1025-00006 · Graystone Forensics LLC · Engagement & Privilege

engagement-letter-quorum.docx DOCUMENT Data Privacy

31 / 88 ← → ✕

PRIVILEGED & CONFIDENTIAL

CALDERWOOD & HARKNESS LLP Attorneys at Law 1700 K Street NW, Suite 900 Washington, D.C. 20006 Tel: (202) 555-4100

Fax: (202) 555-4101

www.calderwoodharkness.com

May 4, 2023

Thomas R. Whitfield, Esq. General Counsel Quorum Insurance Holdings Corp. 400 Constitution Plaza, Suite 2200 Hartford, CT 06103

Re: Engagement of Calderwood & Harkness LLP — Data Security Incident Response Matter Number: 1025-00006

Dear Mr. Whitfield:

1. Introduction and Purpose

Calderwood & Harkness LLP ("C&H" or the "Firm") is pleased to confirm its engagement by Quorum Insurance Holdings Corp. ("Quorum" or the "Company"), a Delaware corporation publicly traded on the Nasdaq Stock Market under the ticker symbol QIHC, in connection with the data security incident originating from Quorum's third-party claims-processing vendor, Palomar Data Solutions, Inc. ("Palomar"), a Texas corporation headquartered at 7100 Greenville Avenue, Suite 450, Dallas, TX 75231. This engagement letter sets forth the terms and conditions under which the Firm will provide legal services to Quorum in connection with this matter.

As you are aware, Palomar notified Quorum on April 21, 2023, of a security incident involving unauthorized access to Palomar's network environment and the potential compromise of Quorum policyholder and claimant data processed by Palomar under the Master Services Agreement dated November 12, 2019, as amended (the "MSA"). Based on the information made available to date, the initial unauthorized access to Palomar's systems is believed to have begun on or about March 14, 2023. Palomar's internal security operations team identified anomalous activity within its network environment on April 18, 2023, and subsequently confirmed the intrusion and potential data exposure. Palomar's notification to Quorum followed three days later, on April 21, 2023.

Given the nature of Quorum's business as a provider of property and casualty insurance products, the potentially affected data sets are likely to include sensitive personal information of policyholders and claimants, which may encompass names, addresses, dates of birth, Social Security numbers, financial account information, medical information, and claims history data. The Firm understands that Quorum processes claims data through Palomar's platform across approximately thirty-eight states, the District of Columbia, and certain U.S. territories, which will necessitate a comprehensive, multi-jurisdictional analysis of applicable breach notification obligations.

C&H's Privacy & Data Security practice group will serve as lead outside counsel for Quorum's incident response. We have assembled an experienced team of attorneys who regularly counsel clients through complex, multi-state data security incidents, and we are well positioned to guide Quorum through all phases of its response to this matter. The terms of our engagement are set forth in the sections that follow.

2. Scope of Engagement

The Firm will represent and advise Quorum in all aspects of its response to the vendor-originated data security incident described above, including but not limited to the following workstreams. In providing these services, C&H will exercise independent professional judgment and act at all times in the best interests of Quorum as the Firm's client in this matter.

2.1 Incident Response Coordination

C&H will serve as central coordinating counsel for all incident response activities undertaken by or on behalf of Quorum in connection with the Palomar security incident. In this capacity, the Firm will:

(a) Advise and collaborate with Quorum's internal incident response team, which currently includes David Naranjo, Chief Information Security Officer; Jennifer Liang, Chief Privacy Officer; Priya Deshmukh, Vice President of Vendor Risk Management; and Robert Wentworth, Senior Vice President of Claims Operations, as well as such other personnel as the Company may designate from time to time;

(b) Coordinate with Quorum's crisis communications firm, BrightPath Consulting Group Inc. ("BrightPath"), regarding the development and review of external and internal communications, media statements, and customer-facing messaging related to the incident, to ensure that such communications are consistent with the Company's legal obligations and do not inadvertently waive any applicable privileges;

(c) Coordinate with Quorum's cyber-insurance broker, Whitmore Risk Advisors Inc. ("Whitmore Risk"), regarding matters relating to insurance coverage, claims submission, and carrier engagement, as described more fully in Section 2.6 below;

(d) Develop and maintain a comprehensive incident response timeline and action-item tracker for the purpose of monitoring the status of key workstreams, deadlines, and deliverables; and

(e) Convene and participate in regular incident response team meetings, as frequently as warranted by the pace and stage of the investigation, and provide ongoing legal counsel to the incident response team in connection with decisions arising throughout the response process.

2.2 Forensic Investigation Oversight

C&H will retain and direct, under the umbrella of the attorney-client privilege and the work product doctrine, a qualified digital forensics and incident response ("DFIR") firm to conduct the technical investigation into the scope and nature of the security incident at Palomar. Specifically, the Firm will:

(a) Engage Graystone Forensics LLC ("Graystone") as the DFIR firm retained at the direction of counsel to assist C&H in rendering legal advice to Quorum regarding the incident. Graystone's engagement will be structured to maximize the protection of applicable privileges, as described more fully in Section 6.2 below;

(b) Oversee the forensic investigation to determine, among other things: (i) the threat actor's entry vector and the methods used to gain unauthorized access to Palomar's network environment; (ii) the timeline of unauthorized access, lateral movement, and data exfiltration activities; (iii) the identification of the specific data sets and data types that were accessed, acquired, or exfiltrated; and (iv) the number and identity of individuals whose personal information was potentially compromised;

(c) Coordinate with Palomar and Palomar's own forensic investigators as necessary to obtain access to relevant systems, logs, and forensic artifacts, while maintaining appropriate privilege protections and avoiding any conflation of Quorum's privileged investigation with Palomar's separate internal investigation; and

(d) Direct the preparation of forensic reports and findings by Graystone, all of which will be addressed and delivered to C&H for the purpose of enabling the Firm to render legal advice to Quorum. All forensic work product will be directed to and through Calderwood & Harkness to preserve attorney-client privilege and work product protection.

