1025-00006 · Graystone Forensics LLC · Insurance Coverage

insurance-coverage-status-update-memo.docx DOCUMENT Data Privacy

44 / 88 ← → ✕

PRIVILEGED AND CONFIDENTIAL — ATTORNEY-CLIENT COMMUNICATION — ATTORNEY WORK PRODUCT — DO NOT DISTRIBUTE

CALDERWOOD & HARKNESS LLP Counselors at Law 51 West 52nd Street, 34th Floor New York, New York 10019

August 30, 2023

MEMORANDUM

TO: Thomas R. Whitfield, General Counsel Quorum Insurance Holdings Corp. 400 Constitution Plaza, Suite 2200 Hartford, CT 06103

FROM: Rachel Bernstein, Partner, Privacy & Data Security Calderwood & Harkness LLP

CC: Kevin Ostrowski, Partner, Calderwood & Harkness LLP Alan Burke, Associate, Calderwood & Harkness LLP

RE: Insurance Coverage Status Update — Palomar Data Solutions Security Incident

Matter No.: 1025-00006

Policy References:

Atlas Mutual Insurance Company, Policy No. CYB-2023-041587 Pinnacle Surplus Lines Insurance Corp., Policy No. XS-CYB-2023-7812

Claim No.: CYB-CLM-2023-05892

I. Purpose and Summary

The purpose of this memorandum is to provide Quorum Insurance Holdings Corp. ("Quorum") General Counsel Thomas R. Whitfield with an updated assessment of the insurance coverage posture related to the data security incident originating from Quorum's third-party claims-processing vendor, Palomar Data Solutions, Inc. ("Palomar"). This memorandum reflects developments through August 30, 2023, including Atlas Mutual Insurance Company's ("Atlas Mutual" or "Atlas") coverage determination, the current status of estimated incident response costs, the posture of regulatory engagements, and the interplay between the insurance recovery and the indemnification claim asserted against Palomar.

In summary, Quorum's insurance recovery posture is favorable. The key conclusions are as follows:

• Coverage Accepted. Atlas Mutual has formally acknowledged the claim under Policy No. CYB-2023-041587 and has accepted coverage for all major categories of first-party incident response costs and regulatory defense costs, subject to the $2,500,000 self-insured retention ("SIR") and the standard terms and conditions of the policy.

• Estimated Costs Within Primary Layer. Total estimated incident response costs of $8,230,250 remain well within the $15,000,000 per-occurrence limit of the Atlas primary policy. The estimated amount recoverable from Atlas—approximately $5,730,250, after application of the SIR—represents approximately 38.2% of the available primary coverage.

• Excess Layer Unlikely to Be Implicated. Based on current cost projections, it is unlikely that the Pinnacle Surplus Lines Insurance Corp. ("Pinnacle") excess layer (Policy No. XS-CYB-2023-7812), which attaches at $15,000,000, will be implicated. A substantial margin of approximately $6,769,750 exists before the primary layer would be exhausted.

• Regulatory Posture Manageable. No fines, penalties, or enforcement actions have been assessed or initiated by any regulator as of the date of this memorandum, and defense costs associated with ongoing regulatory engagements are covered under the Atlas policy.

• Palomar Indemnification Coordination Required. The indemnification claim against Palomar under the Master Services Agreement and Atlas's subrogation rights must be carefully coordinated to avoid double recovery and to maximize Quorum's net financial position.

The sections below provide a detailed discussion of each of these items.

II. Background — Incident and Insurance Claim Filing

A. Incident Overview

On or about March 14, 2023, a threat actor exploited CVE-2023-0669, a critical remote code execution vulnerability in Palomar Data Solutions' GoAnywhere MFT file transfer appliance, to gain unauthorized access to Palomar's network environment. The GoAnywhere MFT vulnerability, which was publicly disclosed in early February 2023, had been widely exploited by threat actors during this period, and Palomar had not applied the available vendor patch prior to the exploitation event. Palomar serves as Quorum's primary third-party claims-processing vendor and, in that capacity, maintains custody of significant volumes of policyholder and claimant data on behalf of Quorum.

Following the initial access event, the threat actor conducted lateral movement within Palomar's network and engaged in sustained data exfiltration over an approximately 35-day window, from March 14, 2023, through April 18, 2023. During this period, the threat actor accessed and exfiltrated files from multiple Palomar systems, including systems containing data processed on behalf of Quorum.

Palomar's security operations center ("SOC") discovered anomalous outbound data transfers on April 18, 2023, and Palomar took immediate containment measures. Palomar notified Quorum of the potential data security incident on April 21, 2023, in accordance with the notification provisions set forth in the Master Services Agreement between the parties.

Upon receiving Palomar's notification, Quorum's internal incident response team, under the direction of Mr. Whitfield and Quorum's Chief Information Security Officer, initiated Quorum's incident response protocol. Calderwood & Harkness LLP was engaged as outside breach counsel on May 4, 2023. On May 5, 2023, Calderwood & Harkness retained Graystone Forensics LLC ("Graystone") to conduct a privileged forensic investigation under the attorney-client privilege and work product doctrine umbrella, with Graystone reporting directly to Calderwood & Harkness in furtherance of the firm's provision of legal advice to Quorum.

Graystone issued its preliminary forensic findings on June 2, 2023, and delivered its final forensic investigation report on July 14, 2023. The final report confirmed the following regarding the scope of the data compromise:

• Total Affected Individuals: 318,247 individuals across 29 states and the District of Columbia.

• Personally Identifiable Information (PII): All 318,247 affected individuals had some form of PII compromised, including names, addresses, dates of birth, and Social Security numbers.

• Financial Information: Approximately 84,619 individuals had financial information compromised, including bank account numbers, payment card numbers, and/or insurance claim payment details.

• Protected Health Information (PHI): Approximately 41,203 individuals had protected health information compromised within the meaning of the Health Insurance Portability and Accountability Act of 1996, as amended ("HIPAA"), including medical records, diagnosis information, and health insurance identification numbers.

The combination of the breadth of affected individuals, the sensitivity of the compromised data categories, and the geographic dispersion across 29 states and the District of Columbia has resulted in substantial incident response obligations, including individualized consumer notification, credit monitoring enrollment, regulatory notifications, and engagement with multiple regulatory bodies.

B. Claim Filing

On May 8, 2023, Calderwood & Harkness submitted a formal written notice of claim to Atlas Mutual Insurance Company under Quorum's primary cyber-liability insurance policy (Policy No. CYB-2023-041587). The notice was submitted in accordance with the policy's claims notification provisions and included a summary description of the incident, the nature of the anticipated losses, and an initial identification of the cost categories expected to be implicated. Concurrently, Calderwood & Harkness submitted a precautionary notice of potential claim to Pinnacle Surplus Lines Insurance Corp. under Quorum's excess cyber-liability insurance policy (Policy No. XS-CYB-2023-7812), consistent with the notice requirements of the excess policy and prudent claims management practice.

Atlas Mutual acknowledged receipt of the claim and assigned Claim No. CYB-CLM-2023-05892. Paul Enriquez was designated as the claims adjuster responsible for handling the matter on behalf of Atlas. Mr. Enriquez has been responsive and cooperative throughout the claims process, and Calderwood & Harkness has maintained regular communication with him regarding the status of the claim, the progress of the forensic investigation, and the development of anticipated cost categories.

Lisa Garner at Pinnacle Surplus Lines acknowledged receipt of the precautionary notice by email on May 12, 2023, and confirmed that Pinnacle's file has been opened and would be monitored pending further developments. Ms. Garner indicated that no further action from Quorum or its counsel was required at that time unless circumstances changed materially.

Sandra Whitmore-Kim at Whitmore Risk Advisors Inc., Quorum's cyber-insurance broker, assisted in coordinating the initial claim submissions to both Atlas and Pinnacle. Ms. Whitmore-Kim has been kept informed of key developments in the claims process and has provided ongoing support in navigating the claims relationship with both insurers.

III. Overview of Quorum's Cyber-Liability Insurance Tower

Quorum maintains a two-layer cyber-liability insurance tower providing aggregate coverage of up to $40,000,000, structured as described below. Both policies are currently in force and the incident falls within the applicable policy periods.

A. Primary Policy — Atlas Mutual Insurance Company

The Atlas primary policy provides broad cyber-liability coverage, including grants for the following key categories relevant to this matter:

• First-Party Forensic Investigation Costs. The policy covers the reasonable and necessary costs of retaining qualified forensic investigation firms to determine the nature, scope, and cause of a covered cyber event, including the identification of compromised data and affected individuals.

• Notification and Credit Monitoring Costs. The policy covers costs associated with providing legally required notifications to affected individuals, including printing, mailing, and postage costs, as well as the costs of providing credit monitoring and identity theft protection services to affected individuals for a reasonable period (up to 24 months under the policy terms).

• Crisis Communications and Public Relations Costs. The policy covers the costs of retaining public relations and crisis communications consultants to manage reputational impacts arising from a covered cyber event.

• Regulatory Defense Costs. The policy covers the costs of defending regulatory inquiries, investigations, and proceedings arising from a covered cyber event, including costs associated with responding to state attorney general inquiries, insurance department examinations, and federal regulatory investigations such as those conducted by the U.S. Department of Health and Human Services, Office for Civil Rights ("HHS-OCR").

