1025-00006 · Graystone Forensics LLC · Insurance Coverage

proof-of-loss-final-cost-summary.docx DOCUMENT Data Privacy

47 / 88 ← → ✕

CALDERWOOD & HARKNESS LLP Attorneys at Law

1700 K Street NW, Suite 900 Washington, D.C. 20006 Tel: (202) 555-4800

November 15, 2023

Via Email and Certified Mail, Return Receipt Requested

Mr. Paul Enriquez Claims Adjuster Atlas Mutual Insurance Company 120 South LaSalle Street, Suite 3200 Chicago, IL 60603

Re: Proof of Loss and Final Cost Summary — Quorum Insurance Holdings Corp. Policy No.: CYB-2023-041587 Claim No.: CYB-CLM-2023-05892 Date of Loss: March 14, 2023 – April 18, 2023 Calderwood & Harkness Matter No.: 1025-00006

Dear Mr. Enriquez:

I. Introduction and Purpose

This firm represents Quorum Insurance Holdings Corp. ("Quorum" or "QIH"), a Delaware corporation publicly traded on the Nasdaq Stock Market (ticker: QIHC) and headquartered at 400 Constitution Plaza, Suite 2200, Hartford, Connecticut 06103 (EIN: 06-4832197). We submit this letter, together with the enclosed supporting documentation, on behalf of Quorum for the purpose of presenting to Atlas Mutual Insurance Company ("Atlas") the formal Proof of Loss and Final Cost Summary arising from the cybersecurity incident described herein, as required under the Cyber-Liability Insurance Policy No. CYB-2023-041587 (the "Policy") issued by Atlas to Quorum for the policy period of January 1, 2023 through January 1, 2024.

As Atlas is aware, Quorum submitted its initial Notice of Claim by letter dated May 8, 2023, promptly upon the engagement of this firm and the commencement of incident response activities. Atlas acknowledged receipt of the Notice of Claim and assigned Claim No. CYB-CLM-2023-05892. Subsequently, Atlas confirmed acceptance of coverage for the principal incident response cost categories at issue, including forensic investigation costs, consumer notification costs, credit monitoring and identity theft protection costs, crisis communications and public relations costs, and regulatory defense costs, in each case subject to the terms, conditions, and limitations of the Policy, including the $2,500,000 self-insured retention (the "SIR").

As of the date of this letter, all incident response activities related to the covered cybersecurity incident have been substantially completed, and all final costs are now determinable. The forensic investigation has concluded, all consumer notifications have been mailed, call center operations have wound down, credit monitoring enrollment is well underway, all regulatory engagements have been resolved favorably without enforcement action, and all vendor invoices have been finalized. Accordingly, Quorum is now in a position to present this Final Cost Summary and to request reimbursement of the amounts due under the Policy.

We note that the sharing of certain privileged and confidential information in connection with this submission is governed by the Common Interest Agreement dated May 10, 2023, entered into between Quorum and Atlas (the "CIA"). Nothing in this submission is intended to waive, and Quorum expressly does not waive, any applicable attorney-client privilege, work product protection, or other applicable privilege or immunity. Information designated as privileged and confidential is shared solely pursuant to the terms of the CIA and is not intended for disclosure to any third party except as contemplated by the CIA.

II. Summary of the Covered Incident

2.1 Nature of the Incident

The covered cybersecurity incident arose from a vendor-originated data breach at Palomar Data Solutions, Inc. ("Palomar"), a Texas corporation headquartered at 7100 Greenville Avenue, Suite 450, Dallas, Texas 75231 (EIN: 75-3291048). Palomar serves as Quorum's third-party claims-processing vendor pursuant to a Master Services Agreement originally dated November 12, 2019, as subsequently amended by Amendment No. 1, dated March 3, 2021, and Amendment No. 2, dated September 15, 2022 (collectively, the "MSA"). Under the MSA, as amended, the annual contract value is approximately $16,300,000 (post-Amendment No. 1). Palomar is responsible for receiving, processing, adjudicating, and managing claims data on behalf of Quorum's personal lines insurance division, which encompasses homeowners, renters, and personal automobile products. In the ordinary course of this engagement, Palomar receives and processes significant volumes of personally identifiable information, financial data, and, in the context of workers' compensation and certain health-related claims, protected health information pertaining to Quorum's policyholders and claimants.

2.2 Attack Vector and Timeline

Based on the forensic investigation conducted by Graystone Forensics LLC, as discussed further below, the relevant timeline and attack vector are summarized as follows:

• On or about March 14, 2023, a threat actor exploited a known but unpatched remote code execution vulnerability, designated CVE-2023-0669, present in Palomar's GoAnywhere MFT (Managed File Transfer) file transfer appliance, to gain unauthorized initial access to Palomar's network environment. The vulnerability had been publicly disclosed and a patch made available by the software vendor prior to Palomar's exploitation; however, Palomar had not yet applied the relevant security patch at the time of the compromise.

• March 14, 2023 – April 18, 2023 (approximately 35 days): Following initial access, the threat actor conducted lateral movement within Palomar's network, escalated privileges, and systematically identified and exfiltrated structured data files containing Quorum policyholder and claimant data. The exfiltration occurred in multiple stages over the approximately 35-day window, utilizing encrypted channels designed to evade detection by Palomar's existing network monitoring and intrusion detection systems.

• April 18, 2023: Palomar's Security Operations Center ("SOC") identified anomalous outbound data transfer activity during routine log review. The SOC initiated its internal incident response procedures and commenced containment activities.

• April 21, 2023: Palomar formally notified Quorum of the security incident. This notification occurred approximately 72 hours after Palomar's internal discovery — approximately 24 hours beyond the 48-hour contractual notification requirement set forth in Section 9.4 of the MSA. Quorum has separately addressed Palomar's late notification as part of the vendor indemnification and settlement process discussed in Section VI below.

2.3 Scope of Compromised Data

The forensic investigation confirmed that data pertaining to a total of 318,247 individuals across 29 states and the District of Columbia was compromised during the incident. The types of data compromised are categorized as follows:

• Personally Identifiable Information (PII): Full names, dates of birth, Social Security numbers, and driver's license numbers — affecting all 318,247 individuals within the scope of the breach.

• Financial Information: Bank account numbers and payment card numbers — affecting a subset of 84,619 individuals whose claims involved direct deposit payments or premium payment card information.

• Protected Health Information (PHI): Health conditions, medical diagnosis codes (ICD-10), and treatment information associated with workers' compensation claims and certain health-related insurance claims — affecting a subset of 41,203 individuals. The presence of PHI triggered additional notification obligations under the Health Insurance Portability and Accountability Act of 1996 ("HIPAA") and corresponding state health data breach notification statutes.

2.4 Incident Response Activities Undertaken

Upon receiving notification from Palomar, Quorum promptly activated its incident response plan and undertook the following principal response activities:

• May 4, 2023: Quorum engaged Calderwood & Harkness LLP as outside breach counsel to coordinate the incident response, oversee the forensic investigation under the protection of the attorney-client privilege, conduct a multi-jurisdictional notification law analysis, prepare and file all required regulatory and consumer notifications, manage regulatory defense, and advise Quorum's board and management on disclosure obligations. The Calderwood & Harkness engagement team consisted of Kevin Ostrowski, Partner (Responsible Partner); Rachel Bernstein, Partner (Billing Partner); Alan Burke, Associate (Lead Associate); and Sara Hendricks, Associate (Working Associate).

• May 5, 2023: At the direction of Calderwood & Harkness LLP, Quorum retained Graystone Forensics LLC ("Graystone") to conduct an independent forensic investigation of the Palomar security incident. Graystone was engaged under the attorney-client privilege umbrella, with all reports and findings directed to and through Calderwood & Harkness. The Graystone engagement was led by Dr. Nolan Briggs, Managing Director, Incident Response, with Kendra Faulkner, Senior Forensic Analyst, serving as the day-to-day analytical lead.

• June 2, 2023: Graystone delivered its Preliminary Forensic Findings Report, confirming the initial assessment that structured data files containing Quorum policyholder and claimant data had been exfiltrated from Palomar's network environment. The preliminary report identified the CVE-2023-0669 vulnerability as the initial attack vector and confirmed evidence of lateral movement within Palomar's network.

• July 14, 2023: Graystone delivered its Final Forensic Investigation Report, providing a comprehensive and definitive assessment of the full scope of the breach, including the complete identification of compromised data types, the total number of affected individuals, and a detailed timeline of the threat actor's activities within Palomar's environment.

• August 4, 2023: Data mining and affected individual identification activities were completed, enabling Quorum to identify all 318,247 individuals whose data was compromised and to determine the specific data elements affected for each individual. This step was essential for the preparation of individualized notification letters and the determination of applicable state and federal notification obligations.

