1025-00006 · Graystone Forensics LLC · Vendor Accountability

breach-of-contract-demand-letter-palomar.docx DOCUMENT Data Privacy

79 / 88 ← → ✕

Contract analysis Extract to table

CONFIDENTIAL — SUBJECT TO ATTORNEY-CLIENT PRIVILEGE AND WORK PRODUCT PROTECTION

CALDERWOOD & HARKNESS LLP Attorneys at Law

1700 K Street NW, Suite 900 Washington, D.C. 20006

Telephone: (202) 555-8400 Facsimile: (202) 555-8401 www.calderwoodharkness.com

June 20, 2023

VIA EMAIL AND OVERNIGHT COURIER

Catherine Langford, Esq. Partner Mercer, Haight & Dunlop LLP 2100 Ross Avenue, Suite 3600 Dallas, TX 75201

Re: Breach of Data Security Obligations and Indemnification Demand — Master Services Agreement dated November 12, 2019 (as amended) between Quorum Insurance Holdings Corp. and Palomar Data Solutions, Inc.

Matter Reference: Calderwood & Harkness Matter No. 1025-00006

Dear Ms. Langford:

I. Introduction and Representation

We write on behalf of our client, Quorum Insurance Holdings Corp. ("Quorum" or "QIH"), a Delaware corporation publicly traded on the Nasdaq Global Select Market under the ticker symbol QIHC, with its principal executive offices located at 400 Constitution Plaza, Suite 2200, Hartford, Connecticut 06103. Quorum is a top-25 United States insurance holding company with operating subsidiaries licensed and doing business in all fifty states and the District of Columbia. Quorum offers a broad portfolio of personal and commercial lines insurance products, specialty insurance, and operates a proprietary digital underwriting platform known as QuorumEdge. For the fiscal year ended December 31, 2022, Quorum reported consolidated revenue of approximately $4.82 billion and employed approximately 11,400 individuals across its enterprise.

This letter is directed to Mercer, Haight & Dunlop LLP ("MHD") in its capacity as outside counsel to Palomar Data Solutions, Inc. ("Palomar" or "PDS"), a Texas corporation headquartered at 7100 Greenville Avenue, Suite 450, Dallas, Texas 75231. We understand that MHD has been engaged by Palomar in connection with the matters described herein, and we ask that you confirm your representation at your earliest convenience.

The purpose of this letter is to provide Palomar with formal notice of its material breaches of the Master Services Agreement dated November 12, 2019, as amended by Amendment 1 dated March 3, 2021, and Amendment 2 dated September 15, 2022 (collectively, the "MSA"), and to demand full indemnification under Section 12.2 of the MSA for all losses, costs, damages, and expenses arising from a significant data security incident that originated from Palomar's network and that was caused by Palomar's failure to comply with its contractual data security obligations. As set forth in detail below, Quorum has incurred and continues to incur substantial losses as a direct and proximate result of Palomar's breaches, and Quorum hereby demands indemnification in the amount of $8,230,250, subject to supplementation as additional costs are incurred or finalized.

Quorum expressly reserves all rights, claims, and remedies available to it under the MSA, at law, and in equity, including without limitation the right to seek additional indemnification up to the full contractual liability cap, the right to terminate the MSA for cause, and the right to pursue any and all applicable causes of action. Nothing in this letter shall be construed as a waiver, limitation, or relinquishment of any such right or remedy, whether or not specifically referenced herein.

II. Background — The Contractual Relationship

A. The Master Services Agreement

On November 12, 2019, Quorum and Palomar entered into the Master Services Agreement pursuant to which Palomar agreed to provide claims data processing, document management, and analytics services for Quorum's personal lines insurance division. The MSA has a five-year term commencing on November 12, 2019, and expiring on November 11, 2024, unless earlier terminated in accordance with its terms.

