.3 — Independent Legal Interests. Notwithstanding their common legal interest as described in Recital E and elsewhere in this Agreement, each Party acknowledges and agrees that it may have separate and independent legal interests with respect to certain matters, including without limitation:
(a) the scope, applicability, and interpretation of coverage under the Policy;
(b) the amount and characterization of insured losses, costs, and expenses;
(c) the application, satisfaction, and calculation of the SIR;
(d) the allocation of losses between covered and non-covered categories;
(e) the reasonableness and necessity of expenses incurred in connection with the Incident; and
(f) any other matter on which the interests of the insured and the insurer may diverge.
The existence of this Agreement shall not preclude either Party from asserting any claim, defense, right, or position in any coverage dispute or other proceeding between the Parties, subject to the limitations on use of Common Interest Materials set forth in Section 4.2 of this Agreement. Neither Party shall be estopped, by virtue of its participation in this Agreement or the exchange of Common Interest Materials hereunder, from taking any position in any coverage dispute that it would otherwise be entitled to take.
ARTICLE VI — TERM AND TERMINATION
Section 6.1 — Effective Date. This Agreement shall be effective as of the date first written above, May 10, 2023.
Section 6.2 — Term. This Agreement shall remain in effect until the earliest of:
(a) the date upon which both Parties execute a written agreement to terminate this Agreement;
(b) the date of final resolution (including the exhaustion or expiration of all applicable appeal periods) of all Related Proceedings; or
(c) the date that is thirty (30) calendar days following the date on which either Party delivers written notice to the other Party of its intention to withdraw from this Agreement;
provided, however, that the withdrawal of either Party pursuant to clause (c) above shall not affect the protections afforded to Common Interest Materials shared prior to the effective date of such withdrawal. All Common Interest Materials shared prior to withdrawal shall continue to be governed by the terms of this Agreement, including the privilege-preservation and confidentiality obligations set forth herein, notwithstanding the termination of this Agreement.
Section 6.3 — Survival. The obligations set forth in Article III (Preservation of Privilege), Article IV (Confidentiality Obligations), and Article V (Reservation of Rights) shall survive the termination, expiration, or withdrawal from this Agreement in perpetuity, or for such shorter period as may be required by the final resolution of all Related Proceedings and the expiration of all applicable statutes of limitations, whichever is later.
Section 6.4 — Return or Destruction of Materials. Upon termination of this Agreement for any reason, each Party shall, at the written request of the disclosing Party, promptly return to the disclosing Party or destroy all Common Interest Materials received from the disclosing Party, including all copies, summaries, extracts, and derivative works thereof, in whatever form or medium. Within thirty (30) calendar days of such request, the receiving Party shall certify in writing, through a duly authorized officer or Counsel, that it has complied with this obligation.
Notwithstanding the foregoing, the receiving Party shall not be required to return or destroy Common Interest Materials to the extent that retention of such materials is required by applicable law, regulation, court order, or regulatory directive, or to the extent that such materials are contained in routine electronic backup systems that are not reasonably accessible in the ordinary course of business. Any materials retained pursuant to this exception shall continue to be subject to the confidentiality and privilege-preservation obligations of this Agreement.
ARTICLE VII — GENERAL PROVISIONS
Section 7.1 — Governing Law. This Agreement shall be governed by and construed in accordance with the laws of the State of Connecticut, without regard to its conflict of laws principles. The State of Connecticut has been selected as the governing jurisdiction because it is the jurisdiction of Quorum's headquarters and principal regulatory nexus, and because a substantial number of the regulatory and legal matters arising from the Incident will involve Connecticut law and Connecticut regulatory authorities, including the Connecticut Insurance Department.