2.3 Notification Compliance

C&H will advise Quorum on all applicable notification obligations arising from the security incident and will manage the notification process on Quorum's behalf. This workstream will include the following:

(a) Conducting a comprehensive analysis of applicable federal and state breach notification statutes, regulations, and guidance across all potentially affected jurisdictions, including an assessment of triggering thresholds, notification content requirements, timing requirements, and available exceptions or safe harbors;

(b) Preparing and reviewing consumer notification letters for mailing to affected individuals, tailored to the specific requirements of each applicable jurisdiction, and including all required content elements such as a description of the incident, the types of personal information involved, and the steps being taken by Quorum in response;

(c) Preparing and filing all required regulatory notifications with state attorneys general, state insurance regulators, and any other applicable state or federal regulators, including the Connecticut Insurance Department and, if protected health information ("PHI") as defined under the Health Insurance Portability and Accountability Act of 1996 ("HIPAA") is determined to have been implicated, the U.S. Department of Health and Human Services, Office for Civil Rights;

(d) Coordinating with a notification and credit monitoring vendor (to be selected) for the production and mailing of consumer notification letters, the establishment and operation of a consumer call center to handle inquiries from affected individuals, and the enrollment of eligible individuals in complimentary credit monitoring and identity theft protection services, as may be required by applicable law or otherwise offered by Quorum as a remedial measure; and

(e) Advising on any obligations to provide notification to consumer reporting agencies pursuant to applicable state and federal law, and preparing any required notices to such agencies.

2.4 Regulatory Defense

C&H will represent Quorum in any inquiries, investigations, civil investigative demands, enforcement proceedings, or other regulatory actions initiated by state attorneys general, the Connecticut Insurance Department, the HHS Office for Civil Rights, or any other state or federal regulatory body arising from or related to the Palomar security incident. In this capacity, the Firm will:

(a) Prepare responses to regulatory inquiries, information requests, subpoenas, and civil investigative demands;

(b) Develop and manage a regulatory engagement strategy designed to foster cooperative relationships with regulators while protecting Quorum's legal interests;

(c) Advise on the implications of any state or multi-state attorney general investigation, including the potential for coordinated multi-state proceedings; and

(d) Represent Quorum in any informal or formal proceedings, hearings, or negotiations with regulatory authorities as may be necessary.

2.5 Vendor Accountability

C&H will advise Quorum on its contractual rights and remedies against Palomar in connection with the security incident. This workstream will include the following:

(a) Analyzing the Master Services Agreement between Quorum and Palomar dated November 12, 2019, as amended by Amendment 1 dated March 3, 2021, and Amendment 2 dated September 15, 2022, to assess Palomar's data security obligations, representations and warranties, breach notification obligations, indemnification provisions, limitation of liability clauses, and any other relevant contractual terms;

(b) Advising on and pursuing contractual remedies against Palomar, including indemnification claims under Section 12.2 of the MSA, which the Firm understands to provide for Palomar's indemnification of Quorum for losses arising from Palomar's breach of its data security obligations and/or its negligent handling of Quorum data;

(c) Preparing and transmitting formal demand letters, indemnification notices, and other correspondence to Palomar and its counsel, Mercer, Haight & Dunlop LLP, as appropriate;

(d) Negotiating with Palomar and Mercer, Haight & Dunlop LLP regarding vendor accountability, cost allocation, and loss recovery, including reimbursement of incident response costs, notification costs, credit monitoring costs, and any regulatory penalties or settlement payments attributable to Palomar's conduct; and

(e) Advising on the preservation of Quorum's rights and remedies under the MSA, including with respect to any applicable notice provisions, cure periods, or contractual limitations periods.

2.6 Insurance Coverage Coordination

C&H will advise Quorum on coverage under its cyber-liability insurance program in connection with the security incident. The Company's relevant insurance program, as the Firm currently understands it, includes the following:

(a) A primary cyber-liability insurance policy issued by Atlas Mutual Insurance Company, Policy No. CYB-2023-041587, providing coverage with a per-occurrence limit of $15,000,000 and a self-insured retention ("SIR") of $2,500,000 (the "Primary Policy"); and

(b) An excess cyber-liability insurance policy issued by Pinnacle Surplus Lines Insurance Corp., Policy No. XS-CYB-2023-7812, providing $25,000,000 in coverage excess of the $15,000,000 Primary Policy limit (the "Excess Policy").

In connection with insurance coverage matters, the Firm will:

(a) Review the Primary Policy and the Excess Policy to assess the scope of available coverage for costs and liabilities arising from the Palomar security incident, including coverage for forensic investigation costs, notification costs, credit monitoring costs, regulatory defense costs, regulatory fines and penalties (to the extent insurable), and third-party claims;

(b) Assist Quorum with the timely filing of notice of claim with Atlas Mutual Insurance Company and, as warranted, Pinnacle Surplus Lines Insurance Corp., and advise on compliance with all policy conditions and cooperation requirements;

(c) Manage ongoing communications with the insurers and their coverage counsel regarding the status of the claim, coverage positions, and any coverage disputes that may arise; and

(d) Coordinate with Whitmore Risk Advisors Inc., and specifically with Sandra Whitmore-Kim, Lead Broker, as needed regarding broker-facilitated communications with the insurers and any coverage-related negotiations.

2.7 Board and Management Reporting

C&H will prepare privileged briefing memoranda for Quorum's Board of Directors, the Audit Committee of the Board of Directors (chaired by Franklin Reeves), Chief Executive Officer Margaret D. Calloway, and the General Counsel, as needed throughout the duration of the engagement. These memoranda will provide updates on the status of the forensic investigation, notification process, regulatory engagement, vendor accountability efforts, insurance coverage matters, and any other material developments in the incident response. All such memoranda will be prepared as privileged attorney-client communications and marked accordingly.

2.8 SEC Disclosure Considerations

C&H will advise Quorum on its disclosure obligations under the federal securities laws in connection with the security incident. This will include analysis of potential disclosure obligations under Form 8-K (including under the Securities and Exchange Commission's recently adopted cybersecurity incident disclosure rules), as well as periodic reporting obligations in Quorum's Form 10-Q and Form 10-K filings. The Firm will coordinate with Quorum's securities counsel, to the extent the Company engages separate counsel for securities matters, to ensure consistency in disclosure analysis and approach.

3. Engagement Team

The following attorneys will be primarily responsible for providing legal services to Quorum in connection with this matter:

Kevin Ostrowski will serve as the Responsible Partner with overall supervisory responsibility for the engagement. Mr. Ostrowski will serve as the primary point of contact for Quorum's General Counsel and incident response team and will be responsible for the strategic direction of all workstreams described in Section 2. Rachel Bernstein will serve as the Billing Partner for the engagement and will be available for matters relating to insurance coverage analysis and SEC disclosure considerations, drawing on her experience advising public company clients on cybersecurity-related disclosure obligations.

