1025-00006 · Graystone Forensics LLC · Engagement & Privilege

engagement-scope-expansion-letter.docx DOCUMENT Data Privacy

32 / 88 ← → ✕

CALDERWOOD & HARKNESS LLP Attorneys at Law

1700 K Street NW, Suite 900 Washington, D.C. 20006

Telephone: (202) 555-4100 Facsimile: (202) 555-4101 www.calderwoodharkness.com

September 10, 2023

Via Email and First Class Mail

Thomas R. Whitfield, Esq. General Counsel Quorum Insurance Holdings Corp. 400 Constitution Plaza, Suite 2200 Hartford, CT 06103

Re: Expansion of Scope of Engagement — Quorum Insurance Holdings Corp. Data Security Incident Response Matter No.: 1025-00006 Subject: Vendor-Originated Data Security Incident Involving Palomar Data Solutions, Inc.

Dear Tom:

1. Introduction and Background

We write to memorialize the agreed-upon expansion of the scope of Calderwood & Harkness LLP's engagement by Quorum Insurance Holdings Corp. ("Quorum" or the "Company") in connection with the data security incident originating from the Company's third-party claims-processing vendor, Palomar Data Solutions, Inc. ("Palomar"). This letter supplements, and should be read in conjunction with, the original engagement letter dated May 4, 2023 (the "Original Engagement Letter"), pursuant to which Calderwood & Harkness was retained by Quorum to serve as its lead outside counsel for incident response matters arising from the Palomar data security incident.

As you know, the Original Engagement Letter established the following scope of our representation: (a) incident response coordination, including management of the Company's internal incident response team and external service providers; (b) oversight of the forensic investigation conducted by Graystone Forensics LLC ("Graystone"), which was retained under the direction and supervision of Calderwood & Harkness on May 5, 2023, for the purpose of preserving applicable privilege protections; (c) breach notification compliance analysis under applicable federal and state law; (d) preparation, review, and filing of consumer notification letters and regulatory notifications across all affected jurisdictions; and (e) insurance coverage coordination with Atlas Mutual Insurance Company ("Atlas Mutual") under Cyber Liability Insurance Policy No. CYB-2023-041587 (Claim No. CYB-CLM-2023-05892).

All terms and conditions of the Original Engagement Letter, including the billing rates, payment terms, privilege protocols, and the parties' respective obligations set forth therein, remain in full force and effect except as specifically supplemented or modified by the terms of this letter.

By way of brief factual background, and to provide context for the expanded workstreams described below, we note the following key developments in this matter. On or about March 14, 2023, a threat actor exploited CVE-2023-0669, a known remote code execution vulnerability in the GoAnywhere Managed File Transfer ("MFT") platform deployed within Palomar's network environment, to gain unauthorized access to Palomar's systems. The unauthorized access and associated data exfiltration activity continued for a period of approximately 35 days until April 18, 2023, when Palomar's Security Operations Center ("SOC") detected anomalous outbound data transfers indicative of large-scale data exfiltration. Palomar notified Quorum of the incident on April 21, 2023, approximately 72 hours after its own initial detection — a delay that, as discussed further below, exceeded the contractual notification window by approximately 24 hours.

Following the engagement of Calderwood & Harkness and the retention of Graystone under our direction, Graystone conducted a comprehensive forensic investigation of the incident. Graystone's final forensic report, delivered on July 14, 2023, confirmed that the incident affected a total of 318,247 individuals across 29 states and the District of Columbia. The categories of compromised data included personally identifiable information ("PII") for all affected individuals, financial account information (including bank account numbers and payment card data) for approximately 84,619 individuals, and protected health information ("PHI") as defined under the Health Insurance Portability and Accountability Act of 1996 ("HIPAA") for approximately 41,203 individuals.

Based on the findings of the Graystone forensic report and our analysis of applicable notification obligations, consumer notification letters were drafted by Calderwood & Harkness and mailed on a rolling basis between August 18, 2023 and September 15, 2023 (with the final tranche currently in process). Regulatory notifications were prepared and filed across all 29 affected states, the Connecticut Insurance Department (pursuant to Conn. Gen. Stat. § 38a-999b), and the U.S. Department of Health and Human Services, Office for Civil Rights ("HHS-OCR") (pursuant to 45 C.F.R. § 164.408), during the period from August 14 through August 25, 2023.

2. Purpose of This Letter

The purpose of this letter is to formally expand the scope of Calderwood & Harkness's engagement to encompass three additional workstreams that have arisen as natural and foreseeable outgrowths of the original incident response engagement. Specifically, the expanded scope will include the following:

1. Defense of the Multistate Attorney General Inquiry. Calderwood & Harkness will represent Quorum in connection with the joint multistate attorney general inquiry initiated by a 29-state coalition led by the Offices of the Connecticut Attorney General and the New York Attorney General, including the preparation and submission of the Company's formal response to the coalition's demand letter and all subsequent engagement with the multistate executive committee.

2. Vendor Indemnification Negotiations Against Palomar Data Solutions, Inc. Calderwood & Harkness will lead the negotiation of indemnification and settlement terms with Palomar and its outside counsel, Mercer, Haight & Dunlop LLP, seeking to maximize Quorum's contractual recovery for incident response costs and related damages arising from Palomar's breaches of the Master Services Agreement.

3. Regulatory Engagement with the Connecticut Insurance Department and HHS Office for Civil Rights. Calderwood & Harkness will manage Quorum's ongoing regulatory engagement with the Connecticut Insurance Department's Cybersecurity Unit and HHS-OCR's Region I office in connection with their respective post-notification inquiries and any compliance reviews or investigations that may follow.

We understand and confirm that you, in your capacity as General Counsel of Quorum Insurance Holdings Corp., have authorized this expansion of scope on behalf of the Company. Each of the three expanded workstreams is described in detail in Sections 3, 4, and 5 below.

3. Expanded Workstream 1 — Defense of the Multistate Attorney General Inquiry

3.1 Background. On September 8, 2023, Quorum received a joint demand letter (the "Multistate Demand Letter") from the Office of the Connecticut Attorney General, Consumer Protection Division (led by Assistant Attorney General Diane Marchetti), and the Office of the New York Attorney General, Bureau of Internet and Technology (led by Assistant Attorney General Mark Petrosian). The Multistate Demand Letter was issued on behalf of a 29-state multistate coalition and is addressed to Quorum in its capacity as the entity whose data was compromised in the Palomar incident.

The Multistate Demand Letter requests detailed information from Quorum regarding, among other things: (i) a comprehensive timeline of the data security incident, including the dates of initial compromise, detection, notification to Quorum by Palomar, and notification to consumers and regulators; (ii) the nature and scope of the compromised data; (iii) the Company's incident response and remediation measures; (iv) Quorum's vendor oversight and management practices, including due diligence and contractual security requirements imposed on Palomar; (v) the Company's broader information security program, policies, and procedures; and (vi) the Company's compliance with applicable state breach notification laws across all 29 affected jurisdictions.

The 29 states participating in the multistate coalition are as follows: Connecticut, New York, Massachusetts, California, Illinois, Pennsylvania, New Jersey, Ohio, Texas, Florida, Georgia, Virginia, Maryland, North Carolina, South Carolina, Michigan, Minnesota, Indiana, Wisconsin, Colorado, Arizona, Oregon, Washington, Tennessee, Missouri, Louisiana, Nevada, Iowa, and New Hampshire. The Connecticut and New York Attorneys General are serving as the executive committee of the coalition and are the primary points of contact for all communications.