Section 7.2 — Entire Agreement. This Agreement, including all exhibits attached hereto and incorporated herein by reference, constitutes the entire agreement between the Parties with respect to the subject matter hereof and supersedes all prior or contemporaneous oral or written agreements, understandings, representations, negotiations, or communications between the Parties relating to the sharing of privileged or confidential materials in connection with the Incident, the Claim, or any Related Proceeding. No representation, warranty, promise, inducement, or statement of intention has been made by either Party that is not embodied in this Agreement, and neither Party shall be bound by or liable for any alleged representation, warranty, promise, inducement, or statement of intention not set forth herein.
Section 7.3 — Amendments. This Agreement may be amended, modified, or supplemented only by a written instrument signed by both Parties or their duly authorized Counsel. No oral modification or waiver of any provision of this Agreement shall be effective. Any amendment extending the scope of this Agreement to cover additional incidents, claims, or parties shall be set forth in a written amendment that specifically identifies the additional subject matter and is executed by all relevant parties.
Section 7.4 — No Third-Party Beneficiaries. This Agreement is for the sole and exclusive benefit of the Parties and their respective Counsel and shall not confer any rights, remedies, benefits, claims, or causes of action on any third party, whether by virtue of the common interest doctrine or otherwise.
For the avoidance of doubt, Palomar Data Solutions, Inc., Mercer, Haight & Dunlop LLP, Graystone Forensics LLC, BrightPath Consulting Group Inc., Pinnacle Surplus Lines Insurance Corp., and any other person or entity are not parties to, and are not intended to be beneficiaries of, this Agreement, and no provision of this Agreement shall be enforceable by any such person or entity.
Section 7.5 — Notices. All notices, requests, consents, demands, and other communications under this Agreement shall be in writing and shall be deemed to have been duly given when delivered by hand, when sent by nationally recognized overnight courier service, or when sent by email (with confirmation of receipt), addressed as follows:
If to Quorum:
Thomas R. Whitfield General Counsel Quorum Insurance Holdings Corp. 400 Constitution Plaza, Suite 2200 Hartford, Connecticut 06103
Email: twhitfield@quoruminsurance.com
with a copy (which shall not constitute notice) to:
Kevin Ostrowski Partner, Privacy & Data Security Calderwood & Harkness LLP 1700 K Street NW, Suite 900 Washington, D.C. 20006
Email: kostrowski@calderwoodharkness.com
If to Atlas:
Paul Enriquez Claims Adjuster Atlas Mutual Insurance Company 120 South LaSalle Street, Suite 3200 Chicago, Illinois 60603
Email: penriquez@atlasmutual.com
Either Party may change its notice address by providing written notice to the other Party in accordance with this Section 7.5.
Section 7.6 — Counterparts. This Agreement may be executed in two or more counterparts, each of which shall be deemed an original and all of which together shall constitute one and the same instrument. Delivery of an executed counterpart by electronic mail (including PDF) or by facsimile transmission shall be equally as effective as delivery of a manually executed counterpart. Electronic or facsimile signatures shall have the same force and effect as original ink signatures for all purposes of this Agreement.
Section 7.7 — Severability. If any provision of this Agreement is held by a court of competent jurisdiction or other tribunal to be invalid, illegal, or unenforceable for any reason, such invalidity, illegality, or unenforceability shall not affect any other provision of this Agreement, and the remaining provisions shall continue in full force and effect. The Parties shall negotiate in good faith to replace any invalid, illegal, or unenforceable provision with a valid provision that, to the greatest extent possible, achieves the original intent and economic effect of the invalid provision.
Section 7.8 — Relationship to Policy. This Agreement is supplemental to, and does not modify, amend, alter, or supersede, the terms and conditions of Policy No. CYB-2023-041587, including without limitation any cooperation obligations, consent provisions, notification provisions, voluntary payment clauses, or other conditions precedent to coverage set forth in the Policy. In the event of any conflict or inconsistency between any provision of this Agreement and any provision of the Policy, the terms of the Policy shall control with respect to the rights and obligations of the Parties under the Policy. Nothing in this Agreement shall be construed to impose upon Atlas any obligation that is inconsistent with or in addition to Atlas's obligations under the Policy, nor shall anything in this Agreement be construed to relieve Quorum of any obligation or condition imposed upon it under the Policy.
