1025-00006 · Graystone Forensics LLC · Insurance Coverage

cyber-insurance-coverage-analysis-memo.docx DOCUMENT Data Privacy

43 / 88 ← → ✕

PRIVILEGED AND CONFIDENTIAL ATTORNEY-CLIENT COMMUNICATION — ATTORNEY WORK PRODUCT DO NOT DISTRIBUTE

May 9, 2023

MEMORANDUM

TO: Thomas R. Whitfield, General Counsel, Quorum Insurance Holdings Corp.

FROM: Rachel Bernstein, Partner, Privacy & Data Security, Calderwood & Harkness LLP (New York, NY) Alan Burke, Associate, Privacy & Data Security, Calderwood & Harkness LLP (Washington, D.C.)

CC: Kevin Ostrowski, Partner, Privacy & Data Security, Calderwood & Harkness LLP (Washington, D.C.)

RE: Coverage Analysis — Quorum Insurance Holdings Corp. Cyber-Liability Insurance Tower — Palomar Data Solutions Security Incident

MATTER NO.: 1025-00006

This memorandum constitutes a privileged and confidential attorney-client communication and attorney work product prepared by Calderwood & Harkness LLP at the direction of and for the sole benefit of Quorum Insurance Holdings Corp. It is protected from disclosure by the attorney-client privilege and the work product doctrine. This memorandum should not be disclosed to any third party without the prior written consent of Calderwood & Harkness LLP and Quorum Insurance Holdings Corp. Disclosure to any third party, including insurers, brokers, or regulatory authorities, may result in waiver of applicable privileges.

I. Executive Summary

The purpose of this memorandum is to provide Quorum Insurance Holdings Corp. ("Quorum" or the "Company") with a detailed analysis of the cyber-liability insurance coverage available to Quorum in connection with the vendor-originated data security incident involving Palomar Data Solutions, Inc. ("Palomar"). This analysis is based on our review of the applicable insurance policies, the facts presently known regarding the incident, and the anticipated categories of loss and expense that Quorum expects to incur in responding to the incident.

On May 8, 2023, Quorum filed a notice of claim with Atlas Mutual Insurance Company ("Atlas Mutual") under Policy No. CYB-2023-041587. Atlas Mutual has assigned the claim Claim No. CYB-CLM-2023-05892. On the same date, precautionary notice was also provided to Pinnacle Surplus Lines Insurance Corp. ("Pinnacle") under excess Policy No. XS-CYB-2023-7812 in order to preserve Quorum's rights under the excess layer.

Quorum's cyber-liability insurance tower provides total available limits of $40,000,000, consisting of $15,000,000 in primary coverage from Atlas Mutual and $25,000,000 in excess coverage from Pinnacle. The primary policy is subject to a $2,500,000 self-insured retention ("SIR") per occurrence, which must be satisfied by Quorum before Atlas Mutual's payment obligations are triggered.

Based on our preliminary assessment, the Palomar security incident appears to fall within the insuring agreements of the primary policy. The anticipated categories of loss — including forensic investigation costs, consumer notification costs, credit monitoring and identity theft protection services, crisis communications expenses, and regulatory defense costs — are all covered cost categories under the policy's first-party and third-party coverage grants. The SIR will need to be satisfied before the primary policy responds to covered costs.

We have identified several key issues that warrant attention as the incident response progresses:

(a) Vendor-Originated Breach: Whether the policy's coverage extends to security incidents occurring on a third-party vendor's systems, rather than Quorum's own systems. As discussed in detail below, the policy's definitions of "Security Incident" and "Service Provider" are drafted to encompass vendor-originated breaches, and coverage should apply.

(b) Consent and Cooperation Requirements: The policy requires the insured to obtain the insurer's prior written consent to the selection of forensic investigators, notification vendors, and defense counsel. Compliance with these consent requirements must be documented carefully.

(c) Subrogation Rights: Atlas Mutual will have subrogation rights against Palomar to the extent it pays covered losses attributable to Palomar's breach of its data security obligations. Quorum's own indemnification claim against Palomar under the Master Services Agreement must be coordinated with Atlas's subrogation interest.

(d) Timing of Notice Compliance: The interval between Quorum's receipt of notification from Palomar (April 21, 2023) and the filing of the notice of claim with Atlas Mutual (May 8, 2023) must be supportable as consistent with the policy's "as soon as practicable" notice requirement.

In conclusion, coverage should be available for the anticipated loss categories, subject to satisfaction of policy conditions including the SIR and the consent requirements described herein. We recommend close coordination with Atlas Mutual's assigned claims adjuster, Paul Enriquez, throughout the response process to ensure that all policy conditions are met and coverage is preserved.

II. Background

A. The Incident

On or about March 14, 2023, a threat actor exploited a known remote code execution vulnerability — specifically, CVE-2023-0669, a pre-authentication command injection vulnerability in Severin Corporation's GoAnywhere MFT file transfer application — to gain unauthorized access to the network of Palomar Data Solutions, Inc. The exploitation of this particular vulnerability has been widely reported in the cybersecurity community and has been associated with organized cybercriminal activity targeting file transfer platforms.

Palomar Data Solutions, Inc. is a Texas-based data processing and business process outsourcing ("BPO") vendor, headquartered at 7100 Greenville Avenue, Suite 450, Dallas, TX 75231. Palomar provides claims data processing, document management, and analytics services to Quorum pursuant to a Master Services Agreement dated November 12, 2019, as amended by Amendment 1, executed March 3, 2021 (collectively, the "MSA"). Palomar is Quorum's second-largest vendor by annual contract value, representing approximately $16.3 million in annual fees under the current contractual arrangement (post-Amendment 1).

Following the initial compromise on March 14, 2023, the threat actor maintained unauthorized access to Palomar's network and engaged in the systematic exfiltration of data over an approximately 35-day window, from March 14 through April 18, 2023. The data exfiltration was detected on April 18, 2023, when Palomar's Security Operations Center ("SOC") identified anomalous outbound data transfers from one or more systems involved in the processing and storage of client data.

Palomar notified Quorum of the incident on April 21, 2023, via email from Derek Copeland, Palomar's General Counsel, to Thomas R. Whitfield, General Counsel of Quorum, and David Naranjo, Quorum's Chief Information Security Officer ("CISO"). This notification was provided approximately 72 hours after Palomar's SOC detected the incident, and approximately 24 hours past the contractual 48-hour notification requirement specified in Section 9.4 of the MSA. The late notification under the MSA is a separate contractual compliance issue that may be relevant to Quorum's indemnification claim against Palomar, and we address the contractual claims in a separate memorandum.

Calderwood & Harkness LLP was engaged by Quorum on May 4, 2023, to serve as outside counsel for the incident response, regulatory engagement, and coverage matters. On May 5, 2023, we retained Graystone Forensics LLC under the attorney-client privilege umbrella to conduct the forensic investigation of the incident, consistent with the well-established practice of retaining forensic investigators under the direction of outside counsel to preserve the confidentiality of forensic findings.

Preliminary information received from Palomar and from our initial review suggests that the compromised data may include personally identifiable information ("PII"), financial information (including bank account and payment card information), and protected health information ("PHI") of Quorum policyholders and claimants. The number of potentially affected individuals may be in the hundreds of thousands across multiple states, reflecting the breadth of Quorum's policyholder and claimant population whose data was processed by Palomar. The full scope of the data compromise is pending completion of Graystone's forensic analysis, which is ongoing.

B. Quorum's Cyber-Insurance Program

Quorum's cyber-liability insurance program was placed by Whitmore Risk Advisors Inc. ("Whitmore"), Quorum's insurance broker for specialty lines coverage. The lead broker on the program is Sandra Whitmore-Kim, who is headquartered at 390 Park Avenue, 18th Floor, New York, NY 10022. Whitmore has been instrumental in negotiating the terms and conditions of Quorum's cyber-liability tower and should be kept informed of developments in the claims process.

The program consists of a two-layer insurance tower, structured as follows:

Primary Layer: Atlas Mutual Insurance Company — $15,000,000 per occurrence / in the aggregate, subject to a $2,500,000 self-insured retention.

Excess Layer: Pinnacle Surplus Lines Insurance Corp. — $25,000,000 per occurrence / in the aggregate, attaching excess of the $15,000,000 Atlas Mutual primary limit.

The policy period for both layers is January 1, 2023 through January 1, 2024. The Palomar security incident — with initial unauthorized access occurring on March 14, 2023, and discovery of the incident on April 18, 2023 — falls squarely within the policy period. There is no question regarding whether the incident is within the temporal scope of the coverage.

We note that Quorum's cyber-insurance program is structured as an occurrence-based program, meaning that coverage is triggered by the occurrence of a security incident during the policy period, regardless of when claims arising from the incident are subsequently asserted. This is favorable to Quorum's coverage position.

III. Policy Summary — Atlas Mutual Primary Policy

A. Policy Identification

The primary layer of Quorum's cyber-liability insurance tower is provided by Atlas Mutual Insurance Company, an Illinois domestic mutual insurance company headquartered at 120 South LaSalle Street, Suite 3200, Chicago, IL 60603. The relevant policy details are as follows:

B. Limits and Retention

The Atlas Mutual primary policy provides the following limits and retention:

The SIR applies to all covered costs arising from a single occurrence. Atlas Mutual's obligation to pay covered costs attaches only after Quorum has incurred and paid $2,500,000 in covered costs attributable to the occurrence. All categories of covered first-party costs and third-party costs count toward satisfaction of the SIR. Once the SIR is satisfied, Atlas Mutual will reimburse Quorum for covered costs in excess of the SIR, up to the per-occurrence limit.

Because the per-occurrence limit and the aggregate limit are both $15,000,000, the full limit is available for this single occurrence, provided that no other claims have been or are made against the policy during the 2023 policy period. We are not aware of any other claims or notices submitted under the policy during the current policy period, and we recommend confirming this with Quorum's risk management team.

C. Insuring Agreements — Key Coverage Grants

The Atlas Mutual primary policy contains both first-party and third-party insuring agreements. We summarize below the coverage grants that are relevant to the Palomar incident.

First-Party Coverage Grants

The following first-party coverage grants are directly applicable to the anticipated costs of responding to the Palomar security incident:

1. Forensic Investigation Costs. The policy covers the reasonable and necessary costs of retaining forensic consultants to investigate the cause, scope, and nature of a security incident, including costs of determining what data was compromised, how the unauthorized access occurred, and whether the threat actor has been contained and ejected from the affected systems. This coverage grant is applicable to the engagement of Graystone Forensics LLC, which was retained by Calderwood & Harkness on May 5, 2023, to conduct the forensic investigation. As discussed in Section V.A below, the insurer's consent to the selection of the forensic investigator is required and has been coordinated.

2. Notification Costs. The policy covers the costs of notifying affected individuals as required by applicable federal and state breach notification laws, including the costs of printing notification letters, mailing and postage, substitute notice (where applicable), and the establishment and operation of a dedicated call center to field inquiries from affected individuals. Given that the compromised data likely implicates the breach notification statutes of multiple states, notification costs are expected to be a significant expense category.

3. Credit Monitoring and Identity Theft Protection Services. The policy covers the costs of providing credit monitoring and identity theft protection services to affected individuals for a period consistent with industry practice or as required by applicable law. Quorum intends to offer 24 months of complimentary credit monitoring, which is consistent with prevailing industry standards and the expectations of state attorneys general and regulators.

4. Crisis Management / Public Relations Costs. The policy covers the costs of retaining a crisis communications or public relations firm to manage the reputational impact of the security incident, including costs associated with preparation of press statements, employee communications, customer-facing communications, and media monitoring. This grant is applicable to the engagement of BrightPath Consulting Group Inc., which Quorum has retained to manage the communications strategy for the incident.

5. Regulatory Defense Costs. The policy covers the costs of legal defense in connection with regulatory investigations, inquiries, or proceedings brought by federal, state, or local regulatory authorities arising out of the security incident. This includes attorney fees and costs incurred in responding to civil investigative demands, subpoenas, and similar regulatory requests from state attorneys general, state insurance departments, and the U.S. Department of Health and Human Services, Office for Civil Rights ("HHS-OCR") if PHI is determined to have been compromised. Calderwood & Harkness's fees for regulatory defense work fall within this coverage grant.