Alan Burke will serve as the Lead Associate on the engagement and will be responsible for the day-to-day management of incident response activities, including oversight of the forensic investigation, preparation of notification materials, and regulatory compliance analysis. Sara Hendricks will serve as a Working Associate on the engagement, providing research and drafting support across all workstreams.

Additional attorneys, paralegals, or staff may be assigned to the matter as the scope and pace of the engagement require. Quorum will be notified of any additional personnel assignments prior to the commencement of their work on the matter. The Firm may also engage attorneys from other practice groups within C&H, including but not limited to the insurance coverage and securities regulation practice groups, as the needs of the engagement warrant. Any such attorneys will be subject to the billing rates set forth in Section 4 below or as otherwise agreed in writing between the Firm and Quorum.

4. Billing Rates and Fee Arrangements

4.1 Hourly Rates

The Firm's current standard hourly rates for the members of the engagement team assigned to this matter are as follows:

These rates are effective as of January 1, 2023, and are subject to annual adjustment, typically effective January 1 of each calendar year. The Firm will provide Quorum with advance written notice of any rate adjustments no fewer than thirty (30) days prior to the effective date of such adjustments. Rates for any additional attorneys assigned to the matter will be communicated to Quorum prior to the commencement of their work on the engagement.

Paralegal and litigation support specialist rates currently range from $275.00 to $450.00 per hour, depending on the experience level and specialization of the individual.

4.2 Disbursements and Expenses

In addition to fees for professional services, Quorum will be responsible for reimbursement of reasonable out-of-pocket disbursements and expenses incurred by the Firm in connection with the engagement. Disbursements and expenses include, but are not limited to, the following: travel expenses (including airfare, ground transportation, lodging, and meals incurred in connection with travel undertaken on behalf of Quorum); court filing fees; copying and printing costs; electronic research charges (including charges for Westmark Data Systems, Sundial Solutions, and similar legal research platforms); expert and consultant fees (except where such experts or consultants are retained under a separate engagement agreement directly with Quorum); courier and delivery charges; and long-distance communication costs.

The retention of Graystone Forensics LLC as the forensic investigation firm and any other third-party vendors retained in connection with the incident response (including, without limitation, notification and credit monitoring services vendors) will be subject to separate engagement agreements and statements of work. Costs incurred by such third-party vendors will be billed to Quorum either directly by the vendor or through C&H as coordinating counsel, as determined on a vendor-by-vendor basis. The Firm will consult with Quorum regarding the selection and retention of any such vendors and will seek Quorum's approval of vendor fees and cost estimates prior to engagement where practicable.

4.3 Billing and Payment

The Firm will submit monthly invoices to Quorum for fees and disbursements incurred during the preceding billing period. Invoices are due and payable within thirty (30) days of the invoice date.

Invoices will include reasonable detail regarding the services performed during the applicable billing period, including the identification of each timekeeper who performed services, the hours expended by each timekeeper, and a narrative description of the work performed. Invoice descriptions will be prepared with due regard for the protection of applicable attorney-client privilege and work product protections, and the Firm reserves the right to redact or generalize descriptions to the extent necessary to preserve such protections. Should Quorum require invoices in any particular electronic billing format (e.g., LEDES), the Firm is prepared to accommodate such requirements upon request.

5. Matter Number

All time entries, disbursements, correspondence, and other records related to this engagement should reference Calderwood & Harkness Matter Number 1025-00006. Quorum is requested to include this matter number on all correspondence and communications directed to the Firm in connection with this matter to facilitate efficient matter management and billing.

6. Privilege and Confidentiality

6.1 Attorney-Client Privilege

All communications between C&H and Quorum in connection with this engagement are intended to be, and should be treated as, privileged and confidential attorney-client communications. The attorney-client privilege belongs to Quorum as the client, and the Firm will take all reasonable steps to protect the confidentiality of communications and work product generated in connection with this engagement.

Quorum should take care to limit the dissemination of privileged communications to those individuals within the Company who have a need to know in connection with the incident response. Privileged communications should not be forwarded to, shared with, or discussed with individuals outside the incident response team without prior consultation with C&H. Inadvertent disclosure of privileged communications to third parties may result in a waiver of the privilege, which could have significant consequences for Quorum's legal interests in connection with any subsequent regulatory proceedings or litigation.

6.2 Forensic Investigation Privilege Framework

As noted in Section 2.2, the Firm intends to retain Graystone Forensics LLC to conduct the technical forensic investigation of the Palomar security incident. Graystone will be retained by C&H, at C&H's direction, for the express purpose of assisting the Firm in rendering legal advice to Quorum regarding the incident and Quorum's obligations arising therefrom.

All forensic reports, findings, analyses, and communications generated by Graystone in connection with the investigation will be directed to and through Calderwood & Harkness and will be treated as attorney work product and/or attorney-client privileged communications. Graystone will be instructed not to communicate directly with Quorum personnel regarding its findings except at the direction of and in the presence of C&H attorneys.

The Firm recognizes that the distinction between a privileged, counsel-directed forensic investigation and a non-privileged, business-purpose investigation is a critical one that must be carefully maintained. Accordingly, a separate privilege protocol memorandum will be prepared by C&H and issued to all members of the engagement team, including relevant Quorum personnel and Graystone, to establish clear procedures for the maintenance of privilege protections throughout the investigation. This privilege protocol will address, among other things, communication protocols, document marking and handling procedures, and guidelines for the separation of privileged forensic work from any non-privileged remediation or business-continuity activities.

6.3 Common Interest Agreements

The Firm anticipates that it may become necessary or advisable to enter into one or more common interest agreements (also referred to as joint defense agreements) with Quorum's cyber-liability insurers, Atlas Mutual Insurance Company and/or Pinnacle Surplus Lines Insurance Corp., or their respective coverage counsel, to facilitate the sharing of privileged and work-product-protected information without effecting a waiver of applicable protections. Such agreements may be beneficial in connection with the coordination of the forensic investigation, regulatory defense, and coverage analysis.

Any proposed common interest agreements will be prepared by C&H and submitted to Quorum for review and approval prior to execution. The Firm will advise Quorum regarding the benefits, risks, and limitations of any such agreements before recommending their execution.