• August 6, 2023: Quorum engaged Clearfield Notification Services LLC ("Clearfield") for consumer notification printing and mailing, call center operations, and credit monitoring and identity theft protection enrollment services. Jerome Tillman served as Clearfield's designated Account Manager. A detailed Statement of Work was executed on this date.

• August 14–25, 2023: Quorum, through Calderwood & Harkness, filed regulatory notifications with the appropriate regulatory authorities in all 29 affected states and the District of Columbia, as well as with the Connecticut Insurance Department (given Quorum's domiciliary state) and the U.S. Department of Health and Human Services, Office for Civil Rights ("HHS-OCR"), in compliance with HIPAA's Breach Notification Rule (45 C.F.R. §§ 164.400–414). All filings were confirmed timely under applicable statutory deadlines.

• August 18 – September 15, 2023: Consumer notification letters were mailed to all 318,247 affected individuals on a rolling basis over approximately 28 days. Three versions of the notification letter were prepared — a general PII version, a financial data version (for individuals whose financial information was compromised), and a PHI/HIPAA-compliant version (for individuals whose protected health information was compromised) — each tailored to address the specific data elements affected and the specific remedial services offered.

• BrightPath Consulting Group Inc. ("BrightPath") was retained for crisis communications and public relations strategy. The BrightPath engagement was led by Meredith Ashford, Managing Director. BrightPath's scope of work included the development and execution of an external communications strategy (press statements, media monitoring, and stakeholder outreach), internal employee communications, and coordination of investor-facing disclosures in connection with Quorum's SEC reporting obligations.

• Clearfield Notification Services LLC managed call center operations through a dedicated toll-free number for a 12-week operational window, staffed by trained agents utilizing approved scripts and frequently asked questions documents. Additionally, Clearfield administered the enrollment of affected individuals in 24-month credit monitoring and identity theft protection services.

2.5 Regulatory Outcomes

We are pleased to report that all regulatory engagements arising from this incident have been resolved favorably, with no enforcement action taken against Quorum by any regulatory authority. Specifically:

• Multistate Attorney General Coalition (29 states): A coalition of attorneys general from the 29 affected states, led by Assistant Attorney General Diane Marchetti of the Connecticut Attorney General's Office and Assistant Attorney General Mark Petrosian of the New York Attorney General's Office, conducted a joint inquiry into the incident. Following Quorum's full cooperation, including detailed written responses and supplemental documentation, the multistate coalition issued a closure letter dated November 22, 2023, indicating that no further action would be taken. A copy of this closure letter is enclosed as part of Exhibit 9.

• Connecticut Insurance Department: Examiner Richard Nakamura of the Connecticut Insurance Department conducted a regulatory inquiry into the incident in light of Quorum's status as a Connecticut-domiciled insurer. The inquiry focused on Quorum's compliance with Connecticut's insurance data security laws and the adequacy of Quorum's vendor oversight. The Connecticut Insurance Department closed its inquiry by letter dated November 28, 2023, with no adverse findings. A copy of this closure letter is enclosed as part of Exhibit 9.

• HHS Office for Civil Rights (Region I, Boston): HHS-OCR conducted a review of the breach notification submitted by Quorum under HIPAA's Breach Notification Rule with respect to the 41,203 individuals whose protected health information was compromised. HHS-OCR issued a no further action letter dated November 30, 2023, confirming that the matter was closed. A copy of this letter is enclosed as part of Exhibit 9.

The favorable resolution of all regulatory matters reflects Quorum's diligent, transparent, and cooperative approach to incident response and regulatory engagement, undertaken with the guidance and representation of Calderwood & Harkness throughout.

III. Policy Coverage Summary

The relevant terms of the Policy applicable to this claim are summarized below for ease of reference:

The following covered cost categories under the Policy are applicable to this claim:

(a) First-Party Forensic Investigation Costs — costs and expenses incurred for the engagement of forensic investigators to determine the cause, scope, and extent of a covered cybersecurity incident, including the identification of compromised data;

(b) Consumer Notification Costs — costs and expenses incurred for the preparation, printing, and mailing of notification letters to affected individuals, including address verification and return mail processing, as required by applicable data breach notification laws;

(c) Call Center Costs — costs and expenses incurred for the establishment and operation of a dedicated call center to respond to inquiries from affected individuals;

(d) Credit Monitoring and Identity Theft Protection Costs — costs and expenses incurred for the provision of credit monitoring and identity theft protection services to affected individuals;

(e) Crisis Communications / Public Relations Costs — costs and expenses incurred for the engagement of public relations and crisis communications consultants to manage reputational risk and stakeholder communications in connection with a covered cybersecurity incident;

(f) Regulatory Defense Costs — legal fees and expenses incurred in connection with regulatory notification compliance, responses to regulatory inquiries, and defense of regulatory proceedings arising from a covered cybersecurity incident; and

(g) Outside Counsel Legal Fees — reasonable and necessary legal fees incurred in connection with the foregoing incident response activities, including breach counsel coordination, privilege-protected forensic investigation oversight, multi-jurisdictional notification law analysis, regulatory engagement, and related advisory services.

Atlas previously confirmed coverage for each of the foregoing cost categories, subject to the SIR and the terms and conditions of the Policy.

Additionally, Quorum maintains an excess cyber-liability insurance policy issued by Pinnacle Surplus Lines Insurance Corp., Policy No. XS-CYB-2023-7812, providing $25,000,000 in coverage excess of the $15,000,000 Atlas primary layer, on a follow-form basis. The total insurance tower applicable to this risk is therefore $40,000,000. As the total costs claimed herein ($8,230,250 gross; $5,730,250 net of SIR) fall well within the Atlas primary layer, attachment of the Pinnacle excess layer is not implicated by this claim. Notwithstanding, a courtesy copy of this submission is being provided to Lisa Garner at Pinnacle, as reflected in the distribution list below, for excess carrier notification purposes.

IV. Final Cost Summary / Itemized Schedule of Loss

4.1 Overview. The total incident response costs incurred by Quorum in connection with the covered cybersecurity incident are $8,230,250. After application of the $2,500,000 SIR, the net amount claimed under the Atlas primary policy is $5,730,250. A detailed breakdown of costs by category is set forth below.

Summary of Claimed Amounts

Each cost category is described in detail in the following subsections.

4.2 Category 1: Forensic Investigation Costs

Vendor: Graystone Forensics LLC Address: 1950 Old Gallows Road, Suite 600, Tysons Corner, Virginia 22182 Engagement Lead: Dr. Nolan Briggs, Managing Director, Incident Response Analyst Lead: Kendra Faulkner, Senior Forensic Analyst

Scope of Engagement: Graystone Forensics LLC was retained on May 5, 2023, at the direction of Calderwood & Harkness LLP, to conduct a comprehensive forensic investigation of the Palomar Data Solutions security incident. The engagement was structured under the attorney-client privilege umbrella, with Graystone serving as a consulting expert retained by counsel. The scope of work encompassed: (i) determination of the threat actor's initial entry vector and exploitation methodology; (ii) analysis of the threat actor's lateral movement, privilege escalation, and persistence mechanisms within Palomar's network environment; (iii) identification and quantification of exfiltrated data, including the types and volumes of structured data files accessed and removed; (iv) assessment of the specific data elements compromised for each affected individual; (v) development of a comprehensive incident timeline; and (vi) preparation of a preliminary findings report and a final forensic investigation report.

Deliverables: Graystone delivered its Preliminary Forensic Findings Report on June 2, 2023, and its Final Forensic Investigation Report on July 14, 2023. Both reports were delivered to and addressed to Calderwood & Harkness LLP as privileged work product.

Total Fees Invoiced: $1,847,000

Supporting documentation, including the Graystone engagement letter dated May 5, 2023, all invoices rendered by Graystone in connection with this engagement, and a summary of the scope of work performed, is enclosed herewith as Exhibit 1.

4.3 Category 2: Notification and Credit Monitoring Costs

Vendor: Clearfield Notification Services LLC Address: 4500 Rockside Road, Suite 210, Independence, Ohio 44131 Account Manager: Jerome Tillman

Scope of Engagement: Clearfield Notification Services LLC was engaged effective August 6, 2023, pursuant to a detailed Statement of Work, to provide the following services: (i) consumer notification printing and mailing; (ii) call center operations; and (iii) credit monitoring and identity theft protection enrollment. Clearfield's services are broken down into the following sub-categories:

(a) Notification Printing and Mailing: $636,000

Clearfield prepared, printed, and mailed individualized notification letters to all 318,247 affected individuals. The per-unit cost of approximately $2.00 per notification letter encompasses printing (including personalized variable data), first-class postage, address verification services (through the National Change of Address database and related address hygiene processes), envelope assembly, and return mail processing. Three versions of the notification letter were prepared (General PII, Financial Data, and PHI/HIPAA-compliant) and mailed to the appropriate recipient populations. Mailings were completed on a rolling basis from August 18, 2023 through September 15, 2023.