Under the MSA, Palomar serves as a critical vendor in Quorum's claims operations infrastructure. Palomar receives, processes, stores, and manages large volumes of sensitive data relating to Quorum's policyholders and claimants, including claims intake data, adjuster notes, settlement calculations, and associated documentation. Palomar also performs analytics services that support Quorum's actuarial and loss-reserving functions.

The original annual contract value ("ACV") under the MSA was $14,200,000, resulting in a five-year total contract value of approximately $71,000,000. Quorum is, and has been throughout the term of the MSA, Palomar's second-largest client by revenue, representing a significant portion of Palomar's annual revenue base. The scale and importance of this engagement underscores the gravity of Palomar's obligations under the MSA, particularly with respect to the security and confidentiality of the data entrusted to Palomar.

B. Amendment 1 (March 3, 2021)

On March 3, 2021, the parties executed Amendment 1 to the MSA. Amendment 1 expanded the scope of services to include data processing and integration services in connection with Quorum's proprietary QuorumEdge digital underwriting platform. The addition of QuorumEdge services reflected Quorum's growing reliance on Palomar as a data processing vendor and significantly increased the volume and sensitivity of data flowing through Palomar's systems. In connection with the expanded scope, the annual contract value was increased by $2,100,000, from $14,200,000 to $16,300,000 per year, effective as of April 1, 2021.

C. Amendment 2 (September 15, 2022)

On September 15, 2022, the parties executed Amendment 2 to the MSA. Amendment 2 was negotiated at Quorum's initiative and was designed to strengthen the data security framework governing Palomar's handling of Quorum data. Specifically, Amendment 2 updated the Data Security Exhibit (Exhibit D) to incorporate enhanced security requirements consistent with evolving industry standards and the increased threat landscape facing organizations in the insurance and financial services sectors. Among other things, Amendment 2 added a requirement that Palomar obtain and provide to Quorum an annual SOC 2 Type II audit report covering the systems and controls relevant to the services provided under the MSA. Amendment 2 also updated the minimum cyber insurance requirements applicable to Palomar, as reflected in Exhibit E. These enhanced requirements were specifically negotiated by the parties in recognition of the sensitivity of the data processed by Palomar and the critical importance of maintaining robust security controls.

D. Nature of Data Processed

The data that Palomar processes and to which Palomar has access under the MSA includes highly sensitive categories of information concerning Quorum's policyholders and claimants. This data encompasses, without limitation:

• Full names, dates of birth, and contact information;

• Social Security numbers;

• Driver's license numbers and state identification numbers;

• Bank account numbers and routing numbers;

• Payment card numbers;

• Health conditions, medical diagnoses, diagnosis codes (including ICD-10 codes), treatment information, and provider information derived from workers' compensation claims and health-related insurance claims; and

• Other categories of personally identifiable information ("PII"), protected health information ("PHI"), and financial data as those terms are defined under applicable federal and state law, including without limitation the Health Insurance Portability and Accountability Act ("HIPAA"), the Gramm-Leach-Bliley Act ("GLBA"), and the various state data breach notification and data protection statutes.

Palomar holds this data in a position of trust and confidence. The MSA, including its data security and confidentiality provisions, was specifically designed to ensure that Palomar would maintain appropriate safeguards over this data at all times. Palomar's obligations with respect to this data are not merely contractual — they are fundamental to the protection of hundreds of thousands of individuals whose most sensitive personal, financial, and health information was entrusted, through Quorum, to Palomar's care.

III. Key Contractual Obligations at Issue

This Section summarizes the specific contractual provisions that Palomar has breached or that are otherwise relevant to Quorum's indemnification demand. Quorum's recitation of these provisions is not intended to be exhaustive, and Quorum reserves the right to identify additional breached provisions as the investigation continues.

