1025-00006 · Graystone Forensics LLC · Insurance Coverage

notice-of-claim-atlas.docx DOCUMENT Data Privacy

45 / 88 ← → ✕

Contract analysis Extract to table

CALDERWOOD & HARKNESS LLP Attorneys at Law

1700 K Street NW, Suite 900 Washington, D.C. 20006

Privacy & Data Security Practice Group

Telephone: (202) 555-7400 Facsimile: (202) 555-7401 www.calderwoodharkness.com

May 8, 2023

VIA Sundial Data Systems (OVERNIGHT) AND EMAIL (paul.enriquez@atlasmutual.com)

Mr. Paul Enriquez Claims Adjuster Atlas Mutual Insurance Company 120 South LaSalle Street, Suite 3200 Chicago, IL 60603

Re: Notice of Claim Under Cyber-Liability Insurance Policy Policy No.: CYB-2023-041587 Insured: Quorum Insurance Holdings Corp. Policy Period: January 1, 2023 – January 1, 2024 Claim No.: CYB-CLM-2023-05892

Dear Mr. Enriquez:

1. Introduction and Purpose of Notice

Calderwood & Harkness LLP serves as outside counsel to Quorum Insurance Holdings Corp. ("Quorum" or the "Insured"), a Delaware corporation publicly traded on the Nasdaq Global Select Market under the ticker symbol QIHC, with its principal executive offices located at 400 Constitution Plaza, Suite 2200, Hartford, CT 06103 (EIN: 06-4832197). We write on behalf of Quorum in connection with a significant cybersecurity incident affecting the personal information of Quorum policyholders and claimants, as described in detail below.

This letter constitutes formal notice of a claim or potential claim under the cyber-liability insurance policy (the "Policy") issued by Atlas Mutual Insurance Company ("Atlas Mutual") to Quorum, bearing Policy No. CYB-2023-041587, with a coverage period of January 1, 2023, through January 1, 2024. This notice is being provided promptly in accordance with the notice provisions set forth in the Policy, including without limitation Section IV(A) thereof, and is intended to preserve Quorum's rights to coverage for all losses, costs, and expenses arising from or related to the security incident described herein.

Calderwood & Harkness was formally engaged by Quorum on May 4, 2023 (Calderwood & Harkness Matter No. 1025-00006), to coordinate incident response, including the forensic investigation, regulatory notification compliance, regulatory defense, and vendor accountability arising from this incident. This notice follows promptly upon our engagement and initial assessment of the circumstances giving rise to this claim.

We note for Atlas Mutual's records that Quorum's cyber-insurance program was placed by Whitmore Risk Advisors Inc. (Sandra Whitmore-Kim, Lead Broker), which has been separately notified of this claim. Ms. Whitmore-Kim is available to coordinate any broker-related communications that Atlas Mutual may require.

2. Policy Summary

For ease of reference and to ensure completeness of the record, we summarize below the key terms of the Policy that are relevant to this notice of claim:

Based on the nature of the security incident described below, Quorum believes that several categories of coverage afforded by the Policy are implicated, including without limitation: (a) first-party forensic investigation costs; (b) notification costs; (c) credit monitoring and identity theft protection services; (d) crisis communications expenses; (e) regulatory defense costs; and (f) regulatory fines and penalties, to the extent insurable by applicable law.

Quorum additionally notes that excess coverage sits above this primary layer. Specifically, Pinnacle Surplus Lines Insurance Corp. has issued Excess Policy No. XS-CYB-2023-7812, providing $25,000,000 in excess coverage above the $15,000,000 Atlas Mutual primary layer, on a follow-form basis. Precautionary notice of this claim is being provided separately to Pinnacle Surplus Lines Insurance Corp. in accordance with the notice requirements of that excess policy, as discussed further in Section 9 of this letter.

3. Description of the Security Incident

3.1 Background on Quorum and the Palomar Vendor Relationship

By way of background, Quorum is a top-25 U.S. insurance holding company with operations spanning all fifty states, the District of Columbia, and Puerto Rico. Quorum offers a diversified product portfolio encompassing personal lines insurance (including homeowners, automobile, and umbrella coverages), commercial lines insurance, specialty insurance products, and a proprietary digital underwriting platform known as QuorumEdge. For fiscal year 2022, Quorum reported annual revenue of approximately $4.82 billion. The company employs approximately 11,400 individuals across its corporate headquarters, regional offices, and field operations.

In support of its personal lines division, Quorum outsources certain claims data processing functions to Palomar Data Solutions, Inc. ("Palomar"), a Texas corporation headquartered at 7100 Greenville Avenue, Suite 450, Dallas, TX 75231. The relationship between Quorum and Palomar is governed by a Master Services Agreement dated November 12, 2019, as subsequently amended (the "MSA"). The annual contract value under the MSA, as most recently amended, is approximately $16.3 million. In its capacity as a claims-processing vendor, Palomar processes significant volumes of personally identifiable information belonging to Quorum policyholders and claimants, including structured data files containing names, Social Security numbers, financial information, and, in certain instances, protected health information derived from workers' compensation and health-related insurance claims.

The security incident giving rise to this notice of claim originated within Palomar's information technology environment. Quorum's own network infrastructure and information systems were not directly compromised as a result of this incident.

3.2 Initial Unauthorized Access

On or about March 14, 2023, a threat actor gained unauthorized access to Palomar's network by exploiting a known remote code execution vulnerability, catalogued as CVE-2023-0669, in Palomar's GoAnywhere MFT (Managed File Transfer) appliance. The GoAnywhere MFT platform is a widely used enterprise file transfer solution; CVE-2023-0669 is a critical pre-authentication remote code execution vulnerability that was publicly disclosed and for which a vendor-issued patch had been made available prior to the date of exploitation. Based on information received to date from Palomar, Palomar had not yet applied the available security patch to its GoAnywhere MFT appliance at the time the threat actor exploited the vulnerability.

It is important to emphasize that this unauthorized access originated entirely within Palomar's network environment. At no point, based on the information currently available, did the threat actor gain access to Quorum's own network, systems, or infrastructure. Rather, the threat actor accessed Quorum policyholder and claimant data that had been entrusted to Palomar for processing under the MSA and that resided within Palomar's claims processing environment.

3.3 Lateral Movement and Data Exfiltration

Following the initial point of compromise on or about March 14, 2023, the threat actor engaged in lateral movement within Palomar's internal network. The threat actor identified and accessed servers and data repositories within Palomar's claims processing environment that contained structured data files belonging to Quorum. The threat actor staged data for exfiltration using techniques that are still being analyzed as part of the ongoing forensic investigation.