(b) Call Center Operations: $478,500

Clearfield established and operated a dedicated toll-free telephone number for affected individuals to call with questions regarding the breach, the notification, and the available remedial services. The call center operated over a 12-week window, staffed by trained call center agents using scripts and frequently asked questions documents approved by Calderwood & Harkness and Quorum. The call center handled inquiries regarding the nature and scope of the incident, the types of data compromised, enrollment in credit monitoring and identity theft protection services, and related topics.

Clearfield administered the enrollment of affected individuals in a 24-month credit monitoring and identity theft protection program. Based on industry experience and the demographic profile of the affected population, the parties estimated an enrollment take-rate of approximately 40%, yielding an estimated 127,299 enrollees. At an estimated per-enrollee cost of approximately $18.00 per month over the 24-month period, the total estimated cost for this service would have been substantially higher under a per-enrollee, per-month pricing model. To manage cost exposure and provide certainty, Quorum, through Calderwood & Harkness, negotiated a flat-fee arrangement with Clearfield at $2,100,000, which caps Quorum's obligation for credit monitoring services regardless of the actual enrollment rate. This flat-fee structure represents a favorable outcome for both Quorum and Atlas, as it eliminates the risk of cost overruns associated with higher-than-expected enrollment rates.

Total Fees Invoiced: $3,214,500

Supporting documentation, including the Clearfield Statement of Work executed August 6, 2023, all invoices rendered by Clearfield, and a summary of enrollment statistics, is enclosed herewith as Exhibit 2.

4.4 Category 3: Crisis Communications / Public Relations Costs

Vendor: BrightPath Consulting Group Inc. Address: 450 Lexington Avenue, 4th Floor, New York, New York 10017 Engagement Lead: Meredith Ashford, Managing Director

Scope of Engagement: BrightPath Consulting Group Inc. was retained to develop and execute a comprehensive communications strategy in connection with the cybersecurity incident. BrightPath's scope of work included: (i) external communications strategy, including the preparation of press statements, media monitoring, and proactive and reactive media engagement; (ii) internal employee communications, including talking points for customer-facing personnel and company-wide notifications; (iii) coordination with Quorum's investor relations team and outside securities counsel regarding investor-facing disclosures and SEC reporting obligations; and (iv) ongoing reputational risk assessment and strategic advisory services throughout the incident response period.

BrightPath's engagement was integral to the management of stakeholder communications during a period of heightened public and regulatory scrutiny. The firm's efforts contributed to the absence of significant adverse media coverage and the preservation of Quorum's reputation in the marketplace.

Total Fees Invoiced: $385,000

Supporting documentation, including the BrightPath engagement letter and all invoices rendered in connection with this engagement, is enclosed herewith as Exhibit 3.

4.5 Category 4: Outside Counsel Legal Fees

Firm: Calderwood & Harkness LLP Address: 1700 K Street NW, Suite 900, Washington, D.C. 20006 Engagement Date: May 4, 2023 Matter No.: 1025-00006

Scope of Engagement: Calderwood & Harkness LLP was engaged as outside breach counsel to coordinate all aspects of Quorum's incident response. The scope of legal services provided in this matter included, without limitation:

(i) Overall incident response coordination and project management;

(ii) Oversight of the forensic investigation under the attorney-client privilege umbrella, including direction and supervision of Graystone Forensics LLC;

(iii) Comprehensive 50-state data breach notification law analysis to determine the applicable notification obligations in each affected jurisdiction;

(iv) Drafting and review of consumer notification letters (three versions: General PII, Financial Data, and PHI/HIPAA-compliant);

(v) Preparation and filing of regulatory notifications with authorities in all 29 affected states, the District of Columbia, the Connecticut Insurance Department, and HHS-OCR;

(vi) Regulatory defense, including preparation of written responses to the multistate attorney general coalition inquiry (led by the Connecticut and New York AG offices), management of the Connecticut Insurance Department examination, and response to HHS-OCR review;

(vii) Vendor indemnification analysis and negotiation of the settlement agreement with Palomar Data Solutions, Inc.;

(viii) Cyber-insurance coordination, including preparation and submission of the initial Notice of Claim, ongoing communication with Atlas regarding coverage, and preparation of this Proof of Loss and Final Cost Summary;

(ix) Board and senior management reporting, including preparation of board-level memoranda and presentations for Quorum's Audit Committee and Board of Directors;

(x) SEC disclosure analysis and coordination with Quorum's securities counsel regarding the company's reporting obligations under SEC rules, including assessment of materiality under the SEC's cybersecurity disclosure requirements; and

(xi) General advisory services related to Quorum's legal obligations and risk mitigation throughout the incident response period.

Timekeeper Rates and Hours:

The blended effective rate of approximately $901.56 per hour reflects the allocation of work across the engagement team, with the substantial majority of hours performed by the associate-level timekeepers at lower billing rates. The partner-level timekeepers focused on strategic oversight, regulatory engagement, client advisory, and board-level reporting, while the associates performed the analytical work, drafting, filing, and coordination activities that constituted the bulk of the engagement hours.

Total Fees Invoiced: $2,163,750

Supporting documentation, including the Calderwood & Harkness engagement letter dated May 4, 2023, all fee invoices rendered in connection with this matter, and a timekeeper summary, is enclosed herewith as Exhibit 4.

4.6 Category 5: Internal Costs

Entity: Quorum Insurance Holdings Corp. Address: 400 Constitution Plaza, Suite 2200, Hartford, Connecticut 06103

Description: Quorum incurred substantial internal costs in connection with the incident response, including the redeployment of personnel and resources across multiple departments. The internal costs reflect the time and effort expended by personnel in Quorum's Information Technology, Claims Operations, Privacy, and Legal departments, as well as administrative support functions, in connection with the following activities:

• IT remediation and system hardening activities, including enhanced monitoring of Quorum's own network environment, review of configurations and access controls related to the Palomar integration, and implementation of additional security measures;

• Employee overtime for manual data review, quality assurance of notification mailings, and handling of inbound customer inquiries that exceeded call center capacity;

• Internal coordination across Quorum's operating divisions, including regular cross-functional meetings, executive briefings, and workflow management;

• Administrative support, including document management, record-keeping, and logistical coordination with external vendors and counsel.

Key personnel whose time is reflected in the internal cost allocation include:

• David Naranjo, Chief Information Security Officer (CISO)

• Jennifer Liang, Chief Privacy Officer (CPO)

• Priya Deshmukh, Vice President, Vendor Risk Management

• Robert Wentworth, Senior Vice President, Claims Operations

• Thomas R. Whitfield, General Counsel

Total Estimated Internal Costs: $620,000

Supporting documentation, including Quorum's internal cost allocation summary with supporting time and expense records, is enclosed herewith as Exhibit 5.

4.7 Reconciliation Summary

The following table provides a complete reconciliation of all incident response costs and the net amount claimed under the Policy:

The total amount claimed of $5,730,250 is well within the $15,000,000 per-occurrence limit and the $15,000,000 aggregate limit of liability under the Policy. As noted above, the Pinnacle excess layer does not attach.

V. Application of Self-Insured Retention

The Policy provides for a self-insured retention of $2,500,000 per covered occurrence. Quorum confirms that it has fully satisfied its SIR obligation through the payment of the first $2,500,000 in incident response costs incurred in connection with this cybersecurity incident. These costs were paid by Quorum in the ordinary course of the incident response from Quorum's own funds.

The remaining $5,730,250 in incident response costs, representing the excess of total costs over the SIR, constitutes the amount properly claimed against the Atlas primary layer. Quorum's payment of the SIR is substantiated in the attached cost documentation, which reflects the chronological sequence of expenditures and confirms that the SIR threshold was reached and exceeded during the course of the incident response.

VI. Palomar Indemnification Recovery and Subrogation Considerations

We wish to advise Atlas of a related development that is material to the administration of this claim. Quorum has reached a settlement with Palomar Data Solutions, Inc. regarding Palomar's contractual indemnification obligations arising from the security incident. The key terms of the settlement are as follows:

On October 27, 2023, Quorum and Palomar executed a Settlement Agreement and Mutual Release (the "Palomar Settlement"), a copy of which is enclosed as Exhibit 6 and is provided under the terms of the Common Interest Agreement. The Palomar Settlement provides for the following:

(a) Cash Payment: Palomar agreed to pay Quorum the sum of $4,200,000 in cash, payable within 30 days of execution of the Palomar Settlement (i.e., on or before November 26, 2023).

(b) Fee Reduction: Palomar agreed to an 18-month reduction in its service fees under the MSA of 8%, effective November 1, 2023. Based on the current annual contract value of $16,300,000, this fee reduction equates to an estimated savings of approximately $1,956,000 over the 18-month period (calculated as $16,300,000 × 8% × 1.5 years).

(c) Total Effective Recovery: The total effective recovery from Palomar, combining the cash payment and the fee reduction, is approximately $6,156,000.