3.2 Scope of Work — Multistate AG Defense

The scope of Calderwood & Harkness's representation in connection with the multistate attorney general inquiry will include the following:

(a) Formal Written Response. Preparation and submission of Quorum's formal written response to the Multistate Demand Letter, including all supporting exhibits and documentation. The response will be comprehensive and designed to demonstrate Quorum's good faith, cooperation, and proactive remediation efforts in a manner calculated to minimize enforcement risk.

(b) Narrative Response Brief. Preparation of a detailed narrative response addressing each area of inquiry raised in the Multistate Demand Letter. The narrative will cover, at a minimum: (i) a complete incident timeline from initial compromise through consumer notification; (ii) root cause analysis, emphasizing that the breach originated within Palomar's network environment as a result of Palomar's failure to timely patch the known CVE-2023-0669 vulnerability; (iii) a description of Quorum's remedial measures implemented in response to the incident, including vendor oversight enhancements, security program improvements, and consumer remediation efforts (including credit monitoring and identity theft protection services); (iv) consumer notification compliance, including the content, timing, and distribution of notification letters; (v) vendor accountability actions taken by Quorum against Palomar, including the demand for full indemnification; and (vi) an overview of Quorum's enterprise information security program, including applicable policies, governance structures, and technical controls.

• Exhibit A — Incident Timeline and Remedial Measures Summary: A detailed chronological summary of the incident from initial compromise through completion of consumer notification and remediation activities.

• Exhibit B — Consumer Notification Samples and Compliance Checklist: Copies of representative consumer notification letters and a state-by-state compliance checklist demonstrating adherence to the notification requirements of each affected jurisdiction.

• Exhibit C — Palomar Vendor Accountability Summary: A summary of the contractual obligations imposed on Palomar, the specific breaches identified, and the indemnification and accountability actions taken by Quorum.

• Exhibit D — Quorum Information Security Program Overview: A summary of Quorum's enterprise information security program, including governance framework, risk assessment practices, technical controls, vendor management policies, employee training, and incident response capabilities.

(d) Ongoing Communication with the Coalition. Ongoing communication and engagement with the multistate AG executive committee, principally AAG Marchetti and AAG Petrosian, including participation in any informational calls, meetings, or presentations requested by the coalition.

(e) Supplemental Information Requests. Preparation and submission of responses to any supplemental information requests, follow-up inquiries, or document production demands issued by the coalition following review of Quorum's initial response.

(f) Strategic Advice and Enforcement Risk Assessment. Ongoing strategic advice regarding the trajectory and likely outcome of the inquiry, including assessment of enforcement risk, identification of potential areas of vulnerability, and development of proactive strategies to mitigate such risk. In the event the coalition moves toward a negotiated resolution, Calderwood & Harkness will advise Quorum on the terms and structure of any proposed resolution, including the desirability of a consent agreement, assurance of voluntary compliance, or similar instrument.

(g) Resolution Objective. The primary objective of this workstream is to achieve closure of the multistate inquiry without enforcement action, consent decree, civil investigative demand, or financial penalty. We will pursue a strategy of proactive cooperation and comprehensive transparency designed to demonstrate to the coalition that Quorum acted responsibly and in good faith, that the root cause of the incident was attributable to Palomar's security failures, and that Quorum has taken all appropriate remedial steps.

3.3 Staffing and Anticipated Timeline

Kevin Ostrowski (Responsible Partner) will lead Calderwood & Harkness's engagement with the multistate AG coalition directly, including all communications with AAG Marchetti, AAG Petrosian, and any other members of the coalition's executive committee. Alan Burke (Lead Associate) and Sara Hendricks (Working Associate) will prepare the narrative response, supporting exhibits, and any supplemental submissions. Additional professionals may be staffed as needed with advance notice to Quorum.

Our target submission date for the initial formal written response to the Multistate Demand Letter is mid-October 2023, which will allow adequate time for thorough preparation while demonstrating Quorum's commitment to timely cooperation. We anticipate that the inquiry may extend through November or December 2023, or possibly beyond, depending on the depth and nature of any follow-up requests from the coalition and whether negotiations toward a formal resolution become necessary.

4. Expanded Workstream 2 — Vendor Indemnification Negotiations Against Palomar Data Solutions, Inc.

4.1 Background. Quorum and Palomar Data Solutions, Inc. are parties to a Master Services Agreement dated November 12, 2019 (the "MSA"), as amended by Amendment 1 dated March 3, 2021 and Amendment 2 dated September 15, 2022. Under the MSA, Palomar serves as Quorum's primary third-party claims-processing vendor and, in that capacity, processes and maintains significant volumes of Quorum's policyholder data, including PII, financial information, and PHI.

As part of the original incident response engagement, Calderwood & Harkness prepared a detailed contractual analysis memorandum dated May 12, 2023 (the "Contractual Analysis Memo"), analyzing the MSA's indemnification provisions (Section 12.2), data security obligations (set forth in Exhibit D to the MSA), breach notification clause (Section 9.4), limitation of liability provisions, and related contractual terms. The Contractual Analysis Memo concluded that Palomar breached multiple material provisions of the MSA, including the following:

(a) Failure to Patch Known Vulnerabilities. Exhibit D to the MSA requires Palomar to apply security patches for known, critical, and high-severity vulnerabilities within 30 calendar days of the patch's public availability. The patch for CVE-2023-0669 was released by Severin Corporation (the developer of the GoAnywhere MFT platform) on or about February 7, 2023. As of the date of the threat actor's initial exploitation on March 14, 2023 — 35 days after the patch release — Palomar had not applied the patch. This failure constitutes a clear breach of Exhibit D.

(b) Late Breach Notification. Section 9.4 of the MSA requires Palomar to notify Quorum of any suspected or confirmed data security incident affecting Quorum data within 48 hours of Palomar's initial detection or reasonable suspicion of such an incident. Palomar's SOC detected anomalous outbound data transfers on April 18, 2023, but Palomar did not notify Quorum until April 21, 2023 — approximately 72 hours after detection, and approximately 24 hours past the contractual notification deadline. This delay constitutes a breach of Section 9.4.

On June 20, 2023, Calderwood & Harkness sent a formal breach of contract demand letter to Palomar's outside counsel, Mercer, Haight & Dunlop LLP (lead partner: Catherine Langford), demanding full indemnification of Quorum's total incident response costs, which were then estimated at $8,230,250. The demand was made pursuant to Section 12.2 of the MSA, which provides that Palomar shall indemnify, defend, and hold harmless Quorum from and against all losses, costs, damages, expenses, and liabilities (including reasonable attorneys' fees) arising from or related to Palomar's breach of the MSA, including any breach of Palomar's data security obligations.

On July 7, 2023, Palomar, through Mercer, Haight & Dunlop LLP, responded to our demand letter. In its response, Palomar disputed causation, asserting that the threat actor's exploitation of CVE-2023-0669 was an unforeseeable zero-day-like attack (a characterization that is factually inaccurate given that the vulnerability was publicly disclosed and a patch was available weeks before the attack). Palomar also disputed the scope of claimed damages, contending that certain categories of costs (including credit monitoring and call center expenses) were excessive. As a counterproposal, Palomar offered a $1,500,000 "goodwill credit" against future service fees, which we view as wholly inadequate and not reflective of Palomar's contractual exposure. Calderwood & Harkness sent a detailed rebuttal letter on July 25, 2023, rejecting the goodwill credit, reaffirming the factual basis for Quorum's claims, and reiterating the demand for full indemnification.