The exfiltration window — that is, the period during which unauthorized data transfers are believed to have occurred — extended from approximately March 14, 2023, through April 18, 2023, a period of approximately thirty-five (35) days. Based on information received to date from Palomar, structured data files containing Quorum policyholder and claimant information were exfiltrated from Palomar's claims processing environment during this window. The full volume and precise content of the exfiltrated data remain subject to confirmation through the ongoing forensic investigation.

3.4 discovery and Notification to Quorum

On April 18, 2023, Palomar's security operations center ("SOC") detected anomalous outbound data transfers from its network, which led to Palomar's internal discovery of the security incident. This detection marked the end of the approximately thirty-five-day exfiltration window. Palomar immediately initiated its own internal investigation and engaged its own forensic consultants.

On April 21, 2023, Palomar's General Counsel, Derek Copeland, notified Quorum's General Counsel, Thomas R. Whitfield, and Quorum's Chief Information Security Officer, David Naranjo, of the security incident via email. This notification included a preliminary description of the nature of the compromise and an initial assessment that Quorum policyholder and claimant data may have been among the data exfiltrated.

We note for Atlas Mutual's awareness that Palomar's notification to Quorum on April 21, 2023 — approximately three (3) calendar days after Palomar's internal discovery on April 18, 2023 — was approximately twenty-four (24) hours late relative to the forty-eight (48) hour contractual notification window set forth in Section 9.4 of the MSA. Quorum expressly reserves its rights against Palomar with respect to this delayed notification, as well as with respect to all other obligations and representations set forth in the MSA.

3.5 Quorum's Immediate Response Actions

Upon receiving notification from Palomar on April 21, 2023, Quorum immediately activated its internal incident response plan. Quorum's incident response team was convened, consisting of the following senior personnel: Thomas R. Whitfield, Executive Vice President and General Counsel; David Naranjo, Chief Information Security Officer; Jennifer Liang, Chief Privacy Officer; Priya Deshmukh, Vice President of Vendor Risk Management; and Robert Wentworth, Senior Vice President of Claims Operations. The incident response team commenced an assessment of Quorum's exposure, initiated communications with Palomar to obtain additional details regarding the scope and nature of the compromise, and began evaluating Quorum's notification obligations under applicable federal and state law.

On May 4, 2023, Quorum formally engaged Calderwood & Harkness LLP to serve as outside breach response counsel. Calderwood & Harkness has assumed responsibility for coordinating the forensic investigation (under the attorney-client privilege and work product doctrine), advising Quorum on notification compliance across all applicable jurisdictions, preparing for anticipated regulatory inquiries, and evaluating Quorum's rights against Palomar under the MSA.

On May 5, 2023, at the direction of Calderwood & Harkness and under the attorney-client privilege umbrella, Quorum retained Graystone Forensics LLC ("Graystone"), a specialized digital forensics and incident response firm headquartered in Tysons Corner, Virginia. The Graystone engagement is being led by Dr. Nolan Briggs, Managing Director of Incident Response, and Kendra Faulkner, Senior Forensic Analyst. Graystone has been tasked with conducting a thorough technical forensic investigation to determine the scope and nature of the compromise, identify the threat actor's methods and tools, confirm the categories and volume of data exfiltrated, and identify all affected individuals.

Additionally, Quorum has engaged BrightPath Consulting Group Inc. ("BrightPath") (Meredith Ashford, Managing Director) to provide crisis communications and public relations support. BrightPath is assisting Quorum with the development of external and internal communications strategies, including preparation of potential press statements, employee communications, and investor-facing disclosures as may become necessary.

4. Preliminary Assessment of Compromised Data

The forensic investigation being conducted by Graystone Forensics is in its early stages. However, based on information available to date — including information received from Palomar, Palomar's own preliminary forensic findings, and Graystone's initial review of available indicators — the security incident potentially compromised the personally identifiable information of Quorum policyholders and claimants across multiple states.

The categories of data potentially compromised in the incident include the following:

• Personally Identifiable Information (PII): Full names, dates of birth, Social Security numbers, and driver's license numbers of Quorum policyholders and claimants whose data was processed by Palomar.

• Financial Information: Bank account numbers and, for a subset of affected individuals, payment card numbers associated with premium payment records and claims disbursement files.

• Protected Health Information (PHI): Health conditions, medical diagnosis codes (ICD-10), and treatment information derived from workers' compensation claims and health-related insurance claims processed by Palomar on behalf of Quorum. This category of data is subject to the Health Insurance Portability and Accountability Act of 1996 ("HIPAA") and applicable state health privacy laws, and triggers additional notification obligations to the U.S. Department of Health and Human Services, Office for Civil Rights.

Preliminary indications suggest that the number of affected individuals may be substantial — potentially in the hundreds of thousands — and that affected individuals are likely to span multiple states, given the nationwide scope of Quorum's personal lines operations. However, until the forensic investigation and data mining phases are complete, it is not possible to determine with precision the exact number of affected individuals or the full geographic distribution of affected persons.

Graystone Forensics has been tasked with providing preliminary findings regarding the scope of the compromise by early June 2023. A final forensic report, including a definitive identification of all affected data elements and individuals, is anticipated by mid-July 2023. Quorum will promptly update Atlas Mutual with the results of these findings as they become available.

5. Anticipated Categories of Loss and Expense

Based on the nature and anticipated scope of the security incident, Quorum expects to incur significant costs and expenses across the following categories. Quorum believes that each of these categories of loss and expense falls within the coverage afforded by the Policy and hereby provides notice of its intent to seek coverage for the same.

5.1 Forensic Investigation Costs

Quorum will incur fees and expenses payable to Graystone Forensics LLC for the technical forensic investigation of the security incident, including the identification of the threat actor's methods of access, the scope and duration of the unauthorized access, the nature and volume of exfiltrated data, and the identification of all affected individuals. Graystone was retained at the direction of, and under the supervision of, Calderwood & Harkness for purposes of preserving the attorney-client privilege and work product protections with respect to the forensic investigation and its findings. Quorum will also incur costs associated with specialized data mining services necessary to identify the specific individuals whose personal information was compromised, including the matching of exfiltrated data elements to individual records.

5.2 Consumer Notification Costs

Quorum anticipates incurring substantial costs associated with the preparation, printing, mailing, and postage of individual consumer notification letters to all affected individuals across all applicable jurisdictions. Quorum is currently subject to data breach notification statutes in all fifty states, the District of Columbia, Guam, Puerto Rico, and the U.S. Virgin Islands, as well as federal notification obligations under HIPAA with respect to the subset of affected individuals whose PHI was compromised. Depending on the final scope of affected individuals, the notification process may involve hundreds of thousands of individual letters, each of which must be tailored to comply with the specific content and formatting requirements of the applicable state notification statute.