For context, under the MSA, Palomar's contractual indemnification cap is set at two times the trailing twelve-month fees paid to Palomar, or $32,600,000 (2 × $16,300,000). The settlement was negotiated below this contractual cap in light of Quorum's assessment of litigation risk, including the cost and uncertainty of protracted litigation, Palomar's financial capacity, and the importance of preserving the ongoing commercial relationship between the parties.

Quorum advises Atlas of the Palomar recovery in full compliance with the Policy's "other insurance" and subrogation provisions. Quorum recognizes that the appropriate allocation of the Palomar recovery as between Quorum's own uninsured losses (including the SIR) and the amounts claimed under the Policy is a matter that requires careful analysis under the specific terms of the Policy.

In particular, Quorum seeks Atlas's input on whether, under the Policy, the Palomar recovery should be: (i) applied first to offset Quorum's SIR expenditure and any uninsured losses before reducing the claim against Atlas; (ii) applied to reduce the Atlas claim on a dollar-for-dollar basis; or (iii) apportioned on a pro rata basis between Quorum's own losses and the insured claim. Quorum's view is that the Policy's subrogation and recovery provisions, properly construed, support the application of recoveries first to the insured's own uninsured losses and SIR, consistent with the "made whole" doctrine and prevailing industry practice. However, Quorum is prepared to engage in a good-faith dialogue with Atlas on this point and welcomes Atlas's position.

Quorum expressly preserves all of its rights under the Policy and the Palomar Settlement with respect to the allocation of the Palomar recovery. Nothing in this submission is intended to concede or waive any rights Quorum may have regarding the proper treatment of the recovery under the Policy.

VII. Supporting Documentation / Exhibits

The following exhibits are enclosed with this submission and are incorporated herein by reference:

Exhibit 1: Graystone Forensics LLC — Engagement letter dated May 5, 2023; invoices; and scope of work summary.

Exhibit 2: Clearfield Notification Services LLC — Statement of Work executed August 6, 2023; invoices; and enrollment statistics summary.

Exhibit 3: BrightPath Consulting Group Inc. — Engagement letter and invoices.

Exhibit 4: Calderwood & Harkness LLP — Fee invoices, timekeeper summary, and engagement letter dated May 4, 2023.

Exhibit 5: Quorum Insurance Holdings Corp. — Internal cost allocation summary with supporting time and expense records.

Exhibit 6: Palomar Data Solutions, Inc. — Settlement Agreement and Mutual Release executed October 27, 2023 (provided under Common Interest Agreement; privileged and confidential).

Exhibit 7: Consumer notification letter samples — General PII version, Financial Data version, and PHI/HIPAA-compliant version.

Exhibit 8: Regulatory notification filing confirmation log — filings made in all 29 affected states, the District of Columbia, the Connecticut Insurance Department, and HHS-OCR, dated August 14–25, 2023; all filings confirmed timely under applicable statutory and regulatory deadlines.

Exhibit 9: Regulatory closure and no-action letters — Multistate Attorney General coalition closure letter dated November 22, 2023; Connecticut Insurance Department closure letter dated November 28, 2023; and HHS-OCR no further action letter dated November 30, 2023.

VIII. Certification and Reservation of Rights

Quorum Insurance Holdings Corp. hereby certifies, through its undersigned counsel, as follows:

1. The amounts set forth in this Proof of Loss and Final Cost Summary represent the actual, reasonable, and necessary costs incurred by Quorum in connection with the response to the covered cybersecurity incident described herein.

2. All costs were incurred in good faith and in accordance with the terms and conditions of the Policy, including the requirement to obtain Atlas's prior consent for the engagement of forensic investigators, notification vendors, crisis communications firms, and outside counsel, which consent was obtained at or prior to each such engagement.

3. The supporting documentation enclosed herewith accurately reflects the costs incurred and the services rendered.

4. Quorum has not received, and is not aware of, any indemnification, reimbursement, or other recovery from any source that would reduce the amounts claimed herein, other than the Palomar recovery described in Section VI, of which Atlas has been advised.

Notwithstanding the foregoing certification, Quorum expressly reserves all rights under the Policy, including without limitation:

(a) The right to submit additional claims for any costs not yet identified or incurred as of the date of this submission, including but not limited to any future litigation defense costs arising from third-party claims related to the cybersecurity incident, any regulatory follow-up costs, any supplemental notification costs that may be required, and any additional remediation or mitigation costs that may become necessary;

(b) The right to dispute any determination by Atlas regarding the scope of coverage, the reasonableness or necessity of costs, the application of the SIR, or the treatment of the Palomar recovery;

(c) The right to pursue any and all remedies available under the Policy, at law, or in equity in the event of a coverage dispute; and

(d) The right to supplement this submission with additional documentation, information, or argument as may be appropriate.

Quorum does not waive, and nothing in this submission shall be construed as waiving, any coverage rights, defenses, or arguments available to Quorum under the Policy or applicable law by reason of this submission or any statement made herein.

IX. Request for Reimbursement

Based on the foregoing, Quorum Insurance Holdings Corp. hereby formally requests that Atlas Mutual Insurance Company reimburse Quorum in the amount of $5,730,250, representing the total incident response costs of $8,230,250 less the $2,500,000 self-insured retention, in accordance with the terms and conditions of the Policy.

Quorum requests that payment be directed to Quorum's designated bank account. Wire transfer instructions will be provided separately and promptly upon Atlas's request, through Calderwood & Harkness or Quorum's treasury department, as Atlas may prefer.

We respectfully request that Atlas confirm receipt of this submission and provide an anticipated timeline for the completion of claims processing and the issuance of payment. We understand that Atlas may wish to review the enclosed documentation and we are prepared to respond promptly to any questions, requests for supplemental information, or clarifications that Atlas may require.

For any questions or requests for additional documentation in connection with this submission, please contact:

Rachel Bernstein, Partner Calderwood & Harkness LLP 51 West 52nd Street, 34th Floor New York, New York 10019 Tel: (212) 555-7200

Email: rbernstein@calderwoodharkness.com

Kevin Ostrowski, Partner Calderwood & Harkness LLP 1700 K Street NW, Suite 900 Washington, D.C. 20006 Tel: (202) 555-4800

Email: kostrowski@calderwoodharkness.com

We appreciate Atlas's attention to this matter and look forward to a prompt resolution.

Respectfully submitted,

CALDERWOOD & HARKNESS LLP

By: ________

Kevin Ostrowski Partner, Privacy & Data Security Calderwood & Harkness LLP 1700 K Street NW, Suite 900 Washington, D.C. 20006

On behalf of Quorum Insurance Holdings Corp.

cc (via email):

Thomas R. Whitfield, General Counsel, Quorum Insurance Holdings Corp.

Jennifer Liang, Chief Privacy Officer, Quorum Insurance Holdings Corp.

Rachel Bernstein, Partner, Calderwood & Harkness LLP

Sandra Whitmore-Kim, Lead Broker, Whitmore Risk Advisors Inc., 390 Park Avenue, 18th Floor, New York, NY 10022

Lisa Garner, Claims Contact, Pinnacle Surplus Lines Insurance Corp., One Beacon Street, Suite 1100, Boston, MA 02108 (courtesy copy — excess carrier notification)

Enclosures: Exhibits 1 through 9 (as described in Section VII above)

Policy Element	Detail
Insurer	Atlas Mutual Insurance Company
Policy Number	CYB-2023-041587
Named Insured	Quorum Insurance Holdings Corp.
Policy Period	January 1, 2023 – January 1, 2024
Per-Occurrence Limit of Liability	$15,000,000
Aggregate Limit of Liability	$15,000,000
Self-Insured Retention (SIR)	$2,500,000
Item	Amount
Total Incident Response Costs	$8,230,250
Less: Self-Insured Retention	($2,500,000)
Net Amount Claimed Under Primary Policy	$5,730,250
Timekeeper	Role	Rate	Approx. Hours
Kevin Ostrowski	Responsible Partner	$1,250/hour	—
Rachel Bernstein	Billing Partner	$1,175/hour	—
Alan Burke	Lead Associate	$825/hour	—
Sara Hendricks	Working Associate	$650/hour	—
Blended	All timekeepers	$901.56/hour (eff.)	~2,400 hours
Cost Category	Vendor / Entity	Amount
Forensic Investigation	Graystone Forensics LLC	$1,847,000
Notification & Credit Monitoring	Clearfield Notification Services LLC	$3,214,500
Crisis Communications / PR	BrightPath Consulting Group Inc.	$385,000
Outside Counsel Legal Fees	Calderwood & Harkness LLP	$2,163,750
Internal Costs	Quorum Insurance Holdings Corp.	$620,000
Total Incident Response Costs	$8,230,250

Less: Self-Insured Retention	($2,500,000)
Net Amount Claimed Under Primary Policy	$5,730,250