A. Data Security Obligations — Exhibit D (as Amended)

Exhibit D to the MSA, as amended by Amendment 2 dated September 15, 2022 (the "Data Security Exhibit"), sets forth Palomar's data security obligations with respect to Quorum data. The Data Security Exhibit requires Palomar, at its own cost and expense, to implement and maintain "commercially reasonable" administrative, technical, and physical safeguards designed to protect the confidentiality, integrity, and availability of Quorum data against unauthorized access, use, disclosure, alteration, or destruction. These safeguards must be consistent with industry standards, including the standards published by the National Institute of Standards and Technology ("NIST") and other applicable frameworks.

Of particular relevance to the matters at hand, the Data Security Exhibit includes the following critical requirements:

Critical Patching Obligation. Exhibit D, Section 4.3(b), requires Palomar to apply patches for critical and high-severity vulnerabilities within thirty (30) calendar days of the date on which the applicable vendor makes the patch generally available. This patching obligation is a cornerstone of any reasonable vulnerability management program and reflects the parties' mutual understanding that timely remediation of known vulnerabilities is essential to the security of the data environment. As set forth below, Palomar's failure to comply with this obligation was the direct and proximate cause of the security incident at issue.

Annual Penetration Testing. Exhibit D, Section 5.1, requires Palomar to conduct annual penetration testing of its systems and networks relevant to the services provided under the MSA, using qualified third-party security professionals, and to promptly remediate any critical or high-severity findings.

SOC 2 Type II Audit Reports. As added by Amendment 2, Exhibit D, Section 6.2, requires Palomar to obtain and provide to Quorum an annual SOC 2 Type II audit report covering the design and operating effectiveness of Palomar's controls relevant to the Trust Services Criteria applicable to the services performed under the MSA.

B. Breach Notification Obligation — Section 9.4

Section 9.4 of the MSA imposes a time-critical notification obligation on Palomar. Specifically, Section 9.4 requires Palomar to notify Quorum in writing within forty-eight (48) hours of discovering any security incident, data breach, or unauthorized access, use, or disclosure involving or reasonably believed to involve Quorum data. The notification must include, to the extent known at the time, a description of the nature and scope of the incident, the categories of data affected, the actions taken or planned by Palomar in response, and the identity of a designated point of contact at Palomar.

This 48-hour notification window reflects the parties' shared understanding that timely notification is essential. Quorum, as the data controller and the entity with direct relationships with affected policyholders and claimants, must be in a position to promptly assess the nature and scope of any incident, activate its own incident response protocols, engage its regulatory counsel and cybersecurity advisors, evaluate its notification obligations under the patchwork of federal and state data breach notification laws, and take protective action on behalf of affected individuals. Every hour of delay in notification translates directly into delay in Quorum's ability to discharge these critical responsibilities.

C. Indemnification — Section 12.2

Section 12.2 of the MSA provides that Palomar shall indemnify, defend, and hold harmless Quorum and its affiliates, directors, officers, employees, agents, and representatives (collectively, the "Quorum Indemnitees") from and against any and all losses, liabilities, damages, costs, and expenses, including reasonable attorneys' fees and expenses, arising out of or relating to any breach by Palomar of its data security, confidentiality, or privacy obligations under the MSA or any exhibit thereto.

The indemnification obligations under Section 12.2 are subject to a liability cap equal to two times (2×) the aggregate fees paid by Quorum to Palomar during the twelve (12) month period immediately preceding the event giving rise to the indemnification claim. Based on the current annual contract value of $16,300,000, the applicable indemnification cap is $32,600,000. As set forth below, Quorum's current demand of $8,230,250 is well within this cap.

D. Insurance Requirements — Exhibit E

Exhibit E to the MSA sets forth minimum insurance requirements applicable to Palomar. As amended by Amendment 2, Exhibit E requires Palomar to procure and maintain, at its own expense, cyber liability insurance coverage with a minimum limit of not less than $10,000,000 per occurrence and in the aggregate. Palomar is required to name Quorum as an additional insured under such policy and to provide certificates of insurance to Quorum upon request. Quorum expects Palomar to tender this matter to its cyber liability insurer promptly, if it has not already done so, and to keep Quorum apprised of the status of any insurance coverage available to fund Palomar's indemnification obligations.