For reference, the indemnification cap under Section 12.2 of the MSA is set at two times the trailing twelve-month fees paid by Quorum to Palomar. Based on Quorum's current annual contract value ("ACV") with Palomar of $16,300,000, the indemnification cap is $32,600,000. Quorum's current total incident response cost claim of approximately $8,230,250 therefore falls well within the contractual cap.

4.2 Scope of Work — Vendor Indemnification

The scope of Calderwood & Harkness's representation in connection with the vendor indemnification negotiations will include the following:

(a) Negotiation Strategy. Development and execution of a comprehensive negotiation strategy designed to maximize Quorum's financial recovery from Palomar while balancing the Company's operational and commercial interests. This strategy will take into account the strength of Quorum's contractual position, the applicable indemnification cap, the likely cost of litigation as an alternative to negotiated resolution, and Quorum's interest in preserving a functional vendor relationship through the remaining term of the MSA.

(b) Settlement Negotiations. Direct negotiation of settlement terms with Mercer, Haight & Dunlop LLP, specifically Catherine Langford (lead partner) and Brian Soto (working partner). Settlement terms under negotiation may include, without limitation: (i) a lump-sum cash payment to Quorum in satisfaction of the indemnification claim; (ii) fee concessions or credits against future service fees; and (iii) enhanced security commitments by Palomar, including accelerated patching timelines, enhanced audit rights for Quorum, and additional security certifications.

(c) Settlement Documentation. Preparation and negotiation of (i) a settlement term sheet outlining the principal terms of the proposed resolution, and (ii) a definitive settlement agreement and mutual release memorializing the final agreed-upon terms, including representations, warranties, covenants, indemnities, and release provisions.

(d) MSA Amendments. Preparation and negotiation of any amendments to the MSA required to implement enhanced data security, audit, notification, and vendor oversight provisions arising from the settlement discussions. We anticipate that this will take the form of a third amendment to the MSA ("Amendment 3"), which would address, among other things, shortened patching timelines, enhanced incident notification obligations, expanded audit and examination rights for Quorum, and additional security certifications and reporting requirements.

(e) Insurance Coordination. Coordination with Rachel Bernstein regarding any insurance subrogation considerations that may arise in connection with the indemnification negotiations. We note that Atlas Mutual Insurance Company, as Quorum's cyber liability insurer, may hold subrogation rights with respect to any recoveries obtained from Palomar to the extent Atlas Mutual has paid or will pay claims arising from the incident. Calderwood & Harkness will ensure that any settlement terms are structured and documented in a manner that addresses Atlas Mutual's subrogation interests and does not jeopardize Quorum's insurance coverage or create conflicts with the policy terms.

(f) Termination-for-Cause Assessment. Assessment of Quorum's termination-for-cause rights under Section 14.2 of the MSA, which permits either party to terminate the MSA in the event of a material breach by the other party that remains uncured for 30 calendar days following written notice. We will evaluate the availability of this remedy as potential negotiating leverage in the indemnification discussions, while carefully balancing it against Quorum's operational interest in maintaining the Palomar vendor relationship through the MSA's remaining term. The MSA is currently set to expire on November 11, 2024, and a premature termination could result in significant operational disruption and transition costs that must be weighed against the incremental negotiating value of the termination threat.

4.3 Staffing and Anticipated Timeline

Kevin Ostrowski will serve as lead negotiator and will manage all substantive settlement discussions with Mercer, Haight & Dunlop LLP. Alan Burke will prepare settlement documentation, including the term sheet, definitive settlement agreement, and any MSA amendments. Rachel Bernstein will advise on insurance coordination aspects, including subrogation analysis and any issues arising under the Atlas Mutual policy.

Our target for completing the indemnification negotiations and executing a definitive settlement agreement is October or November 2023, though the actual timeline will depend on the pace of negotiations and Palomar's willingness to engage constructively.

5. Expanded Workstream 3 — Regulatory Engagement with the Connecticut Insurance Department and HHS Office for Civil Rights

5.1 Connecticut Insurance Department

Quorum filed its notification of the data security incident with the Connecticut Insurance Department, Financial Analysis Division, Cybersecurity Unit (Examiner: Richard Nakamura), on August 14, 2023, pursuant to Conn. Gen. Stat. § 38a-999b, which requires insurers domiciled in Connecticut to notify the Commissioner of Insurance of a cybersecurity event no later than three business days after a determination that a cybersecurity event has occurred. The notification was timely filed and included all information required by the statute.

Following receipt of Quorum's notification, the Department has initiated an inquiry into the cybersecurity event and has requested additional information regarding the Company's information security program, vendor oversight and due diligence practices, remediation measures implemented in response to the incident, and the status of consumer notification efforts. Examiner Nakamura has served as the Department's primary point of contact and has indicated that the inquiry is being conducted as part of the Department's standard examination process for cybersecurity events reported by Connecticut-domiciled insurers.

The scope of Calderwood & Harkness's representation in this workstream will include: (a) preparation and submission of Quorum's responses to the Department's information requests and any supplemental inquiries; (b) direct engagement with Examiner Nakamura and other Department personnel as needed; (c) strategic advice regarding the Department's examination process, including assessment of potential outcomes and any remedial actions or undertakings the Department may request; and (d) coordination with Quorum's internal compliance team to ensure that all submissions are accurate, complete, and consistent with the Company's regulatory obligations.

5.2 HHS Office for Civil Rights

Quorum filed its HIPAA breach notification with HHS-OCR, Region I (Boston Regional Office), on August 15, 2023, pursuant to 45 C.F.R. § 164.408, which requires covered entities to notify the Secretary of Health and Human Services of breaches of unsecured protected health information affecting 500 or more individuals. The notification reported the breach of unsecured protected health information affecting 41,203 individuals and included all information required by the applicable regulations.

Because the breach affected more than 500 individuals, it will be posted on the HHS Breach Portal (commonly referred to as the "Wall of Shame") and may attract the attention of OCR's enforcement division. OCR may, at its discretion, initiate a compliance review or formal investigation to assess Quorum's compliance with the HIPAA Privacy Rule, Security Rule, and Breach Notification Rule. While we cannot predict with certainty whether OCR will pursue an investigation, Calderwood & Harkness will be prepared to manage Quorum's response in the event that OCR elects to do so.

The scope of Calderwood & Harkness's representation in this workstream will include: (a) preparation and submission of any responses to OCR inquiries, data requests, or compliance review questionnaires; (b) coordination with Jennifer Liang, Quorum's Chief Privacy Officer, regarding the assembly and review of HIPAA compliance documentation, including risk analyses, policies and procedures, business associate agreements, training records, and prior audit findings; (c) strategic advice regarding potential investigation outcomes, including the possibility of a resolution agreement, corrective action plan, or civil money penalty; and (d) representation of Quorum in any settlement or resolution discussions with OCR, should such discussions become necessary.

5.3 Staffing. Alan Burke and Sara Hendricks will handle the day-to-day preparation of all regulatory submissions for both the Connecticut Insurance Department and HHS-OCR, including drafting of responses, compilation of supporting documentation, and coordination with Quorum's internal teams. Kevin Ostrowski will oversee strategy for both regulatory engagements and will handle direct communications with regulators as needed, including any calls or meetings with Examiner Nakamura or OCR investigators.