• Regulatory Fines and Penalties. The policy covers regulatory fines and penalties assessed against the insured as a result of a covered cyber event, to the extent such fines and penalties are insurable under applicable law. This coverage is subject to the well-recognized limitation that certain jurisdictions may not permit the insurance of punitive or quasi-punitive regulatory fines.

All coverage under the Atlas primary policy is subject to the $2,500,000 per-occurrence SIR, which must be satisfied by Quorum before Atlas's payment obligations are triggered.

B. Excess Policy — Pinnacle Surplus Lines Insurance Corp.

The Pinnacle excess policy is a follow-form policy that attaches at $15,000,000—i.e., once the Atlas primary per-occurrence limit has been fully exhausted. The Pinnacle policy provides an additional $25,000,000 of coverage on terms and conditions that follow the Atlas primary policy, bringing the total insurance tower to $40,000,000 in aggregate coverage. As discussed in Section V.D below, it is currently unlikely that the Pinnacle excess layer will be implicated given the current cost projections for this matter.

IV. Atlas Mutual's Coverage Determination

A. Acknowledgment and Acceptance

On June 15, 2023, Atlas Mutual issued a written reservation-of-rights acknowledgment letter in response to the formal claim submission. The issuance of a reservation-of-rights letter at this stage is customary practice for claims of this nature and magnitude and does not indicate any adverse coverage determination. Rather, it reflects the insurer's standard protocol of preserving its ability to invoke policy defenses while it evaluates the claim on the merits. Calderwood & Harkness reviewed the reservation-of-rights letter upon receipt and determined that the reservations stated therein were standard in nature and did not raise any immediate coverage concerns specific to the facts of this matter.

Following Calderwood & Harkness's submission of Graystone's preliminary forensic findings on June 2, 2023, and the submission of supplemental documentation regarding anticipated cost categories and vendor engagements in late June and July 2023, Atlas Mutual conducted its coverage evaluation and issued a formal coverage position letter on August 9, 2023.

The August 9, 2023 coverage position letter represents a significant and favorable development. In that letter, Atlas confirmed its acceptance of coverage for the following cost categories, subject to the $2,500,000 SIR and the applicable terms and conditions of the policy:

1. Forensic Investigation Costs. Atlas has confirmed coverage for the fees and costs of Graystone Forensics LLC incurred in connection with the privileged forensic investigation of the security incident. This includes Graystone's work in conducting the forensic analysis of Palomar's systems, identifying the attack vector and threat actor methodology, determining the scope of data exfiltration, and preparing the final forensic investigation report.

2. Notification Costs. Atlas has confirmed coverage for consumer notification printing and mailing costs incurred through Clearfield Notification Services LLC ("Clearfield"). This encompasses the preparation, printing, and mailing of individualized notification letters to each of the 318,247 affected individuals in compliance with the applicable data breach notification statutes of the 29 states and the District of Columbia in which affected individuals reside.

3. Credit Monitoring and Identity Theft Protection Costs. Atlas has confirmed coverage for 24-month credit monitoring and identity theft protection enrollment for affected individuals, as administered by Clearfield. The 24-month coverage period is consistent with industry best practices and regulatory expectations for incidents involving the compromise of Social Security numbers and financial account information.

4. Call Center Operations Costs. Atlas has confirmed coverage for Clearfield's call center operations during the 12-week operational window established to handle inquiries from affected individuals following the mailing of notification letters.

5. Crisis Communications Costs. Atlas has confirmed coverage for the fees and costs of BrightPath Consulting Group Inc. ("BrightPath") for public relations and crisis communications support provided to Quorum in connection with the incident.

6. Regulatory Defense Costs. Atlas has confirmed coverage for Calderwood & Harkness's legal fees attributable to regulatory notification compliance, including the preparation and submission of state regulator breach notifications, as well as the defense of the multistate attorney general inquiry, the Connecticut Insurance Department inquiry, and the HHS-OCR inquiry. This category encompasses all reasonable and necessary legal fees and costs incurred in preparing and submitting regulatory responses, attending meetings or interviews with regulators, and defending against any formal or informal regulatory investigations or proceedings arising from the incident.

7. Potential Regulatory Fines and Penalties. Atlas has confirmed that regulatory fines and penalties, to the extent insurable under applicable law, would be covered under the policy. No fines or penalties have been assessed or are currently anticipated as of the date of this memorandum.

B. Consent and Cooperation Requirements

The Atlas policy contains standard consent and cooperation provisions that require the insured to obtain prior written consent from Atlas before retaining vendors and counsel whose costs are to be covered under the policy. Atlas also requires the insured to cooperate fully with the insurer's investigation and handling of the claim, including the provision of periodic status reports and documentation of incurred costs.

Calderwood & Harkness has ensured full compliance with these provisions. All vendors and counsel retained in connection with this matter were either pre-approved on Atlas's panel of approved service providers or were submitted for and received retroactive approval from Atlas. Specifically, the following entities have been approved by Atlas as covered service providers under the policy:

• Graystone Forensics LLC — Privileged forensic investigation

• Clearfield Notification Services LLC — Consumer notification, credit monitoring, and call center operations

• BrightPath Consulting Group Inc. — Crisis communications and public relations

• Calderwood & Harkness LLP — Breach counsel and regulatory defense

Calderwood & Harkness has been providing periodic reports to Atlas claims adjuster Paul Enriquez regarding the status of the claim, the progress of the forensic investigation, the scope of the data compromise, the status of regulatory notifications and engagements, and the development and refinement of cost estimates. These periodic reports have been submitted by Rachel Bernstein and have been provided on an approximately bi-weekly basis since the initial claim submission. This level of communication has been consistent with Atlas's expectations and has contributed to a constructive and cooperative claims relationship.

C. Reservation of Rights

While Atlas's coverage position letter of August 9, 2023, confirms acceptance of coverage for all major cost categories, the letter does include certain standard reservations of rights, consistent with customary insurer practice. Calderwood & Harkness has reviewed these reservations and provides the following assessment:

1. "Prior Knowledge" Exclusion. Atlas's reservation letter references the policy's "prior knowledge" exclusion, which excludes coverage for claims arising from circumstances that the insured knew about or reasonably should have known about prior to the inception of the policy period. This exclusion is not implicated here. The Palomar security incident began on March 14, 2023, which is within the January 1, 2023 – January 1, 2024 policy period. Furthermore, Quorum had no knowledge of the vulnerability exploitation at Palomar until Palomar provided notice to Quorum on April 21, 2023. There is no factual basis on which Atlas could invoke this exclusion, and Atlas has not indicated any intent to pursue it.

2. "Prior Acts" Exclusion. Atlas's reservation letter also references the policy's "prior acts" exclusion, which excludes coverage for claims arising from wrongful acts committed prior to a specified retroactive date. Again, this exclusion is not implicated, as the incident originated on March 14, 2023, well within the current policy period, and there are no prior acts at issue.

3. Pre-Existing Security Deficiencies. Atlas's reservation letter contains a general reservation regarding any costs that may be attributable to pre-existing security deficiencies at Quorum itself, as distinguished from security deficiencies at Palomar. This reservation reflects the general principle that costs associated with remediating an insured's pre-existing security failures (as opposed to responding to a specific covered incident) may fall outside the scope of coverage. However, Atlas has not raised this as an active coverage issue, and the factual record makes clear that the incident originated entirely from the exploitation of a vulnerability in Palomar's GoAnywhere MFT appliance, not from any deficiency in Quorum's own security environment. Calderwood & Harkness does not anticipate that this reservation will develop into a substantive coverage dispute.

In sum, the reservations of rights contained in Atlas's August 9, 2023 coverage position letter are standard in nature and do not, in our assessment, present a meaningful risk to Quorum's coverage position. We will continue to monitor Atlas's communications for any indication that the insurer intends to pursue any of these reservations as active coverage defenses.

V. Estimated Costs and Coverage Analysis

A. Total Estimated Incident Response Costs

As of August 30, 2023, Calderwood & Harkness estimates the total incident response costs for the Palomar data security incident as follows:

Several points merit additional discussion:

Notification Services. The notification cost estimate of $3,214,500 reflects Clearfield's contractual pricing for notification printing and mailing services to all 318,247 affected individuals, call center operations for a 12-week period following notification mailing, and 24-month credit monitoring and identity theft protection services. The credit monitoring estimate of $2,100,000 is based on a negotiated flat fee structure with Clearfield and assumes an approximately 40% take-rate (approximately 127,299 enrollees out of 318,247 notified individuals). This take-rate assumption is consistent with industry experience for incidents involving Social Security numbers and financial information. The actual take-rate may be higher or lower, but the flat fee arrangement with Clearfield provides cost certainty regardless of the actual enrollment rate.

Legal Fees. Calderwood & Harkness's estimated legal fees of $2,163,750 reflect approximately 2,400 hours of attorney time at a blended effective rate of approximately $901.56 per hour across the engagement team. The team billing rates are as follows:

This estimate includes work through the anticipated conclusion of all incident response activities, including completion of regulatory engagements and preparation and submission of the final proof of loss to Atlas. The estimate may be adjusted upward or downward as regulatory engagements progress toward conclusion and as the scope of any additional work becomes clearer.