7. Conflicts of Interest

The Firm has conducted a comprehensive conflicts check in connection with this engagement and has identified no conflicts of interest that would prevent C&H from undertaking this representation. Specifically, C&H does not currently represent Palomar Data Solutions, Inc., Mercer, Haight & Dunlop LLP, or any other party whose interests are adverse to Quorum in connection with this matter.

C&H is a large law firm with offices in multiple jurisdictions and a diverse client base that includes clients in the insurance, financial services, healthcare, and technology industries, among others. By executing this engagement letter, Quorum consents to C&H's continued representation of other clients in matters unrelated to this engagement, including clients in the insurance and financial services industries, provided that no conflict of interest arises in connection with this engagement. In the event that the Firm identifies a potential conflict of interest at any time during the course of this representation, the Firm will promptly notify Quorum and take such steps as are required under the applicable rules of professional conduct.

8. Document Retention

The Firm maintains document retention policies that govern the storage and disposition of client files and records. Upon the conclusion of this engagement, C&H will retain the Firm's files relating to this matter for a period consistent with the Firm's standard retention policies, after which the Firm may destroy such files without further notice to Quorum, unless Quorum has requested the return of specific documents or files.

Quorum is advised to maintain its own copies of all original documents, data, and materials provided to the Firm in connection with this engagement. The Firm will return original documents to Quorum upon request, and will provide copies of Firm-generated work product to Quorum as appropriate throughout the engagement.

Additionally, C&H will prepare and issue a legal hold notice for dissemination to relevant Quorum departments, including but not limited to Information Technology, Claims Operations, Vendor Risk Management, and the Office of the Chief Privacy Officer, to ensure the preservation of all documents, data, electronically stored information, and tangible materials potentially relevant to the incident. Quorum's prompt implementation of the legal hold is critical to the preservation of evidence and the protection of the Company's interests in any subsequent regulatory proceedings, litigation, or contractual dispute.

9. Limitation of Engagement

The scope of this engagement is limited to the matters described in Section 2 of this letter. C&H is not engaged to provide tax advice, accounting services, or business consulting services in connection with this matter. The Firm's advice and services will be limited to legal counsel in connection with the Palomar data security incident and the workstreams described herein.

This engagement does not encompass representation of Quorum in any litigation, arbitration, or other dispute resolution proceedings, whether brought by third parties (including affected individuals) or initiated by Quorum against Palomar or any other party, unless separately agreed in writing between C&H and Quorum. In the event that litigation or arbitration arises from or in connection with the security incident, the Firm will advise Quorum of the need for a separate engagement and will work with Quorum to establish appropriate terms for any such representation.

Any expansion of the scope of this engagement beyond the matters described in Section 2 will be confirmed in a supplemental engagement letter or written amendment to this letter, executed by both parties.

10. Termination

Either party may terminate this engagement upon written notice to the other party. Quorum may terminate the engagement at any time and for any reason by providing written notice to the Firm. C&H may withdraw from the engagement in accordance with the applicable rules of professional conduct, including situations where continued representation would require the Firm to violate applicable ethical rules or where the client-attorney relationship has been materially impaired.

Upon termination of the engagement, Quorum will remain responsible for payment of all fees for professional services rendered and all disbursements and expenses incurred through the effective date of termination. The Firm will promptly render a final invoice for all outstanding fees and expenses.

C&H will take all reasonable steps to protect Quorum's interests upon termination of the engagement, including providing reasonable cooperation in facilitating the orderly transition of the matter to successor counsel, if requested by Quorum. Such transition assistance will include the prompt transfer of relevant files, documents, and work product to successor counsel, subject to the satisfaction of any outstanding fee obligations.

11. Governing Law

This engagement letter and the terms and conditions set forth herein shall be governed by and construed in accordance with the laws of the District of Columbia, without regard to its conflict of laws principles.

12. Acceptance and Execution

We are grateful for Quorum's confidence in selecting Calderwood & Harkness LLP to serve as outside counsel in this important matter. We are committed to providing the highest quality legal services and to working collaboratively with Quorum's internal team to achieve the best possible outcome.

Please confirm Quorum's acceptance of the terms of this engagement by having Thomas R. Whitfield countersign this letter in the space provided below and return an executed copy to the undersigned by mail or email at kostrowski@calderwoodharkness.com. This engagement letter, together with any supplements or written amendments hereafter executed by both parties, constitutes the entire agreement between Calderwood & Harkness LLP and Quorum Insurance Holdings Corp. regarding the terms and conditions of the Firm's engagement in this matter, and supersedes all prior oral or written communications regarding the same.

We look forward to working with you and the Quorum team.

Very truly yours,

CALDERWOOD & HARKNESS LLP

By: ________

Kevin Ostrowski Partner, Privacy & Data Security Calderwood & Harkness LLP 1700 K Street NW, Suite 900 Washington, D.C. 20006 Tel: (202) 555-4118

Email: kostrowski@calderwoodharkness.com

ACCEPTED AND AGREED

The undersigned hereby confirms, on behalf of Quorum Insurance Holdings Corp., acceptance of the terms and conditions of engagement set forth in this letter dated May 4, 2023.

QUORUM INSURANCE HOLDINGS CORP.

By: ________

Name: Thomas R. Whitfield

Title: General Counsel

Quorum Insurance Holdings Corp. 400 Constitution Plaza, Suite 2200 Hartford, CT 06103

Date: ________

cc: Rachel Bernstein, Calderwood & Harkness LLP (New York) Alan Burke, Calderwood & Harkness LLP (Washington, D.C.) Sara Hendricks, Calderwood & Harkness LLP (Washington, D.C.)