6. Regulatory Fines and Penalties. The policy provides coverage for regulatory fines, penalties, and assessments imposed by a governmental authority arising from a covered security incident, to the extent such amounts are insurable under applicable law. The insurability of regulatory fines is a jurisdiction-specific issue that we address in greater detail in Section V.F below.

Third-Party Coverage Grants

The following third-party coverage grants are potentially applicable, depending on the development of third-party claims:

1. Third-Party Claims / Liability. The policy provides coverage for defense costs and indemnity obligations arising from third-party claims — including civil lawsuits, class action complaints, and written demands — asserted against Quorum by affected individuals, businesses, or other third parties in connection with a covered security incident. While no third-party lawsuits have been filed as of the date of this memorandum, the potential scope of the affected population makes class action litigation a realistic possibility, and this coverage grant may become directly relevant.

D. Key Definitions

The applicability of the above insuring agreements depends on the policy's key defined terms. We analyze the most significant definitions below:

"Security Incident." The policy defines "Security Incident" broadly to include the unauthorized access to, or unauthorized acquisition, use, or disclosure of, nonpublic personal information that is in the care, custody, or control of the insured or a service provider acting on the insured's behalf. This definition is critical to the coverage analysis. The Palomar incident involved unauthorized access to, and exfiltration of, nonpublic personal information — including PII, financial information, and PHI — that was in the custody of Palomar, a service provider acting on Quorum's behalf under the MSA. The data was being processed by Palomar pursuant to the MSA and was therefore in Palomar's care, custody, and control on Quorum's behalf. Accordingly, the Palomar incident satisfies the policy's definition of "Security Incident."

"Service Provider." The policy defines "Service Provider" to include any third-party entity that processes, stores, or transmits data on behalf of the insured pursuant to a written contract. Palomar satisfies every element of this definition: (a) it is a third-party entity; (b) it processes and stores claims data on behalf of Quorum; and (c) it does so pursuant to a written contract — the MSA dated November 12, 2019, as amended. The inclusion of the "Service Provider" concept in the "Security Incident" definition is a deliberate coverage feature designed to extend the policy's protection to vendor-originated breaches, reflecting the reality that modern enterprises rely heavily on third-party vendors to process sensitive data.

"Claim." The policy defines "Claim" to include regulatory investigations, inquiries, or proceedings brought by any governmental authority, as well as civil lawsuits, arbitration proceedings, and written demands for monetary damages or non-monetary relief. This broad definition ensures that regulatory engagement costs — including costs of responding to attorney general inquiries and HHS-OCR investigations — are covered as "Claims" under the policy.

"Loss." The policy defines "Loss" to include defense costs, judgments, settlements, regulatory fines and penalties (to the extent insurable under applicable law), and the first-party costs enumerated in the insuring agreements (forensics, notification, credit monitoring, crisis communications, etc.). This comprehensive definition of "Loss" ensures that all anticipated cost categories fall within the scope of the policy's payment obligations.

IV. Policy Summary — Pinnacle Surplus Lines Excess Policy

A. Policy Identification

The excess layer of Quorum's cyber-liability insurance tower is provided by Pinnacle Surplus Lines Insurance Corp., a Delaware corporation operating as a surplus lines carrier, headquartered at One Beacon Street, Suite 1100, Boston, MA 02108. The relevant policy details are as follows:

B. Limits and Attachment

The Pinnacle excess policy provides the following limits and attachment point:

The total cyber-liability insurance tower — combining the Atlas Mutual primary policy and the Pinnacle excess policy — provides $40,000,000 in total available limits per occurrence ($15,000,000 primary + $25,000,000 excess), subject to the $2,500,000 SIR.

C. Follow-Form Provisions

The Pinnacle excess policy is a "follow-form" policy that follows the terms and conditions of the Atlas Mutual primary policy in all material respects, including insuring agreements, definitions, exclusions, and conditions. The Pinnacle policy does not contain independent coverage terms; rather, it incorporates by reference the coverage provisions of the underlying Atlas Mutual policy. This means that the analysis of coverage under the Atlas Mutual primary policy — including the applicability of the "Security Incident" and "Service Provider" definitions, the scope of the insuring agreements, and the applicability of exclusions — applies equally to the Pinnacle excess policy.

Pinnacle's obligation to pay covered losses attaches only after the Atlas Mutual primary limit of $15,000,000 has been exhausted by payment of covered losses for the occurrence. Until exhaustion of the primary limit, Pinnacle has no payment obligation.

Based on the preliminary cost estimates discussed in Section VII below, total incident response costs are not expected to exhaust the $15,000,000 primary layer, making attachment of the Pinnacle excess layer unlikely for this incident under current projections. However, precautionary notice has been provided to Pinnacle to preserve Quorum's excess coverage rights in the event that costs escalate beyond current projections, additional cost categories emerge, or significant third-party litigation — such as class action complaints by affected individuals — materializes and drives total costs above the primary limit. The preservation of excess coverage rights through timely notice is a prudent risk management practice, and we recommend maintaining periodic communication with Pinnacle's claims contact, Lisa Garner, throughout the claims process.

V. Coverage Analysis — Anticipated Cost Categories

This section analyzes each anticipated category of cost in the context of the Atlas Mutual primary policy's insuring agreements, consent requirements, and other relevant provisions.

A. Forensic Investigation Costs (Graystone Forensics LLC)

Graystone Forensics LLC ("Graystone") was retained by Calderwood & Harkness LLP on May 5, 2023, under the attorney-client privilege umbrella, to conduct the forensic investigation of the Palomar security incident. The engagement is being led by Dr. Nolan Briggs, Managing Director, and Kendra Faulkner, Senior Forensic Analyst. Graystone's scope of work includes determining the full scope of the threat actor's access to Palomar's systems, identifying all data repositories that were accessed or exfiltrated, analyzing the nature and categories of data involved, identifying affected individuals, and assessing whether the threat actor has been fully contained and ejected from the environment.

Graystone's fees and expenses constitute "Forensic Investigation Costs" under the policy's first-party coverage grants and should be covered, subject to the SIR and the insurer consent requirement discussed below.

Consent Requirement. The Atlas Mutual policy requires that the insured obtain the insurer's prior written consent to the selection and retention of forensic investigators. This is a standard feature of cyber-liability policies and is designed to ensure that the insurer has input into the qualifications and cost structure of the forensic engagement. We coordinated with Paul Enriquez, Atlas Mutual's assigned claims adjuster, prior to Graystone's formal retention and confirmed that Graystone Forensics LLC is an approved forensic vendor on Atlas Mutual's panel of pre-approved cyber-incident response vendors. Mr. Enriquez indicated that Graystone's retention would be acceptable. However, we have not yet received formal written consent documenting this approval. We strongly recommend that formal written consent be obtained and placed in the claims file without delay to preclude any subsequent dispute regarding consent compliance.

Estimated Cost Range. Based on the scope of the forensic investigation — which involves a 35-day exfiltration window, a multi-state data set encompassing claims processing records, structured and unstructured data repositories, and the need for data mining and analysis to identify specific affected individuals — forensic costs are expected to be significant. No precise estimate is available at this early stage of the engagement, as the scope of Graystone's work will depend in part on findings from the initial phases of the investigation. We will provide updated cost estimates as Graystone's investigation progresses and the scope of the data compromise becomes clearer.

B. Notification Costs (Clearfield Notification Services LLC)

Consumer notification letters to affected individuals will be required under the data breach notification statutes of multiple states once Graystone's forensic investigation confirms the scope of compromised data and the identities of affected individuals are determined. Quorum's obligations under applicable state breach notification laws will be assessed on a state-by-state basis, as notification triggers, content requirements, timing requirements, and regulator notification obligations vary by jurisdiction. Where PHI is involved, notification obligations under the Health Insurance Portability and Accountability Act ("HIPAA") Breach Notification Rule (45 C.F.R. §§ 164.400–414) may also apply if Quorum is determined to be a covered entity or business associate with respect to the compromised PHI.

Notification costs — including printing of notification letters, mailing and postage, substitute notice (if applicable for individuals whose contact information is unavailable), and the establishment and operation of a dedicated call center to respond to inquiries from affected individuals — fall within the policy's "Notification Costs" insuring agreement and should be covered.

Consent Requirement. The Atlas Mutual policy requires the insured to obtain the insurer's prior written consent to the selection of the notification vendor. We recommend that Quorum propose Clearfield Notification Services LLC ("Clearfield") as the notification and call center vendor for this engagement. Clearfield's contact is Jerome Tillman, Account Manager, and the firm is headquartered at 4500 Rockside Road, Suite 210, Independence, OH 44131. Clearfield is a nationally recognized notification vendor with extensive experience in large-scale breach notification programs, and Quorum has a preexisting relationship with Clearfield from a prior, smaller-scale notification engagement. Insurer approval for the selection of Clearfield should be obtained from Paul Enriquez before the engagement is formalized.

Estimated Cost Range. Notification costs will depend on the number of affected individuals, which has not yet been determined. If the affected population is in the range of 200,000 to 400,000 individuals — consistent with preliminary estimates based on the volume of data processed by Palomar on Quorum's behalf — notification mailing costs alone (printing, postage, fulfillment) could be approximately $400,000 to $800,000. Call center operations, which typically run for 90 to 120 days following notification, could add several hundred thousand dollars to the total, depending on call volume and staffing requirements. We will refine these estimates as the scope of the affected population is confirmed.

C. Credit Monitoring and Identity Theft Protection Services

Quorum expects to offer 24 months of complimentary credit monitoring and identity theft protection services to affected individuals. This duration is consistent with prevailing industry practice for security incidents involving the types of data at issue (PII, financial information, and PHI) and aligns with the expectations of state attorneys general and regulators, who have increasingly demanded longer monitoring periods in enforcement actions and multistate settlements. Offering 24 months of monitoring also serves to demonstrate good faith and mitigate potential regulatory and litigation risk.

These costs are covered under the policy's credit monitoring insuring agreement as a first-party coverage grant.

Estimated Cost Range. The cost of credit monitoring services will depend on several factors: (a) the total number of affected individuals to whom monitoring is offered; (b) the take-rate — i.e., the percentage of affected individuals who actually enroll in the monitoring service — which industry experience suggests typically ranges from 30% to 50% of the notified population; (c) the duration of monitoring (24 months); and (d) the negotiated per-enrollee rate or flat-fee arrangement with the monitoring provider.

To illustrate the potential range: assuming a hypothetical affected population of approximately 300,000 individuals, a 40% take-rate would yield approximately 120,000 enrollees. At estimated market rates of $15 to $20 per enrollee per month for a 24-month term, the aggregate per-unit cost could theoretically reach $43,200,000 to $57,600,000. However, these per-unit calculations significantly overstate the actual cost, because flat-fee or volume-discount arrangements are typically negotiated with credit monitoring vendors that substantially reduce the effective per-enrollee cost. Based on our experience with similarly scaled incidents, a negotiated flat-fee arrangement for credit monitoring services is likely to be in the range of $2,000,000 to $3,000,000 for a population of this size.

The flat-fee negotiation for credit monitoring represents one of the most significant cost management levers available to Quorum in this engagement. We recommend engaging Clearfield (or an alternative credit monitoring provider approved by Atlas Mutual) early in the process to negotiate favorable flat-fee terms before the monitoring program is launched.

D. Crisis Communications / Public Relations Costs (BrightPath Consulting Group Inc.)

Quorum has retained BrightPath Consulting Group Inc. ("BrightPath") to manage external and internal communications strategy related to the security incident. The engagement is being led by Meredith Ashford, Managing Director, at BrightPath's office at 450 Lexington Avenue, 4th Floor, New York, NY 10017. BrightPath's scope of work includes development of press statements, coordination with Quorum's investor relations team regarding SEC disclosure obligations, preparation of employee communications, development of customer-facing talking points, and ongoing media monitoring.

Crisis management and public relations costs are covered under the policy's crisis management insuring agreement as a first-party coverage grant.