Internal Costs. Quorum's internal costs of approximately $620,000 include IT remediation activities, employee overtime, internal project management, and other overhead costs incurred by Quorum's internal teams in connection with the incident response. As discussed in Section V.B below, these internal costs are generally not covered under the Atlas policy and are applied toward and within the SIR.

These cost estimates are based on the best available information as of the date of this memorandum and are subject to revision as the matter progresses. Calderwood & Harkness will continue to refine these estimates as vendor invoices are finalized, regulatory engagements conclude, and any additional cost categories emerge.

B. Application of Self-Insured Retention

The Atlas primary policy is subject to a $2,500,000 per-occurrence self-insured retention. The SIR represents Quorum's first-dollar exposure and is not recoverable from Atlas Mutual. Quorum is responsible for satisfying the full SIR amount before Atlas's obligation to pay covered claims is triggered.

Quorum's internal costs of approximately $620,000 are generally not covered under the terms of the cyber-liability policy, as most internal costs (including employee salaries, overtime, and internal IT remediation efforts) fall outside the policy's covered cost categories. However, these costs are properly applied toward and counted within the SIR for purposes of satisfying the retention threshold. The remaining SIR obligation of approximately $1,880,000 is being funded from Quorum's operating budget and will be satisfied through the payment of vendor invoices for covered costs up to the retention threshold.

Calderwood & Harkness is tracking all costs carefully to ensure that the SIR is properly satisfied and that documentation is maintained to support the transition from SIR-funded costs to Atlas-reimbursable costs.

C. Amount Covered by Atlas Primary Policy

After application of the $2,500,000 SIR, the estimated amount recoverable from Atlas under the primary policy is calculated as follows:

Total Estimated Incident Response Costs: $8,230,250 Less: Self-Insured Retention: ($2,500,000) Estimated Amount Covered by Atlas Primary Policy: $5,730,250

This estimated recovery amount of $5,730,250 represents approximately 38.2% of Atlas's $15,000,000 per-occurrence limit. There is a substantial remaining margin of approximately $9,269,750 within the primary policy limit. Based on current cost projections, there is no anticipated risk of exhausting the primary layer.

It should be noted that the $15,000,000 per-occurrence limit and the $15,000,000 aggregate limit under the Atlas policy are the same, meaning that a single large claim can consume the full aggregate. To date, no other claims have been submitted under the Atlas policy during the January 1, 2023 – January 1, 2024 policy period, and the full aggregate limit remains available for this matter.

D. Excess Layer (Pinnacle) — Unlikely to Be Implicated

The Pinnacle excess policy (Policy No. XS-CYB-2023-7812) attaches at $15,000,000, which is the point at which the Atlas primary per-occurrence limit would be fully exhausted. Given the estimated total incident response costs of $8,230,250, there is a substantial margin of approximately $6,769,750 before the primary layer would be exhausted and the Pinnacle excess layer would be implicated.

Unless there are significant unforeseen cost increases that would cause total costs to approach or exceed the $15,000,000 primary limit, it is unlikely that the Pinnacle excess layer will be triggered. Scenarios that could potentially implicate the excess layer include, but are not limited to:

• A major regulatory enforcement action by one or more state attorneys general or by HHS-OCR resulting in the assessment of substantial fines or penalties;

• The filing of class action litigation by affected individuals, which could generate significant defense costs and potential settlement or judgment exposure; or

• The discovery of additional compromised data categories or additional affected individuals that would substantially expand the scope and cost of the incident response.

None of these scenarios is currently anticipated based on the information available as of the date of this memorandum, although Calderwood & Harkness continues to monitor for these possibilities.

As noted in Section II.B above, precautionary notice has been provided to Pinnacle, and Lisa Garner has acknowledged receipt and confirmed that Pinnacle's file is open. No further action is required with respect to Pinnacle at this time unless and until circumstances change materially.

VI. Interaction with Palomar Indemnification Claim

In addition to the insurance recovery, Calderwood & Harkness has asserted an indemnification claim against Palomar Data Solutions, Inc. under the contractual indemnification provisions of the Master Services Agreement between Quorum and Palomar. Specifically, Calderwood & Harkness, on behalf of Quorum, submitted a formal written demand for indemnification under Section 12.2 of the Master Services Agreement dated November 12, 2019, as amended (the "MSA"), demanding full reimbursement of the $8,230,250 in estimated incident response costs. Section 12.2 of the MSA requires Palomar to indemnify and hold harmless Quorum against all losses, damages, costs, and expenses arising from Palomar's breach of its security obligations under the agreement, including but not limited to data security incidents resulting from Palomar's failure to maintain adequate security controls.

The indemnification claim is subject to a contractual liability cap of $32,600,000, which equals two times (2×) the trailing twelve-month fees paid by Quorum to Palomar under the MSA (trailing twelve-month fees of $16,300,000). The estimated $8,230,250 in incident response costs is well within this contractual cap.

Palomar's initial response to the indemnification demand was received on July 7, 2023, through Palomar's outside counsel, Catherine Langford, a partner at Mercer, Haight & Dunlop LLP. In that response, Palomar disputed causation, asserting that the CVE-2023-0669 vulnerability was a zero-day exploit for which no patch was available at the time of initial exploitation (a contention that Calderwood & Harkness disputes based on available patching timeline evidence) and that Palomar's security posture was otherwise adequate. Palomar offered a goodwill credit of $1,500,000 against future service fees as a settlement of the indemnification claim. Calderwood & Harkness issued a detailed rebuttal letter on July 25, 2023, rejecting the goodwill credit offer, providing evidence that the GoAnywhere MFT patch was available prior to the March 14 exploitation event, and reiterating Quorum's demand for full indemnification. Negotiations between the parties are ongoing.

The interplay between the Palomar indemnification claim and the Atlas insurance recovery requires careful management. The following considerations are relevant:

Subrogation Rights. The Atlas policy contains standard subrogation provisions that entitle Atlas to step into Quorum's shoes and recover from any third party (including Palomar) amounts that Atlas has paid under the policy. Atlas has been informed of the Palomar indemnification claim and has indicated that it intends to assert subrogation rights to the extent it pays covered claims that are also recoverable from Palomar. Calderwood & Harkness is maintaining ongoing communication with Atlas regarding the status of the Palomar negotiations.

Avoidance of Double Recovery. Any recovery from Palomar must be coordinated with Atlas to ensure that Quorum does not recover the same dollar amount from both sources. If Palomar ultimately pays a settlement amount, a portion of that recovery may need to be applied against amounts paid by Atlas, or the settlement structure may need to allocate recovery among covered and non-covered costs in a manner that preserves Quorum's interests while respecting Atlas's subrogation rights.

Maximizing Quorum's Net Financial Position. Calderwood & Harkness's negotiation strategy with Palomar is designed to maximize Quorum's total recovery while preserving the cooperative claims relationship with Atlas. To the extent that Palomar pays amounts attributable to costs within the SIR (which are not recoverable from Atlas), such payments directly benefit Quorum without implicating Atlas's subrogation interests. Calderwood & Harkness is structuring the negotiation with this dynamic in mind.

Calderwood & Harkness will continue to keep Atlas informed of all material developments in the Palomar indemnification negotiations and will seek Atlas's input before finalizing any settlement with Palomar that could affect Atlas's subrogation interests.

VII. Status of Regulatory Engagements and Coverage Implications

Calderwood & Harkness is managing several parallel regulatory engagements arising from the Palomar data security incident. The costs associated with all of these regulatory engagements are covered as regulatory defense costs under the Atlas policy. A summary of each engagement and its current status follows.

A. Multistate Attorney General Inquiry

A coalition of 29 state attorneys general, led by the Connecticut Attorney General (Assistant Attorney General Diane Marchetti) and the New York Attorney General (Assistant Attorney General Mark Petrosian), has formed a multistate inquiry group to investigate the Palomar data security incident. The coalition issued a joint demand letter dated September 8, 2023, requesting detailed information regarding the incident, Quorum's vendor management practices, the nature and scope of the data compromise, and the steps taken by Quorum to remediate the incident and protect affected individuals. The demand letter also requests documentation regarding Quorum's contractual relationship with Palomar and the due diligence conducted by Quorum prior to engaging Palomar as a claims-processing vendor.

Calderwood & Harkness is preparing a comprehensive response to the multistate AG demand letter, which is due within 30 days of receipt. The costs of preparing this response—including Calderwood & Harkness's legal fees and associated costs for document collection, review, and response preparation—are covered as regulatory defense costs under the Atlas policy. Atlas has been informed of the multistate AG inquiry and has confirmed that regulatory defense costs associated with the inquiry are covered.

No enforcement action has been taken by any state attorney general to date, and no fines, penalties, or consent decrees have been proposed or assessed. The multistate inquiry remains at the investigative stage.

B. Connecticut Insurance Department

The Connecticut Insurance Department has been notified of the cybersecurity event, as required by applicable Connecticut insurance regulatory requirements. Richard Nakamura, an examiner in the Financial Analysis Division, Cybersecurity Unit, has been assigned to review the matter on behalf of the Department. Mr. Nakamura has made preliminary inquiries regarding the nature and scope of the incident, Quorum's cybersecurity program, and the steps taken to protect policyholder data.