CALDERWOOD & HARKNESS LLP Attorneys at Law
1700 K Street NW, Suite 900 Washington, D.C. 20006 Tel: (202) 555-4800 | Fax: (202) 555-4801 www.calderwoodharkness.com
November 15, 2023
Via Email and Certified Mail, Return Receipt Requested
Mr. Paul Enriquez Claims Adjuster Atlas Mutual Insurance Company 120 South LaSalle Street, Suite 3200 Chicago, IL 60603
Re: Proof of Loss and Final Cost Summary — Quorum Insurance Holdings Corp. Policy No.: CYB-2023-041587 Claim No.: CYB-CLM-2023-05892 Date of Loss: March 14, 2023 – April 18, 2023 Calderwood & Harkness Matter No.: 1025-00006
Dear Mr. Enriquez:
I. Introduction and Purpose
This firm represents Quorum Insurance Holdings Corp. ("Quorum" or "QIH"), a Delaware corporation publicly traded on the Nasdaq Stock Market (ticker: QIHC) and headquartered at 400 Constitution Plaza, Suite 2200, Hartford, Connecticut 06103 (EIN: 06-4832197). We submit this letter, together with the enclosed supporting documentation, on behalf of Quorum for the purpose of presenting to Atlas Mutual Insurance Company ("Atlas") the formal Proof of Loss and Final Cost Summary arising from the cybersecurity incident described herein, as required under the Cyber-Liability Insurance Policy No. CYB-2023-041587 (the "Policy") issued by Atlas to Quorum for the policy period of January 1, 2023 through January 1, 2024.
As Atlas is aware, Quorum submitted its initial Notice of Claim by letter dated May 8, 2023, promptly upon the engagement of this firm and the commencement of incident response activities. Atlas acknowledged receipt of the Notice of Claim and assigned Claim No. CYB-CLM-2023-05892. Subsequently, Atlas confirmed acceptance of coverage for the principal incident response cost categories at issue, including forensic investigation costs, consumer notification costs, credit monitoring and identity theft protection costs, crisis communications and public relations costs, and regulatory defense costs, in each case subject to the terms, conditions, and limitations of the Policy, including the $2,500,000 self-insured retention (the "SIR").
As of the date of this letter, all incident response activities related to the covered cybersecurity incident have been substantially completed, and all final costs are now determinable. The forensic investigation has concluded, all consumer notifications have been mailed, call center operations have wound down, credit monitoring enrollment is well underway, all regulatory engagements have been resolved favorably without enforcement action, and all vendor invoices have been finalized. Accordingly, Quorum is now in a position to present this Final Cost Summary and to request reimbursement of the amounts due under the Policy.
We note that the sharing of certain privileged and confidential information in connection with this submission is governed by the Common Interest Agreement dated May 10, 2023, entered into between Quorum and Atlas (the "CIA"). Nothing in this submission is intended to waive, and Quorum expressly does not waive, any applicable attorney-client privilege, work product protection, or other applicable privilege or immunity. Information designated as privileged and confidential is shared solely pursuant to the terms of the CIA and is not intended for disclosure to any third party except as contemplated by the CIA.
II. Summary of the Covered Incident
2.1 Nature of the Incident
The covered cybersecurity incident arose from a vendor-originated data breach at Palomar Data Solutions, Inc. ("Palomar"), a Texas corporation headquartered at 7100 Greenville Avenue, Suite 450, Dallas, Texas 75231 (EIN: 75-3291048). Palomar serves as Quorum's third-party claims-processing vendor pursuant to a Master Services Agreement originally dated November 12, 2019, as subsequently amended by Amendment No. 1, dated March 3, 2021, and Amendment No. 2, dated September 15, 2022 (collectively, the "MSA"). Under the MSA, as amended, the annual contract value is approximately $16,300,000 (post-Amendment No. 1). Palomar is responsible for receiving, processing, adjudicating, and managing claims data on behalf of Quorum's personal lines insurance division, which encompasses homeowners, renters, and personal automobile products. In the ordinary course of this engagement, Palomar receives and processes significant volumes of personally identifiable information, financial data, and, in the context of workers' compensation and certain health-related claims, protected health information pertaining to Quorum's policyholders and claimants.
2.2 Attack Vector and Timeline
Based on the forensic investigation conducted by Graystone Forensics LLC, as discussed further below, the relevant timeline and attack vector are summarized as follows:
•  On or about March 14, 2023, a threat actor exploited a known but unpatched remote code execution vulnerability, designated CVE-2023-0669, present in Palomar's GoAnywhere MFT (Managed File Transfer) file transfer appliance, to gain unauthorized initial access to Palomar's network environment. The vulnerability had been publicly disclosed and a patch made available by the software vendor prior to Palomar's exploitation; however, Palomar had not yet applied the relevant security patch at the time of the compromise.
•  March 14, 2023 – April 18, 2023 (approximately 35 days): Following initial access, the threat actor conducted lateral movement within Palomar's network, escalated privileges, and systematically identified and exfiltrated structured data files containing Quorum policyholder and claimant data. The exfiltration occurred in multiple stages over the approximately 35-day window, utilizing encrypted channels designed to evade detection by Palomar's existing network monitoring and intrusion detection systems.
•  April 18, 2023: Palomar's Security Operations Center ("SOC") identified anomalous outbound data transfer activity during routine log review. The SOC initiated its internal incident response procedures and commenced containment activities.
•  April 21, 2023: Palomar formally notified Quorum of the security incident. This notification occurred approximately 72 hours after Palomar's internal discovery — approximately 24 hours beyond the 48-hour contractual notification requirement set forth in Section 9.4 of the MSA. Quorum has separately addressed Palomar's late notification as part of the vendor indemnification and settlement process discussed in Section VI below.
2.3 Scope of Compromised Data
The forensic investigation confirmed that data pertaining to a total of 318,247 individuals across 29 states and the District of Columbia was compromised during the incident. The types of data compromised are categorized as follows:
•  Personally Identifiable Information (PII): Full names, dates of birth, Social Security numbers, and driver's license numbers — affecting all 318,247 individuals within the scope of the breach.
•  Financial Information: Bank account numbers and payment card numbers — affecting a subset of 84,619 individuals whose claims involved direct deposit payments or premium payment card information.
•  Protected Health Information (PHI): Health conditions, medical diagnosis codes (ICD-10), and treatment information associated with workers' compensation claims and certain health-related insurance claims — affecting a subset of 41,203 individuals. The presence of PHI triggered additional notification obligations under the Health Insurance Portability and Accountability Act of 1996 ("HIPAA") and corresponding state health data breach notification statutes.
2.4 Incident Response Activities Undertaken
Upon receiving notification from Palomar, Quorum promptly activated its incident response plan and undertook the following principal response activities:
•  May 4, 2023: Quorum engaged Calderwood & Harkness LLP as outside breach counsel to coordinate the incident response, oversee the forensic investigation under the protection of the attorney-client privilege, conduct a multi-jurisdictional notification law analysis, prepare and file all required regulatory and consumer notifications, manage regulatory defense, and advise Quorum's board and management on disclosure obligations. The Calderwood & Harkness engagement team consisted of Kevin Ostrowski, Partner (Responsible Partner); Rachel Bernstein, Partner (Billing Partner); Alan Burke, Associate (Lead Associate); and Sara Hendricks, Associate (Working Associate).
•  May 5, 2023: At the direction of Calderwood & Harkness LLP, Quorum retained Graystone Forensics LLC ("Graystone") to conduct an independent forensic investigation of the Palomar security incident. Graystone was engaged under the attorney-client privilege umbrella, with all reports and findings directed to and through Calderwood & Harkness. The Graystone engagement was led by Dr. Nolan Briggs, Managing Director, Incident Response, with Kendra Faulkner, Senior Forensic Analyst, serving as the day-to-day analytical lead.
•  June 2, 2023: Graystone delivered its Preliminary Forensic Findings Report, confirming the initial assessment that structured data files containing Quorum policyholder and claimant data had been exfiltrated from Palomar's network environment. The preliminary report identified the CVE-2023-0669 vulnerability as the initial attack vector and confirmed evidence of lateral movement within Palomar's network.
•  July 14, 2023: Graystone delivered its Final Forensic Investigation Report, providing a comprehensive and definitive assessment of the full scope of the breach, including the complete identification of compromised data types, the total number of affected individuals, and a detailed timeline of the threat actor's activities within Palomar's environment.
•  August 4, 2023: Data mining and affected individual identification activities were completed, enabling Quorum to identify all 318,247 individuals whose data was compromised and to determine the specific data elements affected for each individual. This step was essential for the preparation of individualized notification letters and the determination of applicable state and federal notification obligations.