E. Termination for Cause — Section 14.2

Section 14.2 of the MSA provides that either party may terminate the MSA upon written notice if the other party commits a material breach of the MSA and fails to cure such breach within thirty (30) calendar days after receipt of written notice specifying the nature of the breach. As discussed in Section V.C below, the breaches at issue are not susceptible to cure — the data has been exfiltrated and the harm to Quorum and its policyholders and claimants has already been suffered. Quorum expressly reserves its right to terminate the MSA for cause under Section 14.2 and will evaluate the exercise of that right in due course.

IV. The Security Incident — Facts

Based on the information available to Quorum as of the date of this letter — including Palomar's breach notification, subsequent communications between the parties, and the preliminary findings of the forensic investigation conducted under the direction of this firm — the relevant facts are as follows.

A. Unauthorized Access and Exploitation

On or about March 14, 2023, a threat actor exploited a known remote code execution vulnerability identified as CVE-2023-0669 in a GoAnywhere MFT (Managed File Transfer) appliance operated by Palomar as part of its file transfer infrastructure. The GoAnywhere MFT appliance is a widely used enterprise file transfer solution, and Palomar utilized this appliance in connection with the secure transfer of data files between Palomar's systems and those of its clients, including Quorum.

CVE-2023-0669 is a well-documented, publicly disclosed vulnerability that was assigned a critical severity rating. The vulnerability was publicly disclosed in early February 2023, and the vendor, Severin Corporation (formerly Strathmore Industries), issued a security patch to remediate the vulnerability prior to March 14, 2023. Exploitation of this vulnerability was widely reported in the cybersecurity community, including by the Cybersecurity and Infrastructure Security Agency ("CISA"), which added CVE-2023-0669 to its Known Exploited Vulnerabilities Catalog and issued advisories urging organizations to apply the vendor patch immediately.

Despite the public availability of the vendor-issued patch, the well-documented critical severity of the vulnerability, and the active exploitation campaigns reported by CISA and other authorities, Palomar failed to apply the patch within the thirty (30) day window required by Section 4.3(b) of Exhibit D to the MSA. The GoAnywhere MFT appliance remained unpatched and vulnerable at the time of the threat actor's exploitation on or about March 14, 2023. This failure to patch was the direct gateway through which the threat actor gained unauthorized access to Palomar's network.

B. Lateral Movement and Data Exfiltration

Following the initial unauthorized access through the unpatched GoAnywhere MFT appliance, the threat actor moved laterally through Palomar's internal network, escalating privileges and accessing systems and data stores within Palomar's claims processing environment. The threat actor identified and staged data files containing Quorum policyholder and claimant information for exfiltration.

The data exfiltration window spanned approximately thirty-five (35) days, from on or about March 14, 2023, through April 18, 2023. During this period, the threat actor systematically exfiltrated structured data files from Palomar's environment. The prolonged duration of the exfiltration window — more than five weeks — raises serious questions regarding the adequacy of Palomar's network monitoring, intrusion detection, and data loss prevention capabilities. A threat actor operating undetected within a vendor's network for thirty-five days, exfiltrating large volumes of sensitive client data, is indicative of significant deficiencies in Palomar's security posture that extend well beyond the patching failure itself.

C. Palomar's discovery

On April 18, 2023, Palomar's security operations center ("SOC") detected anomalous outbound data transfers from Palomar's network. Upon detection, Palomar's SOC took steps to contain the incident and terminate the unauthorized data exfiltration. Palomar subsequently engaged its own forensic investigators and outside counsel to assess the scope and nature of the incident.

D. Palomar's Late Notification to Quorum

Palomar notified Quorum of the security incident on April 21, 2023, via email from Derek Copeland, General Counsel of Palomar, to Thomas R. Whitfield, General Counsel of Quorum, and David Naranjo, Chief Information Security Officer of Quorum. While Quorum acknowledges that Palomar did ultimately provide notification, the timing of that notification fell short of Palomar's contractual obligations.