Calderwood & Harkness is coordinating with Quorum's regulatory affairs team to respond to the Department's inquiries. Regulatory defense costs associated with the Connecticut Insurance Department engagement are covered under the Atlas policy.

C. HHS-OCR (HIPAA)

Because the incident involved the compromise of protected health information for 41,203 individuals, a breach notification was submitted to the U.S. Department of Health and Human Services, Office for Civil Rights (HHS-OCR), Region I (Boston), on August 15, 2023. The notification was submitted in accordance with the HIPAA Breach Notification Rule (45 C.F.R. §§ 164.400–164.414) and reported the unauthorized access to and exfiltration of PHI from Palomar's systems.

HHS-OCR has acknowledged receipt of the breach notification. To date, HHS-OCR has not initiated a formal investigation or compliance review, although such action remains possible given the magnitude of the breach. Any costs associated with responding to HHS-OCR inquiries or defending against an HHS-OCR investigation or enforcement action are covered as regulatory defense costs under the Atlas policy.

D. Assessment

No fines, penalties, or enforcement actions have been assessed or initiated by any regulator as of the date of this memorandum. Calderwood & Harkness believes that the likelihood of significant regulatory fines or penalties is manageable, given the vendor-originated nature of the breach, Quorum's prompt and comprehensive incident response, and Quorum's cooperation with regulatory authorities. However, the regulatory landscape remains dynamic, and Calderwood & Harkness will continue to monitor all regulatory engagements closely.

If any regulatory fines or penalties were to be assessed, coverage for such fines or penalties under the Atlas policy would depend on whether the specific fine or penalty at issue is "insurable" under the law of the applicable jurisdiction. Certain jurisdictions prohibit the insurance of punitive fines or penalties on public policy grounds, and any assessment would need to be evaluated on a case-by-case basis. Calderwood & Harkness would provide a supplemental coverage analysis if and when any fine or penalty is assessed.

VIII. Open Items and Recommendations

Based on the foregoing analysis, Calderwood & Harkness recommends the following actions and identifies the following open items for Quorum's attention:

A. Ongoing Coordination with Atlas Mutual

Calderwood & Harkness recommends that Quorum continue its proactive and cooperative approach to the Atlas claims relationship. Specifically, Calderwood & Harkness will continue to provide periodic status reports to claims adjuster Paul Enriquez regarding claim developments, the status of regulatory engagements, and updated cost projections. Maintaining a regular cadence of communication with Atlas is important to preserving a constructive claims relationship and ensuring that any potential coverage issues are identified and addressed promptly.

In addition, Calderwood & Harkness will submit interim proof of loss documentation and supporting cost records to Atlas for reimbursement of costs exceeding the $2,500,000 SIR as they are incurred. This will ensure that Quorum receives reimbursement on a timely basis rather than waiting until the conclusion of all incident response activities to submit a single, large reimbursement request.

B. Final Proof of Loss

Upon conclusion of the incident response—including the closure of all regulatory inquiries, the finalization of all vendor invoices, and the completion of all notification and credit monitoring obligations—Calderwood & Harkness will prepare and submit a final proof of loss and comprehensive cost summary to Atlas. The final proof of loss will include detailed documentation of all costs incurred, organized by covered cost category, together with supporting invoices, contracts, and other documentation as required by the policy.

C. Palomar Subrogation Coordination

Any settlement or recovery from Palomar Data Solutions must be coordinated with Atlas to address Atlas's subrogation rights under the policy. Calderwood & Harkness will keep Atlas informed of the status of the Palomar indemnification negotiations and will consult with Atlas before finalizing any settlement agreement with Palomar. The goal is to structure any Palomar recovery in a manner that respects Atlas's subrogation interests while maximizing Quorum's net financial position, including by allocating any Palomar recovery first to costs within the SIR (which are not subject to Atlas's subrogation rights) to the extent permissible.

D. Pinnacle Excess — No Action Required

No further action is required with respect to Pinnacle Surplus Lines Insurance Corp. at this time. Precautionary notice has been provided and acknowledged, and Pinnacle's file remains open. If circumstances materially change—for example, if regulatory fines, litigation costs, or other developments significantly increase the projected total costs such that the Atlas primary layer could be at risk of exhaustion—Calderwood & Harkness will promptly update Pinnacle and engage Lisa Garner to ensure that the excess layer is properly activated and that all notice and cooperation requirements are satisfied.

E. Monitoring for Potential Litigation

As of the date of this memorandum, no class action litigation, individual lawsuits, or regulatory enforcement actions have been filed against Quorum in connection with the Palomar data security incident. However, the consumer notification mailing window, which runs from approximately August 18, 2023, through September 15, 2023, creates a period of heightened risk for potential lawsuits. It is well-established in the data breach context that the filing of consumer class actions tends to occur in the weeks and months following the receipt of notification letters by affected individuals.

Calderwood & Harkness is monitoring public court filings and will promptly advise Quorum if any litigation is filed. If any litigation is filed, the Atlas policy provides coverage for defense costs and any resulting liabilities arising from the covered cyber event, and timely notice to Atlas would be required under the policy's claims notification provisions. Calderwood & Harkness would submit such notice immediately upon learning of any filed litigation.

IX. Conclusion

In summary, Quorum Insurance Holdings Corp.'s insurance coverage posture with respect to the Palomar Data Solutions security incident is favorable. Atlas Mutual Insurance Company has accepted coverage for all major categories of incident response costs in excess of the $2,500,000 self-insured retention, including forensic investigation costs, notification and credit monitoring costs, crisis communications costs, and regulatory defense costs. The estimated covered amount of $5,730,250 is well within the $15,000,000 per-occurrence limit of the Atlas primary policy, representing approximately 38.2% of the available primary coverage. There is no current risk of exhausting the primary layer, and the Pinnacle Surplus Lines excess layer is unlikely to be implicated under current cost projections.

Calderwood & Harkness will continue to manage the insurance claims process on Quorum's behalf, including ongoing coordination with Atlas claims adjuster Paul Enriquez, management of the Palomar indemnification negotiations in coordination with Atlas's subrogation interests, and oversight of all regulatory engagements and associated defense costs. Upon the conclusion of all incident response activities, Calderwood & Harkness will prepare and submit a final proof of loss to Atlas for full and final reimbursement of all covered costs.

Rachel Bernstein remains available at any time to discuss questions regarding coverage, insurance coordination, the Palomar indemnification claim, or any other aspect of this matter. Please do not hesitate to reach out directly.

Respectfully submitted,

CALDERWOOD & HARKNESS LLP

By: ________

Rachel Bernstein Partner, Privacy & Data Security 51 West 52nd Street, 34th Floor New York, NY 10019 Tel: (212) 555-4800

Email: rbernstein@calderwoodharkness.com

PRIVILEGED AND CONFIDENTIAL — ATTORNEY-CLIENT COMMUNICATION — ATTORNEY WORK PRODUCT

This memorandum is a privileged and confidential attorney-client communication and constitutes attorney work product prepared in anticipation of litigation and in furtherance of the provision of legal advice. This memorandum is intended solely for the use of the addressee and authorized recipients identified herein. Any unauthorized review, use, disclosure, or distribution is prohibited. If you have received this memorandum in error, please contact Calderwood & Harkness LLP immediately at (212) 555-4800.

Element	Detail
Insurer	Atlas Mutual Insurance Company, 120 South LaSalle Street, Suite 3200, Chicago, IL 60603
Policy Number	CYB-2023-041587
Coverage Period	January 1, 2023 – January 1, 2024
Per-Occurrence Limit	$15,000,000
Aggregate Limit	$15,000,000
Self-Insured Retention (SIR)	$2,500,000 per occurrence
Claims Adjuster	Paul Enriquez
Element	Detail
Insurer	Pinnacle Surplus Lines Insurance Corp., One Beacon Street, Suite 1100, Boston, MA 02108
Policy Number	XS-CYB-2023-7812
Coverage Period	January 1, 2023 – January 1, 2024
Limit	$25,000,000 excess of $15,000,000
Total Tower Limit	$40,000,000 (combined primary and excess)
Terms	Follow-form to Atlas Mutual primary policy terms and conditions
Claims Contact	Lisa Garner
Cost Category	Vendor / Provider	Estimated Amount
Forensic Investigation	Graystone Forensics LLC	$1,847,000
Notification Services (subtotal)	Clearfield Notification Services LLC	$3,214,500
— Notification printing/mailing (318,247 individuals)	Clearfield	$636,000
— Call center operations (12-week window)	Clearfield	$478,500
— Credit monitoring (24-month, negotiated flat fee, ~40% take-rate / ~127,299 enrollees)	Clearfield	$2,100,000
Crisis Communications / Public Relations	BrightPath Consulting Group Inc.	$385,000
Legal Fees	Calderwood & Harkness LLP	$2,163,750
Internal Costs (IT remediation, employee overtime, etc.)	Quorum (internal)	$620,000 (est.)