Quorum anticipates retaining a specialized notification vendor to manage the large-scale notification process. Discussions are currently underway with Clearfield Notification Services LLC, based in Independence, Ohio, which specializes in high-volume data breach notification fulfillment. Quorum will seek Atlas Mutual's consent or confirmation regarding this vendor selection to the extent required by the Policy's pre-approval or panel vendor provisions.

5.3 Credit Monitoring and Identity Theft Protection

Given the nature of the compromised data — which includes Social Security numbers, financial account information, and other highly sensitive identifiers — Quorum anticipates enrolling all affected individuals in complimentary credit monitoring and identity theft protection services. Quorum currently plans to offer a twenty-four (24) month enrollment period for credit monitoring and identity theft protection to all affected individuals, which Quorum believes is consistent with industry standards and regulatory expectations for incidents of this nature and scope. The costs of procuring and administering these services for potentially hundreds of thousands of individuals are expected to be significant.

5.4 Call Center Operations

Quorum will incur costs associated with the establishment and operation of a dedicated toll-free call center to respond to inquiries from affected individuals during and after the notification window. The call center will be staffed by trained agents capable of answering questions regarding the nature of the incident, the types of information compromised, the credit monitoring and identity theft protection services being offered, and the steps affected individuals can take to protect themselves. Based on the anticipated volume of affected individuals, Quorum expects the call center to remain operational for a period of at least ninety (90) days following the mailing of notification letters, and potentially longer depending on the volume of inquiries received.

5.5 Crisis Communications and Public Relations

Quorum will incur fees and expenses payable to BrightPath Consulting Group Inc. for crisis communications and public relations support. BrightPath's scope of work includes the development and execution of an external communications strategy, preparation of press statements, media monitoring, employee communications, and investor-facing disclosures. As a publicly traded company, Quorum has heightened disclosure obligations under the federal securities laws, including potential obligations to disclose the incident in periodic filings with the U.S. Securities and Exchange Commission. BrightPath's assistance is critical to ensuring that Quorum's public communications are accurate, measured, and consistent.

5.6 Legal Fees and Expenses

Quorum will incur fees and expenses payable to Calderwood & Harkness LLP for legal services rendered in connection with the incident response, including without limitation: coordination of the forensic investigation; analysis of notification obligations under the data breach notification statutes of all fifty states, the District of Columbia, and applicable territories; preparation and filing of regulatory notifications (including notifications to state attorneys general, the Connecticut Insurance Department, and HHS-OCR); preparation for and response to anticipated regulatory inquiries and investigations; and evaluation and pursuit of Quorum's contractual rights and remedies against Palomar under the MSA.

5.7 Regulatory Defense Costs

Quorum anticipates incurring costs associated with preparing for and responding to inquiries, investigations, or enforcement actions from state attorneys general, the Connecticut Insurance Department (Quorum's domestic insurance regulator), and the U.S. Department of Health and Human Services, Office for Civil Rights (HHS-OCR) with respect to the HIPAA breach notification. Given the multi-state scope of the potentially affected individual population — encompassing policyholders and claimants in all or substantially all of the fifty states — Quorum anticipates the possibility of multistate regulatory inquiries coordinated through the National Association of Attorneys General or similar multistate mechanisms. Regulatory defense costs, including legal fees, document collection and production costs, and related expenses, may be substantial depending on the scope and nature of any regulatory proceedings.

5.8 Regulatory Fines and Penalties (If Any, Where Insurable)

While Quorum intends to comply fully and in good faith with all applicable notification statutes and regulations, and while Quorum is taking all reasonable steps to mitigate harm to affected individuals, Quorum cannot rule out the possibility that one or more regulatory bodies may seek to impose fines, penalties, or other assessments in connection with the incident. To the extent that any such fines or penalties are assessed, Quorum reserves its rights under the Policy with respect to coverage for such amounts, to the extent that coverage for regulatory fines and penalties is afforded by the Policy and is insurable under applicable law.

5.9 Preliminary Cost Estimates

It is premature to provide definitive cost estimates at this early stage of the investigation and response process. The total costs incurred by Quorum in connection with this incident will depend on several variables that are not yet fully known, including the final number of affected individuals, the number of states in which notification is required, the extent of any regulatory inquiries or proceedings, and the duration of call center and credit monitoring operations.

However, based on the anticipated scope of the incident — potentially involving hundreds of thousands of affected individuals across multiple states, with compromised data including Social Security numbers, financial information, and protected health information — Quorum's total incident response costs may approach or exceed the $2,500,000 Self-Insured Retention, thereby potentially implicating the primary policy layer. Quorum will provide Atlas Mutual with updated cost estimates as the investigation progresses and as the scope of affected individuals is confirmed through the forensic investigation and data mining processes.

6. Reservation of Rights

By providing this notice of claim, Quorum expressly reserves all of its rights, remedies, and defenses under the Policy, at law, and in equity. Without limiting the generality of the foregoing, Quorum specifically reserves the following:

(a) The right to seek coverage under the Policy for all categories of loss, cost, and expense arising from or related to the security incident described in this letter, including all categories of loss and expense identified in Section 5 above and any additional categories of loss or expense that may arise as the investigation and response process continues.

(b) The right to supplement this notice of claim with additional information, facts, and circumstances as the forensic investigation progresses and the scope and nature of the incident are further defined and clarified.

(c) The right to assert coverage under the Policy for any additional categories of loss, cost, or expense not specifically enumerated in this letter that may arise from or relate to the security incident, including without limitation any third-party claims, litigation, or demands that may be asserted against Quorum by affected individuals, classes of affected individuals, or other third parties.

(d) All rights, remedies, and defenses available to Quorum under the Policy, applicable state insurance law, and general principles of contract law and equity.

Nothing in this notice of claim shall be construed as a waiver, release, or limitation of any rights, claims, or defenses available to Quorum under the Policy or applicable law. Quorum's provision of this notice shall not be construed as an admission of liability or fault on the part of Quorum with respect to the security incident, which originated within the information technology environment of Quorum's third-party vendor, Palomar Data Solutions, Inc.