•  August 6, 2023: Quorum engaged Clearfield Notification Services LLC ("Clearfield") for consumer notification printing and mailing, call center operations, and credit monitoring and identity theft protection enrollment services. Jerome Tillman served as Clearfield's designated Account Manager. A detailed Statement of Work was executed on this date.
•  August 14–25, 2023: Quorum, through Calderwood & Harkness, filed regulatory notifications with the appropriate regulatory authorities in all 29 affected states and the District of Columbia, as well as with the Connecticut Insurance Department (given Quorum's domiciliary state) and the U.S. Department of Health and Human Services, Office for Civil Rights ("HHS-OCR"), in compliance with HIPAA's Breach Notification Rule (45 C.F.R. §§ 164.400–414). All filings were confirmed timely under applicable statutory deadlines.
•  August 18 – September 15, 2023: Consumer notification letters were mailed to all 318,247 affected individuals on a rolling basis over approximately 28 days. Three versions of the notification letter were prepared — a general PII version, a financial data version (for individuals whose financial information was compromised), and a PHI/HIPAA-compliant version (for individuals whose protected health information was compromised) — each tailored to address the specific data elements affected and the specific remedial services offered.
•  BrightPath Consulting Group Inc. ("BrightPath") was retained for crisis communications and public relations strategy. The BrightPath engagement was led by Meredith Ashford, Managing Director. BrightPath's scope of work included the development and execution of an external communications strategy (press statements, media monitoring, and stakeholder outreach), internal employee communications, and coordination of investor-facing disclosures in connection with Quorum's SEC reporting obligations.
•  Clearfield Notification Services LLC managed call center operations through a dedicated toll-free number for a 12-week operational window, staffed by trained agents utilizing approved scripts and frequently asked questions documents. Additionally, Clearfield administered the enrollment of affected individuals in 24-month credit monitoring and identity theft protection services.
2.5 Regulatory Outcomes
We are pleased to report that all regulatory engagements arising from this incident have been resolved favorably, with no enforcement action taken against Quorum by any regulatory authority. Specifically:
•  Multistate Attorney General Coalition (29 states): A coalition of attorneys general from the 29 affected states, led by Assistant Attorney General Diane Marchetti of the Connecticut Attorney General's Office and Assistant Attorney General Mark Petrosian of the New York Attorney General's Office, conducted a joint inquiry into the incident. Following Quorum's full cooperation, including detailed written responses and supplemental documentation, the multistate coalition issued a closure letter dated November 22, 2023, indicating that no further action would be taken. A copy of this closure letter is enclosed as part of Exhibit 9.
•  Connecticut Insurance Department: Examiner Richard Nakamura of the Connecticut Insurance Department conducted a regulatory inquiry into the incident in light of Quorum's status as a Connecticut-domiciled insurer. The inquiry focused on Quorum's compliance with Connecticut's insurance data security laws and the adequacy of Quorum's vendor oversight. The Connecticut Insurance Department closed its inquiry by letter dated November 28, 2023, with no adverse findings. A copy of this closure letter is enclosed as part of Exhibit 9.
•  HHS Office for Civil Rights (Region I, Boston): HHS-OCR conducted a review of the breach notification submitted by Quorum under HIPAA's Breach Notification Rule with respect to the 41,203 individuals whose protected health information was compromised. HHS-OCR issued a no further action letter dated November 30, 2023, confirming that the matter was closed. A copy of this letter is enclosed as part of Exhibit 9.
The favorable resolution of all regulatory matters reflects Quorum's diligent, transparent, and cooperative approach to incident response and regulatory engagement, undertaken with the guidance and representation of Calderwood & Harkness throughout.
III. Policy Coverage Summary
The relevant terms of the Policy applicable to this claim are summarized below for ease of reference:
The following covered cost categories under the Policy are applicable to this claim:
(a) First-Party Forensic Investigation Costs — costs and expenses incurred for the engagement of forensic investigators to determine the cause, scope, and extent of a covered cybersecurity incident, including the identification of compromised data;
(b) Consumer Notification Costs — costs and expenses incurred for the preparation, printing, and mailing of notification letters to affected individuals, including address verification and return mail processing, as required by applicable data breach notification laws;
(c) Call Center Costs — costs and expenses incurred for the establishment and operation of a dedicated call center to respond to inquiries from affected individuals;
(d) Credit Monitoring and Identity Theft Protection Costs — costs and expenses incurred for the provision of credit monitoring and identity theft protection services to affected individuals;
(e) Crisis Communications / Public Relations Costs — costs and expenses incurred for the engagement of public relations and crisis communications consultants to manage reputational risk and stakeholder communications in connection with a covered cybersecurity incident;
(f) Regulatory Defense Costs — legal fees and expenses incurred in connection with regulatory notification compliance, responses to regulatory inquiries, and defense of regulatory proceedings arising from a covered cybersecurity incident; and
(g) Outside Counsel Legal Fees — reasonable and necessary legal fees incurred in connection with the foregoing incident response activities, including breach counsel coordination, privilege-protected forensic investigation oversight, multi-jurisdictional notification law analysis, regulatory engagement, and related advisory services.
Atlas previously confirmed coverage for each of the foregoing cost categories, subject to the SIR and the terms and conditions of the Policy.
Additionally, Quorum maintains an excess cyber-liability insurance policy issued by Pinnacle Surplus Lines Insurance Corp., Policy No. XS-CYB-2023-7812, providing $25,000,000 in coverage excess of the $15,000,000 Atlas primary layer, on a follow-form basis. The total insurance tower applicable to this risk is therefore $40,000,000. As the total costs claimed herein ($8,230,250 gross; $5,730,250 net of SIR) fall well within the Atlas primary layer, attachment of the Pinnacle excess layer is not implicated by this claim. Notwithstanding, a courtesy copy of this submission is being provided to Lisa Garner at Pinnacle, as reflected in the distribution list below, for excess carrier notification purposes.
IV. Final Cost Summary / Itemized Schedule of Loss
4.1 Overview.  The total incident response costs incurred by Quorum in connection with the covered cybersecurity incident are $8,230,250. After application of the $2,500,000 SIR, the net amount claimed under the Atlas primary policy is $5,730,250. A detailed breakdown of costs by category is set forth below.
Summary of Claimed Amounts
Each cost category is described in detail in the following subsections.
4.2 Category 1: Forensic Investigation Costs
Vendor: Graystone Forensics LLC Address: 1950 Old Gallows Road, Suite 600, Tysons Corner, Virginia 22182 Engagement Lead: Dr. Nolan Briggs, Managing Director, Incident Response Analyst Lead: Kendra Faulkner, Senior Forensic Analyst
Scope of Engagement: Graystone Forensics LLC was retained on May 5, 2023, at the direction of Calderwood & Harkness LLP, to conduct a comprehensive forensic investigation of the Palomar Data Solutions security incident. The engagement was structured under the attorney-client privilege umbrella, with Graystone serving as a consulting expert retained by counsel. The scope of work encompassed: (i) determination of the threat actor's initial entry vector and exploitation methodology; (ii) analysis of the threat actor's lateral movement, privilege escalation, and persistence mechanisms within Palomar's network environment; (iii) identification and quantification of exfiltrated data, including the types and volumes of structured data files accessed and removed; (iv) assessment of the specific data elements compromised for each affected individual; (v) development of a comprehensive incident timeline; and (vi) preparation of a preliminary findings report and a final forensic investigation report.
Deliverables: Graystone delivered its Preliminary Forensic Findings Report on June 2, 2023, and its Final Forensic Investigation Report on July 14, 2023. Both reports were delivered to and addressed to Calderwood & Harkness LLP as privileged work product.
Total Fees Invoiced: $1,847,000
Supporting documentation, including the Graystone engagement letter dated May 5, 2023, all invoices rendered by Graystone in connection with this engagement, and a summary of the scope of work performed, is enclosed herewith as Exhibit 1.
4.3 Category 2: Notification and Credit Monitoring Costs
Vendor: Clearfield Notification Services LLC Address: 4500 Rockside Road, Suite 210, Independence, Ohio 44131 Account Manager: Jerome Tillman
Scope of Engagement: Clearfield Notification Services LLC was engaged effective August 6, 2023, pursuant to a detailed Statement of Work, to provide the following services: (i) consumer notification printing and mailing; (ii) call center operations; and (iii) credit monitoring and identity theft protection enrollment. Clearfield's services are broken down into the following sub-categories:
(a) Notification Printing and Mailing: $636,000
Clearfield prepared, printed, and mailed individualized notification letters to all 318,247 affected individuals. The per-unit cost of approximately $2.00 per notification letter encompasses printing (including personalized variable data), first-class postage, address verification services (through the National Change of Address database and related address hygiene processes), envelope assembly, and return mail processing. Three versions of the notification letter were prepared (General PII, Financial Data, and PHI/HIPAA-compliant) and mailed to the appropriate recipient populations. Mailings were completed on a rolling basis from August 18, 2023 through September 15, 2023.