Attorney	Role	Office
Kevin Ostrowski	Responsible Partner, Privacy & Data Security	Washington, D.C. (1700 K Street NW, Suite 900)
Rachel Bernstein	Billing Partner, Privacy & Data Security	New York, NY (51 West 52nd Street, 34th Floor, New York, NY 10019)
Alan Burke	Lead Associate, Privacy & Data Security	Washington, D.C. (1700 K Street NW, Suite 900)
Sara Hendricks	Working Associate, Privacy & Data Security	Washington, D.C. (1700 K Street NW, Suite 900)
Attorney	Hourly Rate
Kevin Ostrowski (Partner)	$1,250.00
Rachel Bernstein (Partner)	$1,175.00
Alan Burke (Associate)	$825.00
Sara Hendricks (Associate)	$650.00

PRIVILEGED & CONFIDENTIAL
CALDERWOOD & HARKNESS LLP Attorneys at Law 1700 K Street NW, Suite 900 Washington, D.C. 20006 Tel: (202) 555-4100
Fax: (202) 555-4101
www.calderwoodharkness.com
May 4, 2023
Thomas R. Whitfield, Esq. General Counsel Quorum Insurance Holdings Corp. 400 Constitution Plaza, Suite 2200 Hartford, CT 06103
Re: Engagement of Calderwood & Harkness LLP — Data Security Incident Response Matter Number: 1025-00006
Dear Mr. Whitfield:
1. Introduction and Purpose
Calderwood & Harkness LLP ("C&H" or the "Firm") is pleased to confirm its engagement by Quorum Insurance Holdings Corp. ("Quorum" or the "Company"), a Delaware corporation publicly traded on the Nasdaq Stock Market under the ticker symbol QIHC, in connection with the data security incident originating from Quorum's third-party claims-processing vendor, Palomar Data Solutions, Inc. ("Palomar"), a Texas corporation headquartered at 7100 Greenville Avenue, Suite 450, Dallas, TX 75231. This engagement letter sets forth the terms and conditions under which the Firm will provide legal services to Quorum in connection with this matter.
As you are aware, Palomar notified Quorum on April 21, 2023, of a security incident involving unauthorized access to Palomar's network environment and the potential compromise of Quorum policyholder and claimant data processed by Palomar under the Master Services Agreement dated November 12, 2019, as amended (the "MSA"). Based on the information made available to date, the initial unauthorized access to Palomar's systems is believed to have begun on or about March 14, 2023. Palomar's internal security operations team identified anomalous activity within its network environment on April 18, 2023, and subsequently confirmed the intrusion and potential data exposure. Palomar's notification to Quorum followed three days later, on April 21, 2023.
Given the nature of Quorum's business as a provider of property and casualty insurance products, the potentially affected data sets are likely to include sensitive personal information of policyholders and claimants, which may encompass names, addresses, dates of birth, Social Security numbers, financial account information, medical information, and claims history data. The Firm understands that Quorum processes claims data through Palomar's platform across approximately thirty-eight states, the District of Columbia, and certain U.S. territories, which will necessitate a comprehensive, multi-jurisdictional analysis of applicable breach notification obligations.
C&H's Privacy & Data Security practice group will serve as lead outside counsel for Quorum's incident response. We have assembled an experienced team of attorneys who regularly counsel clients through complex, multi-state data security incidents, and we are well positioned to guide Quorum through all phases of its response to this matter. The terms of our engagement are set forth in the sections that follow.
2. Scope of Engagement
The Firm will represent and advise Quorum in all aspects of its response to the vendor-originated data security incident described above, including but not limited to the following workstreams. In providing these services, C&H will exercise independent professional judgment and act at all times in the best interests of Quorum as the Firm's client in this matter.
2.1 Incident Response Coordination
C&H will serve as central coordinating counsel for all incident response activities undertaken by or on behalf of Quorum in connection with the Palomar security incident. In this capacity, the Firm will:
(a) Advise and collaborate with Quorum's internal incident response team, which currently includes David Naranjo, Chief Information Security Officer; Jennifer Liang, Chief Privacy Officer; Priya Deshmukh, Vice President of Vendor Risk Management; and Robert Wentworth, Senior Vice President of Claims Operations, as well as such other personnel as the Company may designate from time to time;
(b) Coordinate with Quorum's crisis communications firm, BrightPath Consulting Group Inc. ("BrightPath"), regarding the development and review of external and internal communications, media statements, and customer-facing messaging related to the incident, to ensure that such communications are consistent with the Company's legal obligations and do not inadvertently waive any applicable privileges;
(c) Coordinate with Quorum's cyber-insurance broker, Whitmore Risk Advisors Inc. ("Whitmore Risk"), regarding matters relating to insurance coverage, claims submission, and carrier engagement, as described more fully in Section 2.6 below;
(d) Develop and maintain a comprehensive incident response timeline and action-item tracker for the purpose of monitoring the status of key workstreams, deadlines, and deliverables; and
(e) Convene and participate in regular incident response team meetings, as frequently as warranted by the pace and stage of the investigation, and provide ongoing legal counsel to the incident response team in connection with decisions arising throughout the response process.
2.2 Forensic Investigation Oversight
C&H will retain and direct, under the umbrella of the attorney-client privilege and the work product doctrine, a qualified digital forensics and incident response ("DFIR") firm to conduct the technical investigation into the scope and nature of the security incident at Palomar. Specifically, the Firm will:
(a) Engage Graystone Forensics LLC ("Graystone") as the DFIR firm retained at the direction of counsel to assist C&H in rendering legal advice to Quorum regarding the incident. Graystone's engagement will be structured to maximize the protection of applicable privileges, as described more fully in Section 6.2 below;
(b) Oversee the forensic investigation to determine, among other things: (i) the threat actor's entry vector and the methods used to gain unauthorized access to Palomar's network environment; (ii) the timeline of unauthorized access, lateral movement, and data exfiltration activities; (iii) the identification of the specific data sets and data types that were accessed, acquired, or exfiltrated; and (iv) the number and identity of individuals whose personal information was potentially compromised;
(c) Coordinate with Palomar and Palomar's own forensic investigators as necessary to obtain access to relevant systems, logs, and forensic artifacts, while maintaining appropriate privilege protections and avoiding any conflation of Quorum's privileged investigation with Palomar's separate internal investigation; and
(d) Direct the preparation of forensic reports and findings by Graystone, all of which will be addressed and delivered to C&H for the purpose of enabling the Firm to render legal advice to Quorum. All forensic work product will be directed to and through Calderwood & Harkness to preserve attorney-client privilege and work product protection.
2.3 Notification Compliance
C&H will advise Quorum on all applicable notification obligations arising from the security incident and will manage the notification process on Quorum's behalf. This workstream will include the following:
(a) Conducting a comprehensive analysis of applicable federal and state breach notification statutes, regulations, and guidance across all potentially affected jurisdictions, including an assessment of triggering thresholds, notification content requirements, timing requirements, and available exceptions or safe harbors;