Quorum also expressly reserves all rights, remedies, and claims against Palomar Data Solutions, Inc. under the Master Services Agreement, including without limitation indemnification rights set forth in Section 12.2 of the MSA. Section 12.2 of the MSA provides for indemnification by Palomar for losses arising from a breach of Palomar's data security obligations, subject to a liability cap equal to two times (2×) the trailing twelve-month fees paid under the MSA, or approximately $32,600,000. Any recovery by Quorum from Palomar will be coordinated with Atlas Mutual in accordance with applicable policy provisions concerning subrogation, reimbursement, and other insurance, and Quorum will keep Atlas Mutual informed of developments in its pursuit of contractual remedies against Palomar.

7. Requests to Atlas Mutual

In connection with this notice of claim, Quorum respectfully requests the following from Atlas Mutual:

1. Acknowledgment of Receipt. Written acknowledgment of Atlas Mutual's receipt of this notice of claim, including confirmation of the date on which this notice was received and entered into Atlas Mutual's claims management system.

2. Claim Number Assignment. Assignment of a claim number to this matter, if one has not already been assigned. Quorum understands, based on preliminary communications through its broker, that this claim may be designated CYB-CLM-2023-05892. Quorum requests confirmation of the assigned claim number for tracking and correspondence purposes.

3. Confirmation of Claims Processing. Confirmation that Atlas Mutual will process this claim under Policy No. CYB-2023-041587, and identification of the claims adjuster and any other Atlas Mutual personnel who will be responsible for handling this claim going forward.

4. Panel and Pre-Approval Requirements. Identification of any panel counsel requirements, pre-approved vendor lists, consent requirements, or other pre-approval procedures under the Policy that Atlas Mutual wishes Quorum to observe in connection with the retention of legal counsel, forensic investigators, notification vendors, credit monitoring providers, call center operators, or crisis communications consultants. Quorum is committed to complying promptly with any such requirements and requests that Atlas Mutual communicate them at the earliest opportunity so as not to delay the incident response process.

5. Documentation Requirements. Identification of any documentation, forms, sworn proof of loss, or other information that Atlas Mutual requires from Quorum at this stage to facilitate the claims process.

Quorum is committed to cooperating fully with Atlas Mutual throughout the claims process. Quorum will provide periodic updates on the status of the forensic investigation, the identification of affected individuals, notification activities, regulatory developments, and costs incurred. Quorum will also make available its incident response team members, outside counsel, and forensic investigators for discussions with Atlas Mutual as reasonably requested.

8. Contact Information

All communications regarding this claim should be directed to the following individuals:

Primary Contact — Outside Counsel:

Kevin Ostrowski, Partner Privacy & Data Security Practice Group Calderwood & Harkness LLP 1700 K Street NW, Suite 900 Washington, D.C. 20006 Telephone: (202) 555-7418

Email: kostrowski@calderwoodharkness.com

Billing Contact — Outside Counsel:

Rachel Bernstein, Partner Calderwood & Harkness LLP 51 West 52nd Street, 34th Floor New York, NY 10019 Telephone: (212) 555-3200

Email: rbernstein@calderwoodharkness.com

With copies to:

Thomas R. Whitfield, Executive Vice President and General Counsel Quorum Insurance Holdings Corp. 400 Constitution Plaza, Suite 2200 Hartford, CT 06103 Telephone: (860) 555-9100

Email: twhitfield@quorumholdings.com

Sandra Whitmore-Kim, Lead Broker Whitmore Risk Advisors Inc. 390 Park Avenue, 18th Floor New York, NY 10022 Telephone: (212) 555-6700

Email: swhitmore-kim@whitmoreadvisors.com

9. Excess Carrier Notice

As noted in Section 2 above, Quorum maintains excess cyber-liability coverage above the Atlas Mutual primary layer. Quorum is providing separate precautionary notice of this claim to its excess cyber-liability insurer, Pinnacle Surplus Lines Insurance Corp. (Attention: Lisa Garner, Claims Department), under Excess Policy No. XS-CYB-2023-7812. That excess policy provides $25,000,000 in coverage in excess of the $15,000,000 Atlas Mutual primary layer, on a follow-form basis.

Based on current preliminary estimates and the early stage of the investigation, Quorum does not presently anticipate that total incident response costs and losses will exceed the $15,000,000 primary policy limit. However, given the potentially large number of affected individuals and the multi-state scope of the incident, Quorum is providing notice to Pinnacle out of an abundance of caution and in compliance with the excess policy's notice provisions. Quorum will keep both Atlas Mutual and Pinnacle apprised of any developments that may affect the likelihood of the claim reaching the excess layer.

10. Closing

Calderwood & Harkness reserves the right to supplement this notice of claim as additional facts, circumstances, and information become available through the ongoing forensic investigation and response process. This notice is not intended to be, and should not be construed as, a comprehensive or final statement of all facts, claims, or losses arising from the security incident. Quorum's understanding of the scope and impact of the incident continues to evolve, and additional categories of loss, additional affected individuals, or additional regulatory developments may emerge as the investigation progresses.

Quorum looks forward to Atlas Mutual's prompt acknowledgment of this notice and to Atlas Mutual's full cooperation in processing this claim in a timely and fair manner. Quorum values its relationship with Atlas Mutual and is confident that the parties can work together constructively to address this matter.

We thank you for your prompt attention to this notice of claim. Please do not hesitate to contact the undersigned directly if you have any questions or require any additional information at this time.

Respectfully submitted,

CALDERWOOD & HARKNESS LLP

By: ________

Kevin Ostrowski Partner, Privacy & Data Security Calderwood & Harkness LLP 1700 K Street NW, Suite 900 Washington, D.C. 20006 Telephone: (202) 555-7418

Email: kostrowski@calderwoodharkness.com

Enclosures: None. A copy of the Policy is on file with both parties and is not enclosed herewith. Quorum will provide supporting documentation, including forensic reports, cost summaries, and notification materials, as the investigation progresses and such materials become available.

cc:

Thomas R. Whitfield, Executive Vice President and General Counsel, Quorum Insurance Holdings Corp. Jennifer Liang, Chief Privacy Officer, Quorum Insurance Holdings Corp. David Naranjo, Chief Information Security Officer, Quorum Insurance Holdings Corp. Sandra Whitmore-Kim, Lead Broker, Whitmore Risk Advisors Inc. Rachel Bernstein, Partner, Calderwood & Harkness LLP

Term	Detail
Insurer	Atlas Mutual Insurance Company
Policy Number	CYB-2023-041587
Policy Period	January 1, 2023 – January 1, 2024
Per-Occurrence Limit of Liability	$15,000,000
Aggregate Limit of Liability	$15,000,000
Self-Insured Retention (SIR)	$2,500,000