Palomar's internal discovery of the security incident occurred on April 18, 2023. Under Section 9.4 of the MSA, Palomar was required to notify Quorum within forty-eight (48) hours of such discovery — that is, no later than April 20, 2023. Palomar's notification was not provided until April 21, 2023, approximately twenty-four (24) hours past the contractual deadline.

The delay, while it may appear modest in isolation, was consequential. In the immediate aftermath of a data security incident of this magnitude, every hour matters. The 24-hour delay hampered Quorum's ability to promptly activate its own incident response team, engage outside counsel and forensic advisors, begin assessing the scope of affected data and individuals, evaluate its notification obligations under the data breach notification statutes of the fifty states and applicable federal laws, communicate with its regulators, and take protective action on behalf of affected policyholders and claimants. Quorum was deprived of a critical day of response time at the most pivotal stage of incident management, and that delay contributed to the overall costs and complexity of Quorum's response.

E. Scope of Compromised Data — Forensic Investigation Findings

Following Palomar's April 21, 2023 notification, Quorum moved expeditiously to understand the scope and impact of the incident. On May 4, 2023, Quorum engaged Calderwood & Harkness LLP as breach response counsel. On May 5, 2023, this firm retained Graystone Forensics LLC ("Graystone"), a nationally recognized digital forensics and incident response firm, to conduct a comprehensive forensic investigation under the protection of the attorney-client privilege and work product doctrine. The engagement is directed by Dr. Nolan Briggs, Managing Director, Incident Response, at Graystone.

On June 2, 2023, Graystone delivered its preliminary forensic findings to Calderwood & Harkness. The preliminary findings confirmed that the threat actor successfully exfiltrated structured data files from Palomar's claims processing environment. These files contained data relating to Quorum policyholders and claimants, including PII, financial information, and PHI of the categories described in Section II.D above.

The forensic investigation is ongoing. Based on information available to date — including Graystone's preliminary findings and the ongoing data mining and individual identification process — the breach is expected to affect a substantial number of Quorum policyholders and claimants across multiple states. Current estimates, which are subject to refinement as the data mining process continues, indicate that approximately 318,247 unique individuals may be affected. The compromised data includes names, Social Security numbers, dates of birth, driver's license numbers, financial account information, and protected health information, creating a multi-vector risk of identity theft, financial fraud, and privacy harm for each affected individual.

Graystone's final forensic report is expected to be delivered in approximately mid-July 2023, with the individual identification and data mining process extending beyond that date. As additional information becomes available and the full scope of the incident is determined, Quorum's total costs will increase accordingly. The demand amount set forth in this letter represents Quorum's reasonable estimate of its total incident response costs based on information currently available and reasonable projections of anticipated costs. Quorum expressly reserves the right to supplement this demand as actual costs are incurred and finalized.

V. Palomar's Breaches of the MSA

Based on the foregoing facts, Palomar has committed the following material breaches of the MSA.

A. Breach of Data Security Obligations (Exhibit D)

Failure to Timely Patch Critical Vulnerability. Palomar failed to apply the vendor-issued patch for CVE-2023-0669 within thirty (30) calendar days of the date on which the patch was made generally available by the vendor, as required by Section 4.3(b) of Exhibit D to the MSA (as amended by Amendment 2, dated September 15, 2022). The GoAnywhere MFT appliance remained unpatched and vulnerable on or about March 14, 2023, when the threat actor exploited the vulnerability to gain unauthorized access to Palomar's network.