(b) Preparing and reviewing consumer notification letters for mailing to affected individuals, tailored to the specific requirements of each applicable jurisdiction, and including all required content elements such as a description of the incident, the types of personal information involved, and the steps being taken by Quorum in response;
(c) Preparing and filing all required regulatory notifications with state attorneys general, state insurance regulators, and any other applicable state or federal regulators, including the Connecticut Insurance Department and, if protected health information ("PHI") as defined under the Health Insurance Portability and Accountability Act of 1996 ("HIPAA") is determined to have been implicated, the U.S. Department of Health and Human Services, Office for Civil Rights;
(d) Coordinating with a notification and credit monitoring vendor (to be selected) for the production and mailing of consumer notification letters, the establishment and operation of a consumer call center to handle inquiries from affected individuals, and the enrollment of eligible individuals in complimentary credit monitoring and identity theft protection services, as may be required by applicable law or otherwise offered by Quorum as a remedial measure; and
(e) Advising on any obligations to provide notification to consumer reporting agencies pursuant to applicable state and federal law, and preparing any required notices to such agencies.
2.4 Regulatory Defense
C&H will represent Quorum in any inquiries, investigations, civil investigative demands, enforcement proceedings, or other regulatory actions initiated by state attorneys general, the Connecticut Insurance Department, the HHS Office for Civil Rights, or any other state or federal regulatory body arising from or related to the Palomar security incident. In this capacity, the Firm will:
(a) Prepare responses to regulatory inquiries, information requests, subpoenas, and civil investigative demands;
(b) Develop and manage a regulatory engagement strategy designed to foster cooperative relationships with regulators while protecting Quorum's legal interests;
(c) Advise on the implications of any state or multi-state attorney general investigation, including the potential for coordinated multi-state proceedings; and
(d) Represent Quorum in any informal or formal proceedings, hearings, or negotiations with regulatory authorities as may be necessary.
2.5 Vendor Accountability
C&H will advise Quorum on its contractual rights and remedies against Palomar in connection with the security incident. This workstream will include the following:
(a) Analyzing the Master Services Agreement between Quorum and Palomar dated November 12, 2019, as amended by Amendment 1 dated March 3, 2021, and Amendment 2 dated September 15, 2022, to assess Palomar's data security obligations, representations and warranties, breach notification obligations, indemnification provisions, limitation of liability clauses, and any other relevant contractual terms;
(b) Advising on and pursuing contractual remedies against Palomar, including indemnification claims under Section 12.2 of the MSA, which the Firm understands to provide for Palomar's indemnification of Quorum for losses arising from Palomar's breach of its data security obligations and/or its negligent handling of Quorum data;
(c) Preparing and transmitting formal demand letters, indemnification notices, and other correspondence to Palomar and its counsel, Mercer, Haight & Dunlop LLP, as appropriate;
(d) Negotiating with Palomar and Mercer, Haight & Dunlop LLP regarding vendor accountability, cost allocation, and loss recovery, including reimbursement of incident response costs, notification costs, credit monitoring costs, and any regulatory penalties or settlement payments attributable to Palomar's conduct; and
(e) Advising on the preservation of Quorum's rights and remedies under the MSA, including with respect to any applicable notice provisions, cure periods, or contractual limitations periods.
2.6 Insurance Coverage Coordination
C&H will advise Quorum on coverage under its cyber-liability insurance program in connection with the security incident. The Company's relevant insurance program, as the Firm currently understands it, includes the following:
(a) A primary cyber-liability insurance policy issued by Atlas Mutual Insurance Company, Policy No. CYB-2023-041587, providing coverage with a per-occurrence limit of $15,000,000 and a self-insured retention ("SIR") of $2,500,000 (the "Primary Policy"); and
(b) An excess cyber-liability insurance policy issued by Pinnacle Surplus Lines Insurance Corp., Policy No. XS-CYB-2023-7812, providing $25,000,000 in coverage excess of the $15,000,000 Primary Policy limit (the "Excess Policy").
In connection with insurance coverage matters, the Firm will:
(a) Review the Primary Policy and the Excess Policy to assess the scope of available coverage for costs and liabilities arising from the Palomar security incident, including coverage for forensic investigation costs, notification costs, credit monitoring costs, regulatory defense costs, regulatory fines and penalties (to the extent insurable), and third-party claims;
(b) Assist Quorum with the timely filing of notice of claim with Atlas Mutual Insurance Company and, as warranted, Pinnacle Surplus Lines Insurance Corp., and advise on compliance with all policy conditions and cooperation requirements;
(c) Manage ongoing communications with the insurers and their coverage counsel regarding the status of the claim, coverage positions, and any coverage disputes that may arise; and
(d) Coordinate with Whitmore Risk Advisors Inc., and specifically with Sandra Whitmore-Kim, Lead Broker, as needed regarding broker-facilitated communications with the insurers and any coverage-related negotiations.
2.7 Board and Management Reporting
C&H will prepare privileged briefing memoranda for Quorum's Board of Directors, the Audit Committee of the Board of Directors (chaired by Franklin Reeves), Chief Executive Officer Margaret D. Calloway, and the General Counsel, as needed throughout the duration of the engagement. These memoranda will provide updates on the status of the forensic investigation, notification process, regulatory engagement, vendor accountability efforts, insurance coverage matters, and any other material developments in the incident response. All such memoranda will be prepared as privileged attorney-client communications and marked accordingly.
2.8 SEC Disclosure Considerations
C&H will advise Quorum on its disclosure obligations under the federal securities laws in connection with the security incident. This will include analysis of potential disclosure obligations under Form 8-K (including under the Securities and Exchange Commission's recently adopted cybersecurity incident disclosure rules), as well as periodic reporting obligations in Quorum's Form 10-Q and Form 10-K filings. The Firm will coordinate with Quorum's securities counsel, to the extent the Company engages separate counsel for securities matters, to ensure consistency in disclosure analysis and approach.
3. Engagement Team
The following attorneys will be primarily responsible for providing legal services to Quorum in connection with this matter:
Kevin Ostrowski will serve as the Responsible Partner with overall supervisory responsibility for the engagement. Mr. Ostrowski will serve as the primary point of contact for Quorum's General Counsel and incident response team and will be responsible for the strategic direction of all workstreams described in Section 2. Rachel Bernstein will serve as the Billing Partner for the engagement and will be available for matters relating to insurance coverage analysis and SEC disclosure considerations, drawing on her experience advising public company clients on cybersecurity-related disclosure obligations.