(b) Call Center Operations: $478,500
Clearfield established and operated a dedicated toll-free telephone number for affected individuals to call with questions regarding the breach, the notification, and the available remedial services. The call center operated over a 12-week window, staffed by trained call center agents using scripts and frequently asked questions documents approved by Calderwood & Harkness and Quorum. The call center handled inquiries regarding the nature and scope of the incident, the types of data compromised, enrollment in credit monitoring and identity theft protection services, and related topics.
(c) Credit Monitoring and Identity Theft Protection Enrollment: $2,100,000
Clearfield administered the enrollment of affected individuals in a 24-month credit monitoring and identity theft protection program. Based on industry experience and the demographic profile of the affected population, the parties estimated an enrollment take-rate of approximately 40%, yielding an estimated 127,299 enrollees. At an estimated per-enrollee cost of approximately $18.00 per month over the 24-month period, the total estimated cost for this service would have been substantially higher under a per-enrollee, per-month pricing model. To manage cost exposure and provide certainty, Quorum, through Calderwood & Harkness, negotiated a flat-fee arrangement with Clearfield at $2,100,000, which caps Quorum's obligation for credit monitoring services regardless of the actual enrollment rate. This flat-fee structure represents a favorable outcome for both Quorum and Atlas, as it eliminates the risk of cost overruns associated with higher-than-expected enrollment rates.
Total Fees Invoiced: $3,214,500
Supporting documentation, including the Clearfield Statement of Work executed August 6, 2023, all invoices rendered by Clearfield, and a summary of enrollment statistics, is enclosed herewith as Exhibit 2.
4.4 Category 3: Crisis Communications / Public Relations Costs
Vendor: BrightPath Consulting Group Inc. Address: 450 Lexington Avenue, 4th Floor, New York, New York 10017 Engagement Lead: Meredith Ashford, Managing Director
Scope of Engagement: BrightPath Consulting Group Inc. was retained to develop and execute a comprehensive communications strategy in connection with the cybersecurity incident. BrightPath's scope of work included: (i) external communications strategy, including the preparation of press statements, media monitoring, and proactive and reactive media engagement; (ii) internal employee communications, including talking points for customer-facing personnel and company-wide notifications; (iii) coordination with Quorum's investor relations team and outside securities counsel regarding investor-facing disclosures and SEC reporting obligations; and (iv) ongoing reputational risk assessment and strategic advisory services throughout the incident response period.
BrightPath's engagement was integral to the management of stakeholder communications during a period of heightened public and regulatory scrutiny. The firm's efforts contributed to the absence of significant adverse media coverage and the preservation of Quorum's reputation in the marketplace.
Total Fees Invoiced: $385,000
Supporting documentation, including the BrightPath engagement letter and all invoices rendered in connection with this engagement, is enclosed herewith as Exhibit 3.
4.5 Category 4: Outside Counsel Legal Fees
Firm: Calderwood & Harkness LLP Address: 1700 K Street NW, Suite 900, Washington, D.C. 20006 Engagement Date: May 4, 2023 Matter No.: 1025-00006
Scope of Engagement: Calderwood & Harkness LLP was engaged as outside breach counsel to coordinate all aspects of Quorum's incident response. The scope of legal services provided in this matter included, without limitation:
(i) Overall incident response coordination and project management;
(ii) Oversight of the forensic investigation under the attorney-client privilege umbrella, including direction and supervision of Graystone Forensics LLC;
(iii) Comprehensive 50-state data breach notification law analysis to determine the applicable notification obligations in each affected jurisdiction;
(iv) Drafting and review of consumer notification letters (three versions: General PII, Financial Data, and PHI/HIPAA-compliant);
(v) Preparation and filing of regulatory notifications with authorities in all 29 affected states, the District of Columbia, the Connecticut Insurance Department, and HHS-OCR;
(vi) Regulatory defense, including preparation of written responses to the multistate attorney general coalition inquiry (led by the Connecticut and New York AG offices), management of the Connecticut Insurance Department examination, and response to HHS-OCR review;
(vii) Vendor indemnification analysis and negotiation of the settlement agreement with Palomar Data Solutions, Inc.;
(viii) Cyber-insurance coordination, including preparation and submission of the initial Notice of Claim, ongoing communication with Atlas regarding coverage, and preparation of this Proof of Loss and Final Cost Summary;
(ix) Board and senior management reporting, including preparation of board-level memoranda and presentations for Quorum's Audit Committee and Board of Directors;
(x) SEC disclosure analysis and coordination with Quorum's securities counsel regarding the company's reporting obligations under SEC rules, including assessment of materiality under the SEC's cybersecurity disclosure requirements; and
(xi) General advisory services related to Quorum's legal obligations and risk mitigation throughout the incident response period.
Timekeeper Rates and Hours:
The blended effective rate of approximately $901.56 per hour reflects the allocation of work across the engagement team, with the substantial majority of hours performed by the associate-level timekeepers at lower billing rates. The partner-level timekeepers focused on strategic oversight, regulatory engagement, client advisory, and board-level reporting, while the associates performed the analytical work, drafting, filing, and coordination activities that constituted the bulk of the engagement hours.
Total Fees Invoiced: $2,163,750
Supporting documentation, including the Calderwood & Harkness engagement letter dated May 4, 2023, all fee invoices rendered in connection with this matter, and a timekeeper summary, is enclosed herewith as Exhibit 4.
4.6 Category 5: Internal Costs
Entity: Quorum Insurance Holdings Corp. Address: 400 Constitution Plaza, Suite 2200, Hartford, Connecticut 06103
Description: Quorum incurred substantial internal costs in connection with the incident response, including the redeployment of personnel and resources across multiple departments. The internal costs reflect the time and effort expended by personnel in Quorum's Information Technology, Claims Operations, Privacy, and Legal departments, as well as administrative support functions, in connection with the following activities:
•  IT remediation and system hardening activities, including enhanced monitoring of Quorum's own network environment, review of configurations and access controls related to the Palomar integration, and implementation of additional security measures;
•  Employee overtime for manual data review, quality assurance of notification mailings, and handling of inbound customer inquiries that exceeded call center capacity;
•  Internal coordination across Quorum's operating divisions, including regular cross-functional meetings, executive briefings, and workflow management;
•  Administrative support, including document management, record-keeping, and logistical coordination with external vendors and counsel.
Key personnel whose time is reflected in the internal cost allocation include:
•  David Naranjo, Chief Information Security Officer (CISO)
•  Jennifer Liang, Chief Privacy Officer (CPO)
•  Priya Deshmukh, Vice President, Vendor Risk Management
•  Robert Wentworth, Senior Vice President, Claims Operations
•  Thomas R. Whitfield, General Counsel
Total Estimated Internal Costs: $620,000
Supporting documentation, including Quorum's internal cost allocation summary with supporting time and expense records, is enclosed herewith as Exhibit 5.
4.7 Reconciliation Summary
The following table provides a complete reconciliation of all incident response costs and the net amount claimed under the Policy:
The total amount claimed of $5,730,250 is well within the $15,000,000 per-occurrence limit and the $15,000,000 aggregate limit of liability under the Policy. As noted above, the Pinnacle excess layer does not attach.
V. Application of Self-Insured Retention
The Policy provides for a self-insured retention of $2,500,000 per covered occurrence. Quorum confirms that it has fully satisfied its SIR obligation through the payment of the first $2,500,000 in incident response costs incurred in connection with this cybersecurity incident. These costs were paid by Quorum in the ordinary course of the incident response from Quorum's own funds.
The remaining $5,730,250 in incident response costs, representing the excess of total costs over the SIR, constitutes the amount properly claimed against the Atlas primary layer. Quorum's payment of the SIR is substantiated in the attached cost documentation, which reflects the chronological sequence of expenditures and confirms that the SIR threshold was reached and exceeded during the course of the incident response.
VI. Palomar Indemnification Recovery and Subrogation Considerations
We wish to advise Atlas of a related development that is material to the administration of this claim. Quorum has reached a settlement with Palomar Data Solutions, Inc. regarding Palomar's contractual indemnification obligations arising from the security incident. The key terms of the settlement are as follows:
On October 27, 2023, Quorum and Palomar executed a Settlement Agreement and Mutual Release (the "Palomar Settlement"), a copy of which is enclosed as Exhibit 6 and is provided under the terms of the Common Interest Agreement. The Palomar Settlement provides for the following:
(a) Cash Payment: Palomar agreed to pay Quorum the sum of $4,200,000 in cash, payable within 30 days of execution of the Palomar Settlement (i.e., on or before November 26, 2023).
(b) Fee Reduction: Palomar agreed to an 18-month reduction in its service fees under the MSA of 8%, effective November 1, 2023. Based on the current annual contract value of $16,300,000, this fee reduction equates to an estimated savings of approximately $1,956,000 over the 18-month period (calculated as $16,300,000 × 8% × 1.5 years).
(c) Total Effective Recovery: The total effective recovery from Palomar, combining the cash payment and the fee reduction, is approximately $6,156,000.
For context, under the MSA, Palomar's contractual indemnification cap is set at two times the trailing twelve-month fees paid to Palomar, or $32,600,000 (2 × $16,300,000). The settlement was negotiated below this contractual cap in light of Quorum's assessment of litigation risk, including the cost and uncertainty of protracted litigation, Palomar's financial capacity, and the importance of preserving the ongoing commercial relationship between the parties.
Quorum advises Atlas of the Palomar recovery in full compliance with the Policy's "other insurance" and subrogation provisions. Quorum recognizes that the appropriate allocation of the Palomar recovery as between Quorum's own uninsured losses (including the SIR) and the amounts claimed under the Policy is a matter that requires careful analysis under the specific terms of the Policy.
In particular, Quorum seeks Atlas's input on whether, under the Policy, the Palomar recovery should be: (i) applied first to offset Quorum's SIR expenditure and any uninsured losses before reducing the claim against Atlas; (ii) applied to reduce the Atlas claim on a dollar-for-dollar basis; or (iii) apportioned on a pro rata basis between Quorum's own losses and the insured claim. Quorum's view is that the Policy's subrogation and recovery provisions, properly construed, support the application of recoveries first to the insured's own uninsured losses and SIR, consistent with the "made whole" doctrine and prevailing industry practice. However, Quorum is prepared to engage in a good-faith dialogue with Atlas on this point and welcomes Atlas's position.
Quorum expressly preserves all of its rights under the Policy and the Palomar Settlement with respect to the allocation of the Palomar recovery. Nothing in this submission is intended to concede or waive any rights Quorum may have regarding the proper treatment of the recovery under the Policy.
VII. Supporting Documentation / Exhibits
The following exhibits are enclosed with this submission and are incorporated herein by reference:
Exhibit 1: Graystone Forensics LLC — Engagement letter dated May 5, 2023; invoices; and scope of work summary.
Exhibit 2: Clearfield Notification Services LLC — Statement of Work executed August 6, 2023; invoices; and enrollment statistics summary.
Exhibit 3: BrightPath Consulting Group Inc. — Engagement letter and invoices.
Exhibit 4: Calderwood & Harkness LLP — Fee invoices, timekeeper summary, and engagement letter dated May 4, 2023.
Exhibit 5: Quorum Insurance Holdings Corp. — Internal cost allocation summary with supporting time and expense records.
Exhibit 6: Palomar Data Solutions, Inc. — Settlement Agreement and Mutual Release executed October 27, 2023 (provided under Common Interest Agreement; privileged and confidential).
Exhibit 7: Consumer notification letter samples — General PII version, Financial Data version, and PHI/HIPAA-compliant version.
Exhibit 8: Regulatory notification filing confirmation log — filings made in all 29 affected states, the District of Columbia, the Connecticut Insurance Department, and HHS-OCR, dated August 14–25, 2023; all filings confirmed timely under applicable statutory and regulatory deadlines.
Exhibit 9: Regulatory closure and no-action letters — Multistate Attorney General coalition closure letter dated November 22, 2023; Connecticut Insurance Department closure letter dated November 28, 2023; and HHS-OCR no further action letter dated November 30, 2023.
VIII. Certification and Reservation of Rights
Quorum Insurance Holdings Corp. hereby certifies, through its undersigned counsel, as follows:
1.  The amounts set forth in this Proof of Loss and Final Cost Summary represent the actual, reasonable, and necessary costs incurred by Quorum in connection with the response to the covered cybersecurity incident described herein.
2.  All costs were incurred in good faith and in accordance with the terms and conditions of the Policy, including the requirement to obtain Atlas's prior consent for the engagement of forensic investigators, notification vendors, crisis communications firms, and outside counsel, which consent was obtained at or prior to each such engagement.
3.  The supporting documentation enclosed herewith accurately reflects the costs incurred and the services rendered.
4.  Quorum has not received, and is not aware of, any indemnification, reimbursement, or other recovery from any source that would reduce the amounts claimed herein, other than the Palomar recovery described in Section VI, of which Atlas has been advised.
Notwithstanding the foregoing certification, Quorum expressly reserves all rights under the Policy, including without limitation:
(a) The right to submit additional claims for any costs not yet identified or incurred as of the date of this submission, including but not limited to any future litigation defense costs arising from third-party claims related to the cybersecurity incident, any regulatory follow-up costs, any supplemental notification costs that may be required, and any additional remediation or mitigation costs that may become necessary;
(b) The right to dispute any determination by Atlas regarding the scope of coverage, the reasonableness or necessity of costs, the application of the SIR, or the treatment of the Palomar recovery;
(c) The right to pursue any and all remedies available under the Policy, at law, or in equity in the event of a coverage dispute; and
(d) The right to supplement this submission with additional documentation, information, or argument as may be appropriate.
Quorum does not waive, and nothing in this submission shall be construed as waiving, any coverage rights, defenses, or arguments available to Quorum under the Policy or applicable law by reason of this submission or any statement made herein.
IX. Request for Reimbursement
Based on the foregoing, Quorum Insurance Holdings Corp. hereby formally requests that Atlas Mutual Insurance Company reimburse Quorum in the amount of $5,730,250, representing the total incident response costs of $8,230,250 less the $2,500,000 self-insured retention, in accordance with the terms and conditions of the Policy.
Quorum requests that payment be directed to Quorum's designated bank account. Wire transfer instructions will be provided separately and promptly upon Atlas's request, through Calderwood & Harkness or Quorum's treasury department, as Atlas may prefer.
We respectfully request that Atlas confirm receipt of this submission and provide an anticipated timeline for the completion of claims processing and the issuance of payment. We understand that Atlas may wish to review the enclosed documentation and we are prepared to respond promptly to any questions, requests for supplemental information, or clarifications that Atlas may require.
For any questions or requests for additional documentation in connection with this submission, please contact:
Rachel Bernstein, Partner Calderwood & Harkness LLP 51 West 52nd Street, 34th Floor New York, New York 10019 Tel: (212) 555-7200
Email: rbernstein@calderwoodharkness.com
Kevin Ostrowski, Partner Calderwood & Harkness LLP 1700 K Street NW, Suite 900 Washington, D.C. 20006 Tel: (202) 555-4800
Email: kostrowski@calderwoodharkness.com
We appreciate Atlas's attention to this matter and look forward to a prompt resolution.
Respectfully submitted,
CALDERWOOD & HARKNESS LLP
By: ________
Kevin Ostrowski Partner, Privacy & Data Security Calderwood & Harkness LLP 1700 K Street NW, Suite 900 Washington, D.C. 20006
On behalf of Quorum Insurance Holdings Corp.
cc (via email):
Thomas R. Whitfield, General Counsel, Quorum Insurance Holdings Corp.
Jennifer Liang, Chief Privacy Officer, Quorum Insurance Holdings Corp.
Rachel Bernstein, Partner, Calderwood & Harkness LLP
Sandra Whitmore-Kim, Lead Broker, Whitmore Risk Advisors Inc., 390 Park Avenue, 18th Floor, New York, NY 10022
Lisa Garner, Claims Contact, Pinnacle Surplus Lines Insurance Corp., One Beacon Street, Suite 1100, Boston, MA 02108 (courtesy copy — excess carrier notification)
Enclosures: Exhibits 1 through 9 (as described in Section VII above)
Policy Element | Detail
Insurer | Atlas Mutual Insurance Company
Policy Number | CYB-2023-041587
Named Insured | Quorum Insurance Holdings Corp.
Policy Period | January 1, 2023 – January 1, 2024
Per-Occurrence Limit of Liability | $15,000,000
Aggregate Limit of Liability | $15,000,000
Self-Insured Retention (SIR) | $2,500,000
Item | Amount
Total Incident Response Costs | $8,230,250
Less: Self-Insured Retention | ($2,500,000)
Net Amount Claimed Under Primary Policy | $5,730,250
Timekeeper | Role | Rate | Approx. Hours
Kevin Ostrowski | Responsible Partner | $1,250/hour | —
Rachel Bernstein | Billing Partner | $1,175/hour | —
Alan Burke | Lead Associate | $825/hour | —
Sara Hendricks | Working Associate | $650/hour | —
Blended | All timekeepers | $901.56/hour (eff.) | ~2,400 hours
Cost Category | Vendor / Entity | Amount
Forensic Investigation | Graystone Forensics LLC | $1,847,000
Notification & Credit Monitoring | Clearfield Notification Services LLC | $3,214,500
Crisis Communications / PR | BrightPath Consulting Group Inc. | $385,000
Outside Counsel Legal Fees | Calderwood & Harkness LLP | $2,163,750
Internal Costs | Quorum Insurance Holdings Corp. | $620,000
Total Incident Response Costs | $8,230,250
Less: Self-Insured Retention | ($2,500,000)
Net Amount Claimed Under Primary Policy | $5,730,250

CALDERWOOD & HARKNESS LLP Attorneys at Law

CALDERWOOD & HARKNESS LLP

Record

Parties

Dates

Amounts