This failure constitutes a direct and material breach of Palomar's data security obligations under Exhibit D. The obligation to timely patch critical vulnerabilities is not a mere aspirational guideline — it is a specific, time-bound contractual requirement that Palomar agreed to as a condition of its engagement by Quorum. The requirement exists precisely because unpatched critical vulnerabilities represent the single most common and preventable attack vector in the modern threat landscape. Palomar's failure to comply with this fundamental obligation was the proximate cause of the threat actor's unauthorized access to Palomar's network and the subsequent exfiltration of Quorum data. But for Palomar's failure to apply the available patch within the required timeframe, the exploitation of CVE-2023-0669 would not have occurred, the threat actor would not have gained access to Palomar's network through this vector, and the data exfiltration that followed would not have taken place.

In addition to the specific patching failure, Palomar's failure to detect the threat actor's presence within its network for approximately thirty-five (35) days — during which time the threat actor moved laterally, escalated privileges, staged data, and systematically exfiltrated files — demonstrates a broader failure to maintain "commercially reasonable" administrative, technical, and physical safeguards as required by the overarching security standard set forth in Exhibit D. A commercially reasonable security program would include network monitoring, intrusion detection, and data loss prevention controls sufficient to detect and respond to the kind of sustained, large-scale data exfiltration that occurred here. Palomar's apparent failure to detect the intrusion for more than five weeks constitutes an additional and independent breach of the commercially reasonable safeguards standard.

B. Breach of Notification Obligation (Section 9.4)

Palomar failed to notify Quorum within the contractually required forty-eight (48) hour window following Palomar's discovery of the security incident on April 18, 2023. Notification was not provided until April 21, 2023 — approximately twenty-four (24) hours past the contractual deadline established by Section 9.4 of the MSA.

This breach is independently actionable. The notification obligation is a distinct and separately enforceable provision of the MSA, and Palomar's failure to comply with it is a breach regardless of whether Palomar also breached its data security obligations. The late notification compounded the harm to Quorum by delaying the activation of Quorum's incident response protocols, compressing the timeline for Quorum's regulatory and legal assessments, and increasing the overall cost and complexity of Quorum's response effort. In the context of a data breach affecting hundreds of thousands of individuals across multiple states, a 24-hour delay in notification has real and measurable consequences.

C. Materiality of Breaches

Both of the foregoing breaches are material under any reasonable standard. The patching failure directly caused the unauthorized access to and exfiltration of sensitive personal, financial, and health information of an estimated 318,247 Quorum policyholders and claimants. The consequences of this breach are severe and far-reaching: Quorum faces substantial incident response costs, regulatory scrutiny, potential enforcement actions, litigation risk, reputational harm, and the ongoing obligation to provide notification and remediation services to affected individuals. The late notification compounded Quorum's exposure by delaying its response at a critical juncture.

Importantly, these breaches are not susceptible to cure within the meaning of Section 14.2 of the MSA. The data has already been exfiltrated from Palomar's network and is in the possession of one or more threat actors. The harm to Quorum and to the affected individuals has already occurred and cannot be undone by any post-hoc remedial action by Palomar. While Palomar may take steps to improve its security posture going forward — and Quorum expects that it will do so — such steps cannot cure the breaches that have already occurred or reverse the harm that has already been suffered.

VI. Damages and Losses Arising from Palomar's Breaches

A. Overview. As a direct and proximate result of Palomar's material breaches of the MSA, Quorum has incurred and will continue to incur substantial losses, costs, and expenses in connection with its response to the security incident. These losses include, without limitation, the costs of forensic investigation, consumer notification and credit monitoring, crisis communications, legal fees, and internal remediation efforts. Quorum demands full indemnification under Section 12.2 of the MSA for all such losses, as detailed below.

B. Categories of Losses

The following is a summary of the losses Quorum has incurred or reasonably expects to incur in connection with the security incident, based on information available as of the date of this letter. As noted, these figures represent Quorum's current estimates and projections, and Quorum reserves the right to supplement this demand as additional costs are incurred or finalized.