Alan Burke will serve as the Lead Associate on the engagement and will be responsible for the day-to-day management of incident response activities, including oversight of the forensic investigation, preparation of notification materials, and regulatory compliance analysis. Sara Hendricks will serve as a Working Associate on the engagement, providing research and drafting support across all workstreams.
Additional attorneys, paralegals, or staff may be assigned to the matter as the scope and pace of the engagement require. Quorum will be notified of any additional personnel assignments prior to the commencement of their work on the matter. The Firm may also engage attorneys from other practice groups within C&H, including but not limited to the insurance coverage and securities regulation practice groups, as the needs of the engagement warrant. Any such attorneys will be subject to the billing rates set forth in Section 4 below or as otherwise agreed in writing between the Firm and Quorum.
4. Billing Rates and Fee Arrangements
4.1 Hourly Rates
The Firm's current standard hourly rates for the members of the engagement team assigned to this matter are as follows:
These rates are effective as of January 1, 2023, and are subject to annual adjustment, typically effective January 1 of each calendar year. The Firm will provide Quorum with advance written notice of any rate adjustments no fewer than thirty (30) days prior to the effective date of such adjustments. Rates for any additional attorneys assigned to the matter will be communicated to Quorum prior to the commencement of their work on the engagement.
Paralegal and litigation support specialist rates currently range from $275.00 to $450.00 per hour, depending on the experience level and specialization of the individual.
4.2 Disbursements and Expenses
In addition to fees for professional services, Quorum will be responsible for reimbursement of reasonable out-of-pocket disbursements and expenses incurred by the Firm in connection with the engagement. Disbursements and expenses include, but are not limited to, the following: travel expenses (including airfare, ground transportation, lodging, and meals incurred in connection with travel undertaken on behalf of Quorum); court filing fees; copying and printing costs; electronic research charges (including charges for Westmark Data Systems, Sundial Solutions, and similar legal research platforms); expert and consultant fees (except where such experts or consultants are retained under a separate engagement agreement directly with Quorum); courier and delivery charges; and long-distance communication costs.
The retention of Graystone Forensics LLC as the forensic investigation firm and any other third-party vendors retained in connection with the incident response (including, without limitation, notification and credit monitoring services vendors) will be subject to separate engagement agreements and statements of work. Costs incurred by such third-party vendors will be billed to Quorum either directly by the vendor or through C&H as coordinating counsel, as determined on a vendor-by-vendor basis. The Firm will consult with Quorum regarding the selection and retention of any such vendors and will seek Quorum's approval of vendor fees and cost estimates prior to engagement where practicable.
4.3 Billing and Payment
The Firm will submit monthly invoices to Quorum for fees and disbursements incurred during the preceding billing period. Invoices are due and payable within thirty (30) days of the invoice date.
Invoices will include reasonable detail regarding the services performed during the applicable billing period, including the identification of each timekeeper who performed services, the hours expended by each timekeeper, and a narrative description of the work performed. Invoice descriptions will be prepared with due regard for the protection of applicable attorney-client privilege and work product protections, and the Firm reserves the right to redact or generalize descriptions to the extent necessary to preserve such protections. Should Quorum require invoices in any particular electronic billing format (e.g., LEDES), the Firm is prepared to accommodate such requirements upon request.
5. Matter Number
All time entries, disbursements, correspondence, and other records related to this engagement should reference Calderwood & Harkness Matter Number 1025-00006. Quorum is requested to include this matter number on all correspondence and communications directed to the Firm in connection with this matter to facilitate efficient matter management and billing.
6. Privilege and Confidentiality
6.1 Attorney-Client Privilege
All communications between C&H and Quorum in connection with this engagement are intended to be, and should be treated as, privileged and confidential attorney-client communications. The attorney-client privilege belongs to Quorum as the client, and the Firm will take all reasonable steps to protect the confidentiality of communications and work product generated in connection with this engagement.
Quorum should take care to limit the dissemination of privileged communications to those individuals within the Company who have a need to know in connection with the incident response. Privileged communications should not be forwarded to, shared with, or discussed with individuals outside the incident response team without prior consultation with C&H. Inadvertent disclosure of privileged communications to third parties may result in a waiver of the privilege, which could have significant consequences for Quorum's legal interests in connection with any subsequent regulatory proceedings or litigation.
6.2 Forensic Investigation Privilege Framework
As noted in Section 2.2, the Firm intends to retain Graystone Forensics LLC to conduct the technical forensic investigation of the Palomar security incident. Graystone will be retained by C&H, at C&H's direction, for the express purpose of assisting the Firm in rendering legal advice to Quorum regarding the incident and Quorum's obligations arising therefrom.
All forensic reports, findings, analyses, and communications generated by Graystone in connection with the investigation will be directed to and through Calderwood & Harkness and will be treated as attorney work product and/or attorney-client privileged communications. Graystone will be instructed not to communicate directly with Quorum personnel regarding its findings except at the direction of and in the presence of C&H attorneys.
The Firm recognizes that the distinction between a privileged, counsel-directed forensic investigation and a non-privileged, business-purpose investigation is a critical one that must be carefully maintained. Accordingly, a separate privilege protocol memorandum will be prepared by C&H and issued to all members of the engagement team, including relevant Quorum personnel and Graystone, to establish clear procedures for the maintenance of privilege protections throughout the investigation. This privilege protocol will address, among other things, communication protocols, document marking and handling procedures, and guidelines for the separation of privileged forensic work from any non-privileged remediation or business-continuity activities.
6.3 Common Interest Agreements
The Firm anticipates that it may become necessary or advisable to enter into one or more common interest agreements (also referred to as joint defense agreements) with Quorum's cyber-liability insurers, Atlas Mutual Insurance Company and/or Pinnacle Surplus Lines Insurance Corp., or their respective coverage counsel, to facilitate the sharing of privileged and work-product-protected information without effecting a waiver of applicable protections. Such agreements may be beneficial in connection with the coordination of the forensic investigation, regulatory defense, and coverage analysis.