CALDERWOOD & HARKNESS LLP Attorneys at Law
1700 K Street NW, Suite 900 Washington, D.C. 20006
Privacy & Data Security Practice Group
Telephone: (202) 555-7400 Facsimile: (202) 555-7401 www.calderwoodharkness.com
May 8, 2023
VIA Sundial Data Systems (OVERNIGHT) AND EMAIL (paul.enriquez@atlasmutual.com)
Mr. Paul Enriquez Claims Adjuster Atlas Mutual Insurance Company 120 South LaSalle Street, Suite 3200 Chicago, IL 60603
Re: Notice of Claim Under Cyber-Liability Insurance Policy Policy No.: CYB-2023-041587 Insured: Quorum Insurance Holdings Corp. Policy Period: January 1, 2023 – January 1, 2024 Claim No.: CYB-CLM-2023-05892
Dear Mr. Enriquez:
1. Introduction and Purpose of Notice
Calderwood & Harkness LLP serves as outside counsel to Quorum Insurance Holdings Corp. ("Quorum" or the "Insured"), a Delaware corporation publicly traded on the Nasdaq Global Select Market under the ticker symbol QIHC, with its principal executive offices located at 400 Constitution Plaza, Suite 2200, Hartford, CT 06103 (EIN: 06-4832197). We write on behalf of Quorum in connection with a significant cybersecurity incident affecting the personal information of Quorum policyholders and claimants, as described in detail below.
This letter constitutes formal notice of a claim or potential claim under the cyber-liability insurance policy (the "Policy") issued by Atlas Mutual Insurance Company ("Atlas Mutual") to Quorum, bearing Policy No. CYB-2023-041587, with a coverage period of January 1, 2023, through January 1, 2024. This notice is being provided promptly in accordance with the notice provisions set forth in the Policy, including without limitation Section IV(A) thereof, and is intended to preserve Quorum's rights to coverage for all losses, costs, and expenses arising from or related to the security incident described herein.
Calderwood & Harkness was formally engaged by Quorum on May 4, 2023 (Calderwood & Harkness Matter No. 1025-00006), to coordinate incident response, including the forensic investigation, regulatory notification compliance, regulatory defense, and vendor accountability arising from this incident. This notice follows promptly upon our engagement and initial assessment of the circumstances giving rise to this claim.
We note for Atlas Mutual's records that Quorum's cyber-insurance program was placed by Whitmore Risk Advisors Inc. (Sandra Whitmore-Kim, Lead Broker), which has been separately notified of this claim. Ms. Whitmore-Kim is available to coordinate any broker-related communications that Atlas Mutual may require.
2. Policy Summary
For ease of reference and to ensure completeness of the record, we summarize below the key terms of the Policy that are relevant to this notice of claim:
Based on the nature of the security incident described below, Quorum believes that several categories of coverage afforded by the Policy are implicated, including without limitation: (a) first-party forensic investigation costs; (b) notification costs; (c) credit monitoring and identity theft protection services; (d) crisis communications expenses; (e) regulatory defense costs; and (f) regulatory fines and penalties, to the extent insurable by applicable law.
Quorum additionally notes that excess coverage sits above this primary layer. Specifically, Pinnacle Surplus Lines Insurance Corp. has issued Excess Policy No. XS-CYB-2023-7812, providing $25,000,000 in excess coverage above the $15,000,000 Atlas Mutual primary layer, on a follow-form basis. Precautionary notice of this claim is being provided separately to Pinnacle Surplus Lines Insurance Corp. in accordance with the notice requirements of that excess policy, as discussed further in Section 9 of this letter.
3. Description of the Security Incident
3.1 Background on Quorum and the Palomar Vendor Relationship
By way of background, Quorum is a top-25 U.S. insurance holding company with operations spanning all fifty states, the District of Columbia, and Puerto Rico. Quorum offers a diversified product portfolio encompassing personal lines insurance (including homeowners, automobile, and umbrella coverages), commercial lines insurance, specialty insurance products, and a proprietary digital underwriting platform known as QuorumEdge. For fiscal year 2022, Quorum reported annual revenue of approximately $4.82 billion. The company employs approximately 11,400 individuals across its corporate headquarters, regional offices, and field operations.
In support of its personal lines division, Quorum outsources certain claims data processing functions to Palomar Data Solutions, Inc. ("Palomar"), a Texas corporation headquartered at 7100 Greenville Avenue, Suite 450, Dallas, TX 75231. The relationship between Quorum and Palomar is governed by a Master Services Agreement dated November 12, 2019, as subsequently amended (the "MSA"). The annual contract value under the MSA, as most recently amended, is approximately $16.3 million. In its capacity as a claims-processing vendor, Palomar processes significant volumes of personally identifiable information belonging to Quorum policyholders and claimants, including structured data files containing names, Social Security numbers, financial information, and, in certain instances, protected health information derived from workers' compensation and health-related insurance claims.
The security incident giving rise to this notice of claim originated within Palomar's information technology environment. Quorum's own network infrastructure and information systems were not directly compromised as a result of this incident.
3.2 Initial Unauthorized Access
On or about March 14, 2023, a threat actor gained unauthorized access to Palomar's network by exploiting a known remote code execution vulnerability, catalogued as CVE-2023-0669, in Palomar's GoAnywhere MFT (Managed File Transfer) appliance. The GoAnywhere MFT platform is a widely used enterprise file transfer solution; CVE-2023-0669 is a critical pre-authentication remote code execution vulnerability that was publicly disclosed and for which a vendor-issued patch had been made available prior to the date of exploitation. Based on information received to date from Palomar, Palomar had not yet applied the available security patch to its GoAnywhere MFT appliance at the time the threat actor exploited the vulnerability.
It is important to emphasize that this unauthorized access originated entirely within Palomar's network environment. At no point, based on the information currently available, did the threat actor gain access to Quorum's own network, systems, or infrastructure. Rather, the threat actor accessed Quorum policyholder and claimant data that had been entrusted to Palomar for processing under the MSA and that resided within Palomar's claims processing environment.
3.3 Lateral Movement and Data Exfiltration
Following the initial point of compromise on or about March 14, 2023, the threat actor engaged in lateral movement within Palomar's internal network. The threat actor identified and accessed servers and data repositories within Palomar's claims processing environment that contained structured data files belonging to Quorum. The threat actor staged data for exfiltration using techniques that are still being analyzed as part of the ongoing forensic investigation.
The exfiltration window — that is, the period during which unauthorized data transfers are believed to have occurred — extended from approximately March 14, 2023, through April 18, 2023, a period of approximately thirty-five (35) days. Based on information received to date from Palomar, structured data files containing Quorum policyholder and claimant information were exfiltrated from Palomar's claims processing environment during this window. The full volume and precise content of the exfiltrated data remain subject to confirmation through the ongoing forensic investigation.
3.4 discovery and Notification to Quorum