6. Engagement Terms — Confirmation and Updates

6.1 Billing Rates

We confirm that the billing rates set forth in the Original Engagement Letter dated May 4, 2023 remain in full force and effect for all work performed under the expanded scope described in this letter. For ease of reference, the applicable billing rates are as follows:

In the event that it becomes necessary to staff additional attorneys or other professionals on any of the expanded workstreams, we will notify you in advance and communicate their billing rates prior to the commencement of any billable work. As noted in the Original Engagement Letter, the firm's standard billing rates are subject to annual adjustment effective January 1 of each calendar year, with advance written notice to the client.

6.2 Billing and Payment

Invoices will continue to be rendered on a monthly basis and are payable within 30 calendar days of receipt, consistent with the payment terms established in the Original Engagement Letter. All time and expenses incurred in connection with the expanded workstreams will be tracked under the existing Matter No. 1025-00006, with sub-matter codes assigned to each of the three new workstreams to distinguish them from the original incident response work. This sub-matter coding will facilitate internal tracking, budget monitoring, and insurance reporting.

Costs that are covered by Quorum's cyber liability insurance under Atlas Mutual Policy No. CYB-2023-041587 — including, without limitation, regulatory defense costs, which are an insured category of loss under the policy — will be clearly identified on all invoices for purposes of submission to Atlas Mutual for reimbursement. We note that the policy is subject to a $2,500,000 self-insured retention ("SIR"), which we understand has been substantially eroded by prior incident response costs. All communications with Atlas Mutual's claims adjuster, Paul Enriquez, regarding coverage and reimbursement of the expanded workstream costs will be coordinated with Rachel Bernstein and your office.

6.3 Privilege and Confidentiality

All work performed under the expanded scope of this engagement remains subject to the attorney-client privilege and work product doctrine protections established in the Original Engagement Letter and the Privilege Protocol Memorandum dated May 5, 2023, which set forth the protocols for preserving privilege in connection with communications among Calderwood & Harkness, Quorum, Graystone Forensics LLC, and other parties involved in the incident response.

We remind you that certain categories of communications undertaken in connection with the expanded workstreams are not subject to attorney-client privilege. Specifically, communications submitted to regulators — including the multistate AG coalition, the Connecticut Insurance Department, and HHS-OCR — are made on behalf of the client in a regulatory context and are not privileged. However, internal strategy memoranda, attorney-client communications, and work product prepared by Calderwood & Harkness in connection with the development of response strategy, risk assessment, and settlement positioning remain fully privileged and protected from disclosure.

The Common Interest Agreement dated May 10, 2023, between Quorum and Atlas Mutual Insurance Company, which permits the sharing of certain privileged communications and work product in connection with the defense and resolution of the data security incident, remains in full force and effect and covers the expanded workstreams described herein to the extent they involve matters within the scope of the insured claim.

6.4 Scope Limitations

We wish to note certain matters that fall outside the expanded scope of engagement described in this letter:

(a) Private Litigation and Class Action Defense. The expanded engagement does not cover the defense of any private litigation, including consumer class actions or representative actions, that may be filed in connection with the data security incident. In the event that any such actions are filed, a separate engagement letter addressing scope, staffing, billing, and litigation strategy will be required.

(b) SEC Enforcement Defense. The expanded engagement does not cover the defense of any enforcement action by the U.S. Securities and Exchange Commission. We note, however, that the existing engagement under the Original Engagement Letter covers SEC disclosure analysis, including review and advice regarding Quorum's disclosure obligations under the SEC's cybersecurity disclosure rules, and that work will continue under the original scope.

(c) Criminal Investigation Defense. The expanded engagement does not cover representation in connection with any criminal investigation or prosecution arising from the data security incident.

Additionally, Calderwood & Harkness reserves the right to recommend the engagement of local counsel in specific jurisdictions if required for any regulatory proceeding covered by the expanded scope, including any enforcement action initiated by an individual state attorney general outside of the multistate framework. Any such recommendation will be discussed with you in advance, and any engagement of local counsel will be subject to your approval.

7. Estimated Budget for Expanded Workstreams

We recognize the importance of providing budget guidance to assist Quorum in managing its legal costs and insurance reporting obligations. We note, however, that precise budgets are inherently difficult to estimate in matters of this nature given the unpredictable trajectory of regulatory inquiries, the uncertain pace of vendor negotiations, and the possibility of unforeseen developments. With that caveat, we provide the following good-faith estimates of anticipated legal fees for each expanded workstream:

The range for the multistate AG defense reflects the uncertainty regarding the depth and number of follow-up inquiries the coalition may issue and whether a negotiated resolution (such as an assurance of voluntary compliance or consent agreement) will be required, which would involve additional negotiation and documentation costs. The range for the vendor indemnification workstream reflects the potential for protracted negotiations and the complexity of drafting and negotiating a definitive settlement agreement and MSA amendments. The range for the regulatory engagement workstream reflects uncertainty regarding whether either the Connecticut Insurance Department or HHS-OCR will escalate beyond an initial inquiry to a more formal examination or investigation.

These estimates are provided solely for planning and budgeting purposes and are not a cap on fees. Actual fees will depend on the scope, complexity, and duration of each workstream as it develops. We will provide periodic budget updates as each workstream progresses and will promptly notify you if we anticipate that actual fees may materially exceed the high end of the estimated range for any workstream.

8. Acknowledgment

We would appreciate it if you would indicate Quorum's agreement to the expanded scope of engagement described in this letter by signing in the space provided below and returning a signed copy to our office. An electronic signature and return via email to kostrowski@calderwoodharkness.com will be sufficient, with a hard copy to follow at your convenience.

We are grateful for the continued confidence that you and the Quorum team have placed in Calderwood & Harkness, and we look forward to continuing to work with you on these important matters. Please do not hesitate to contact me directly if you have any questions or wish to discuss any aspect of this letter.

Very truly yours,

CALDERWOOD & HARKNESS LLP

By: ________

Kevin Ostrowski Partner, Privacy & Data Security

Direct: (202) 555-4127

Email: kostrowski@calderwoodharkness.com

ACKNOWLEDGMENT AND ACCEPTANCE

The undersigned, on behalf of Quorum Insurance Holdings Corp., hereby acknowledges receipt of the foregoing Engagement Scope Expansion Letter dated September 10, 2023 and confirms Quorum's agreement to the expanded scope of engagement, the additional workstreams, and the engagement terms as described herein. The undersigned further confirms that he is authorized to execute this acknowledgment on behalf of Quorum Insurance Holdings Corp.

AGREED AND ACCEPTED:

QUORUM INSURANCE HOLDINGS CORP.

By: ________

Name: Thomas R. Whitfield, Esq.

Title: General Counsel

Date: ________

cc:

Rachel Bernstein, Partner, Calderwood & Harkness LLP Alan Burke, Associate, Calderwood & Harkness LLP Sara Hendricks, Associate, Calderwood & Harkness LLP Jennifer Liang, Chief Privacy Officer, Quorum Insurance Holdings Corp. David Naranjo, Chief Information Security Officer, Quorum Insurance Holdings Corp.