Consent Requirement. The Atlas Mutual policy may require insurer consent for the selection of the crisis communications firm, depending on the specific wording of the consent clause. We recommend proactively confirming with Paul Enriquez that BrightPath is an acceptable vendor and obtaining written consent for BrightPath's retention. Even if the policy does not strictly require consent for crisis communications firms, documenting the insurer's acknowledgment and agreement will avoid potential disputes at the time of cost reimbursement.

Estimated Cost Range. Public relations and crisis communications engagements for security incidents of this magnitude — involving potential multi-state notifications of hundreds of thousands of individuals and likely media attention — typically range from $200,000 to $500,000, depending on the intensity and duration of the engagement, the number of media touchpoints, and the complexity of the communications strategy. We will refine this estimate as the communications plan develops.

E. Regulatory Defense Costs (Calderwood & Harkness LLP)

Calderwood & Harkness LLP's legal fees for regulatory defense work — including preparing for and responding to inquiries from state attorneys general offices, state insurance department regulators, and HHS-OCR (in the event PHI is confirmed to have been compromised) — are covered as "Regulatory Defense Costs" under the policy's insuring agreements. Regulatory defense work includes, among other things, drafting responses to civil investigative demands and subpoenas, preparing for and attending meetings with regulators, negotiating assurance of voluntary compliance ("AVC") or consent agreements, and advising Quorum on regulatory strategy.

Consent Requirement. The Atlas Mutual policy requires the insurer's prior written consent to the selection of defense counsel. Calderwood & Harkness was engaged by Quorum on May 4, 2023. We have confirmed with Paul Enriquez that Calderwood & Harkness LLP is on Atlas Mutual's approved panel of cyber-breach counsel. As with the forensic investigator consent, we recommend obtaining formal written confirmation of this approval from Mr. Enriquez and maintaining the written consent in the claims file.

Calderwood & Harkness's overall engagement encompasses both covered work (forensic investigation oversight, notification compliance, regulatory defense) and work that may fall outside the policy's coverage (vendor indemnification negotiations and affirmative contractual claims against Palomar). The allocation of legal fees between covered and non-covered work is addressed in Section VI.F below.

Billing Rates. The following billing rates apply to the Calderwood & Harkness professionals assigned to this matter:

Atlas Mutual may apply rate caps or billing guidelines that could affect the reimbursable rate for one or more of these timekeepers. We should confirm at the earliest opportunity whether the Atlas Mutual policy contains billing rate limitations, outside counsel billing guidelines, or requirements that counsel adhere to specific insurer litigation management guidelines. If rate caps apply, any differential between Calderwood & Harkness's standard rates and the insurer's approved rates would be borne by Quorum.

F. Regulatory Fines and Penalties

If any state attorney general, state insurance department regulator, or federal regulator (such as HHS-OCR) imposes fines, penalties, or assessments on Quorum arising from the security incident, the Atlas Mutual policy provides coverage for such amounts to the extent they are insurable under applicable law.

The insurability of regulatory fines and penalties is a jurisdiction-specific legal question that varies depending on the nature of the fine (civil versus criminal), the regulatory authority imposing the fine, and the law of the jurisdiction in which insurability is evaluated. Generally, civil fines and penalties imposed by regulatory authorities — such as HIPAA civil monetary penalties imposed by HHS-OCR, or civil penalties imposed by state attorneys general under state breach notification or data protection statutes — are considered insurable in a number of jurisdictions, including Connecticut (the state of Quorum's domicile) and several other states. Criminal fines and penalties, by contrast, are generally not insurable as a matter of public policy.

We note, however, that the primary objective of Quorum's regulatory engagement strategy is to avoid any enforcement action or imposition of fines. A well-executed incident response — including timely notification, proactive engagement with regulators, and implementation of remedial measures — significantly reduces the likelihood of regulatory enforcement. If fines are avoided through successful regulatory engagement, this coverage grant will not need to be triggered.

G. Third-Party Litigation Defense and Indemnity

As of the date of this memorandum, no third-party lawsuits have been filed against Quorum in connection with the Palomar security incident. No class action complaints, individual lawsuits, or written demands from affected individuals have been received. However, given the potential scope of the affected population — potentially hundreds of thousands of individuals across multiple states — and the increasing prevalence of data breach class action litigation in the United States, class action complaints are a realistic possibility, particularly if the incident receives significant media attention or if affected individuals include consumers in jurisdictions with active plaintiffs' bars.

The Atlas Mutual policy's third-party coverage grants would respond to defense costs and indemnity obligations arising from such litigation, subject to the SIR and the per-occurrence limit. Defense costs under the policy are typically included within the policy limits (i.e., they erode the available limits) rather than provided in addition to limits. This is a standard feature of cyber-liability policies and should be factored into the overall coverage adequacy assessment.

We recommend that Quorum monitor state and federal court dockets for any litigation filings related to the Palomar incident and provide prompt supplemental notice to Atlas Mutual (and Pinnacle, if warranted) if any lawsuits or written demands are received. Timely notice of third-party claims is essential to preserving coverage.

VI. Potential Coverage Issues and Gaps

While we believe that coverage should be available for the Palomar incident under Quorum's cyber-liability insurance tower, there are several potential coverage issues and gaps that warrant careful attention. We analyze each below.

A. Vendor-Originated Breach — Service Provider Coverage

The most significant coverage issue presented by this incident is whether the Atlas Mutual policy covers security incidents that originate on a third-party vendor's network, rather than on Quorum's own systems. The Palomar breach occurred entirely within Palomar's IT environment — the threat actor exploited a vulnerability in Palomar's GoAnywhere MFT appliance and exfiltrated data from Palomar's systems. Quorum's own network was not directly compromised.

Analysis. As discussed in Section III.D above, the policy's definition of "Security Incident" expressly includes unauthorized access to, or unauthorized acquisition, use, or disclosure of, nonpublic personal information "in the care, custody, or control of the insured or a service provider acting on the insured's behalf." The inclusion of the phrase "or a service provider acting on the insured's behalf" is a deliberate extension of coverage to vendor-originated breaches. The policy further defines "Service Provider" to include any third-party entity that processes, stores, or transmits data on behalf of the insured pursuant to a written contract.

Palomar clearly qualifies as a "Service Provider" under this definition. Palomar processes, stores, and transmits Quorum policyholder and claimant data on Quorum's behalf pursuant to the MSA — a written contract. The data that was compromised in the Palomar breach was in Palomar's care, custody, and control, but it was being held on Quorum's behalf as part of Palomar's data processing obligations under the MSA.

Conclusion. The policy should provide coverage for this vendor-originated incident. The "Service Provider" extension is a standard feature of modern, well-drafted cyber-liability policies and reflects the commercial reality that enterprises routinely entrust sensitive data to third-party vendors. This is precisely the coverage feature for which Whitmore Risk Advisors negotiated on Quorum's behalf, and we see no basis for Atlas Mutual to deny coverage on the ground that the breach originated on Palomar's systems.

Risk Factor. Notwithstanding our confidence in the coverage analysis, we recommend proactively confirming with Paul Enriquez that Atlas Mutual agrees the service provider coverage applies and that Atlas does not intend to assert any coverage defense based on the vendor-originated nature of the breach. An early confirmation on this point will provide certainty and allow Quorum to proceed with the incident response without concern about retroactive coverage challenges.

B. Late Notice / Timeliness of Claim

The Atlas Mutual policy requires that the insured provide notice of a claim or potential claim "as soon as practicable" after the insured becomes aware of a security incident that may give rise to a claim under the policy. The "as soon as practicable" standard is a common notice provision in insurance policies and has been the subject of extensive judicial interpretation. While the standard does not require immediate notice, it does require that notice be provided within a reasonable time under the circumstances.

The relevant timeline is as follows:

Analysis. Quorum received initial notice of the incident from Palomar on April 21, 2023, and filed its notice of claim with Atlas Mutual 17 days later, on May 8, 2023. In the intervening 17-day period, Quorum took the following steps: (a) assessed the initial information provided by Palomar regarding the nature and scope of the incident; (b) conducted internal discussions among the General Counsel, CISO, and relevant risk management personnel; (c) identified and engaged outside counsel (Calderwood & Harkness LLP, engaged May 4, 2023); (d) retained a forensic investigator under the privilege umbrella (Graystone Forensics LLC, retained May 5, 2023); and (e) prepared and submitted the notice of claim to Atlas Mutual and the precautionary notice to Pinnacle.

This 17-day interval between Quorum's receipt of notification from Palomar and the filing of the notice of claim is, in our judgment, consistent with the "as soon as practicable" standard. The "as soon as practicable" standard does not require an insured to provide notice instantaneously or before it has had an opportunity to assess the situation, engage counsel, and prepare an informed notice. Indeed, courts have generally held that a reasonable period for initial assessment and engagement of professional advisors is contemplated by the "as soon as practicable" standard, and that 17 days is within the bounds of reasonableness, particularly for a complex security incident requiring legal and forensic assessment before the contours of the potential claim could be understood.

Conclusion. We do not anticipate that Atlas Mutual will assert a late-notice defense. Nevertheless, to mitigate any risk, we recommend that Quorum maintain detailed documentation of the steps taken between April 21 and May 8, 2023, to demonstrate the reasonableness of the notice timeline. A chronology of internal actions, counsel engagement, and claim preparation activities should be prepared and maintained in the claims file.

C. Self-Insured Retention — $2,500,000

The $2,500,000 SIR per occurrence must be fully satisfied by Quorum before Atlas Mutual's payment obligations are triggered. All categories of covered costs incurred by Quorum in connection with the Palomar incident — including forensic investigation fees, notification costs, credit monitoring costs, crisis communications fees, and legal fees — count toward satisfaction of the SIR.

Quorum should implement a system for tracking all incident-related costs from the outset of the engagement, with clear categorization of costs by category (forensics, notification, credit monitoring, crisis communications, legal fees, internal costs). This cost-tracking system will serve multiple purposes: (a) it will document when the SIR threshold of $2,500,000 is reached, enabling Quorum to notify Atlas Mutual that the SIR has been satisfied and that Atlas's reimbursement obligation has commenced; (b) it will facilitate the preparation of cost submissions and claim documentation for Atlas Mutual; and (c) it will support the segregation of covered costs from non-covered costs (as discussed in Section VI.F below).

Based on the preliminary cost projections discussed in Section VII below — which suggest total incident response costs in the range of $5.1 million to $11.3 million — the $2,500,000 SIR is expected to be exhausted relatively quickly as forensic investigation fees, legal fees, and initial notification preparation costs accumulate during the early stages of the response. We anticipate that the SIR will be satisfied within the first 60 to 90 days of the engagement, though this timeline will depend on the pace of Graystone's forensic investigation and the timing of vendor engagements.

D. Vendor Indemnification / Subrogation Interaction

Quorum intends to pursue indemnification from Palomar under Section 12.2 of the MSA for Palomar's breach of its data security obligations, including Palomar's failure to timely patch the GoAnywhere MFT vulnerability and its delayed notification to Quorum. The MSA contains a liability cap equal to two times the trailing twelve-month fees paid under the agreement, which currently equates to a cap of approximately $32,600,000 (2 × $16.3 million). The vendor indemnification claim is being analyzed in a separate Calderwood & Harkness memorandum and is not the subject of this coverage analysis.

However, the interplay between Quorum's vendor indemnification claim against Palomar and Atlas Mutual's subrogation rights under the insurance policy is a significant coverage coordination issue that requires careful management.

Subrogation Rights. Atlas Mutual will have subrogation rights against Palomar to the extent that Atlas pays covered losses attributable to Palomar's acts or omissions. Subrogation is the right of an insurer, upon paying a loss, to step into the insured's shoes and pursue the insured's claims against the responsible third party. The Atlas Mutual policy almost certainly contains a subrogation clause requiring Quorum to cooperate with Atlas's subrogation efforts and to refrain from any action that would prejudice or impair Atlas's subrogation rights.

Coordination Issue. Quorum's direct indemnification claim against Palomar under the MSA and Atlas Mutual's subrogation claim against Palomar are based on overlapping factual and legal theories. If Quorum settles its indemnification claim with Palomar — particularly if it does so at a discount to Quorum's full damages — without Atlas Mutual's knowledge or consent, such a settlement could be argued to prejudice Atlas's subrogation rights. For example, if Quorum were to release Palomar from liability in exchange for a partial indemnification payment, Atlas could argue that the release impaired Atlas's ability to pursue its own subrogation claim against Palomar for amounts Atlas paid under the policy.