On April 18, 2023, Palomar's security operations center ("SOC") detected anomalous outbound data transfers from its network, which led to Palomar's internal discovery of the security incident. This detection marked the end of the approximately thirty-five-day exfiltration window. Palomar immediately initiated its own internal investigation and engaged its own forensic consultants.
On April 21, 2023, Palomar's General Counsel, Derek Copeland, notified Quorum's General Counsel, Thomas R. Whitfield, and Quorum's Chief Information Security Officer, David Naranjo, of the security incident via email. This notification included a preliminary description of the nature of the compromise and an initial assessment that Quorum policyholder and claimant data may have been among the data exfiltrated.
We note for Atlas Mutual's awareness that Palomar's notification to Quorum on April 21, 2023 — approximately three (3) calendar days after Palomar's internal discovery on April 18, 2023 — was approximately twenty-four (24) hours late relative to the forty-eight (48) hour contractual notification window set forth in Section 9.4 of the MSA. Quorum expressly reserves its rights against Palomar with respect to this delayed notification, as well as with respect to all other obligations and representations set forth in the MSA.
3.5 Quorum's Immediate Response Actions
Upon receiving notification from Palomar on April 21, 2023, Quorum immediately activated its internal incident response plan. Quorum's incident response team was convened, consisting of the following senior personnel: Thomas R. Whitfield, Executive Vice President and General Counsel; David Naranjo, Chief Information Security Officer; Jennifer Liang, Chief Privacy Officer; Priya Deshmukh, Vice President of Vendor Risk Management; and Robert Wentworth, Senior Vice President of Claims Operations. The incident response team commenced an assessment of Quorum's exposure, initiated communications with Palomar to obtain additional details regarding the scope and nature of the compromise, and began evaluating Quorum's notification obligations under applicable federal and state law.
On May 4, 2023, Quorum formally engaged Calderwood & Harkness LLP to serve as outside breach response counsel. Calderwood & Harkness has assumed responsibility for coordinating the forensic investigation (under the attorney-client privilege and work product doctrine), advising Quorum on notification compliance across all applicable jurisdictions, preparing for anticipated regulatory inquiries, and evaluating Quorum's rights against Palomar under the MSA.
On May 5, 2023, at the direction of Calderwood & Harkness and under the attorney-client privilege umbrella, Quorum retained Graystone Forensics LLC ("Graystone"), a specialized digital forensics and incident response firm headquartered in Tysons Corner, Virginia. The Graystone engagement is being led by Dr. Nolan Briggs, Managing Director of Incident Response, and Kendra Faulkner, Senior Forensic Analyst. Graystone has been tasked with conducting a thorough technical forensic investigation to determine the scope and nature of the compromise, identify the threat actor's methods and tools, confirm the categories and volume of data exfiltrated, and identify all affected individuals.
Additionally, Quorum has engaged BrightPath Consulting Group Inc. ("BrightPath") (Meredith Ashford, Managing Director) to provide crisis communications and public relations support. BrightPath is assisting Quorum with the development of external and internal communications strategies, including preparation of potential press statements, employee communications, and investor-facing disclosures as may become necessary.
4. Preliminary Assessment of Compromised Data
The forensic investigation being conducted by Graystone Forensics is in its early stages. However, based on information available to date — including information received from Palomar, Palomar's own preliminary forensic findings, and Graystone's initial review of available indicators — the security incident potentially compromised the personally identifiable information of Quorum policyholders and claimants across multiple states.
The categories of data potentially compromised in the incident include the following:
• Personally Identifiable Information (PII): Full names, dates of birth, Social Security numbers, and driver's license numbers of Quorum policyholders and claimants whose data was processed by Palomar.
• Financial Information: Bank account numbers and, for a subset of affected individuals, payment card numbers associated with premium payment records and claims disbursement files.
• Protected Health Information (PHI): Health conditions, medical diagnosis codes (ICD-10), and treatment information derived from workers' compensation claims and health-related insurance claims processed by Palomar on behalf of Quorum. This category of data is subject to the Health Insurance Portability and Accountability Act of 1996 ("HIPAA") and applicable state health privacy laws, and triggers additional notification obligations to the U.S. Department of Health and Human Services, Office for Civil Rights.
Preliminary indications suggest that the number of affected individuals may be substantial — potentially in the hundreds of thousands — and that affected individuals are likely to span multiple states, given the nationwide scope of Quorum's personal lines operations. However, until the forensic investigation and data mining phases are complete, it is not possible to determine with precision the exact number of affected individuals or the full geographic distribution of affected persons.
Graystone Forensics has been tasked with providing preliminary findings regarding the scope of the compromise by early June 2023. A final forensic report, including a definitive identification of all affected data elements and individuals, is anticipated by mid-July 2023. Quorum will promptly update Atlas Mutual with the results of these findings as they become available.
5. Anticipated Categories of Loss and Expense
Based on the nature and anticipated scope of the security incident, Quorum expects to incur significant costs and expenses across the following categories. Quorum believes that each of these categories of loss and expense falls within the coverage afforded by the Policy and hereby provides notice of its intent to seek coverage for the same.
5.1 Forensic Investigation Costs
Quorum will incur fees and expenses payable to Graystone Forensics LLC for the technical forensic investigation of the security incident, including the identification of the threat actor's methods of access, the scope and duration of the unauthorized access, the nature and volume of exfiltrated data, and the identification of all affected individuals. Graystone was retained at the direction of, and under the supervision of, Calderwood & Harkness for purposes of preserving the attorney-client privilege and work product protections with respect to the forensic investigation and its findings. Quorum will also incur costs associated with specialized data mining services necessary to identify the specific individuals whose personal information was compromised, including the matching of exfiltrated data elements to individual records.
5.2 Consumer Notification Costs
Quorum anticipates incurring substantial costs associated with the preparation, printing, mailing, and postage of individual consumer notification letters to all affected individuals across all applicable jurisdictions. Quorum is currently subject to data breach notification statutes in all fifty states, the District of Columbia, Guam, Puerto Rico, and the U.S. Virgin Islands, as well as federal notification obligations under HIPAA with respect to the subset of affected individuals whose PHI was compromised. Depending on the final scope of affected individuals, the notification process may involve hundreds of thousands of individual letters, each of which must be tailored to comply with the specific content and formatting requirements of the applicable state notification statute.