1. Forensic Investigation Costs — $1,847,000. Quorum has retained Graystone Forensics LLC under the direction of this firm to conduct the forensic investigation into the security incident. The engagement is led by Dr. Nolan Briggs, Managing Director, Incident Response, a nationally recognized expert in digital forensics and incident response. Graystone's scope of work includes technical forensic analysis of Palomar's network and systems, identification of the attack vector and threat actor methodology, assessment of the scope and nature of data exfiltrated, data mining to identify affected individuals, and preparation of a comprehensive forensic report. Based on fees incurred to date and projected fees through the completion of the engagement (including data mining and individual identification), Quorum's total forensic investigation costs are estimated at $1,847,000.

2. Notification and Credit Monitoring Costs — $3,214,500. Quorum has contracted with Clearfield Notification Services LLC ("Clearfield") to manage the consumer notification and credit monitoring program for affected individuals. The Clearfield engagement is managed by Jerome Tillman, Account Manager, and encompasses the following components:

(a) Notification Printing and Mailing. Clearfield will prepare, print, and mail individualized notification letters to approximately 318,247 affected individuals in compliance with the notification requirements of each applicable state's data breach notification statute. Estimated cost: $636,000.

(b) Call Center Operations. Clearfield will operate a dedicated toll-free call center staffed with trained agents to handle inquiries from affected individuals during a twelve (12) week operational window following the mailing of notification letters. Estimated cost: $478,500.

(c) Credit Monitoring and Identity Theft Protection. Clearfield will offer a twenty-four (24) month credit monitoring and identity theft protection program to all affected individuals. Based on an estimated take-rate of approximately forty percent (40%), or approximately 127,299 enrollees, the negotiated flat-fee cost for this program is: $2,100,000.

The total estimated cost for notification and credit monitoring services through Clearfield is $3,214,500.

3. Crisis Communications Costs — $385,000. Quorum has retained BrightPath Consulting Group Inc. ("BrightPath"), a leading crisis communications firm, to manage external and internal communications strategy in connection with the security incident. The engagement is led by Meredith Ashford, Managing Director. BrightPath's scope of work includes preparation and coordination of press statements and media inquiries, development and delivery of internal employee communications, preparation of investor-facing disclosures and talking points, and ongoing strategic communications counsel. Fees incurred and projected through the completion of the engagement are estimated at $385,000.

4. Legal Fees — $2,163,750. Calderwood & Harkness LLP was engaged by Quorum on May 4, 2023, to serve as outside breach response counsel. The scope of this firm's engagement encompasses incident response coordination and management, oversight and direction of the forensic investigation, fifty-state notification compliance analysis and implementation, regulatory defense and preparation for potential regulatory inquiries or enforcement actions, and vendor accountability, including the preparation of this demand and any subsequent proceedings. Based on fees incurred to date and projected fees through the current phase of the engagement, Quorum's legal fees are estimated at $2,163,750. This estimate is based on approximately 2,400 hours of professional time at the following blended rates:

These rates are consistent with the prevailing market rates for attorneys of comparable experience and expertise in the data security and incident response practice area in the Washington, D.C. metropolitan area, and are reasonable in light of the complexity, scope, and urgency of this engagement.

5. Internal Costs — $620,000. Quorum has incurred and continues to incur significant internal costs in connection with its response to the security incident, including IT remediation efforts to secure Quorum's own systems and assess any residual risk from the compromise of data within Palomar's environment, employee overtime for members of Quorum's information security, legal, compliance, and customer service teams who have been diverted from their ordinary responsibilities to support the incident response effort, and other related operational costs. Quorum's internal costs are estimated at approximately $620,000.

C. Total Demand

The following table summarizes Quorum's current estimated losses:

This total demand of $8,230,250 is well within the contractual indemnification cap of $32,600,000 (calculated as two times the trailing twelve-month fees of $16,300,000) established by Section 12.2 of the MSA. Quorum hereby demands that Palomar indemnify Quorum in the full amount of $8,230,250 in accordance with its obligations under Section 12.2.