Section 7.9 — Excess Carrier. The Parties acknowledge that Pinnacle Surplus Lines Insurance Corp. ("Pinnacle") has issued an excess cyber-liability insurance policy bearing Policy No. XS-CYB-2023-7812, which provides Twenty-Five Million Dollars ($25,000,000) in excess cyber-liability coverage above the Atlas primary layer, for a total insurance tower of Forty Million Dollars ($40,000,000). Pinnacle is not a party to this Agreement, and nothing in this Agreement shall be construed to create any obligation on the part of Pinnacle or to confer any rights or benefits on Pinnacle.
To the extent the Parties determine that it is advisable or necessary to extend the common interest framework established by this Agreement to include Pinnacle, the Parties may enter into a separate common interest agreement with Pinnacle or amend this Agreement to include Pinnacle as an additional party, in either case with the prior written consent of all relevant parties. Any such extension or amendment shall be documented in writing and executed in accordance with the requirements of Section 7.3 of this Agreement.
[SIGNATURE PAGE FOLLOWS]
IN WITNESS WHEREOF, the undersigned Parties have caused this Common Interest Agreement to be executed by their duly authorized representatives as of the date first written above.
QUORUM INSURANCE HOLDINGS CORP.
By: ________
Name: Thomas R. Whitfield
Title: General Counsel
Date: ________
Acknowledged and agreed by Outside Counsel:
CALDERWOOD & HARKNESS LLP
By: ________
Name: Kevin Ostrowski
Title: Partner, Privacy & Data Security
Date: ________
ATLAS MUTUAL INSURANCE COMPANY
By: ________
Name: Paul Enriquez
Title: Claims Adjuster, Authorized Representative
Date: ________
EXHIBIT A
IDENTIFICATION OF COUNSEL
(Referenced in Section 1.2)
I. Counsel for Quorum Insurance Holdings Corp.
Firm: Calderwood & Harkness LLP
Office Addresses:
1700 K Street NW, Suite 900 Washington, D.C. 20006 Telephone: (202) 555-8400 Facsimile: (202) 555-8401
51 West 52nd Street, 34th Floor New York, New York 10019 Telephone: (212) 555-7300 Facsimile: (212) 555-7301
Designated Attorneys:
C&H Matter No.: 1025-00006
Calderwood & Harkness LLP may designate additional attorneys to serve as Counsel for Quorum from time to time in connection with C&H Matter No. 1025-00006, upon written notice to Atlas's designated representative.
II. Counsel for Atlas Mutual Insurance Company
Atlas Mutual Insurance Company shall designate its internal and/or external legal counsel by completing the information below and providing written notice thereof to Calderwood & Harkness LLP in accordance with Section 7.5 of the Agreement. Atlas shall provide such written notice prior to sharing any Common Interest Materials with any designated counsel.
Internal Counsel (if applicable):
External Counsel (if applicable):
Firm: _______
Address: _______
Designated Attorneys:
Atlas shall promptly notify Calderwood & Harkness LLP in writing of any changes to the foregoing designations, including the addition or removal of any attorney, in accordance with Section 7.5 of the Agreement.
EXHIBIT B
DESCRIPTION OF THE INCIDENT AND CLAIM
(Referenced in Recitals B and C)
I. Summary Description of the Incident
On or about March 14, 2023, a threat actor exploited a known remote code execution vulnerability designated as CVE-2023-0669 in a GoAnywhere MFT (Managed File Transfer) file transfer appliance operated by Palomar Data Solutions, Inc. ("Palomar"), a third-party claims-processing vendor retained by Quorum Insurance Holdings Corp. ("Quorum") pursuant to a Master Services Agreement dated November 12, 2019, as subsequently amended. The vulnerability permitted the threat actor to gain unauthorized access to Palomar's network environment and to execute commands on the affected file transfer appliance.
Unauthorized access to Palomar's systems was maintained during an approximately thirty-five (35) day window, from on or about March 14, 2023 through on or about April 18, 2023. During this period, the threat actor exfiltrated structured data files from the affected file transfer appliance, including files containing the following categories of personal and financial data pertaining to Quorum policyholders and claimants:
•  Personally Identifiable Information (PII): Full names, dates of birth, Social Security numbers, driver's license numbers, mailing addresses, email addresses, and telephone numbers.
•  Protected Health Information (PHI): Health insurance claim information, medical record numbers, diagnosis codes, treatment information, and health plan beneficiary identifiers.
•  Financial Data: Bank account numbers, payment card information (in limited instances), policy premium payment records, and claims payment history.