Insurance Recovery Offset. In addition, the Atlas Mutual policy may contain "other insurance," "recovery," or "collateral source" provisions requiring Quorum to credit recoveries received from third parties (such as Palomar indemnification payments) against the total covered loss. If Quorum recovers a substantial sum from Palomar, that recovery may reduce the net loss for which Atlas is responsible, potentially dollar-for-dollar.

Recommendation. To navigate these issues, we recommend the following approach:

(a) Coordinate with Paul Enriquez regarding the interplay between the Palomar indemnification claim and Atlas's coverage obligations, including Atlas's subrogation interests.

(b) Obtain Atlas Mutual's written consent before finalizing any settlement or binding agreement with Palomar regarding indemnification.

(c) Structure any settlement with Palomar in a manner that preserves Atlas's subrogation rights, such as by excluding from the release any claims that Atlas may wish to pursue independently.

(d) Maintain clear records of any amounts recovered from Palomar, as these may need to be credited against covered losses under the policy.

E. Exclusions — Preliminary Review

We have conducted a preliminary review of the exclusions contained in the Atlas Mutual policy and assessed their potential applicability to the Palomar security incident. Our analysis of each potentially relevant exclusion is as follows:

Intentional Acts Exclusion. The policy excludes coverage for losses arising from the intentional, fraudulent, or criminal acts of the insured. This exclusion is not implicated by the Palomar incident. The security breach was perpetrated by an external threat actor who exploited a vulnerability in Palomar's systems. Neither Quorum nor any of its officers, directors, or employees engaged in any intentional, fraudulent, or criminal conduct that caused or contributed to the breach. This exclusion has no applicability to the facts of this incident.

Prior Knowledge Exclusion. The policy excludes coverage for security incidents that were known to the insured prior to the inception date of the policy (January 1, 2023). The initial unauthorized access to Palomar's systems occurred on March 14, 2023 — more than two months after the policy inception date. Quorum had no knowledge of the GoAnywhere MFT vulnerability in Palomar's environment or of the subsequent data breach prior to receiving Palomar's notification on April 21, 2023. There is no prior knowledge issue, and this exclusion does not apply.

Contractual Liability Exclusion. Some cyber-liability policies contain exclusions for losses arising from the insured's breach of contract or failure to perform contractual obligations. Even if such an exclusion exists in the Atlas Mutual policy, it would not apply here because Quorum's losses arise from Palomar's breach of its data security obligations, not from any breach of contract by Quorum. Quorum is the victim of its vendor's security failure, not the perpetrator of a contractual breach.

War / Terrorism Exclusion. The policy contains standard war, terrorism, and hostile acts exclusions. Based on the information currently available, there is no indication that the threat actor responsible for the Palomar breach was a nation-state actor or that the attack constitutes an act of war, terrorism, or hostile action by a sovereign power. The CVE-2023-0669 exploitation has been associated with financially motivated cybercriminal activity, not state-sponsored operations. However, threat actor attribution is an evolving area of analysis, and Graystone's forensic investigation may yield additional intelligence regarding the identity and motivations of the threat actor. We recommend monitoring Graystone's findings on this point and revisiting the war/terrorism exclusion analysis if attribution information changes.

Bodily Injury / Property Damage Exclusion. Standard bodily injury and property damage exclusions are typically included in cyber-liability policies to delineate cyber coverage from general liability coverage. These exclusions are not implicated by a data breach incident and are not relevant to the Palomar incident.

Conclusion. Based on our preliminary review, no policy exclusions appear to bar coverage for the Palomar security incident. We will revisit this analysis if new facts emerge during the forensic investigation or if Atlas Mutual raises any exclusion-based coverage defenses.

F. Allocation of Legal Fees Between Covered and Non-Covered Work

As noted in Section V.E above, Calderwood & Harkness's engagement on behalf of Quorum encompasses both work that is covered under the Atlas Mutual policy and work that is likely not covered. Specifically:

Covered Work: Forensic investigation oversight and coordination; breach notification compliance analysis and execution; credit monitoring program oversight; crisis communications coordination; regulatory engagement strategy, preparation, and defense; and general incident response management.

Potentially Non-Covered Work: Vendor indemnification analysis, negotiations, and demands against Palomar; preparation and pursuit of affirmative contractual claims against Palomar under the MSA; and related commercial litigation strategy. These activities are in the nature of affirmative claims pursued by Quorum against Palomar, rather than defensive costs incurred in response to claims against Quorum. Affirmative claim pursuit costs are generally not covered under cyber-liability policies.

Recommendation. To address this allocation issue, we will maintain detailed contemporaneous time records that segregate time spent on covered activities from time spent on non-covered affirmative vendor indemnification and contractual claim activities. Each timekeeper will use separate billing codes or task codes for covered and non-covered work. This segregation will facilitate accurate cost submissions to Atlas Mutual and will minimize the risk of coverage disputes regarding the allocation of legal fees between covered and non-covered categories. If a particular activity involves elements of both covered and non-covered work and cannot be cleanly segregated, we will apply a reasonable allocation methodology and document the basis for the allocation.

G. Internal Costs

Quorum will inevitably incur significant internal costs in connection with the incident response, including IT remediation efforts (e.g., costs of assessing and hardening Quorum's own systems to the extent data flows between Quorum and Palomar may have been compromised), employee overtime for personnel involved in the response, and management time devoted to incident oversight and decision-making.

Many cyber-liability policies cover only external vendor costs and do not reimburse the insured for internal labor, overhead, or other internal costs. The Atlas Mutual policy's definition of "Loss" and the specific cost categories enumerated in the insuring agreements should be reviewed carefully to determine whether Quorum's internal costs are reimbursable. If the policy's coverage is limited to costs incurred with third-party vendors and professionals, Quorum's internal costs will be borne by Quorum outside the insurance recovery.

Recommendation. We recommend reviewing the policy's definition of "Loss" and the specific language of each insuring agreement to confirm whether internal costs are excluded. If internal costs are not covered, they should be tracked separately for budgeting and financial reporting purposes but should not be included in cost submissions to Atlas Mutual.

VII. Estimated Total Costs and Coverage Positioning

A. Preliminary Cost Estimates

At this early stage of the engagement — with Graystone's forensic investigation still in its initial phases and the scope of affected individuals not yet confirmed — precise cost estimates are not available. However, based on the anticipated scope of the incident (a potential affected population of hundreds of thousands of individuals across multiple states, involving PII, financial information, and PHI), our experience with similarly scaled incidents, and the engagement parameters for the vendors already retained or anticipated, we project the following preliminary cost ranges:

These estimates are preliminary and are subject to revision as the forensic investigation progresses, the scope of affected individuals is confirmed, regulatory engagement unfolds, and vendor costs are finalized. In particular, the forensic investigation costs and credit monitoring costs are highly sensitive to the scope of the data compromise and the number of affected individuals. If the affected population proves to be at the higher end of the range — or if additional categories of data (such as Social Security numbers on a large scale) are confirmed to have been compromised — costs could trend toward the upper end of these estimates or potentially exceed them.

We have not included in these estimates any costs associated with potential third-party litigation (e.g., class action defense costs and settlements), as no litigation has been filed to date. If significant class action litigation materializes, defense costs and potential settlements could substantially increase total costs and could implicate the excess layer.

B. Coverage Adequacy

Based on the preliminary cost estimates above, total incident response costs are expected to fall well within the $15,000,000 per-occurrence limit of the Atlas Mutual primary policy, after satisfaction of the $2,500,000 SIR. Even at the high end of the projected range ($11,300,000), the net covered costs (excluding the estimated $400,000 to $800,000 in internal costs that may not be covered) would be approximately $10,500,000, of which $2,500,000 would be borne by Quorum through the SIR, and approximately $8,000,000 would be payable by Atlas Mutual.

The Pinnacle excess layer ($25,000,000 excess of $15,000,000) is unlikely to be implicated unless (a) costs substantially exceed the current projections, (b) significant class action litigation materializes with defense costs and potential settlement or judgment exposure that drives total costs above $15,000,000, or (c) additional cost categories emerge that are not currently anticipated. The total insurance tower of $40,000,000 provides robust protection against even a worst-case scenario.

C. Net Exposure Analysis

Quorum's net financial exposure will depend on the interplay between the insurance recovery, the SIR, and any indemnification recovered from Palomar. The key components are as follows:

Quorum's SIR obligation: $2,500,000. This amount will be borne by Quorum regardless of the total cost of the incident.

Potential Palomar indemnification recovery: Up to $32,600,000 (the MSA liability cap of 2× trailing twelve-month fees). Actual recovery will depend on the outcome of negotiations with Palomar and, if necessary, litigation or arbitration. If Palomar agrees to indemnify Quorum for a significant portion of the incident costs, the Palomar recovery could offset or exceed Quorum's SIR obligation, potentially reducing Quorum's net out-of-pocket exposure to zero or near-zero.

Internal costs: $400,000 to $800,000 in internal costs that may not be covered by the insurance policy and may not be recoverable from Palomar (depending on the terms of the MSA indemnification provision and whether internal costs are included in the definition of indemnifiable losses).

Net effect: Depending on the ultimate cost figure and the extent of Palomar indemnification recovery, Quorum's net out-of-pocket exposure may be limited to the SIR ($2,500,000) or less, if substantial Palomar indemnification is achieved. In a best-case scenario, Palomar indemnification could fully offset Quorum's SIR obligation and internal costs, resulting in minimal or no net financial exposure to Quorum.

VIII. Recommendations and Next Steps

Based on the foregoing analysis, we recommend the following action items to preserve and maximize Quorum's insurance coverage and to ensure compliance with all policy conditions:

1. Document Insurer Consents. Obtain and document formal written consent from Paul Enriquez at Atlas Mutual for the retention of the following vendors and professionals:

(a) Graystone Forensics LLC as the forensic investigator;

(b) Calderwood & Harkness LLP as breach response and regulatory defense counsel;

(d) BrightPath Consulting Group Inc. as the crisis communications firm.

Written consent should be maintained in both the Calderwood & Harkness matter file and Quorum's internal claims file. Where verbal consent has already been obtained (as with Graystone Forensics), follow-up written confirmation should be requested and documented.

2. Billing Rate Confirmation. Confirm whether the Atlas Mutual policy contains billing rate caps, fee schedules, or litigation management guidelines that may affect reimbursement of Calderwood & Harkness's fees at the specified hourly rates. If rate caps apply, we will advise Quorum regarding the differential and its impact on Quorum's net cost exposure.

3. Cost Tracking and Segregation. Implement a comprehensive cost-tracking system from the outset of the engagement, with costs clearly segregated into the following categories:

(a) Covered first-party incident response costs (forensics, notification, credit monitoring, crisis communications);

(b) Covered regulatory defense costs;

(d) Internal Quorum costs (IT remediation, employee overtime, management time).

This segregation will facilitate timely and accurate cost submissions to Atlas Mutual, minimize coverage disputes regarding allocation, and support Quorum's internal budgeting and financial reporting.

4. SIR Satisfaction Documentation. Track cumulative covered costs against the $2,500,000 SIR on a rolling basis and notify Atlas Mutual in writing when the SIR threshold has been reached. Upon SIR satisfaction, Atlas Mutual's reimbursement obligation will commence, and Quorum should begin submitting cost documentation to Atlas Mutual for reimbursement on a periodic (e.g., monthly) basis.