Attorney	Title	Hourly Rate
Kevin Ostrowski	Partner	$1,250.00
Rachel Bernstein	Partner	$1,175.00
Alan Burke	Associate	$825.00
Sara Hendricks	Associate	$650.00
Workstream	Estimated Fee Range
Multistate Attorney General Defense	$400,000 – $600,000
Vendor Indemnification Negotiations (Palomar)	$150,000 – $250,000
CT Insurance Department and HHS-OCR Regulatory Engagement	$100,000 – $175,000
Total Estimated Additional Fees	$650,000 – $1,025,000

CALDERWOOD & HARKNESS LLP Attorneys at Law
1700 K Street NW, Suite 900 Washington, D.C. 20006
Telephone: (202) 555-4100 Facsimile: (202) 555-4101 www.calderwoodharkness.com
September 10, 2023
Via Email and First Class Mail
Thomas R. Whitfield, Esq. General Counsel Quorum Insurance Holdings Corp. 400 Constitution Plaza, Suite 2200 Hartford, CT 06103
Re: Expansion of Scope of Engagement — Quorum Insurance Holdings Corp. Data Security Incident Response Matter No.: 1025-00006 Subject: Vendor-Originated Data Security Incident Involving Palomar Data Solutions, Inc.
Dear Tom:
1. Introduction and Background
We write to memorialize the agreed-upon expansion of the scope of Calderwood & Harkness LLP's engagement by Quorum Insurance Holdings Corp. ("Quorum" or the "Company") in connection with the data security incident originating from the Company's third-party claims-processing vendor, Palomar Data Solutions, Inc. ("Palomar"). This letter supplements, and should be read in conjunction with, the original engagement letter dated May 4, 2023 (the "Original Engagement Letter"), pursuant to which Calderwood & Harkness was retained by Quorum to serve as its lead outside counsel for incident response matters arising from the Palomar data security incident.
As you know, the Original Engagement Letter established the following scope of our representation: (a) incident response coordination, including management of the Company's internal incident response team and external service providers; (b) oversight of the forensic investigation conducted by Graystone Forensics LLC ("Graystone"), which was retained under the direction and supervision of Calderwood & Harkness on May 5, 2023, for the purpose of preserving applicable privilege protections; (c) breach notification compliance analysis under applicable federal and state law; (d) preparation, review, and filing of consumer notification letters and regulatory notifications across all affected jurisdictions; and (e) insurance coverage coordination with Atlas Mutual Insurance Company ("Atlas Mutual") under Cyber Liability Insurance Policy No. CYB-2023-041587 (Claim No. CYB-CLM-2023-05892).
All terms and conditions of the Original Engagement Letter, including the billing rates, payment terms, privilege protocols, and the parties' respective obligations set forth therein, remain in full force and effect except as specifically supplemented or modified by the terms of this letter.
By way of brief factual background, and to provide context for the expanded workstreams described below, we note the following key developments in this matter. On or about March 14, 2023, a threat actor exploited CVE-2023-0669, a known remote code execution vulnerability in the GoAnywhere Managed File Transfer ("MFT") platform deployed within Palomar's network environment, to gain unauthorized access to Palomar's systems. The unauthorized access and associated data exfiltration activity continued for a period of approximately 35 days until April 18, 2023, when Palomar's Security Operations Center ("SOC") detected anomalous outbound data transfers indicative of large-scale data exfiltration. Palomar notified Quorum of the incident on April 21, 2023, approximately 72 hours after its own initial detection — a delay that, as discussed further below, exceeded the contractual notification window by approximately 24 hours.
Following the engagement of Calderwood & Harkness and the retention of Graystone under our direction, Graystone conducted a comprehensive forensic investigation of the incident. Graystone's final forensic report, delivered on July 14, 2023, confirmed that the incident affected a total of 318,247 individuals across 29 states and the District of Columbia. The categories of compromised data included personally identifiable information ("PII") for all affected individuals, financial account information (including bank account numbers and payment card data) for approximately 84,619 individuals, and protected health information ("PHI") as defined under the Health Insurance Portability and Accountability Act of 1996 ("HIPAA") for approximately 41,203 individuals.
Based on the findings of the Graystone forensic report and our analysis of applicable notification obligations, consumer notification letters were drafted by Calderwood & Harkness and mailed on a rolling basis between August 18, 2023 and September 15, 2023 (with the final tranche currently in process). Regulatory notifications were prepared and filed across all 29 affected states, the Connecticut Insurance Department (pursuant to Conn. Gen. Stat. § 38a-999b), and the U.S. Department of Health and Human Services, Office for Civil Rights ("HHS-OCR") (pursuant to 45 C.F.R. § 164.408), during the period from August 14 through August 25, 2023.
2. Purpose of This Letter
The purpose of this letter is to formally expand the scope of Calderwood & Harkness's engagement to encompass three additional workstreams that have arisen as natural and foreseeable outgrowths of the original incident response engagement. Specifically, the expanded scope will include the following:
1.  Defense of the Multistate Attorney General Inquiry. Calderwood & Harkness will represent Quorum in connection with the joint multistate attorney general inquiry initiated by a 29-state coalition led by the Offices of the Connecticut Attorney General and the New York Attorney General, including the preparation and submission of the Company's formal response to the coalition's demand letter and all subsequent engagement with the multistate executive committee.
2.  Vendor Indemnification Negotiations Against Palomar Data Solutions, Inc. Calderwood & Harkness will lead the negotiation of indemnification and settlement terms with Palomar and its outside counsel, Mercer, Haight & Dunlop LLP, seeking to maximize Quorum's contractual recovery for incident response costs and related damages arising from Palomar's breaches of the Master Services Agreement.
3.  Regulatory Engagement with the Connecticut Insurance Department and HHS Office for Civil Rights. Calderwood & Harkness will manage Quorum's ongoing regulatory engagement with the Connecticut Insurance Department's Cybersecurity Unit and HHS-OCR's Region I office in connection with their respective post-notification inquiries and any compliance reviews or investigations that may follow.
We understand and confirm that you, in your capacity as General Counsel of Quorum Insurance Holdings Corp., have authorized this expansion of scope on behalf of the Company. Each of the three expanded workstreams is described in detail in Sections 3, 4, and 5 below.
3. Expanded Workstream 1 — Defense of the Multistate Attorney General Inquiry
3.1 Background.  On September 8, 2023, Quorum received a joint demand letter (the "Multistate Demand Letter") from the Office of the Connecticut Attorney General, Consumer Protection Division (led by Assistant Attorney General Diane Marchetti), and the Office of the New York Attorney General, Bureau of Internet and Technology (led by Assistant Attorney General Mark Petrosian). The Multistate Demand Letter was issued on behalf of a 29-state multistate coalition and is addressed to Quorum in its capacity as the entity whose data was compromised in the Palomar incident.
The Multistate Demand Letter requests detailed information from Quorum regarding, among other things: (i) a comprehensive timeline of the data security incident, including the dates of initial compromise, detection, notification to Quorum by Palomar, and notification to consumers and regulators; (ii) the nature and scope of the compromised data; (iii) the Company's incident response and remediation measures; (iv) Quorum's vendor oversight and management practices, including due diligence and contractual security requirements imposed on Palomar; (v) the Company's broader information security program, policies, and procedures; and (vi) the Company's compliance with applicable state breach notification laws across all 29 affected jurisdictions.
The 29 states participating in the multistate coalition are as follows: Connecticut, New York, Massachusetts, California, Illinois, Pennsylvania, New Jersey, Ohio, Texas, Florida, Georgia, Virginia, Maryland, North Carolina, South Carolina, Michigan, Minnesota, Indiana, Wisconsin, Colorado, Arizona, Oregon, Washington, Tennessee, Missouri, Louisiana, Nevada, Iowa, and New Hampshire. The Connecticut and New York Attorneys General are serving as the executive committee of the coalition and are the primary points of contact for all communications.
3.2 Scope of Work — Multistate AG Defense
The scope of Calderwood & Harkness's representation in connection with the multistate attorney general inquiry will include the following:
(a) Formal Written Response. Preparation and submission of Quorum's formal written response to the Multistate Demand Letter, including all supporting exhibits and documentation. The response will be comprehensive and designed to demonstrate Quorum's good faith, cooperation, and proactive remediation efforts in a manner calculated to minimize enforcement risk.
(b) Narrative Response Brief. Preparation of a detailed narrative response addressing each area of inquiry raised in the Multistate Demand Letter. The narrative will cover, at a minimum: (i) a complete incident timeline from initial compromise through consumer notification; (ii) root cause analysis, emphasizing that the breach originated within Palomar's network environment as a result of Palomar's failure to timely patch the known CVE-2023-0669 vulnerability; (iii) a description of Quorum's remedial measures implemented in response to the incident, including vendor oversight enhancements, security program improvements, and consumer remediation efforts (including credit monitoring and identity theft protection services); (iv) consumer notification compliance, including the content, timing, and distribution of notification letters; (v) vendor accountability actions taken by Quorum against Palomar, including the demand for full indemnification; and (vi) an overview of Quorum's enterprise information security program, including applicable policies, governance structures, and technical controls.
(c) Supporting Exhibits. Preparation of the following supporting exhibits for submission with the narrative response:
•  Exhibit A — Incident Timeline and Remedial Measures Summary: A detailed chronological summary of the incident from initial compromise through completion of consumer notification and remediation activities.
•  Exhibit B — Consumer Notification Samples and Compliance Checklist: Copies of representative consumer notification letters and a state-by-state compliance checklist demonstrating adherence to the notification requirements of each affected jurisdiction.
•  Exhibit C — Palomar Vendor Accountability Summary: A summary of the contractual obligations imposed on Palomar, the specific breaches identified, and the indemnification and accountability actions taken by Quorum.
•  Exhibit D — Quorum Information Security Program Overview: A summary of Quorum's enterprise information security program, including governance framework, risk assessment practices, technical controls, vendor management policies, employee training, and incident response capabilities.
(d) Ongoing Communication with the Coalition. Ongoing communication and engagement with the multistate AG executive committee, principally AAG Marchetti and AAG Petrosian, including participation in any informational calls, meetings, or presentations requested by the coalition.
(e) Supplemental Information Requests. Preparation and submission of responses to any supplemental information requests, follow-up inquiries, or document production demands issued by the coalition following review of Quorum's initial response.
(f) Strategic Advice and Enforcement Risk Assessment. Ongoing strategic advice regarding the trajectory and likely outcome of the inquiry, including assessment of enforcement risk, identification of potential areas of vulnerability, and development of proactive strategies to mitigate such risk. In the event the coalition moves toward a negotiated resolution, Calderwood & Harkness will advise Quorum on the terms and structure of any proposed resolution, including the desirability of a consent agreement, assurance of voluntary compliance, or similar instrument.
(g) Resolution Objective. The primary objective of this workstream is to achieve closure of the multistate inquiry without enforcement action, consent decree, civil investigative demand, or financial penalty. We will pursue a strategy of proactive cooperation and comprehensive transparency designed to demonstrate to the coalition that Quorum acted responsibly and in good faith, that the root cause of the incident was attributable to Palomar's security failures, and that Quorum has taken all appropriate remedial steps.
3.3 Staffing and Anticipated Timeline
Kevin Ostrowski (Responsible Partner) will lead Calderwood & Harkness's engagement with the multistate AG coalition directly, including all communications with AAG Marchetti, AAG Petrosian, and any other members of the coalition's executive committee. Alan Burke (Lead Associate) and Sara Hendricks (Working Associate) will prepare the narrative response, supporting exhibits, and any supplemental submissions. Additional professionals may be staffed as needed with advance notice to Quorum.
Our target submission date for the initial formal written response to the Multistate Demand Letter is mid-October 2023, which will allow adequate time for thorough preparation while demonstrating Quorum's commitment to timely cooperation. We anticipate that the inquiry may extend through November or December 2023, or possibly beyond, depending on the depth and nature of any follow-up requests from the coalition and whether negotiations toward a formal resolution become necessary.
4. Expanded Workstream 2 — Vendor Indemnification Negotiations Against Palomar Data Solutions, Inc.
4.1 Background.  Quorum and Palomar Data Solutions, Inc. are parties to a Master Services Agreement dated November 12, 2019 (the "MSA"), as amended by Amendment 1 dated March 3, 2021 and Amendment 2 dated September 15, 2022. Under the MSA, Palomar serves as Quorum's primary third-party claims-processing vendor and, in that capacity, processes and maintains significant volumes of Quorum's policyholder data, including PII, financial information, and PHI.
As part of the original incident response engagement, Calderwood & Harkness prepared a detailed contractual analysis memorandum dated May 12, 2023 (the "Contractual Analysis Memo"), analyzing the MSA's indemnification provisions (Section 12.2), data security obligations (set forth in Exhibit D to the MSA), breach notification clause (Section 9.4), limitation of liability provisions, and related contractual terms. The Contractual Analysis Memo concluded that Palomar breached multiple material provisions of the MSA, including the following:
(a) Failure to Patch Known Vulnerabilities. Exhibit D to the MSA requires Palomar to apply security patches for known, critical, and high-severity vulnerabilities within 30 calendar days of the patch's public availability. The patch for CVE-2023-0669 was released by Severin Corporation (the developer of the GoAnywhere MFT platform) on or about February 7, 2023. As of the date of the threat actor's initial exploitation on March 14, 2023 — 35 days after the patch release — Palomar had not applied the patch. This failure constitutes a clear breach of Exhibit D.
(b) Late Breach Notification. Section 9.4 of the MSA requires Palomar to notify Quorum of any suspected or confirmed data security incident affecting Quorum data within 48 hours of Palomar's initial detection or reasonable suspicion of such an incident. Palomar's SOC detected anomalous outbound data transfers on April 18, 2023, but Palomar did not notify Quorum until April 21, 2023 — approximately 72 hours after detection, and approximately 24 hours past the contractual notification deadline. This delay constitutes a breach of Section 9.4.
On June 20, 2023, Calderwood & Harkness sent a formal breach of contract demand letter to Palomar's outside counsel, Mercer, Haight & Dunlop LLP (lead partner: Catherine Langford), demanding full indemnification of Quorum's total incident response costs, which were then estimated at $8,230,250. The demand was made pursuant to Section 12.2 of the MSA, which provides that Palomar shall indemnify, defend, and hold harmless Quorum from and against all losses, costs, damages, expenses, and liabilities (including reasonable attorneys' fees) arising from or related to Palomar's breach of the MSA, including any breach of Palomar's data security obligations.
On July 7, 2023, Palomar, through Mercer, Haight & Dunlop LLP, responded to our demand letter. In its response, Palomar disputed causation, asserting that the threat actor's exploitation of CVE-2023-0669 was an unforeseeable zero-day-like attack (a characterization that is factually inaccurate given that the vulnerability was publicly disclosed and a patch was available weeks before the attack). Palomar also disputed the scope of claimed damages, contending that certain categories of costs (including credit monitoring and call center expenses) were excessive. As a counterproposal, Palomar offered a $1,500,000 "goodwill credit" against future service fees, which we view as wholly inadequate and not reflective of Palomar's contractual exposure. Calderwood & Harkness sent a detailed rebuttal letter on July 25, 2023, rejecting the goodwill credit, reaffirming the factual basis for Quorum's claims, and reiterating the demand for full indemnification.