The compromised data pertained to approximately 318,247 Quorum policyholders and claimants located across twenty-nine (29) states and the District of Columbia.
II. Palomar's Notification to Quorum
On April 21, 2023, Palomar Data Solutions, Inc. notified Quorum of the security incident. Palomar's notification indicated that it had become aware of anomalous activity on its GoAnywhere MFT appliance on or about April 18, 2023, that it had engaged a third-party forensic investigation firm to assess the scope of the compromise, and that preliminary findings indicated that data files belonging to Quorum had been accessed and potentially exfiltrated by an unauthorized third party.
III. Engagement of Counsel and Forensic Investigators
On May 4, 2023, Quorum engaged Calderwood & Harkness LLP ("C&H") as outside counsel to coordinate the incident response, forensic investigation, regulatory notification compliance, regulatory defense, and vendor accountability negotiations arising from the Incident. The engagement was assigned C&H Matter No. 1025-00006.
On May 5, 2023, Calderwood & Harkness LLP, at the direction of counsel and under the umbrella of the attorney-client privilege, retained Graystone Forensics LLC, a Virginia limited liability company headquartered at 1950 Old Gallows Road, Suite 600, Tysons Corner, Virginia 22182, to conduct an independent forensic investigation of the Incident (the "Forensic Investigation"). Graystone Forensics was retained by and reports to Calderwood & Harkness LLP in order to preserve the privileged nature of its findings, analyses, and reports.
IV. Filing of Claim with Atlas
On May 8, 2023, Quorum, through its Outside Counsel, submitted a formal notice of claim to Atlas Mutual Insurance Company under Policy No. CYB-2023-041587. Atlas assigned Claim No. CYB-CLM-2023-05892 to the notice of claim.
V. Anticipated Cost Categories
Based on preliminary assessments as of the date of this Agreement, the following categories of costs and expenses are anticipated to be incurred in connection with the Incident, subject to further investigation, analysis, and adjustment:
The foregoing cost categories are provided for illustrative purposes and do not represent an exhaustive list of all costs and expenses that may be incurred. The inclusion of any cost category in this Exhibit B does not constitute an admission by Atlas that such costs are covered under the Policy, nor does it constitute a waiver of any coverage defenses, exclusions, or limitations.
VI. Policy Terms Applicable to the Claim
•  Policy Number: CYB-2023-041587
•  Coverage Period: January 1, 2023 through January 1, 2024
•  Per-Occurrence Limit: $15,000,000
•  Aggregate Limit: $15,000,000
•  Self-Insured Retention (SIR): $2,500,000
•  Excess Coverage: Pinnacle Surplus Lines Insurance Corp., Policy No. XS-CYB-2023-7812, providing $25,000,000 excess of the Atlas primary layer
•  Total Insurance Tower: $40,000,000
This Exhibit B is provided for reference and informational purposes in connection with the Common Interest Agreement to which it is attached. The information contained herein is based on preliminary assessments as of May 10, 2023 and is subject to revision as the investigation and response to the Incident progress. Nothing in this Exhibit B shall be construed as an admission of coverage, liability, fault, or wrongdoing by either Party.
Name | Role | Email
Kevin Ostrowski | Responsible Partner, Privacy & Data Security | kostrowski@calderwoodharkness.com
Rachel Bernstein | Billing Partner | rbernstein@calderwoodharkness.com
Alan Burke | Lead Associate | aburke@calderwoodharkness.com
Sara Hendricks | Working Associate | shendricks@calderwoodharkness.com
Name | Title | Email
_______ | _______ | _______
Name | Role | Email
_______ | _______ | _______
_______ | _______ | _______
Category | Vendor / Provider | Estimated Range
Forensic Investigation | Graystone Forensics LLC | To be determined
Consumer Notification and Credit Monitoring | Notification vendor (to be selected) | To be determined
Crisis Communications | BrightPath Consulting Group Inc. | To be determined
Legal Fees — Incident Response, Regulatory Defense, and Vendor Accountability | Calderwood & Harkness LLP | To be determined
Regulatory Defense Costs | Calderwood & Harkness LLP / local regulatory counsel as needed | To be determined
Internal Quorum Remediation Costs | Quorum Insurance Holdings Corp. (internal resources) | To be determined

COMMON INTEREST AGREEMENT

RECITALS

WHEREAS:

QUORUM INSURANCE HOLDINGS CORP.

CALDERWOOD & HARKNESS LLP

ATLAS MUTUAL INSURANCE COMPANY

EXHIBIT A

IDENTIFICATION OF COUNSEL

EXHIBIT B

DESCRIPTION OF THE INCIDENT AND CLAIM

Record

Parties

Dates

Amounts