Total Estimated Incident Response Costs	$8,230,250
Attorney	Billing Rate
Kevin Ostrowski, Partner	$1,250/hr
Rachel Bernstein, Partner	$1,175/hr
Alan Burke, Associate	$825/hr
Sarah Hendricks, Associate	$650/hr

PRIVILEGED AND CONFIDENTIAL — ATTORNEY-CLIENT COMMUNICATION — ATTORNEY WORK PRODUCT — DO NOT DISTRIBUTE
CALDERWOOD & HARKNESS LLP Counselors at Law 51 West 52nd Street, 34th Floor New York, New York 10019
August 30, 2023
MEMORANDUM
TO: Thomas R. Whitfield, General Counsel Quorum Insurance Holdings Corp. 400 Constitution Plaza, Suite 2200 Hartford, CT 06103
FROM: Rachel Bernstein, Partner, Privacy & Data Security Calderwood & Harkness LLP
CC: Kevin Ostrowski, Partner, Calderwood & Harkness LLP Alan Burke, Associate, Calderwood & Harkness LLP
RE: Insurance Coverage Status Update — Palomar Data Solutions Security Incident
Matter No.: 1025-00006
Policy References:
Atlas Mutual Insurance Company, Policy No. CYB-2023-041587 Pinnacle Surplus Lines Insurance Corp., Policy No. XS-CYB-2023-7812
Claim No.: CYB-CLM-2023-05892
I. Purpose and Summary
The purpose of this memorandum is to provide Quorum Insurance Holdings Corp. ("Quorum") General Counsel Thomas R. Whitfield with an updated assessment of the insurance coverage posture related to the data security incident originating from Quorum's third-party claims-processing vendor, Palomar Data Solutions, Inc. ("Palomar"). This memorandum reflects developments through August 30, 2023, including Atlas Mutual Insurance Company's ("Atlas Mutual" or "Atlas") coverage determination, the current status of estimated incident response costs, the posture of regulatory engagements, and the interplay between the insurance recovery and the indemnification claim asserted against Palomar.
In summary, Quorum's insurance recovery posture is favorable. The key conclusions are as follows:
• Coverage Accepted. Atlas Mutual has formally acknowledged the claim under Policy No. CYB-2023-041587 and has accepted coverage for all major categories of first-party incident response costs and regulatory defense costs, subject to the $2,500,000 self-insured retention ("SIR") and the standard terms and conditions of the policy.
• Estimated Costs Within Primary Layer. Total estimated incident response costs of $8,230,250 remain well within the $15,000,000 per-occurrence limit of the Atlas primary policy. The estimated amount recoverable from Atlas—approximately $5,730,250, after application of the SIR—represents approximately 38.2% of the available primary coverage.
• Excess Layer Unlikely to Be Implicated. Based on current cost projections, it is unlikely that the Pinnacle Surplus Lines Insurance Corp. ("Pinnacle") excess layer (Policy No. XS-CYB-2023-7812), which attaches at $15,000,000, will be implicated. A substantial margin of approximately $6,769,750 exists before the primary layer would be exhausted.
• Regulatory Posture Manageable. No fines, penalties, or enforcement actions have been assessed or initiated by any regulator as of the date of this memorandum, and defense costs associated with ongoing regulatory engagements are covered under the Atlas policy.
• Palomar Indemnification Coordination Required. The indemnification claim against Palomar under the Master Services Agreement and Atlas's subrogation rights must be carefully coordinated to avoid double recovery and to maximize Quorum's net financial position.
The sections below provide a detailed discussion of each of these items.
II. Background — Incident and Insurance Claim Filing
A. Incident Overview
On or about March 14, 2023, a threat actor exploited CVE-2023-0669, a critical remote code execution vulnerability in Palomar Data Solutions' GoAnywhere MFT file transfer appliance, to gain unauthorized access to Palomar's network environment. The GoAnywhere MFT vulnerability, which was publicly disclosed in early February 2023, had been widely exploited by threat actors during this period, and Palomar had not applied the available vendor patch prior to the exploitation event. Palomar serves as Quorum's primary third-party claims-processing vendor and, in that capacity, maintains custody of significant volumes of policyholder and claimant data on behalf of Quorum.
Following the initial access event, the threat actor conducted lateral movement within Palomar's network and engaged in sustained data exfiltration over an approximately 35-day window, from March 14, 2023, through April 18, 2023. During this period, the threat actor accessed and exfiltrated files from multiple Palomar systems, including systems containing data processed on behalf of Quorum.
Palomar's security operations center ("SOC") discovered anomalous outbound data transfers on April 18, 2023, and Palomar took immediate containment measures. Palomar notified Quorum of the potential data security incident on April 21, 2023, in accordance with the notification provisions set forth in the Master Services Agreement between the parties.
Upon receiving Palomar's notification, Quorum's internal incident response team, under the direction of Mr. Whitfield and Quorum's Chief Information Security Officer, initiated Quorum's incident response protocol. Calderwood & Harkness LLP was engaged as outside breach counsel on May 4, 2023. On May 5, 2023, Calderwood & Harkness retained Graystone Forensics LLC ("Graystone") to conduct a privileged forensic investigation under the attorney-client privilege and work product doctrine umbrella, with Graystone reporting directly to Calderwood & Harkness in furtherance of the firm's provision of legal advice to Quorum.
Graystone issued its preliminary forensic findings on June 2, 2023, and delivered its final forensic investigation report on July 14, 2023. The final report confirmed the following regarding the scope of the data compromise:
• Total Affected Individuals: 318,247 individuals across 29 states and the District of Columbia.
• Personally Identifiable Information (PII): All 318,247 affected individuals had some form of PII compromised, including names, addresses, dates of birth, and Social Security numbers.
• Financial Information: Approximately 84,619 individuals had financial information compromised, including bank account numbers, payment card numbers, and/or insurance claim payment details.
• Protected Health Information (PHI): Approximately 41,203 individuals had protected health information compromised within the meaning of the Health Insurance Portability and Accountability Act of 1996, as amended ("HIPAA"), including medical records, diagnosis information, and health insurance identification numbers.
The combination of the breadth of affected individuals, the sensitivity of the compromised data categories, and the geographic dispersion across 29 states and the District of Columbia has resulted in substantial incident response obligations, including individualized consumer notification, credit monitoring enrollment, regulatory notifications, and engagement with multiple regulatory bodies.
B. Claim Filing
On May 8, 2023, Calderwood & Harkness submitted a formal written notice of claim to Atlas Mutual Insurance Company under Quorum's primary cyber-liability insurance policy (Policy No. CYB-2023-041587). The notice was submitted in accordance with the policy's claims notification provisions and included a summary description of the incident, the nature of the anticipated losses, and an initial identification of the cost categories expected to be implicated. Concurrently, Calderwood & Harkness submitted a precautionary notice of potential claim to Pinnacle Surplus Lines Insurance Corp. under Quorum's excess cyber-liability insurance policy (Policy No. XS-CYB-2023-7812), consistent with the notice requirements of the excess policy and prudent claims management practice.
Atlas Mutual acknowledged receipt of the claim and assigned Claim No. CYB-CLM-2023-05892. Paul Enriquez was designated as the claims adjuster responsible for handling the matter on behalf of Atlas. Mr. Enriquez has been responsive and cooperative throughout the claims process, and Calderwood & Harkness has maintained regular communication with him regarding the status of the claim, the progress of the forensic investigation, and the development of anticipated cost categories.
Lisa Garner at Pinnacle Surplus Lines acknowledged receipt of the precautionary notice by email on May 12, 2023, and confirmed that Pinnacle's file has been opened and would be monitored pending further developments. Ms. Garner indicated that no further action from Quorum or its counsel was required at that time unless circumstances changed materially.
Sandra Whitmore-Kim at Whitmore Risk Advisors Inc., Quorum's cyber-insurance broker, assisted in coordinating the initial claim submissions to both Atlas and Pinnacle. Ms. Whitmore-Kim has been kept informed of key developments in the claims process and has provided ongoing support in navigating the claims relationship with both insurers.
III. Overview of Quorum's Cyber-Liability Insurance Tower
Quorum maintains a two-layer cyber-liability insurance tower providing aggregate coverage of up to $40,000,000, structured as described below. Both policies are currently in force and the incident falls within the applicable policy periods.
A. Primary Policy — Atlas Mutual Insurance Company
The Atlas primary policy provides broad cyber-liability coverage, including grants for the following key categories relevant to this matter:
• First-Party Forensic Investigation Costs. The policy covers the reasonable and necessary costs of retaining qualified forensic investigation firms to determine the nature, scope, and cause of a covered cyber event, including the identification of compromised data and affected individuals.
• Notification and Credit Monitoring Costs. The policy covers costs associated with providing legally required notifications to affected individuals, including printing, mailing, and postage costs, as well as the costs of providing credit monitoring and identity theft protection services to affected individuals for a reasonable period (up to 24 months under the policy terms).
• Crisis Communications and Public Relations Costs. The policy covers the costs of retaining public relations and crisis communications consultants to manage reputational impacts arising from a covered cyber event.
• Regulatory Defense Costs. The policy covers the costs of defending regulatory inquiries, investigations, and proceedings arising from a covered cyber event, including costs associated with responding to state attorney general inquiries, insurance department examinations, and federal regulatory investigations such as those conducted by the U.S. Department of Health and Human Services, Office for Civil Rights ("HHS-OCR").
• Regulatory Fines and Penalties. The policy covers regulatory fines and penalties assessed against the insured as a result of a covered cyber event, to the extent such fines and penalties are insurable under applicable law. This coverage is subject to the well-recognized limitation that certain jurisdictions may not permit the insurance of punitive or quasi-punitive regulatory fines.