Quorum anticipates retaining a specialized notification vendor to manage the large-scale notification process. Discussions are currently underway with Clearfield Notification Services LLC, based in Independence, Ohio, which specializes in high-volume data breach notification fulfillment. Quorum will seek Atlas Mutual's consent or confirmation regarding this vendor selection to the extent required by the Policy's pre-approval or panel vendor provisions.
5.3 Credit Monitoring and Identity Theft Protection
Given the nature of the compromised data — which includes Social Security numbers, financial account information, and other highly sensitive identifiers — Quorum anticipates enrolling all affected individuals in complimentary credit monitoring and identity theft protection services. Quorum currently plans to offer a twenty-four (24) month enrollment period for credit monitoring and identity theft protection to all affected individuals, which Quorum believes is consistent with industry standards and regulatory expectations for incidents of this nature and scope. The costs of procuring and administering these services for potentially hundreds of thousands of individuals are expected to be significant.
5.4 Call Center Operations
Quorum will incur costs associated with the establishment and operation of a dedicated toll-free call center to respond to inquiries from affected individuals during and after the notification window. The call center will be staffed by trained agents capable of answering questions regarding the nature of the incident, the types of information compromised, the credit monitoring and identity theft protection services being offered, and the steps affected individuals can take to protect themselves. Based on the anticipated volume of affected individuals, Quorum expects the call center to remain operational for a period of at least ninety (90) days following the mailing of notification letters, and potentially longer depending on the volume of inquiries received.
5.5 Crisis Communications and Public Relations
Quorum will incur fees and expenses payable to BrightPath Consulting Group Inc. for crisis communications and public relations support. BrightPath's scope of work includes the development and execution of an external communications strategy, preparation of press statements, media monitoring, employee communications, and investor-facing disclosures. As a publicly traded company, Quorum has heightened disclosure obligations under the federal securities laws, including potential obligations to disclose the incident in periodic filings with the U.S. Securities and Exchange Commission. BrightPath's assistance is critical to ensuring that Quorum's public communications are accurate, measured, and consistent.
5.6 Legal Fees and Expenses
Quorum will incur fees and expenses payable to Calderwood & Harkness LLP for legal services rendered in connection with the incident response, including without limitation: coordination of the forensic investigation; analysis of notification obligations under the data breach notification statutes of all fifty states, the District of Columbia, and applicable territories; preparation and filing of regulatory notifications (including notifications to state attorneys general, the Connecticut Insurance Department, and HHS-OCR); preparation for and response to anticipated regulatory inquiries and investigations; and evaluation and pursuit of Quorum's contractual rights and remedies against Palomar under the MSA.
5.7 Regulatory Defense Costs
Quorum anticipates incurring costs associated with preparing for and responding to inquiries, investigations, or enforcement actions from state attorneys general, the Connecticut Insurance Department (Quorum's domestic insurance regulator), and the U.S. Department of Health and Human Services, Office for Civil Rights (HHS-OCR) with respect to the HIPAA breach notification. Given the multi-state scope of the potentially affected individual population — encompassing policyholders and claimants in all or substantially all of the fifty states — Quorum anticipates the possibility of multistate regulatory inquiries coordinated through the National Association of Attorneys General or similar multistate mechanisms. Regulatory defense costs, including legal fees, document collection and production costs, and related expenses, may be substantial depending on the scope and nature of any regulatory proceedings.
5.8 Regulatory Fines and Penalties (If Any, Where Insurable)
While Quorum intends to comply fully and in good faith with all applicable notification statutes and regulations, and while Quorum is taking all reasonable steps to mitigate harm to affected individuals, Quorum cannot rule out the possibility that one or more regulatory bodies may seek to impose fines, penalties, or other assessments in connection with the incident. To the extent that any such fines or penalties are assessed, Quorum reserves its rights under the Policy with respect to coverage for such amounts, to the extent that coverage for regulatory fines and penalties is afforded by the Policy and is insurable under applicable law.
5.9 Preliminary Cost Estimates
It is premature to provide definitive cost estimates at this early stage of the investigation and response process. The total costs incurred by Quorum in connection with this incident will depend on several variables that are not yet fully known, including the final number of affected individuals, the number of states in which notification is required, the extent of any regulatory inquiries or proceedings, and the duration of call center and credit monitoring operations.
However, based on the anticipated scope of the incident — potentially involving hundreds of thousands of affected individuals across multiple states, with compromised data including Social Security numbers, financial information, and protected health information — Quorum's total incident response costs may approach or exceed the $2,500,000 Self-Insured Retention, thereby potentially implicating the primary policy layer. Quorum will provide Atlas Mutual with updated cost estimates as the investigation progresses and as the scope of affected individuals is confirmed through the forensic investigation and data mining processes.
6. Reservation of Rights
By providing this notice of claim, Quorum expressly reserves all of its rights, remedies, and defenses under the Policy, at law, and in equity. Without limiting the generality of the foregoing, Quorum specifically reserves the following:
(a) The right to seek coverage under the Policy for all categories of loss, cost, and expense arising from or related to the security incident described in this letter, including all categories of loss and expense identified in Section 5 above and any additional categories of loss or expense that may arise as the investigation and response process continues.
(b) The right to supplement this notice of claim with additional information, facts, and circumstances as the forensic investigation progresses and the scope and nature of the incident are further defined and clarified.
(c) The right to assert coverage under the Policy for any additional categories of loss, cost, or expense not specifically enumerated in this letter that may arise from or relate to the security incident, including without limitation any third-party claims, litigation, or demands that may be asserted against Quorum by affected individuals, classes of affected individuals, or other third parties.
(d) All rights, remedies, and defenses available to Quorum under the Policy, applicable state insurance law, and general principles of contract law and equity.