5. Subrogation Coordination. Coordinate with Paul Enriquez at Atlas Mutual regarding the Palomar indemnification claim to ensure that Quorum's negotiations with Palomar do not prejudice Atlas's subrogation rights. Specifically:

(a) Consult with Paul Enriquez before entering into any binding settlement agreement or release with Palomar;

(b) Structure any settlement with Palomar to preserve Atlas's abil

PRIVILEGED AND CONFIDENTIAL ATTORNEY-CLIENT COMMUNICATION — ATTORNEY WORK PRODUCT DO NOT DISTRIBUTE
May 9, 2023
MEMORANDUM
TO: Thomas R. Whitfield, General Counsel, Quorum Insurance Holdings Corp.
FROM: Rachel Bernstein, Partner, Privacy & Data Security, Calderwood & Harkness LLP (New York, NY) Alan Burke, Associate, Privacy & Data Security, Calderwood & Harkness LLP (Washington, D.C.)
CC: Kevin Ostrowski, Partner, Privacy & Data Security, Calderwood & Harkness LLP (Washington, D.C.)
RE: Coverage Analysis — Quorum Insurance Holdings Corp. Cyber-Liability Insurance Tower — Palomar Data Solutions Security Incident
MATTER NO.: 1025-00006
This memorandum constitutes a privileged and confidential attorney-client communication and attorney work product prepared by Calderwood & Harkness LLP at the direction of and for the sole benefit of Quorum Insurance Holdings Corp. It is protected from disclosure by the attorney-client privilege and the work product doctrine. This memorandum should not be disclosed to any third party without the prior written consent of Calderwood & Harkness LLP and Quorum Insurance Holdings Corp. Disclosure to any third party, including insurers, brokers, or regulatory authorities, may result in waiver of applicable privileges.
I. Executive Summary
The purpose of this memorandum is to provide Quorum Insurance Holdings Corp. ("Quorum" or the "Company") with a detailed analysis of the cyber-liability insurance coverage available to Quorum in connection with the vendor-originated data security incident involving Palomar Data Solutions, Inc. ("Palomar"). This analysis is based on our review of the applicable insurance policies, the facts presently known regarding the incident, and the anticipated categories of loss and expense that Quorum expects to incur in responding to the incident.
On May 8, 2023, Quorum filed a notice of claim with Atlas Mutual Insurance Company ("Atlas Mutual") under Policy No. CYB-2023-041587. Atlas Mutual has assigned the claim Claim No. CYB-CLM-2023-05892. On the same date, precautionary notice was also provided to Pinnacle Surplus Lines Insurance Corp. ("Pinnacle") under excess Policy No. XS-CYB-2023-7812 in order to preserve Quorum's rights under the excess layer.
Quorum's cyber-liability insurance tower provides total available limits of $40,000,000, consisting of $15,000,000 in primary coverage from Atlas Mutual and $25,000,000 in excess coverage from Pinnacle. The primary policy is subject to a $2,500,000 self-insured retention ("SIR") per occurrence, which must be satisfied by Quorum before Atlas Mutual's payment obligations are triggered.
Based on our preliminary assessment, the Palomar security incident appears to fall within the insuring agreements of the primary policy. The anticipated categories of loss — including forensic investigation costs, consumer notification costs, credit monitoring and identity theft protection services, crisis communications expenses, and regulatory defense costs — are all covered cost categories under the policy's first-party and third-party coverage grants. The SIR will need to be satisfied before the primary policy responds to covered costs.
We have identified several key issues that warrant attention as the incident response progresses:
(a) Vendor-Originated Breach: Whether the policy's coverage extends to security incidents occurring on a third-party vendor's systems, rather than Quorum's own systems. As discussed in detail below, the policy's definitions of "Security Incident" and "Service Provider" are drafted to encompass vendor-originated breaches, and coverage should apply.
(b) Consent and Cooperation Requirements: The policy requires the insured to obtain the insurer's prior written consent to the selection of forensic investigators, notification vendors, and defense counsel. Compliance with these consent requirements must be documented carefully.
(c) Subrogation Rights: Atlas Mutual will have subrogation rights against Palomar to the extent it pays covered losses attributable to Palomar's breach of its data security obligations. Quorum's own indemnification claim against Palomar under the Master Services Agreement must be coordinated with Atlas's subrogation interest.
(d) Timing of Notice Compliance: The interval between Quorum's receipt of notification from Palomar (April 21, 2023) and the filing of the notice of claim with Atlas Mutual (May 8, 2023) must be supportable as consistent with the policy's "as soon as practicable" notice requirement.
In conclusion, coverage should be available for the anticipated loss categories, subject to satisfaction of policy conditions including the SIR and the consent requirements described herein. We recommend close coordination with Atlas Mutual's assigned claims adjuster, Paul Enriquez, throughout the response process to ensure that all policy conditions are met and coverage is preserved.
II. Background
A. The Incident
On or about March 14, 2023, a threat actor exploited a known remote code execution vulnerability — specifically, CVE-2023-0669, a pre-authentication command injection vulnerability in Severin Corporation's GoAnywhere MFT file transfer application — to gain unauthorized access to the network of Palomar Data Solutions, Inc. The exploitation of this particular vulnerability has been widely reported in the cybersecurity community and has been associated with organized cybercriminal activity targeting file transfer platforms.
Palomar Data Solutions, Inc. is a Texas-based data processing and business process outsourcing ("BPO") vendor, headquartered at 7100 Greenville Avenue, Suite 450, Dallas, TX 75231. Palomar provides claims data processing, document management, and analytics services to Quorum pursuant to a Master Services Agreement dated November 12, 2019, as amended by Amendment 1, executed March 3, 2021 (collectively, the "MSA"). Palomar is Quorum's second-largest vendor by annual contract value, representing approximately $16.3 million in annual fees under the current contractual arrangement (post-Amendment 1).
Following the initial compromise on March 14, 2023, the threat actor maintained unauthorized access to Palomar's network and engaged in the systematic exfiltration of data over an approximately 35-day window, from March 14 through April 18, 2023. The data exfiltration was detected on April 18, 2023, when Palomar's Security Operations Center ("SOC") identified anomalous outbound data transfers from one or more systems involved in the processing and storage of client data.
Palomar notified Quorum of the incident on April 21, 2023, via email from Derek Copeland, Palomar's General Counsel, to Thomas R. Whitfield, General Counsel of Quorum, and David Naranjo, Quorum's Chief Information Security Officer ("CISO"). This notification was provided approximately 72 hours after Palomar's SOC detected the incident, and approximately 24 hours past the contractual 48-hour notification requirement specified in Section 9.4 of the MSA. The late notification under the MSA is a separate contractual compliance issue that may be relevant to Quorum's indemnification claim against Palomar, and we address the contractual claims in a separate memorandum.
Calderwood & Harkness LLP was engaged by Quorum on May 4, 2023, to serve as outside counsel for the incident response, regulatory engagement, and coverage matters. On May 5, 2023, we retained Graystone Forensics LLC under the attorney-client privilege umbrella to conduct the forensic investigation of the incident, consistent with the well-established practice of retaining forensic investigators under the direction of outside counsel to preserve the confidentiality of forensic findings.
Preliminary information received from Palomar and from our initial review suggests that the compromised data may include personally identifiable information ("PII"), financial information (including bank account and payment card information), and protected health information ("PHI") of Quorum policyholders and claimants. The number of potentially affected individuals may be in the hundreds of thousands across multiple states, reflecting the breadth of Quorum's policyholder and claimant population whose data was processed by Palomar. The full scope of the data compromise is pending completion of Graystone's forensic analysis, which is ongoing.
B. Quorum's Cyber-Insurance Program
Quorum's cyber-liability insurance program was placed by Whitmore Risk Advisors Inc. ("Whitmore"), Quorum's insurance broker for specialty lines coverage. The lead broker on the program is Sandra Whitmore-Kim, who is headquartered at 390 Park Avenue, 18th Floor, New York, NY 10022. Whitmore has been instrumental in negotiating the terms and conditions of Quorum's cyber-liability tower and should be kept informed of developments in the claims process.
The program consists of a two-layer insurance tower, structured as follows:
Primary Layer: Atlas Mutual Insurance Company — $15,000,000 per occurrence / in the aggregate, subject to a $2,500,000 self-insured retention.
Excess Layer: Pinnacle Surplus Lines Insurance Corp. — $25,000,000 per occurrence / in the aggregate, attaching excess of the $15,000,000 Atlas Mutual primary limit.
The policy period for both layers is January 1, 2023 through January 1, 2024. The Palomar security incident — with initial unauthorized access occurring on March 14, 2023, and discovery of the incident on April 18, 2023 — falls squarely within the policy period. There is no question regarding whether the incident is within the temporal scope of the coverage.
We note that Quorum's cyber-insurance program is structured as an occurrence-based program, meaning that coverage is triggered by the occurrence of a security incident during the policy period, regardless of when claims arising from the incident are subsequently asserted. This is favorable to Quorum's coverage position.
III. Policy Summary — Atlas Mutual Primary Policy
A. Policy Identification
The primary layer of Quorum's cyber-liability insurance tower is provided by Atlas Mutual Insurance Company, an Illinois domestic mutual insurance company headquartered at 120 South LaSalle Street, Suite 3200, Chicago, IL 60603. The relevant policy details are as follows:
B. Limits and Retention
The Atlas Mutual primary policy provides the following limits and retention:
The SIR applies to all covered costs arising from a single occurrence. Atlas Mutual's obligation to pay covered costs attaches only after Quorum has incurred and paid $2,500,000 in covered costs attributable to the occurrence. All categories of covered first-party costs and third-party costs count toward satisfaction of the SIR. Once the SIR is satisfied, Atlas Mutual will reimburse Quorum for covered costs in excess of the SIR, up to the per-occurrence limit.
Because the per-occurrence limit and the aggregate limit are both $15,000,000, the full limit is available for this single occurrence, provided that no other claims have been or are made against the policy during the 2023 policy period. We are not aware of any other claims or notices submitted under the policy during the current policy period, and we recommend confirming this with Quorum's risk management team.
C. Insuring Agreements — Key Coverage Grants
The Atlas Mutual primary policy contains both first-party and third-party insuring agreements. We summarize below the coverage grants that are relevant to the Palomar incident.
First-Party Coverage Grants
The following first-party coverage grants are directly applicable to the anticipated costs of responding to the Palomar security incident:
1. Forensic Investigation Costs. The policy covers the reasonable and necessary costs of retaining forensic consultants to investigate the cause, scope, and nature of a security incident, including costs of determining what data was compromised, how the unauthorized access occurred, and whether the threat actor has been contained and ejected from the affected systems. This coverage grant is applicable to the engagement of Graystone Forensics LLC, which was retained by Calderwood & Harkness on May 5, 2023, to conduct the forensic investigation. As discussed in Section V.A below, the insurer's consent to the selection of the forensic investigator is required and has been coordinated.
2. Notification Costs. The policy covers the costs of notifying affected individuals as required by applicable federal and state breach notification laws, including the costs of printing notification letters, mailing and postage, substitute notice (where applicable), and the establishment and operation of a dedicated call center to field inquiries from affected individuals. Given that the compromised data likely implicates the breach notification statutes of multiple states, notification costs are expected to be a significant expense category.
3. Credit Monitoring and Identity Theft Protection Services. The policy covers the costs of providing credit monitoring and identity theft protection services to affected individuals for a period consistent with industry practice or as required by applicable law. Quorum intends to offer 24 months of complimentary credit monitoring, which is consistent with prevailing industry standards and the expectations of state attorneys general and regulators.
4. Crisis Management / Public Relations Costs. The policy covers the costs of retaining a crisis communications or public relations firm to manage the reputational impact of the security incident, including costs associated with preparation of press statements, employee communications, customer-facing communications, and media monitoring. This grant is applicable to the engagement of BrightPath Consulting Group Inc., which Quorum has retained to manage the communications strategy for the incident.
5. Regulatory Defense Costs. The policy covers the costs of legal defense in connection with regulatory investigations, inquiries, or proceedings brought by federal, state, or local regulatory authorities arising out of the security incident. This includes attorney fees and costs incurred in responding to civil investigative demands, subpoenas, and similar regulatory requests from state attorneys general, state insurance departments, and the U.S. Department of Health and Human Services, Office for Civil Rights ("HHS-OCR") if PHI is determined to have been compromised. Calderwood & Harkness's fees for regulatory defense work fall within this coverage grant.
6. Regulatory Fines and Penalties. The policy provides coverage for regulatory fines, penalties, and assessments imposed by a governmental authority arising from a covered security incident, to the extent such amounts are insurable under applicable law. The insurability of regulatory fines is a jurisdiction-specific issue that we address in greater detail in Section V.F below.