All coverage under the Atlas primary policy is subject to the $2,500,000 per-occurrence SIR, which must be satisfied by Quorum before Atlas's payment obligations are triggered.
B. Excess Policy — Pinnacle Surplus Lines Insurance Corp.
The Pinnacle excess policy is a follow-form policy that attaches at $15,000,000—i.e., once the Atlas primary per-occurrence limit has been fully exhausted. The Pinnacle policy provides an additional $25,000,000 of coverage on terms and conditions that follow the Atlas primary policy, bringing the total insurance tower to $40,000,000 in aggregate coverage. As discussed in Section V.D below, it is currently unlikely that the Pinnacle excess layer will be implicated given the current cost projections for this matter.
IV. Atlas Mutual's Coverage Determination
A. Acknowledgment and Acceptance
On June 15, 2023, Atlas Mutual issued a written reservation-of-rights acknowledgment letter in response to the formal claim submission. The issuance of a reservation-of-rights letter at this stage is customary practice for claims of this nature and magnitude and does not indicate any adverse coverage determination. Rather, it reflects the insurer's standard protocol of preserving its ability to invoke policy defenses while it evaluates the claim on the merits. Calderwood & Harkness reviewed the reservation-of-rights letter upon receipt and determined that the reservations stated therein were standard in nature and did not raise any immediate coverage concerns specific to the facts of this matter.
Following Calderwood & Harkness's submission of Graystone's preliminary forensic findings on June 2, 2023, and the submission of supplemental documentation regarding anticipated cost categories and vendor engagements in late June and July 2023, Atlas Mutual conducted its coverage evaluation and issued a formal coverage position letter on August 9, 2023.
The August 9, 2023 coverage position letter represents a significant and favorable development. In that letter, Atlas confirmed its acceptance of coverage for the following cost categories, subject to the $2,500,000 SIR and the applicable terms and conditions of the policy:
1. Forensic Investigation Costs. Atlas has confirmed coverage for the fees and costs of Graystone Forensics LLC incurred in connection with the privileged forensic investigation of the security incident. This includes Graystone's work in conducting the forensic analysis of Palomar's systems, identifying the attack vector and threat actor methodology, determining the scope of data exfiltration, and preparing the final forensic investigation report.
2. Notification Costs. Atlas has confirmed coverage for consumer notification printing and mailing costs incurred through Clearfield Notification Services LLC ("Clearfield"). This encompasses the preparation, printing, and mailing of individualized notification letters to each of the 318,247 affected individuals in compliance with the applicable data breach notification statutes of the 29 states and the District of Columbia in which affected individuals reside.
3. Credit Monitoring and Identity Theft Protection Costs. Atlas has confirmed coverage for 24-month credit monitoring and identity theft protection enrollment for affected individuals, as administered by Clearfield. The 24-month coverage period is consistent with industry best practices and regulatory expectations for incidents involving the compromise of Social Security numbers and financial account information.
4. Call Center Operations Costs. Atlas has confirmed coverage for Clearfield's call center operations during the 12-week operational window established to handle inquiries from affected individuals following the mailing of notification letters.
5. Crisis Communications Costs. Atlas has confirmed coverage for the fees and costs of BrightPath Consulting Group Inc. ("BrightPath") for public relations and crisis communications support provided to Quorum in connection with the incident.
6. Regulatory Defense Costs. Atlas has confirmed coverage for Calderwood & Harkness's legal fees attributable to regulatory notification compliance, including the preparation and submission of state regulator breach notifications, as well as the defense of the multistate attorney general inquiry, the Connecticut Insurance Department inquiry, and the HHS-OCR inquiry. This category encompasses all reasonable and necessary legal fees and costs incurred in preparing and submitting regulatory responses, attending meetings or interviews with regulators, and defending against any formal or informal regulatory investigations or proceedings arising from the incident.
7. Potential Regulatory Fines and Penalties. Atlas has confirmed that regulatory fines and penalties, to the extent insurable under applicable law, would be covered under the policy. No fines or penalties have been assessed or are currently anticipated as of the date of this memorandum.
B. Consent and Cooperation Requirements
The Atlas policy contains standard consent and cooperation provisions that require the insured to obtain prior written consent from Atlas before retaining vendors and counsel whose costs are to be covered under the policy. Atlas also requires the insured to cooperate fully with the insurer's investigation and handling of the claim, including the provision of periodic status reports and documentation of incurred costs.
Calderwood & Harkness has ensured full compliance with these provisions. All vendors and counsel retained in connection with this matter were either pre-approved on Atlas's panel of approved service providers or were submitted for and received retroactive approval from Atlas. Specifically, the following entities have been approved by Atlas as covered service providers under the policy:
• Graystone Forensics LLC — Privileged forensic investigation
• Clearfield Notification Services LLC — Consumer notification, credit monitoring, and call center operations
• BrightPath Consulting Group Inc. — Crisis communications and public relations
• Calderwood & Harkness LLP — Breach counsel and regulatory defense
Calderwood & Harkness has been providing periodic reports to Atlas claims adjuster Paul Enriquez regarding the status of the claim, the progress of the forensic investigation, the scope of the data compromise, the status of regulatory notifications and engagements, and the development and refinement of cost estimates. These periodic reports have been submitted by Rachel Bernstein and have been provided on an approximately bi-weekly basis since the initial claim submission. This level of communication has been consistent with Atlas's expectations and has contributed to a constructive and cooperative claims relationship.
C. Reservation of Rights
While Atlas's coverage position letter of August 9, 2023, confirms acceptance of coverage for all major cost categories, the letter does include certain standard reservations of rights, consistent with customary insurer practice. Calderwood & Harkness has reviewed these reservations and provides the following assessment:
1. "Prior Knowledge" Exclusion. Atlas's reservation letter references the policy's "prior knowledge" exclusion, which excludes coverage for claims arising from circumstances that the insured knew about or reasonably should have known about prior to the inception of the policy period. This exclusion is not implicated here. The Palomar security incident began on March 14, 2023, which is within the January 1, 2023 – January 1, 2024 policy period. Furthermore, Quorum had no knowledge of the vulnerability exploitation at Palomar until Palomar provided notice to Quorum on April 21, 2023. There is no factual basis on which Atlas could invoke this exclusion, and Atlas has not indicated any intent to pursue it.
2. "Prior Acts" Exclusion. Atlas's reservation letter also references the policy's "prior acts" exclusion, which excludes coverage for claims arising from wrongful acts committed prior to a specified retroactive date. Again, this exclusion is not implicated, as the incident originated on March 14, 2023, well within the current policy period, and there are no prior acts at issue.
3. Pre-Existing Security Deficiencies. Atlas's reservation letter contains a general reservation regarding any costs that may be attributable to pre-existing security deficiencies at Quorum itself, as distinguished from security deficiencies at Palomar. This reservation reflects the general principle that costs associated with remediating an insured's pre-existing security failures (as opposed to responding to a specific covered incident) may fall outside the scope of coverage. However, Atlas has not raised this as an active coverage issue, and the factual record makes clear that the incident originated entirely from the exploitation of a vulnerability in Palomar's GoAnywhere MFT appliance, not from any deficiency in Quorum's own security environment. Calderwood & Harkness does not anticipate that this reservation will develop into a substantive coverage dispute.
In sum, the reservations of rights contained in Atlas's August 9, 2023 coverage position letter are standard in nature and do not, in our assessment, present a meaningful risk to Quorum's coverage position. We will continue to monitor Atlas's communications for any indication that the insurer intends to pursue any of these reservations as active coverage defenses.
V. Estimated Costs and Coverage Analysis
A. Total Estimated Incident Response Costs
As of August 30, 2023, Calderwood & Harkness estimates the total incident response costs for the Palomar data security incident as follows:
Several points merit additional discussion:
Notification Services. The notification cost estimate of $3,214,500 reflects Clearfield's contractual pricing for notification printing and mailing services to all 318,247 affected individuals, call center operations for a 12-week period following notification mailing, and 24-month credit monitoring and identity theft protection services. The credit monitoring estimate of $2,100,000 is based on a negotiated flat fee structure with Clearfield and assumes an approximately 40% take-rate (approximately 127,299 enrollees out of 318,247 notified individuals). This take-rate assumption is consistent with industry experience for incidents involving Social Security numbers and financial information. The actual take-rate may be higher or lower, but the flat fee arrangement with Clearfield provides cost certainty regardless of the actual enrollment rate.
Legal Fees. Calderwood & Harkness's estimated legal fees of $2,163,750 reflect approximately 2,400 hours of attorney time at a blended effective rate of approximately $901.56 per hour across the engagement team. The team billing rates are as follows:
This estimate includes work through the anticipated conclusion of all incident response activities, including completion of regulatory engagements and preparation and submission of the final proof of loss to Atlas. The estimate may be adjusted upward or downward as regulatory engagements progress toward conclusion and as the scope of any additional work becomes clearer.
Internal Costs. Quorum's internal costs of approximately $620,000 include IT remediation activities, employee overtime, internal project management, and other overhead costs incurred by Quorum's internal teams in connection with the incident response. As discussed in Section V.B below, these internal costs are generally not covered under the Atlas policy and are applied toward and within the SIR.
These cost estimates are based on the best available information as of the date of this memorandum and are subject to revision as the matter progresses. Calderwood & Harkness will continue to refine these estimates as vendor invoices are finalized, regulatory engagements conclude, and any additional cost categories emerge.
B. Application of Self-Insured Retention
The Atlas primary policy is subject to a $2,500,000 per-occurrence self-insured retention. The SIR represents Quorum's first-dollar exposure and is not recoverable from Atlas Mutual. Quorum is responsible for satisfying the full SIR amount before Atlas's obligation to pay covered claims is triggered.
Quorum's internal costs of approximately $620,000 are generally not covered under the terms of the cyber-liability policy, as most internal costs (including employee salaries, overtime, and internal IT remediation efforts) fall outside the policy's covered cost categories. However, these costs are properly applied toward and counted within the SIR for purposes of satisfying the retention threshold. The remaining SIR obligation of approximately $1,880,000 is being funded from Quorum's operating budget and will be satisfied through the payment of vendor invoices for covered costs up to the retention threshold.
Calderwood & Harkness is tracking all costs carefully to ensure that the SIR is properly satisfied and that documentation is maintained to support the transition from SIR-funded costs to Atlas-reimbursable costs.
C. Amount Covered by Atlas Primary Policy
After application of the $2,500,000 SIR, the estimated amount recoverable from Atlas under the primary policy is calculated as follows:
Total Estimated Incident Response Costs: $8,230,250 Less: Self-Insured Retention: ($2,500,000) Estimated Amount Covered by Atlas Primary Policy: $5,730,250
This estimated recovery amount of $5,730,250 represents approximately 38.2% of Atlas's $15,000,000 per-occurrence limit. There is a substantial remaining margin of approximately $9,269,750 within the primary policy limit. Based on current cost projections, there is no anticipated risk of exhausting the primary layer.
It should be noted that the $15,000,000 per-occurrence limit and the $15,000,000 aggregate limit under the Atlas policy are the same, meaning that a single large claim can consume the full aggregate. To date, no other claims have been submitted under the Atlas policy during the January 1, 2023 – January 1, 2024 policy period, and the full aggregate limit remains available for this matter.
D. Excess Layer (Pinnacle) — Unlikely to Be Implicated
The Pinnacle excess policy (Policy No. XS-CYB-2023-7812) attaches at $15,000,000, which is the point at which the Atlas primary per-occurrence limit would be fully exhausted. Given the estimated total incident response costs of $8,230,250, there is a substantial margin of approximately $6,769,750 before the primary layer would be exhausted and the Pinnacle excess layer would be implicated.
Unless there are significant unforeseen cost increases that would cause total costs to approach or exceed the $15,000,000 primary limit, it is unlikely that the Pinnacle excess layer will be triggered. Scenarios that could potentially implicate the excess layer include, but are not limited to:
• A major regulatory enforcement action by one or more state attorneys general or by HHS-OCR resulting in the assessment of substantial fines or penalties;
• The filing of class action litigation by affected individuals, which could generate significant defense costs and potential settlement or judgment exposure; or
• The discovery of additional compromised data categories or additional affected individuals that would substantially expand the scope and cost of the incident response.
None of these scenarios is currently anticipated based on the information available as of the date of this memorandum, although Calderwood & Harkness continues to monitor for these possibilities.
As noted in Section II.B above, precautionary notice has been provided to Pinnacle, and Lisa Garner has acknowledged receipt and confirmed that Pinnacle's file is open. No further action is required with respect to Pinnacle at this time unless and until circumstances change materially.
VI. Interaction with Palomar Indemnification Claim
In addition to the insurance recovery, Calderwood & Harkness has asserted an indemnification claim against Palomar Data Solutions, Inc. under the contractual indemnification provisions of the Master Services Agreement between Quorum and Palomar. Specifically, Calderwood & Harkness, on behalf of Quorum, submitted a formal written demand for indemnification under Section 12.2 of the Master Services Agreement dated November 12, 2019, as amended (the "MSA"), demanding full reimbursement of the $8,230,250 in estimated incident response costs. Section 12.2 of the MSA requires Palomar to indemnify and hold harmless Quorum against all losses, damages, costs, and expenses arising from Palomar's breach of its security obligations under the agreement, including but not limited to data security incidents resulting from Palomar's failure to maintain adequate security controls.
The indemnification claim is subject to a contractual liability cap of $32,600,000, which equals two times (2×) the trailing twelve-month fees paid by Quorum to Palomar under the MSA (trailing twelve-month fees of $16,300,000). The estimated $8,230,250 in incident response costs is well within this contractual cap.
Palomar's initial response to the indemnification demand was received on July 7, 2023, through Palomar's outside counsel, Catherine Langford, a partner at Mercer, Haight & Dunlop LLP. In that response, Palomar disputed causation, asserting that the CVE-2023-0669 vulnerability was a zero-day exploit for which no patch was available at the time of initial exploitation (a contention that Calderwood & Harkness disputes based on available patching timeline evidence) and that Palomar's security posture was otherwise adequate. Palomar offered a goodwill credit of $1,500,000 against future service fees as a settlement of the indemnification claim. Calderwood & Harkness issued a detailed rebuttal letter on July 25, 2023, rejecting the goodwill credit offer, providing evidence that the GoAnywhere MFT patch was available prior to the March 14 exploitation event, and reiterating Quorum's demand for full indemnification. Negotiations between the parties are ongoing.
The interplay between the Palomar indemnification claim and the Atlas insurance recovery requires careful management. The following considerations are relevant:
Subrogation Rights. The Atlas policy contains standard subrogation provisions that entitle Atlas to step into Quorum's shoes and recover from any third party (including Palomar) amounts that Atlas has paid under the policy. Atlas has been informed of the Palomar indemnification claim and has indicated that it intends to assert subrogation rights to the extent it pays covered claims that are also recoverable from Palomar. Calderwood & Harkness is maintaining ongoing communication with Atlas regarding the status of the Palomar negotiations.
Avoidance of Double Recovery. Any recovery from Palomar must be coordinated with Atlas to ensure that Quorum does not recover the same dollar amount from both sources. If Palomar ultimately pays a settlement amount, a portion of that recovery may need to be applied against amounts paid by Atlas, or the settlement structure may need to allocate recovery among covered and non-covered costs in a manner that preserves Quorum's interests while respecting Atlas's subrogation rights.
Maximizing Quorum's Net Financial Position. Calderwood & Harkness's negotiation strategy with Palomar is designed to maximize Quorum's total recovery while preserving the cooperative claims relationship with Atlas. To the extent that Palomar pays amounts attributable to costs within the SIR (which are not recoverable from Atlas), such payments directly benefit Quorum without implicating Atlas's subrogation interests. Calderwood & Harkness is structuring the negotiation with this dynamic in mind.
Calderwood & Harkness will continue to keep Atlas informed of all material developments in the Palomar indemnification negotiations and will seek Atlas's input before finalizing any settlement with Palomar that could affect Atlas's subrogation interests.
VII. Status of Regulatory Engagements and Coverage Implications
Calderwood & Harkness is managing several parallel regulatory engagements arising from the Palomar data security incident. The costs associated with all of these regulatory engagements are covered as regulatory defense costs under the Atlas policy. A summary of each engagement and its current status follows.
A. Multistate Attorney General Inquiry
A coalition of 29 state attorneys general, led by the Connecticut Attorney General (Assistant Attorney General Diane Marchetti) and the New York Attorney General (Assistant Attorney General Mark Petrosian), has formed a multistate inquiry group to investigate the Palomar data security incident. The coalition issued a joint demand letter dated September 8, 2023, requesting detailed information regarding the incident, Quorum's vendor management practices, the nature and scope of the data compromise, and the steps taken by Quorum to remediate the incident and protect affected individuals. The demand letter also requests documentation regarding Quorum's contractual relationship with Palomar and the due diligence conducted by Quorum prior to engaging Palomar as a claims-processing vendor.
Calderwood & Harkness is preparing a comprehensive response to the multistate AG demand letter, which is due within 30 days of receipt. The costs of preparing this response—including Calderwood & Harkness's legal fees and associated costs for document collection, review, and response preparation—are covered as regulatory defense costs under the Atlas policy. Atlas has been informed of the multistate AG inquiry and has confirmed that regulatory defense costs associated with the inquiry are covered.
No enforcement action has been taken by any state attorney general to date, and no fines, penalties, or consent decrees have been proposed or assessed. The multistate inquiry remains at the investigative stage.
B. Connecticut Insurance Department