Nothing in this notice of claim shall be construed as a waiver, release, or limitation of any rights, claims, or defenses available to Quorum under the Policy or applicable law. Quorum's provision of this notice shall not be construed as an admission of liability or fault on the part of Quorum with respect to the security incident, which originated within the information technology environment of Quorum's third-party vendor, Palomar Data Solutions, Inc.
Quorum also expressly reserves all rights, remedies, and claims against Palomar Data Solutions, Inc. under the Master Services Agreement, including without limitation indemnification rights set forth in Section 12.2 of the MSA. Section 12.2 of the MSA provides for indemnification by Palomar for losses arising from a breach of Palomar's data security obligations, subject to a liability cap equal to two times (2×) the trailing twelve-month fees paid under the MSA, or approximately $32,600,000. Any recovery by Quorum from Palomar will be coordinated with Atlas Mutual in accordance with applicable policy provisions concerning subrogation, reimbursement, and other insurance, and Quorum will keep Atlas Mutual informed of developments in its pursuit of contractual remedies against Palomar.
7. Requests to Atlas Mutual
In connection with this notice of claim, Quorum respectfully requests the following from Atlas Mutual:
1. Acknowledgment of Receipt. Written acknowledgment of Atlas Mutual's receipt of this notice of claim, including confirmation of the date on which this notice was received and entered into Atlas Mutual's claims management system.
2. Claim Number Assignment. Assignment of a claim number to this matter, if one has not already been assigned. Quorum understands, based on preliminary communications through its broker, that this claim may be designated CYB-CLM-2023-05892. Quorum requests confirmation of the assigned claim number for tracking and correspondence purposes.
3. Confirmation of Claims Processing. Confirmation that Atlas Mutual will process this claim under Policy No. CYB-2023-041587, and identification of the claims adjuster and any other Atlas Mutual personnel who will be responsible for handling this claim going forward.
4. Panel and Pre-Approval Requirements. Identification of any panel counsel requirements, pre-approved vendor lists, consent requirements, or other pre-approval procedures under the Policy that Atlas Mutual wishes Quorum to observe in connection with the retention of legal counsel, forensic investigators, notification vendors, credit monitoring providers, call center operators, or crisis communications consultants. Quorum is committed to complying promptly with any such requirements and requests that Atlas Mutual communicate them at the earliest opportunity so as not to delay the incident response process.
5. Documentation Requirements. Identification of any documentation, forms, sworn proof of loss, or other information that Atlas Mutual requires from Quorum at this stage to facilitate the claims process.
Quorum is committed to cooperating fully with Atlas Mutual throughout the claims process. Quorum will provide periodic updates on the status of the forensic investigation, the identification of affected individuals, notification activities, regulatory developments, and costs incurred. Quorum will also make available its incident response team members, outside counsel, and forensic investigators for discussions with Atlas Mutual as reasonably requested.
8. Contact Information
All communications regarding this claim should be directed to the following individuals:
Primary Contact — Outside Counsel:
Kevin Ostrowski, Partner Privacy & Data Security Practice Group Calderwood & Harkness LLP 1700 K Street NW, Suite 900 Washington, D.C. 20006 Telephone: (202) 555-7418
Email: kostrowski@calderwoodharkness.com
Billing Contact — Outside Counsel:
Rachel Bernstein, Partner Calderwood & Harkness LLP 51 West 52nd Street, 34th Floor New York, NY 10019 Telephone: (212) 555-3200
Email: rbernstein@calderwoodharkness.com
With copies to:
Thomas R. Whitfield, Executive Vice President and General Counsel Quorum Insurance Holdings Corp. 400 Constitution Plaza, Suite 2200 Hartford, CT 06103 Telephone: (860) 555-9100
Email: twhitfield@quorumholdings.com
Sandra Whitmore-Kim, Lead Broker Whitmore Risk Advisors Inc. 390 Park Avenue, 18th Floor New York, NY 10022 Telephone: (212) 555-6700
Email: swhitmore-kim@whitmoreadvisors.com
9. Excess Carrier Notice
As noted in Section 2 above, Quorum maintains excess cyber-liability coverage above the Atlas Mutual primary layer. Quorum is providing separate precautionary notice of this claim to its excess cyber-liability insurer, Pinnacle Surplus Lines Insurance Corp. (Attention: Lisa Garner, Claims Department), under Excess Policy No. XS-CYB-2023-7812. That excess policy provides $25,000,000 in coverage in excess of the $15,000,000 Atlas Mutual primary layer, on a follow-form basis.
Based on current preliminary estimates and the early stage of the investigation, Quorum does not presently anticipate that total incident response costs and losses will exceed the $15,000,000 primary policy limit. However, given the potentially large number of affected individuals and the multi-state scope of the incident, Quorum is providing notice to Pinnacle out of an abundance of caution and in compliance with the excess policy's notice provisions. Quorum will keep both Atlas Mutual and Pinnacle apprised of any developments that may affect the likelihood of the claim reaching the excess layer.
10. Closing
Calderwood & Harkness reserves the right to supplement this notice of claim as additional facts, circumstances, and information become available through the ongoing forensic investigation and response process. This notice is not intended to be, and should not be construed as, a comprehensive or final statement of all facts, claims, or losses arising from the security incident. Quorum's understanding of the scope and impact of the incident continues to evolve, and additional categories of loss, additional affected individuals, or additional regulatory developments may emerge as the investigation progresses.
Quorum looks forward to Atlas Mutual's prompt acknowledgment of this notice and to Atlas Mutual's full cooperation in processing this claim in a timely and fair manner. Quorum values its relationship with Atlas Mutual and is confident that the parties can work together constructively to address this matter.
We thank you for your prompt attention to this notice of claim. Please do not hesitate to contact the undersigned directly if you have any questions or require any additional information at this time.
Respectfully submitted,
CALDERWOOD & HARKNESS LLP
By: ________
Kevin Ostrowski Partner, Privacy & Data Security Calderwood & Harkness LLP 1700 K Street NW, Suite 900 Washington, D.C. 20006 Telephone: (202) 555-7418
Email: kostrowski@calderwoodharkness.com
Enclosures: None. A copy of the Policy is on file with both parties and is not enclosed herewith. Quorum will provide supporting documentation, including forensic reports, cost summaries, and notification materials, as the investigation progresses and such materials become available.
cc:
Thomas R. Whitfield, Executive Vice President and General Counsel, Quorum Insurance Holdings Corp. Jennifer Liang, Chief Privacy Officer, Quorum Insurance Holdings Corp. David Naranjo, Chief Information Security Officer, Quorum Insurance Holdings Corp. Sandra Whitmore-Kim, Lead Broker, Whitmore Risk Advisors Inc. Rachel Bernstein, Partner, Calderwood & Harkness LLP
Term | Detail
Insurer | Atlas Mutual Insurance Company
Policy Number | CYB-2023-041587
Policy Period | January 1, 2023 – January 1, 2024
Per-Occurrence Limit of Liability | $15,000,000
Aggregate Limit of Liability | $15,000,000
Self-Insured Retention (SIR) | $2,500,000

CALDERWOOD & HARKNESS LLP Attorneys at Law

CALDERWOOD & HARKNESS LLP

Record

Parties

Dates

Amounts