Third-Party Coverage Grants
The following third-party coverage grants are potentially applicable, depending on the development of third-party claims:
1. Third-Party Claims / Liability. The policy provides coverage for defense costs and indemnity obligations arising from third-party claims — including civil lawsuits, class action complaints, and written demands — asserted against Quorum by affected individuals, businesses, or other third parties in connection with a covered security incident. While no third-party lawsuits have been filed as of the date of this memorandum, the potential scope of the affected population makes class action litigation a realistic possibility, and this coverage grant may become directly relevant.
D. Key Definitions
The applicability of the above insuring agreements depends on the policy's key defined terms. We analyze the most significant definitions below:
"Security Incident." The policy defines "Security Incident" broadly to include the unauthorized access to, or unauthorized acquisition, use, or disclosure of, nonpublic personal information that is in the care, custody, or control of the insured or a service provider acting on the insured's behalf. This definition is critical to the coverage analysis. The Palomar incident involved unauthorized access to, and exfiltration of, nonpublic personal information — including PII, financial information, and PHI — that was in the custody of Palomar, a service provider acting on Quorum's behalf under the MSA. The data was being processed by Palomar pursuant to the MSA and was therefore in Palomar's care, custody, and control on Quorum's behalf. Accordingly, the Palomar incident satisfies the policy's definition of "Security Incident."
"Service Provider." The policy defines "Service Provider" to include any third-party entity that processes, stores, or transmits data on behalf of the insured pursuant to a written contract. Palomar satisfies every element of this definition: (a) it is a third-party entity; (b) it processes and stores claims data on behalf of Quorum; and (c) it does so pursuant to a written contract — the MSA dated November 12, 2019, as amended. The inclusion of the "Service Provider" concept in the "Security Incident" definition is a deliberate coverage feature designed to extend the policy's protection to vendor-originated breaches, reflecting the reality that modern enterprises rely heavily on third-party vendors to process sensitive data.
"Claim." The policy defines "Claim" to include regulatory investigations, inquiries, or proceedings brought by any governmental authority, as well as civil lawsuits, arbitration proceedings, and written demands for monetary damages or non-monetary relief. This broad definition ensures that regulatory engagement costs — including costs of responding to attorney general inquiries and HHS-OCR investigations — are covered as "Claims" under the policy.
"Loss." The policy defines "Loss" to include defense costs, judgments, settlements, regulatory fines and penalties (to the extent insurable under applicable law), and the first-party costs enumerated in the insuring agreements (forensics, notification, credit monitoring, crisis communications, etc.). This comprehensive definition of "Loss" ensures that all anticipated cost categories fall within the scope of the policy's payment obligations.
IV. Policy Summary — Pinnacle Surplus Lines Excess Policy
A. Policy Identification
The excess layer of Quorum's cyber-liability insurance tower is provided by Pinnacle Surplus Lines Insurance Corp., a Delaware corporation operating as a surplus lines carrier, headquartered at One Beacon Street, Suite 1100, Boston, MA 02108. The relevant policy details are as follows:
B. Limits and Attachment
The Pinnacle excess policy provides the following limits and attachment point:
The total cyber-liability insurance tower — combining the Atlas Mutual primary policy and the Pinnacle excess policy — provides $40,000,000 in total available limits per occurrence ($15,000,000 primary + $25,000,000 excess), subject to the $2,500,000 SIR.
C. Follow-Form Provisions
The Pinnacle excess policy is a "follow-form" policy that follows the terms and conditions of the Atlas Mutual primary policy in all material respects, including insuring agreements, definitions, exclusions, and conditions. The Pinnacle policy does not contain independent coverage terms; rather, it incorporates by reference the coverage provisions of the underlying Atlas Mutual policy. This means that the analysis of coverage under the Atlas Mutual primary policy — including the applicability of the "Security Incident" and "Service Provider" definitions, the scope of the insuring agreements, and the applicability of exclusions — applies equally to the Pinnacle excess policy.
Pinnacle's obligation to pay covered losses attaches only after the Atlas Mutual primary limit of $15,000,000 has been exhausted by payment of covered losses for the occurrence. Until exhaustion of the primary limit, Pinnacle has no payment obligation.
Based on the preliminary cost estimates discussed in Section VII below, total incident response costs are not expected to exhaust the $15,000,000 primary layer, making attachment of the Pinnacle excess layer unlikely for this incident under current projections. However, precautionary notice has been provided to Pinnacle to preserve Quorum's excess coverage rights in the event that costs escalate beyond current projections, additional cost categories emerge, or significant third-party litigation — such as class action complaints by affected individuals — materializes and drives total costs above the primary limit. The preservation of excess coverage rights through timely notice is a prudent risk management practice, and we recommend maintaining periodic communication with Pinnacle's claims contact, Lisa Garner, throughout the claims process.
V. Coverage Analysis — Anticipated Cost Categories
This section analyzes each anticipated category of cost in the context of the Atlas Mutual primary policy's insuring agreements, consent requirements, and other relevant provisions.
A. Forensic Investigation Costs (Graystone Forensics LLC)
Graystone Forensics LLC ("Graystone") was retained by Calderwood & Harkness LLP on May 5, 2023, under the attorney-client privilege umbrella, to conduct the forensic investigation of the Palomar security incident. The engagement is being led by Dr. Nolan Briggs, Managing Director, and Kendra Faulkner, Senior Forensic Analyst. Graystone's scope of work includes determining the full scope of the threat actor's access to Palomar's systems, identifying all data repositories that were accessed or exfiltrated, analyzing the nature and categories of data involved, identifying affected individuals, and assessing whether the threat actor has been fully contained and ejected from the environment.
Graystone's fees and expenses constitute "Forensic Investigation Costs" under the policy's first-party coverage grants and should be covered, subject to the SIR and the insurer consent requirement discussed below.
Consent Requirement. The Atlas Mutual policy requires that the insured obtain the insurer's prior written consent to the selection and retention of forensic investigators. This is a standard feature of cyber-liability policies and is designed to ensure that the insurer has input into the qualifications and cost structure of the forensic engagement. We coordinated with Paul Enriquez, Atlas Mutual's assigned claims adjuster, prior to Graystone's formal retention and confirmed that Graystone Forensics LLC is an approved forensic vendor on Atlas Mutual's panel of pre-approved cyber-incident response vendors. Mr. Enriquez indicated that Graystone's retention would be acceptable. However, we have not yet received formal written consent documenting this approval. We strongly recommend that formal written consent be obtained and placed in the claims file without delay to preclude any subsequent dispute regarding consent compliance.
Estimated Cost Range. Based on the scope of the forensic investigation — which involves a 35-day exfiltration window, a multi-state data set encompassing claims processing records, structured and unstructured data repositories, and the need for data mining and analysis to identify specific affected individuals — forensic costs are expected to be significant. No precise estimate is available at this early stage of the engagement, as the scope of Graystone's work will depend in part on findings from the initial phases of the investigation. We will provide updated cost estimates as Graystone's investigation progresses and the scope of the data compromise becomes clearer.
B. Notification Costs (Clearfield Notification Services LLC)
Consumer notification letters to affected individuals will be required under the data breach notification statutes of multiple states once Graystone's forensic investigation confirms the scope of compromised data and the identities of affected individuals are determined. Quorum's obligations under applicable state breach notification laws will be assessed on a state-by-state basis, as notification triggers, content requirements, timing requirements, and regulator notification obligations vary by jurisdiction. Where PHI is involved, notification obligations under the Health Insurance Portability and Accountability Act ("HIPAA") Breach Notification Rule (45 C.F.R. §§ 164.400–414) may also apply if Quorum is determined to be a covered entity or business associate with respect to the compromised PHI.
Notification costs — including printing of notification letters, mailing and postage, substitute notice (if applicable for individuals whose contact information is unavailable), and the establishment and operation of a dedicated call center to respond to inquiries from affected individuals — fall within the policy's "Notification Costs" insuring agreement and should be covered.
Consent Requirement. The Atlas Mutual policy requires the insured to obtain the insurer's prior written consent to the selection of the notification vendor. We recommend that Quorum propose Clearfield Notification Services LLC ("Clearfield") as the notification and call center vendor for this engagement. Clearfield's contact is Jerome Tillman, Account Manager, and the firm is headquartered at 4500 Rockside Road, Suite 210, Independence, OH 44131. Clearfield is a nationally recognized notification vendor with extensive experience in large-scale breach notification programs, and Quorum has a preexisting relationship with Clearfield from a prior, smaller-scale notification engagement. Insurer approval for the selection of Clearfield should be obtained from Paul Enriquez before the engagement is formalized.
Estimated Cost Range. Notification costs will depend on the number of affected individuals, which has not yet been determined. If the affected population is in the range of 200,000 to 400,000 individuals — consistent with preliminary estimates based on the volume of data processed by Palomar on Quorum's behalf — notification mailing costs alone (printing, postage, fulfillment) could be approximately $400,000 to $800,000. Call center operations, which typically run for 90 to 120 days following notification, could add several hundred thousand dollars to the total, depending on call volume and staffing requirements. We will refine these estimates as the scope of the affected population is confirmed.
C. Credit Monitoring and Identity Theft Protection Services
Quorum expects to offer 24 months of complimentary credit monitoring and identity theft protection services to affected individuals. This duration is consistent with prevailing industry practice for security incidents involving the types of data at issue (PII, financial information, and PHI) and aligns with the expectations of state attorneys general and regulators, who have increasingly demanded longer monitoring periods in enforcement actions and multistate settlements. Offering 24 months of monitoring also serves to demonstrate good faith and mitigate potential regulatory and litigation risk.
These costs are covered under the policy's credit monitoring insuring agreement as a first-party coverage grant.
Estimated Cost Range. The cost of credit monitoring services will depend on several factors: (a) the total number of affected individuals to whom monitoring is offered; (b) the take-rate — i.e., the percentage of affected individuals who actually enroll in the monitoring service — which industry experience suggests typically ranges from 30% to 50% of the notified population; (c) the duration of monitoring (24 months); and (d) the negotiated per-enrollee rate or flat-fee arrangement with the monitoring provider.
To illustrate the potential range: assuming a hypothetical affected population of approximately 300,000 individuals, a 40% take-rate would yield approximately 120,000 enrollees. At estimated market rates of $15 to $20 per enrollee per month for a 24-month term, the aggregate per-unit cost could theoretically reach $43,200,000 to $57,600,000. However, these per-unit calculations significantly overstate the actual cost, because flat-fee or volume-discount arrangements are typically negotiated with credit monitoring vendors that substantially reduce the effective per-enrollee cost. Based on our experience with similarly scaled incidents, a negotiated flat-fee arrangement for credit monitoring services is likely to be in the range of $2,000,000 to $3,000,000 for a population of this size.
The flat-fee negotiation for credit monitoring represents one of the most significant cost management levers available to Quorum in this engagement. We recommend engaging Clearfield (or an alternative credit monitoring provider approved by Atlas Mutual) early in the process to negotiate favorable flat-fee terms before the monitoring program is launched.
D. Crisis Communications / Public Relations Costs (BrightPath Consulting Group Inc.)
Quorum has retained BrightPath Consulting Group Inc. ("BrightPath") to manage external and internal communications strategy related to the security incident. The engagement is being led by Meredith Ashford, Managing Director, at BrightPath's office at 450 Lexington Avenue, 4th Floor, New York, NY 10017. BrightPath's scope of work includes development of press statements, coordination with Quorum's investor relations team regarding SEC disclosure obligations, preparation of employee communications, development of customer-facing talking points, and ongoing media monitoring.
Crisis management and public relations costs are covered under the policy's crisis management insuring agreement as a first-party coverage grant.