The Connecticut Insurance Department has been notified of the cybersecurity event, as required by applicable Connecticut insurance regulatory requirements. Richard Nakamura, an examiner in the Financial Analysis Division, Cybersecurity Unit, has been assigned to review the matter on behalf of the Department. Mr. Nakamura has made preliminary inquiries regarding the nature and scope of the incident, Quorum's cybersecurity program, and the steps taken to protect policyholder data.
Calderwood & Harkness is coordinating with Quorum's regulatory affairs team to respond to the Department's inquiries. Regulatory defense costs associated with the Connecticut Insurance Department engagement are covered under the Atlas policy.
C. HHS-OCR (HIPAA)
Because the incident involved the compromise of protected health information for 41,203 individuals, a breach notification was submitted to the U.S. Department of Health and Human Services, Office for Civil Rights (HHS-OCR), Region I (Boston), on August 15, 2023. The notification was submitted in accordance with the HIPAA Breach Notification Rule (45 C.F.R. §§ 164.400–164.414) and reported the unauthorized access to and exfiltration of PHI from Palomar's systems.
HHS-OCR has acknowledged receipt of the breach notification. To date, HHS-OCR has not initiated a formal investigation or compliance review, although such action remains possible given the magnitude of the breach. Any costs associated with responding to HHS-OCR inquiries or defending against an HHS-OCR investigation or enforcement action are covered as regulatory defense costs under the Atlas policy.
D. Assessment
No fines, penalties, or enforcement actions have been assessed or initiated by any regulator as of the date of this memorandum. Calderwood & Harkness believes that the likelihood of significant regulatory fines or penalties is manageable, given the vendor-originated nature of the breach, Quorum's prompt and comprehensive incident response, and Quorum's cooperation with regulatory authorities. However, the regulatory landscape remains dynamic, and Calderwood & Harkness will continue to monitor all regulatory engagements closely.
If any regulatory fines or penalties were to be assessed, coverage for such fines or penalties under the Atlas policy would depend on whether the specific fine or penalty at issue is "insurable" under the law of the applicable jurisdiction. Certain jurisdictions prohibit the insurance of punitive fines or penalties on public policy grounds, and any assessment would need to be evaluated on a case-by-case basis. Calderwood & Harkness would provide a supplemental coverage analysis if and when any fine or penalty is assessed.
VIII. Open Items and Recommendations
Based on the foregoing analysis, Calderwood & Harkness recommends the following actions and identifies the following open items for Quorum's attention:
A. Ongoing Coordination with Atlas Mutual
Calderwood & Harkness recommends that Quorum continue its proactive and cooperative approach to the Atlas claims relationship. Specifically, Calderwood & Harkness will continue to provide periodic status reports to claims adjuster Paul Enriquez regarding claim developments, the status of regulatory engagements, and updated cost projections. Maintaining a regular cadence of communication with Atlas is important to preserving a constructive claims relationship and ensuring that any potential coverage issues are identified and addressed promptly.
In addition, Calderwood & Harkness will submit interim proof of loss documentation and supporting cost records to Atlas for reimbursement of costs exceeding the $2,500,000 SIR as they are incurred. This will ensure that Quorum receives reimbursement on a timely basis rather than waiting until the conclusion of all incident response activities to submit a single, large reimbursement request.
B. Final Proof of Loss
Upon conclusion of the incident response—including the closure of all regulatory inquiries, the finalization of all vendor invoices, and the completion of all notification and credit monitoring obligations—Calderwood & Harkness will prepare and submit a final proof of loss and comprehensive cost summary to Atlas. The final proof of loss will include detailed documentation of all costs incurred, organized by covered cost category, together with supporting invoices, contracts, and other documentation as required by the policy.
C. Palomar Subrogation Coordination
Any settlement or recovery from Palomar Data Solutions must be coordinated with Atlas to address Atlas's subrogation rights under the policy. Calderwood & Harkness will keep Atlas informed of the status of the Palomar indemnification negotiations and will consult with Atlas before finalizing any settlement agreement with Palomar. The goal is to structure any Palomar recovery in a manner that respects Atlas's subrogation interests while maximizing Quorum's net financial position, including by allocating any Palomar recovery first to costs within the SIR (which are not subject to Atlas's subrogation rights) to the extent permissible.
D. Pinnacle Excess — No Action Required
No further action is required with respect to Pinnacle Surplus Lines Insurance Corp. at this time. Precautionary notice has been provided and acknowledged, and Pinnacle's file remains open. If circumstances materially change—for example, if regulatory fines, litigation costs, or other developments significantly increase the projected total costs such that the Atlas primary layer could be at risk of exhaustion—Calderwood & Harkness will promptly update Pinnacle and engage Lisa Garner to ensure that the excess layer is properly activated and that all notice and cooperation requirements are satisfied.
E. Monitoring for Potential Litigation
As of the date of this memorandum, no class action litigation, individual lawsuits, or regulatory enforcement actions have been filed against Quorum in connection with the Palomar data security incident. However, the consumer notification mailing window, which runs from approximately August 18, 2023, through September 15, 2023, creates a period of heightened risk for potential lawsuits. It is well-established in the data breach context that the filing of consumer class actions tends to occur in the weeks and months following the receipt of notification letters by affected individuals.
Calderwood & Harkness is monitoring public court filings and will promptly advise Quorum if any litigation is filed. If any litigation is filed, the Atlas policy provides coverage for defense costs and any resulting liabilities arising from the covered cyber event, and timely notice to Atlas would be required under the policy's claims notification provisions. Calderwood & Harkness would submit such notice immediately upon learning of any filed litigation.
IX. Conclusion
In summary, Quorum Insurance Holdings Corp.'s insurance coverage posture with respect to the Palomar Data Solutions security incident is favorable. Atlas Mutual Insurance Company has accepted coverage for all major categories of incident response costs in excess of the $2,500,000 self-insured retention, including forensic investigation costs, notification and credit monitoring costs, crisis communications costs, and regulatory defense costs. The estimated covered amount of $5,730,250 is well within the $15,000,000 per-occurrence limit of the Atlas primary policy, representing approximately 38.2% of the available primary coverage. There is no current risk of exhausting the primary layer, and the Pinnacle Surplus Lines excess layer is unlikely to be implicated under current cost projections.
Calderwood & Harkness will continue to manage the insurance claims process on Quorum's behalf, including ongoing coordination with Atlas claims adjuster Paul Enriquez, management of the Palomar indemnification negotiations in coordination with Atlas's subrogation interests, and oversight of all regulatory engagements and associated defense costs. Upon the conclusion of all incident response activities, Calderwood & Harkness will prepare and submit a final proof of loss to Atlas for full and final reimbursement of all covered costs.
Rachel Bernstein remains available at any time to discuss questions regarding coverage, insurance coordination, the Palomar indemnification claim, or any other aspect of this matter. Please do not hesitate to reach out directly.
Respectfully submitted,
CALDERWOOD & HARKNESS LLP
By: ________
Rachel Bernstein Partner, Privacy & Data Security 51 West 52nd Street, 34th Floor New York, NY 10019 Tel: (212) 555-4800
Email: rbernstein@calderwoodharkness.com
PRIVILEGED AND CONFIDENTIAL — ATTORNEY-CLIENT COMMUNICATION — ATTORNEY WORK PRODUCT
This memorandum is a privileged and confidential attorney-client communication and constitutes attorney work product prepared in anticipation of litigation and in furtherance of the provision of legal advice. This memorandum is intended solely for the use of the addressee and authorized recipients identified herein. Any unauthorized review, use, disclosure, or distribution is prohibited. If you have received this memorandum in error, please contact Calderwood & Harkness LLP immediately at (212) 555-4800.
Element | Detail
Insurer | Atlas Mutual Insurance Company, 120 South LaSalle Street, Suite 3200, Chicago, IL 60603
Policy Number | CYB-2023-041587
Coverage Period | January 1, 2023 – January 1, 2024
Per-Occurrence Limit | $15,000,000
Aggregate Limit | $15,000,000
Self-Insured Retention (SIR) | $2,500,000 per occurrence
Claims Adjuster | Paul Enriquez
Element | Detail
Insurer | Pinnacle Surplus Lines Insurance Corp., One Beacon Street, Suite 1100, Boston, MA 02108
Policy Number | XS-CYB-2023-7812
Coverage Period | January 1, 2023 – January 1, 2024
Limit | $25,000,000 excess of $15,000,000
Total Tower Limit | $40,000,000 (combined primary and excess)
Terms | Follow-form to Atlas Mutual primary policy terms and conditions
Claims Contact | Lisa Garner
Cost Category | Vendor / Provider | Estimated Amount
Forensic Investigation | Graystone Forensics LLC | $1,847,000
Notification Services (subtotal) | Clearfield Notification Services LLC | $3,214,500
— Notification printing/mailing (318,247 individuals) | Clearfield | $636,000
— Call center operations (12-week window) | Clearfield | $478,500
— Credit monitoring (24-month, negotiated flat fee, ~40% take-rate / ~127,299 enrollees) | Clearfield | $2,100,000
Crisis Communications / Public Relations | BrightPath Consulting Group Inc. | $385,000
Legal Fees | Calderwood & Harkness LLP | $2,163,750
Internal Costs (IT remediation, employee overtime, etc.) | Quorum (internal) | $620,000 (est.)
Total Estimated Incident Response Costs | $8,230,250
Attorney | Billing Rate
Kevin Ostrowski, Partner | $1,250/hr
Rachel Bernstein, Partner | $1,175/hr
Alan Burke, Associate | $825/hr
Sarah Hendricks, Associate | $650/hr

PRIVILEGED AND CONFIDENTIAL — ATTORNEY-CLIENT COMMUNICATION — ATTORNEY WORK PRODUCT — DO NOT DISTRIBUTE

MEMORANDUM

C. HHS-OCR (HIPAA)

CALDERWOOD & HARKNESS LLP

Record

Parties

Dates

Amounts