For reference, the indemnification cap under Section 12.2 of the MSA is set at two times the trailing twelve-month fees paid by Quorum to Palomar. Based on Quorum's current annual contract value ("ACV") with Palomar of $16,300,000, the indemnification cap is $32,600,000. Quorum's current total incident response cost claim of approximately $8,230,250 therefore falls well within the contractual cap.
4.2 Scope of Work — Vendor Indemnification
The scope of Calderwood & Harkness's representation in connection with the vendor indemnification negotiations will include the following:
(a) Negotiation Strategy. Development and execution of a comprehensive negotiation strategy designed to maximize Quorum's financial recovery from Palomar while balancing the Company's operational and commercial interests. This strategy will take into account the strength of Quorum's contractual position, the applicable indemnification cap, the likely cost of litigation as an alternative to negotiated resolution, and Quorum's interest in preserving a functional vendor relationship through the remaining term of the MSA.
(b) Settlement Negotiations. Direct negotiation of settlement terms with Mercer, Haight & Dunlop LLP, specifically Catherine Langford (lead partner) and Brian Soto (working partner). Settlement terms under negotiation may include, without limitation: (i) a lump-sum cash payment to Quorum in satisfaction of the indemnification claim; (ii) fee concessions or credits against future service fees; and (iii) enhanced security commitments by Palomar, including accelerated patching timelines, enhanced audit rights for Quorum, and additional security certifications.
(c) Settlement Documentation. Preparation and negotiation of (i) a settlement term sheet outlining the principal terms of the proposed resolution, and (ii) a definitive settlement agreement and mutual release memorializing the final agreed-upon terms, including representations, warranties, covenants, indemnities, and release provisions.
(d) MSA Amendments. Preparation and negotiation of any amendments to the MSA required to implement enhanced data security, audit, notification, and vendor oversight provisions arising from the settlement discussions. We anticipate that this will take the form of a third amendment to the MSA ("Amendment 3"), which would address, among other things, shortened patching timelines, enhanced incident notification obligations, expanded audit and examination rights for Quorum, and additional security certifications and reporting requirements.
(e) Insurance Coordination. Coordination with Rachel Bernstein regarding any insurance subrogation considerations that may arise in connection with the indemnification negotiations. We note that Atlas Mutual Insurance Company, as Quorum's cyber liability insurer, may hold subrogation rights with respect to any recoveries obtained from Palomar to the extent Atlas Mutual has paid or will pay claims arising from the incident. Calderwood & Harkness will ensure that any settlement terms are structured and documented in a manner that addresses Atlas Mutual's subrogation interests and does not jeopardize Quorum's insurance coverage or create conflicts with the policy terms.
(f) Termination-for-Cause Assessment. Assessment of Quorum's termination-for-cause rights under Section 14.2 of the MSA, which permits either party to terminate the MSA in the event of a material breach by the other party that remains uncured for 30 calendar days following written notice. We will evaluate the availability of this remedy as potential negotiating leverage in the indemnification discussions, while carefully balancing it against Quorum's operational interest in maintaining the Palomar vendor relationship through the MSA's remaining term. The MSA is currently set to expire on November 11, 2024, and a premature termination could result in significant operational disruption and transition costs that must be weighed against the incremental negotiating value of the termination threat.
4.3 Staffing and Anticipated Timeline
Kevin Ostrowski will serve as lead negotiator and will manage all substantive settlement discussions with Mercer, Haight & Dunlop LLP. Alan Burke will prepare settlement documentation, including the term sheet, definitive settlement agreement, and any MSA amendments. Rachel Bernstein will advise on insurance coordination aspects, including subrogation analysis and any issues arising under the Atlas Mutual policy.
Our target for completing the indemnification negotiations and executing a definitive settlement agreement is October or November 2023, though the actual timeline will depend on the pace of negotiations and Palomar's willingness to engage constructively.
5. Expanded Workstream 3 — Regulatory Engagement with the Connecticut Insurance Department and HHS Office for Civil Rights
5.1 Connecticut Insurance Department
Quorum filed its notification of the data security incident with the Connecticut Insurance Department, Financial Analysis Division, Cybersecurity Unit (Examiner: Richard Nakamura), on August 14, 2023, pursuant to Conn. Gen. Stat. § 38a-999b, which requires insurers domiciled in Connecticut to notify the Commissioner of Insurance of a cybersecurity event no later than three business days after a determination that a cybersecurity event has occurred. The notification was timely filed and included all information required by the statute.
Following receipt of Quorum's notification, the Department has initiated an inquiry into the cybersecurity event and has requested additional information regarding the Company's information security program, vendor oversight and due diligence practices, remediation measures implemented in response to the incident, and the status of consumer notification efforts. Examiner Nakamura has served as the Department's primary point of contact and has indicated that the inquiry is being conducted as part of the Department's standard examination process for cybersecurity events reported by Connecticut-domiciled insurers.
The scope of Calderwood & Harkness's representation in this workstream will include: (a) preparation and submission of Quorum's responses to the Department's information requests and any supplemental inquiries; (b) direct engagement with Examiner Nakamura and other Department personnel as needed; (c) strategic advice regarding the Department's examination process, including assessment of potential outcomes and any remedial actions or undertakings the Department may request; and (d) coordination with Quorum's internal compliance team to ensure that all submissions are accurate, complete, and consistent with the Company's regulatory obligations.
5.2 HHS Office for Civil Rights
Quorum filed its HIPAA breach notification with HHS-OCR, Region I (Boston Regional Office), on August 15, 2023, pursuant to 45 C.F.R. § 164.408, which requires covered entities to notify the Secretary of Health and Human Services of breaches of unsecured protected health information affecting 500 or more individuals. The notification reported the breach of unsecured protected health information affecting 41,203 individuals and included all information required by the applicable regulations.
Because the breach affected more than 500 individuals, it will be posted on the HHS Breach Portal (commonly referred to as the "Wall of Shame") and may attract the attention of OCR's enforcement division. OCR may, at its discretion, initiate a compliance review or formal investigation to assess Quorum's compliance with the HIPAA Privacy Rule, Security Rule, and Breach Notification Rule. While we cannot predict with certainty whether OCR will pursue an investigation, Calderwood & Harkness will be prepared to manage Quorum's response in the event that OCR elects to do so.
The scope of Calderwood & Harkness's representation in this workstream will include: (a) preparation and submission of any responses to OCR inquiries, data requests, or compliance review questionnaires; (b) coordination with Jennifer Liang, Quorum's Chief Privacy Officer, regarding the assembly and review of HIPAA compliance documentation, including risk analyses, policies and procedures, business associate agreements, training records, and prior audit findings; (c) strategic advice regarding potential investigation outcomes, including the possibility of a resolution agreement, corrective action plan, or civil money penalty; and (d) representation of Quorum in any settlement or resolution discussions with OCR, should such discussions become necessary.
5.3 Staffing.  Alan Burke and Sara Hendricks will handle the day-to-day preparation of all regulatory submissions for both the Connecticut Insurance Department and HHS-OCR, including drafting of responses, compilation of supporting documentation, and coordination with Quorum's internal teams. Kevin Ostrowski will oversee strategy for both regulatory engagements and will handle direct communications with regulators as needed, including any calls or meetings with Examiner Nakamura or OCR investigators.
6. Engagement Terms — Confirmation and Updates
6.1 Billing Rates
We confirm that the billing rates set forth in the Original Engagement Letter dated May 4, 2023 remain in full force and effect for all work performed under the expanded scope described in this letter. For ease of reference, the applicable billing rates are as follows:
In the event that it becomes necessary to staff additional attorneys or other professionals on any of the expanded workstreams, we will notify you in advance and communicate their billing rates prior to the commencement of any billable work. As noted in the Original Engagement Letter, the firm's standard billing rates are subject to annual adjustment effective January 1 of each calendar year, with advance written notice to the client.
6.2 Billing and Payment
Invoices will continue to be rendered on a monthly basis and are payable within 30 calendar days of receipt, consistent with the payment terms established in the Original Engagement Letter. All time and expenses incurred in connection with the expanded workstreams will be tracked under the existing Matter No. 1025-00006, with sub-matter codes assigned to each of the three new workstreams to distinguish them from the original incident response work. This sub-matter coding will facilitate internal tracking, budget monitoring, and insurance reporting.
Costs that are covered by Quorum's cyber liability insurance under Atlas Mutual Policy No. CYB-2023-041587 — including, without limitation, regulatory defense costs, which are an insured category of loss under the policy — will be clearly identified on all invoices for purposes of submission to Atlas Mutual for reimbursement. We note that the policy is subject to a $2,500,000 self-insured retention ("SIR"), which we understand has been substantially eroded by prior incident response costs. All communications with Atlas Mutual's claims adjuster, Paul Enriquez, regarding coverage and reimbursement of the expanded workstream costs will be coordinated with Rachel Bernstein and your office.
6.3 Privilege and Confidentiality
All work performed under the expanded scope of this engagement remains subject to the attorney-client privilege and work product doctrine protections established in the Original Engagement Letter and the Privilege Protocol Memorandum dated May 5, 2023, which set forth the protocols for preserving privilege in connection with communications among Calderwood & Harkness, Quorum, Graystone Forensics LLC, and other parties involved in the incident response.
We remind you that certain categories of communications undertaken in connection with the expanded workstreams are not subject to attorney-client privilege. Specifically, communications submitted to regulators — including the multistate AG coalition, the Connecticut Insurance Department, and HHS-OCR — are made on behalf of the client in a regulatory context and are not privileged. However, internal strategy memoranda, attorney-client communications, and work product prepared by Calderwood & Harkness in connection with the development of response strategy, risk assessment, and settlement positioning remain fully privileged and protected from disclosure.
The Common Interest Agreement dated May 10, 2023, between Quorum and Atlas Mutual Insurance Company, which permits the sharing of certain privileged communications and work product in connection with the defense and resolution of the data security incident, remains in full force and effect and covers the expanded workstreams described herein to the extent they involve matters within the scope of the insured claim.
6.4 Scope Limitations
We wish to note certain matters that fall outside the expanded scope of engagement described in this letter:
(a) Private Litigation and Class Action Defense. The expanded engagement does not cover the defense of any private litigation, including consumer class actions or representative actions, that may be filed in connection with the data security incident. In the event that any such actions are filed, a separate engagement letter addressing scope, staffing, billing, and litigation strategy will be required.
(b) SEC Enforcement Defense. The expanded engagement does not cover the defense of any enforcement action by the U.S. Securities and Exchange Commission. We note, however, that the existing engagement under the Original Engagement Letter covers SEC disclosure analysis, including review and advice regarding Quorum's disclosure obligations under the SEC's cybersecurity disclosure rules, and that work will continue under the original scope.
(c) Criminal Investigation Defense. The expanded engagement does not cover representation in connection with any criminal investigation or prosecution arising from the data security incident.
Additionally, Calderwood & Harkness reserves the right to recommend the engagement of local counsel in specific jurisdictions if required for any regulatory proceeding covered by the expanded scope, including any enforcement action initiated by an individual state attorney general outside of the multistate framework. Any such recommendation will be discussed with you in advance, and any engagement of local counsel will be subject to your approval.
7. Estimated Budget for Expanded Workstreams
We recognize the importance of providing budget guidance to assist Quorum in managing its legal costs and insurance reporting obligations. We note, however, that precise budgets are inherently difficult to estimate in matters of this nature given the unpredictable trajectory of regulatory inquiries, the uncertain pace of vendor negotiations, and the possibility of unforeseen developments. With that caveat, we provide the following good-faith estimates of anticipated legal fees for each expanded workstream:
The range for the multistate AG defense reflects the uncertainty regarding the depth and number of follow-up inquiries the coalition may issue and whether a negotiated resolution (such as an assurance of voluntary compliance or consent agreement) will be required, which would involve additional negotiation and documentation costs. The range for the vendor indemnification workstream reflects the potential for protracted negotiations and the complexity of drafting and negotiating a definitive settlement agreement and MSA amendments. The range for the regulatory engagement workstream reflects uncertainty regarding whether either the Connecticut Insurance Department or HHS-OCR will escalate beyond an initial inquiry to a more formal examination or investigation.
These estimates are provided solely for planning and budgeting purposes and are not a cap on fees. Actual fees will depend on the scope, complexity, and duration of each workstream as it develops. We will provide periodic budget updates as each workstream progresses and will promptly notify you if we anticipate that actual fees may materially exceed the high end of the estimated range for any workstream.
8. Acknowledgment
We would appreciate it if you would indicate Quorum's agreement to the expanded scope of engagement described in this letter by signing in the space provided below and returning a signed copy to our office. An electronic signature and return via email to kostrowski@calderwoodharkness.com will be sufficient, with a hard copy to follow at your convenience.
We are grateful for the continued confidence that you and the Quorum team have placed in Calderwood & Harkness, and we look forward to continuing to work with you on these important matters. Please do not hesitate to contact me directly if you have any questions or wish to discuss any aspect of this letter.
Very truly yours,
CALDERWOOD & HARKNESS LLP
By: ________
Kevin Ostrowski Partner, Privacy & Data Security
Direct: (202) 555-4127
Email: kostrowski@calderwoodharkness.com
ACKNOWLEDGMENT AND ACCEPTANCE
The undersigned, on behalf of Quorum Insurance Holdings Corp., hereby acknowledges receipt of the foregoing Engagement Scope Expansion Letter dated September 10, 2023 and confirms Quorum's agreement to the expanded scope of engagement, the additional workstreams, and the engagement terms as described herein. The undersigned further confirms that he is authorized to execute this acknowledgment on behalf of Quorum Insurance Holdings Corp.
AGREED AND ACCEPTED:
QUORUM INSURANCE HOLDINGS CORP.
By: ________
Name: Thomas R. Whitfield, Esq.
Title: General Counsel
Date: ________
cc:
Rachel Bernstein, Partner, Calderwood & Harkness LLP Alan Burke, Associate, Calderwood & Harkness LLP Sara Hendricks, Associate, Calderwood & Harkness LLP Jennifer Liang, Chief Privacy Officer, Quorum Insurance Holdings Corp. David Naranjo, Chief Information Security Officer, Quorum Insurance Holdings Corp.
Attorney | Title | Hourly Rate
Kevin Ostrowski | Partner | $1,250.00
Rachel Bernstein | Partner | $1,175.00
Alan Burke | Associate | $825.00
Sara Hendricks | Associate | $650.00
Workstream | Estimated Fee Range
Multistate Attorney General Defense | $400,000 – $600,000
Vendor Indemnification Negotiations (Palomar) | $150,000 – $250,000
CT Insurance Department and HHS-OCR Regulatory Engagement | $100,000 – $175,000
Total Estimated Additional Fees | $650,000 – $1,025,000

CALDERWOOD & HARKNESS LLP Attorneys at Law

CALDERWOOD & HARKNESS LLP

ACKNOWLEDGMENT AND ACCEPTANCE

AGREED AND ACCEPTED:

QUORUM INSURANCE HOLDINGS CORP.

Record

Parties

Dates

Amounts