Consent Requirement. The Atlas Mutual policy may require insurer consent for the selection of the crisis communications firm, depending on the specific wording of the consent clause. We recommend proactively confirming with Paul Enriquez that BrightPath is an acceptable vendor and obtaining written consent for BrightPath's retention. Even if the policy does not strictly require consent for crisis communications firms, documenting the insurer's acknowledgment and agreement will avoid potential disputes at the time of cost reimbursement.
Estimated Cost Range. Public relations and crisis communications engagements for security incidents of this magnitude — involving potential multi-state notifications of hundreds of thousands of individuals and likely media attention — typically range from $200,000 to $500,000, depending on the intensity and duration of the engagement, the number of media touchpoints, and the complexity of the communications strategy. We will refine this estimate as the communications plan develops.
E. Regulatory Defense Costs (Calderwood & Harkness LLP)
Calderwood & Harkness LLP's legal fees for regulatory defense work — including preparing for and responding to inquiries from state attorneys general offices, state insurance department regulators, and HHS-OCR (in the event PHI is confirmed to have been compromised) — are covered as "Regulatory Defense Costs" under the policy's insuring agreements. Regulatory defense work includes, among other things, drafting responses to civil investigative demands and subpoenas, preparing for and attending meetings with regulators, negotiating assurance of voluntary compliance ("AVC") or consent agreements, and advising Quorum on regulatory strategy.
Consent Requirement. The Atlas Mutual policy requires the insurer's prior written consent to the selection of defense counsel. Calderwood & Harkness was engaged by Quorum on May 4, 2023. We have confirmed with Paul Enriquez that Calderwood & Harkness LLP is on Atlas Mutual's approved panel of cyber-breach counsel. As with the forensic investigator consent, we recommend obtaining formal written confirmation of this approval from Mr. Enriquez and maintaining the written consent in the claims file.
Calderwood & Harkness's overall engagement encompasses both covered work (forensic investigation oversight, notification compliance, regulatory defense) and work that may fall outside the policy's coverage (vendor indemnification negotiations and affirmative contractual claims against Palomar). The allocation of legal fees between covered and non-covered work is addressed in Section VI.F below.
Billing Rates. The following billing rates apply to the Calderwood & Harkness professionals assigned to this matter:
Atlas Mutual may apply rate caps or billing guidelines that could affect the reimbursable rate for one or more of these timekeepers. We should confirm at the earliest opportunity whether the Atlas Mutual policy contains billing rate limitations, outside counsel billing guidelines, or requirements that counsel adhere to specific insurer litigation management guidelines. If rate caps apply, any differential between Calderwood & Harkness's standard rates and the insurer's approved rates would be borne by Quorum.
F. Regulatory Fines and Penalties
If any state attorney general, state insurance department regulator, or federal regulator (such as HHS-OCR) imposes fines, penalties, or assessments on Quorum arising from the security incident, the Atlas Mutual policy provides coverage for such amounts to the extent they are insurable under applicable law.
The insurability of regulatory fines and penalties is a jurisdiction-specific legal question that varies depending on the nature of the fine (civil versus criminal), the regulatory authority imposing the fine, and the law of the jurisdiction in which insurability is evaluated. Generally, civil fines and penalties imposed by regulatory authorities — such as HIPAA civil monetary penalties imposed by HHS-OCR, or civil penalties imposed by state attorneys general under state breach notification or data protection statutes — are considered insurable in a number of jurisdictions, including Connecticut (the state of Quorum's domicile) and several other states. Criminal fines and penalties, by contrast, are generally not insurable as a matter of public policy.
We note, however, that the primary objective of Quorum's regulatory engagement strategy is to avoid any enforcement action or imposition of fines. A well-executed incident response — including timely notification, proactive engagement with regulators, and implementation of remedial measures — significantly reduces the likelihood of regulatory enforcement. If fines are avoided through successful regulatory engagement, this coverage grant will not need to be triggered.
G. Third-Party Litigation Defense and Indemnity
As of the date of this memorandum, no third-party lawsuits have been filed against Quorum in connection with the Palomar security incident. No class action complaints, individual lawsuits, or written demands from affected individuals have been received. However, given the potential scope of the affected population — potentially hundreds of thousands of individuals across multiple states — and the increasing prevalence of data breach class action litigation in the United States, class action complaints are a realistic possibility, particularly if the incident receives significant media attention or if affected individuals include consumers in jurisdictions with active plaintiffs' bars.
The Atlas Mutual policy's third-party coverage grants would respond to defense costs and indemnity obligations arising from such litigation, subject to the SIR and the per-occurrence limit. Defense costs under the policy are typically included within the policy limits (i.e., they erode the available limits) rather than provided in addition to limits. This is a standard feature of cyber-liability policies and should be factored into the overall coverage adequacy assessment.
We recommend that Quorum monitor state and federal court dockets for any litigation filings related to the Palomar incident and provide prompt supplemental notice to Atlas Mutual (and Pinnacle, if warranted) if any lawsuits or written demands are received. Timely notice of third-party claims is essential to preserving coverage.
VI. Potential Coverage Issues and Gaps
While we believe that coverage should be available for the Palomar incident under Quorum's cyber-liability insurance tower, there are several potential coverage issues and gaps that warrant careful attention. We analyze each below.
A. Vendor-Originated Breach — Service Provider Coverage
The most significant coverage issue presented by this incident is whether the Atlas Mutual policy covers security incidents that originate on a third-party vendor's network, rather than on Quorum's own systems. The Palomar breach occurred entirely within Palomar's IT environment — the threat actor exploited a vulnerability in Palomar's GoAnywhere MFT appliance and exfiltrated data from Palomar's systems. Quorum's own network was not directly compromised.
Analysis. As discussed in Section III.D above, the policy's definition of "Security Incident" expressly includes unauthorized access to, or unauthorized acquisition, use, or disclosure of, nonpublic personal information "in the care, custody, or control of the insured or a service provider acting on the insured's behalf." The inclusion of the phrase "or a service provider acting on the insured's behalf" is a deliberate extension of coverage to vendor-originated breaches. The policy further defines "Service Provider" to include any third-party entity that processes, stores, or transmits data on behalf of the insured pursuant to a written contract.
Palomar clearly qualifies as a "Service Provider" under this definition. Palomar processes, stores, and transmits Quorum policyholder and claimant data on Quorum's behalf pursuant to the MSA — a written contract. The data that was compromised in the Palomar breach was in Palomar's care, custody, and control, but it was being held on Quorum's behalf as part of Palomar's data processing obligations under the MSA.
Conclusion. The policy should provide coverage for this vendor-originated incident. The "Service Provider" extension is a standard feature of modern, well-drafted cyber-liability policies and reflects the commercial reality that enterprises routinely entrust sensitive data to third-party vendors. This is precisely the coverage feature for which Whitmore Risk Advisors negotiated on Quorum's behalf, and we see no basis for Atlas Mutual to deny coverage on the ground that the breach originated on Palomar's systems.
Risk Factor. Notwithstanding our confidence in the coverage analysis, we recommend proactively confirming with Paul Enriquez that Atlas Mutual agrees the service provider coverage applies and that Atlas does not intend to assert any coverage defense based on the vendor-originated nature of the breach. An early confirmation on this point will provide certainty and allow Quorum to proceed with the incident response without concern about retroactive coverage challenges.
B. Late Notice / Timeliness of Claim
The Atlas Mutual policy requires that the insured provide notice of a claim or potential claim "as soon as practicable" after the insured becomes aware of a security incident that may give rise to a claim under the policy. The "as soon as practicable" standard is a common notice provision in insurance policies and has been the subject of extensive judicial interpretation. While the standard does not require immediate notice, it does require that notice be provided within a reasonable time under the circumstances.
The relevant timeline is as follows:
Analysis. Quorum received initial notice of the incident from Palomar on April 21, 2023, and filed its notice of claim with Atlas Mutual 17 days later, on May 8, 2023. In the intervening 17-day period, Quorum took the following steps: (a) assessed the initial information provided by Palomar regarding the nature and scope of the incident; (b) conducted internal discussions among the General Counsel, CISO, and relevant risk management personnel; (c) identified and engaged outside counsel (Calderwood & Harkness LLP, engaged May 4, 2023); (d) retained a forensic investigator under the privilege umbrella (Graystone Forensics LLC, retained May 5, 2023); and (e) prepared and submitted the notice of claim to Atlas Mutual and the precautionary notice to Pinnacle.
This 17-day interval between Quorum's receipt of notification from Palomar and the filing of the notice of claim is, in our judgment, consistent with the "as soon as practicable" standard. The "as soon as practicable" standard does not require an insured to provide notice instantaneously or before it has had an opportunity to assess the situation, engage counsel, and prepare an informed notice. Indeed, courts have generally held that a reasonable period for initial assessment and engagement of professional advisors is contemplated by the "as soon as practicable" standard, and that 17 days is within the bounds of reasonableness, particularly for a complex security incident requiring legal and forensic assessment before the contours of the potential claim could be understood.
Conclusion. We do not anticipate that Atlas Mutual will assert a late-notice defense. Nevertheless, to mitigate any risk, we recommend that Quorum maintain detailed documentation of the steps taken between April 21 and May 8, 2023, to demonstrate the reasonableness of the notice timeline. A chronology of internal actions, counsel engagement, and claim preparation activities should be prepared and maintained in the claims file.
C. Self-Insured Retention — $2,500,000
The $2,500,000 SIR per occurrence must be fully satisfied by Quorum before Atlas Mutual's payment obligations are triggered. All categories of covered costs incurred by Quorum in connection with the Palomar incident — including forensic investigation fees, notification costs, credit monitoring costs, crisis communications fees, and legal fees — count toward satisfaction of the SIR.
Quorum should implement a system for tracking all incident-related costs from the outset of the engagement, with clear categorization of costs by category (forensics, notification, credit monitoring, crisis communications, legal fees, internal costs). This cost-tracking system will serve multiple purposes: (a) it will document when the SIR threshold of $2,500,000 is reached, enabling Quorum to notify Atlas Mutual that the SIR has been satisfied and that Atlas's reimbursement obligation has commenced; (b) it will facilitate the preparation of cost submissions and claim documentation for Atlas Mutual; and (c) it will support the segregation of covered costs from non-covered costs (as discussed in Section VI.F below).
Based on the preliminary cost projections discussed in Section VII below — which suggest total incident response costs in the range of $5.1 million to $11.3 million — the $2,500,000 SIR is expected to be exhausted relatively quickly as forensic investigation fees, legal fees, and initial notification preparation costs accumulate during the early stages of the response. We anticipate that the SIR will be satisfied within the first 60 to 90 days of the engagement, though this timeline will depend on the pace of Graystone's forensic investigation and the timing of vendor engagements.
D. Vendor Indemnification / Subrogation Interaction
Quorum intends to pursue indemnification from Palomar under Section 12.2 of the MSA for Palomar's breach of its data security obligations, including Palomar's failure to timely patch the GoAnywhere MFT vulnerability and its delayed notification to Quorum. The MSA contains a liability cap equal to two times the trailing twelve-month fees paid under the agreement, which currently equates to a cap of approximately $32,600,000 (2 × $16.3 million). The vendor indemnification claim is being analyzed in a separate Calderwood & Harkness memorandum and is not the subject of this coverage analysis.
However, the interplay between Quorum's vendor indemnification claim against Palomar and Atlas Mutual's subrogation rights under the insurance policy is a significant coverage coordination issue that requires careful management.
Subrogation Rights. Atlas Mutual will have subrogation rights against Palomar to the extent that Atlas pays covered losses attributable to Palomar's acts or omissions. Subrogation is the right of an insurer, upon paying a loss, to step into the insured's shoes and pursue the insured's claims against the responsible third party. The Atlas Mutual policy almost certainly contains a subrogation clause requiring Quorum to cooperate with Atlas's subrogation efforts and to refrain from any action that would prejudice or impair Atlas's subrogation rights.
Coordination Issue. Quorum's direct indemnification claim against Palomar under the MSA and Atlas Mutual's subrogation claim against Palomar are based on overlapping factual and legal theories. If Quorum settles its indemnification claim with Palomar — particularly if it does so at a discount to Quorum's full damages — without Atlas Mutual's knowledge or consent, such a settlement could be argued to prejudice Atlas's subrogation rights. For example, if Quorum were to release Palomar from liability in exchange for a partial indemnification payment, Atlas could argue that the release impaired Atlas's ability to pursue its own subrogation claim against Palomar for amounts Atlas paid under the policy.