Any proposed common interest agreements will be prepared by C&H and submitted to Quorum for review and approval prior to execution. The Firm will advise Quorum regarding the benefits, risks, and limitations of any such agreements before recommending their execution.
7. Conflicts of Interest
The Firm has conducted a comprehensive conflicts check in connection with this engagement and has identified no conflicts of interest that would prevent C&H from undertaking this representation. Specifically, C&H does not currently represent Palomar Data Solutions, Inc., Mercer, Haight & Dunlop LLP, or any other party whose interests are adverse to Quorum in connection with this matter.
C&H is a large law firm with offices in multiple jurisdictions and a diverse client base that includes clients in the insurance, financial services, healthcare, and technology industries, among others. By executing this engagement letter, Quorum consents to C&H's continued representation of other clients in matters unrelated to this engagement, including clients in the insurance and financial services industries, provided that no conflict of interest arises in connection with this engagement. In the event that the Firm identifies a potential conflict of interest at any time during the course of this representation, the Firm will promptly notify Quorum and take such steps as are required under the applicable rules of professional conduct.
8. Document Retention
The Firm maintains document retention policies that govern the storage and disposition of client files and records. Upon the conclusion of this engagement, C&H will retain the Firm's files relating to this matter for a period consistent with the Firm's standard retention policies, after which the Firm may destroy such files without further notice to Quorum, unless Quorum has requested the return of specific documents or files.
Quorum is advised to maintain its own copies of all original documents, data, and materials provided to the Firm in connection with this engagement. The Firm will return original documents to Quorum upon request, and will provide copies of Firm-generated work product to Quorum as appropriate throughout the engagement.
Additionally, C&H will prepare and issue a legal hold notice for dissemination to relevant Quorum departments, including but not limited to Information Technology, Claims Operations, Vendor Risk Management, and the Office of the Chief Privacy Officer, to ensure the preservation of all documents, data, electronically stored information, and tangible materials potentially relevant to the incident. Quorum's prompt implementation of the legal hold is critical to the preservation of evidence and the protection of the Company's interests in any subsequent regulatory proceedings, litigation, or contractual dispute.
9. Limitation of Engagement
The scope of this engagement is limited to the matters described in Section 2 of this letter. C&H is not engaged to provide tax advice, accounting services, or business consulting services in connection with this matter. The Firm's advice and services will be limited to legal counsel in connection with the Palomar data security incident and the workstreams described herein.
This engagement does not encompass representation of Quorum in any litigation, arbitration, or other dispute resolution proceedings, whether brought by third parties (including affected individuals) or initiated by Quorum against Palomar or any other party, unless separately agreed in writing between C&H and Quorum. In the event that litigation or arbitration arises from or in connection with the security incident, the Firm will advise Quorum of the need for a separate engagement and will work with Quorum to establish appropriate terms for any such representation.
Any expansion of the scope of this engagement beyond the matters described in Section 2 will be confirmed in a supplemental engagement letter or written amendment to this letter, executed by both parties.
10. Termination
Either party may terminate this engagement upon written notice to the other party. Quorum may terminate the engagement at any time and for any reason by providing written notice to the Firm. C&H may withdraw from the engagement in accordance with the applicable rules of professional conduct, including situations where continued representation would require the Firm to violate applicable ethical rules or where the client-attorney relationship has been materially impaired.
Upon termination of the engagement, Quorum will remain responsible for payment of all fees for professional services rendered and all disbursements and expenses incurred through the effective date of termination. The Firm will promptly render a final invoice for all outstanding fees and expenses.
C&H will take all reasonable steps to protect Quorum's interests upon termination of the engagement, including providing reasonable cooperation in facilitating the orderly transition of the matter to successor counsel, if requested by Quorum. Such transition assistance will include the prompt transfer of relevant files, documents, and work product to successor counsel, subject to the satisfaction of any outstanding fee obligations.
11. Governing Law
This engagement letter and the terms and conditions set forth herein shall be governed by and construed in accordance with the laws of the District of Columbia, without regard to its conflict of laws principles.
12. Acceptance and Execution
We are grateful for Quorum's confidence in selecting Calderwood & Harkness LLP to serve as outside counsel in this important matter. We are committed to providing the highest quality legal services and to working collaboratively with Quorum's internal team to achieve the best possible outcome.
Please confirm Quorum's acceptance of the terms of this engagement by having Thomas R. Whitfield countersign this letter in the space provided below and return an executed copy to the undersigned by mail or email at kostrowski@calderwoodharkness.com. This engagement letter, together with any supplements or written amendments hereafter executed by both parties, constitutes the entire agreement between Calderwood & Harkness LLP and Quorum Insurance Holdings Corp. regarding the terms and conditions of the Firm's engagement in this matter, and supersedes all prior oral or written communications regarding the same.
We look forward to working with you and the Quorum team.
Very truly yours,
CALDERWOOD & HARKNESS LLP
By: ________
Kevin Ostrowski Partner, Privacy & Data Security Calderwood & Harkness LLP 1700 K Street NW, Suite 900 Washington, D.C. 20006 Tel: (202) 555-4118
Email: kostrowski@calderwoodharkness.com
ACCEPTED AND AGREED
The undersigned hereby confirms, on behalf of Quorum Insurance Holdings Corp., acceptance of the terms and conditions of engagement set forth in this letter dated May 4, 2023.
QUORUM INSURANCE HOLDINGS CORP.
By: ________
Name: Thomas R. Whitfield
Title: General Counsel
Quorum Insurance Holdings Corp. 400 Constitution Plaza, Suite 2200 Hartford, CT 06103
Date: ________
cc: Rachel Bernstein, Calderwood & Harkness LLP (New York) Alan Burke, Calderwood & Harkness LLP (Washington, D.C.) Sara Hendricks, Calderwood & Harkness LLP (Washington, D.C.)
Attorney | Role | Office
Kevin Ostrowski | Responsible Partner, Privacy & Data Security | Washington, D.C. (1700 K Street NW, Suite 900)
Rachel Bernstein | Billing Partner, Privacy & Data Security | New York, NY (51 West 52nd Street, 34th Floor, New York, NY 10019)
Alan Burke | Lead Associate, Privacy & Data Security | Washington, D.C. (1700 K Street NW, Suite 900)
Sara Hendricks | Working Associate, Privacy & Data Security | Washington, D.C. (1700 K Street NW, Suite 900)
Attorney | Hourly Rate
Kevin Ostrowski (Partner) | $1,250.00
Rachel Bernstein (Partner) | $1,175.00
Alan Burke (Associate) | $825.00
Sara Hendricks (Associate) | $650.00

PRIVILEGED & CONFIDENTIAL

CALDERWOOD & HARKNESS LLP

ACCEPTED AND AGREED

QUORUM INSURANCE HOLDINGS CORP.

Record

Parties

Dates

Amounts