Insurance Recovery Offset. In addition, the Atlas Mutual policy may contain "other insurance," "recovery," or "collateral source" provisions requiring Quorum to credit recoveries received from third parties (such as Palomar indemnification payments) against the total covered loss. If Quorum recovers a substantial sum from Palomar, that recovery may reduce the net loss for which Atlas is responsible, potentially dollar-for-dollar.
Recommendation. To navigate these issues, we recommend the following approach:
(a) Coordinate with Paul Enriquez regarding the interplay between the Palomar indemnification claim and Atlas's coverage obligations, including Atlas's subrogation interests.
(b) Obtain Atlas Mutual's written consent before finalizing any settlement or binding agreement with Palomar regarding indemnification.
(c) Structure any settlement with Palomar in a manner that preserves Atlas's subrogation rights, such as by excluding from the release any claims that Atlas may wish to pursue independently.
(d) Maintain clear records of any amounts recovered from Palomar, as these may need to be credited against covered losses under the policy.
E. Exclusions — Preliminary Review
We have conducted a preliminary review of the exclusions contained in the Atlas Mutual policy and assessed their potential applicability to the Palomar security incident. Our analysis of each potentially relevant exclusion is as follows:
Intentional Acts Exclusion. The policy excludes coverage for losses arising from the intentional, fraudulent, or criminal acts of the insured. This exclusion is not implicated by the Palomar incident. The security breach was perpetrated by an external threat actor who exploited a vulnerability in Palomar's systems. Neither Quorum nor any of its officers, directors, or employees engaged in any intentional, fraudulent, or criminal conduct that caused or contributed to the breach. This exclusion has no applicability to the facts of this incident.
Prior Knowledge Exclusion. The policy excludes coverage for security incidents that were known to the insured prior to the inception date of the policy (January 1, 2023). The initial unauthorized access to Palomar's systems occurred on March 14, 2023 — more than two months after the policy inception date. Quorum had no knowledge of the GoAnywhere MFT vulnerability in Palomar's environment or of the subsequent data breach prior to receiving Palomar's notification on April 21, 2023. There is no prior knowledge issue, and this exclusion does not apply.
Contractual Liability Exclusion. Some cyber-liability policies contain exclusions for losses arising from the insured's breach of contract or failure to perform contractual obligations. Even if such an exclusion exists in the Atlas Mutual policy, it would not apply here because Quorum's losses arise from Palomar's breach of its data security obligations, not from any breach of contract by Quorum. Quorum is the victim of its vendor's security failure, not the perpetrator of a contractual breach.
War / Terrorism Exclusion. The policy contains standard war, terrorism, and hostile acts exclusions. Based on the information currently available, there is no indication that the threat actor responsible for the Palomar breach was a nation-state actor or that the attack constitutes an act of war, terrorism, or hostile action by a sovereign power. The CVE-2023-0669 exploitation has been associated with financially motivated cybercriminal activity, not state-sponsored operations. However, threat actor attribution is an evolving area of analysis, and Graystone's forensic investigation may yield additional intelligence regarding the identity and motivations of the threat actor. We recommend monitoring Graystone's findings on this point and revisiting the war/terrorism exclusion analysis if attribution information changes.
Bodily Injury / Property Damage Exclusion. Standard bodily injury and property damage exclusions are typically included in cyber-liability policies to delineate cyber coverage from general liability coverage. These exclusions are not implicated by a data breach incident and are not relevant to the Palomar incident.
Conclusion. Based on our preliminary review, no policy exclusions appear to bar coverage for the Palomar security incident. We will revisit this analysis if new facts emerge during the forensic investigation or if Atlas Mutual raises any exclusion-based coverage defenses.
F. Allocation of Legal Fees Between Covered and Non-Covered Work
As noted in Section V.E above, Calderwood & Harkness's engagement on behalf of Quorum encompasses both work that is covered under the Atlas Mutual policy and work that is likely not covered. Specifically:
Covered Work: Forensic investigation oversight and coordination; breach notification compliance analysis and execution; credit monitoring program oversight; crisis communications coordination; regulatory engagement strategy, preparation, and defense; and general incident response management.
Potentially Non-Covered Work: Vendor indemnification analysis, negotiations, and demands against Palomar; preparation and pursuit of affirmative contractual claims against Palomar under the MSA; and related commercial litigation strategy. These activities are in the nature of affirmative claims pursued by Quorum against Palomar, rather than defensive costs incurred in response to claims against Quorum. Affirmative claim pursuit costs are generally not covered under cyber-liability policies.
Recommendation. To address this allocation issue, we will maintain detailed contemporaneous time records that segregate time spent on covered activities from time spent on non-covered affirmative vendor indemnification and contractual claim activities. Each timekeeper will use separate billing codes or task codes for covered and non-covered work. This segregation will facilitate accurate cost submissions to Atlas Mutual and will minimize the risk of coverage disputes regarding the allocation of legal fees between covered and non-covered categories. If a particular activity involves elements of both covered and non-covered work and cannot be cleanly segregated, we will apply a reasonable allocation methodology and document the basis for the allocation.
G. Internal Costs
Quorum will inevitably incur significant internal costs in connection with the incident response, including IT remediation efforts (e.g., costs of assessing and hardening Quorum's own systems to the extent data flows between Quorum and Palomar may have been compromised), employee overtime for personnel involved in the response, and management time devoted to incident oversight and decision-making.
Many cyber-liability policies cover only external vendor costs and do not reimburse the insured for internal labor, overhead, or other internal costs. The Atlas Mutual policy's definition of "Loss" and the specific cost categories enumerated in the insuring agreements should be reviewed carefully to determine whether Quorum's internal costs are reimbursable. If the policy's coverage is limited to costs incurred with third-party vendors and professionals, Quorum's internal costs will be borne by Quorum outside the insurance recovery.
Recommendation. We recommend reviewing the policy's definition of "Loss" and the specific language of each insuring agreement to confirm whether internal costs are excluded. If internal costs are not covered, they should be tracked separately for budgeting and financial reporting purposes but should not be included in cost submissions to Atlas Mutual.
VII. Estimated Total Costs and Coverage Positioning
A. Preliminary Cost Estimates
At this early stage of the engagement — with Graystone's forensic investigation still in its initial phases and the scope of affected individuals not yet confirmed — precise cost estimates are not available. However, based on the anticipated scope of the incident (a potential affected population of hundreds of thousands of individuals across multiple states, involving PII, financial information, and PHI), our experience with similarly scaled incidents, and the engagement parameters for the vendors already retained or anticipated, we project the following preliminary cost ranges:
These estimates are preliminary and are subject to revision as the forensic investigation progresses, the scope of affected individuals is confirmed, regulatory engagement unfolds, and vendor costs are finalized. In particular, the forensic investigation costs and credit monitoring costs are highly sensitive to the scope of the data compromise and the number of affected individuals. If the affected population proves to be at the higher end of the range — or if additional categories of data (such as Social Security numbers on a large scale) are confirmed to have been compromised — costs could trend toward the upper end of these estimates or potentially exceed them.
We have not included in these estimates any costs associated with potential third-party litigation (e.g., class action defense costs and settlements), as no litigation has been filed to date. If significant class action litigation materializes, defense costs and potential settlements could substantially increase total costs and could implicate the excess layer.
B. Coverage Adequacy
Based on the preliminary cost estimates above, total incident response costs are expected to fall well within the $15,000,000 per-occurrence limit of the Atlas Mutual primary policy, after satisfaction of the $2,500,000 SIR. Even at the high end of the projected range ($11,300,000), the net covered costs (excluding the estimated $400,000 to $800,000 in internal costs that may not be covered) would be approximately $10,500,000, of which $2,500,000 would be borne by Quorum through the SIR, and approximately $8,000,000 would be payable by Atlas Mutual.
The Pinnacle excess layer ($25,000,000 excess of $15,000,000) is unlikely to be implicated unless (a) costs substantially exceed the current projections, (b) significant class action litigation materializes with defense costs and potential settlement or judgment exposure that drives total costs above $15,000,000, or (c) additional cost categories emerge that are not currently anticipated. The total insurance tower of $40,000,000 provides robust protection against even a worst-case scenario.
C. Net Exposure Analysis
Quorum's net financial exposure will depend on the interplay between the insurance recovery, the SIR, and any indemnification recovered from Palomar. The key components are as follows:
Quorum's SIR obligation: $2,500,000. This amount will be borne by Quorum regardless of the total cost of the incident.
Potential Palomar indemnification recovery: Up to $32,600,000 (the MSA liability cap of 2× trailing twelve-month fees). Actual recovery will depend on the outcome of negotiations with Palomar and, if necessary, litigation or arbitration. If Palomar agrees to indemnify Quorum for a significant portion of the incident costs, the Palomar recovery could offset or exceed Quorum's SIR obligation, potentially reducing Quorum's net out-of-pocket exposure to zero or near-zero.
Internal costs: $400,000 to $800,000 in internal costs that may not be covered by the insurance policy and may not be recoverable from Palomar (depending on the terms of the MSA indemnification provision and whether internal costs are included in the definition of indemnifiable losses).
Net effect: Depending on the ultimate cost figure and the extent of Palomar indemnification recovery, Quorum's net out-of-pocket exposure may be limited to the SIR ($2,500,000) or less, if substantial Palomar indemnification is achieved. In a best-case scenario, Palomar indemnification could fully offset Quorum's SIR obligation and internal costs, resulting in minimal or no net financial exposure to Quorum.
VIII. Recommendations and Next Steps
Based on the foregoing analysis, we recommend the following action items to preserve and maximize Quorum's insurance coverage and to ensure compliance with all policy conditions:
1. Document Insurer Consents. Obtain and document formal written consent from Paul Enriquez at Atlas Mutual for the retention of the following vendors and professionals:
(a) Graystone Forensics LLC as the forensic investigator;
(b) Calderwood & Harkness LLP as breach response and regulatory defense counsel;
(c) Clearfield Notification Services LLC as the notification and credit monitoring vendor (when engaged); and
(d) BrightPath Consulting Group Inc. as the crisis communications firm.
Written consent should be maintained in both the Calderwood & Harkness matter file and Quorum's internal claims file. Where verbal consent has already been obtained (as with Graystone Forensics), follow-up written confirmation should be requested and documented.
2. Billing Rate Confirmation. Confirm whether the Atlas Mutual policy contains billing rate caps, fee schedules, or litigation management guidelines that may affect reimbursement of Calderwood & Harkness's fees at the specified hourly rates. If rate caps apply, we will advise Quorum regarding the differential and its impact on Quorum's net cost exposure.
3. Cost Tracking and Segregation. Implement a comprehensive cost-tracking system from the outset of the engagement, with costs clearly segregated into the following categories:
(a) Covered first-party incident response costs (forensics, notification, credit monitoring, crisis communications);
(b) Covered regulatory defense costs;
(c) Non-covered affirmative vendor indemnification and contractual claim costs; and
(d) Internal Quorum costs (IT remediation, employee overtime, management time).
This segregation will facilitate timely and accurate cost submissions to Atlas Mutual, minimize coverage disputes regarding allocation, and support Quorum's internal budgeting and financial reporting.
4. SIR Satisfaction Documentation. Track cumulative covered costs against the $2,500,000 SIR on a rolling basis and notify Atlas Mutual in writing when the SIR threshold has been reached. Upon SIR satisfaction, Atlas Mutual's reimbursement obligation will commence, and Quorum should begin submitting cost documentation to Atlas Mutual for reimbursement on a periodic (e.g., monthly) basis.
5. Subrogation Coordination. Coordinate with Paul Enriquez at Atlas Mutual regarding the Palomar indemnification claim to ensure that Quorum's negotiations with Palomar do not prejudice Atlas's subrogation rights. Specifically:
(a) Consult with Paul Enriquez before entering into any binding settlement agreement or release with Palomar;
(b) Structure any settlement with Palomar to preserve Atlas's abil

PRIVILEGED AND CONFIDENTIAL ATTORNEY-CLIENT COMMUNICATION — ATTORNEY WORK PRODUCT DO NOT DISTRIBUTE

MEMORANDUM

MATTER NO.: 1025-00006

Record

Parties

Dates

Amounts