Quorum expressly reserves the right to supplement this demand as additional costs are incurred or finalized, including without limitation costs arising from the completion of the forensic investigation, completion of the data mining and individual identification process, regulatory inquiries or enforcement proceedings, third-party litigation, and any other losses or expenses attributable to Palomar's breaches. Quorum's total losses may increase materially as the investigation and response effort progresses.

VII. Quorum's Remediation Efforts and Mitigation

Quorum wishes to make clear that it has acted promptly, diligently, and responsibly to mitigate harm following its discovery of the security incident. From the moment Quorum received Palomar's notification on April 21, 2023, Quorum mobilized its internal incident response team, including its General Counsel, Chief Information Security Officer, Chief Privacy Officer, and senior members of its information technology and compliance organizations.

Within approximately two weeks of Palomar's notification, Quorum engaged Calderwood & Harkness LLP as outside breach response counsel. This firm immediately retained Graystone Forensics LLC on May 5, 2023, to initiate the forensic investigation. Quorum also moved promptly to engage Clearfield Notification Services LLC and BrightPath Consulting Group Inc. to begin preparing for consumer notification and managing communications, respectively.

On May 8, 2023, Quorum filed a claim with its cyber liability insurer, Atlas Mutual Insurance Company, under Policy No. CYB-2023-041587 (Claim No. CYB-CLM-2023-05892). Quorum is actively pursuing its insurance recovery in parallel with this indemnification demand. Any recovery obtained by Quorum under its own cyber insurance policy does not diminish or offset Palomar's indemnification obligations under Section 12.2 of the MSA, except to the extent, if any, expressly required by the MSA or applicable law.

Consumer notification planning is actively underway, with the notification timeline to be determined based on the completion of the data mining and individual identification process. Quorum's regulatory notification analysis — encompassing the data breach notification requirements of all fifty states, the District of Columbia, and applicable federal regulators — is also in progress.

Quorum's diligent mitigation efforts do not in any way diminish Palomar's indemnification obligations. To the contrary, they reflect Quorum's responsible efforts to minimize the harm caused by Palomar's breaches and to protect the interests of affected policyholders and claimants. Quorum expects that Palomar will recognize and fulfill its contractual obligation to bear the costs of these efforts.

VIII. Reservation of Rights

Quorum expressly reserves all rights, claims, and remedies available to it under the MSA, at law, and in equity, including without limitation the following:

(a) The right to seek indemnification under Section 12.2 of the MSA up to the full contractual liability cap of $32,600,000, including for losses and expenses not yet incurred or not yet quantified as of the date of this letter;

(b) The right to terminate the MSA for cause under Section 14.2, with or without providing a cure period, to the extent the breaches at issue are not susceptible to cure;

(c) The right to pursue claims for breach of contract, negligence, gross negligence, and any other applicable causes of action arising from Palomar's conduct, whether under the MSA or under applicable common law or statutory provisions;

(d) The right to seek consequential, incidental, special, and other categories of damages to the extent permitted by the MSA and applicable law;

(e) The right to supplement this demand as additional costs are incurred, as the forensic investigation and data mining process are completed, as regulatory and litigation developments unfold, and as the full scope of Quorum's losses becomes known;

(f) The right to seek recovery directly from Palomar's cyber liability insurer to the extent permitted by law and by the terms of Palomar's insurance policy; and

(g) The right to pursue any and all other remedies available to Quorum, whether or not specifically identified in this letter.

Nothing in this letter, and no action or inaction by Quorum, shall be construed as a waiver, relinquishment, or limitation of any right, claim, or remedy available to Quorum. Quorum's acceptance of any partial payment, credit, or other consideration from Palomar in connection with this matter shall not be deemed a waiver, release, satisfaction, or accord with respect to any remaining claim or demand. Quorum's decision not to exercise any particular right or remedy at this time shall not be construed as a waiver of that right or remedy and shall not preclude Quorum from exercising such right or remedy in the future.

IX. Demand for Response

Quorum hereby demands a substantive written response from Palomar, through counsel, within thirty (30) calendar days of the date of this letter — that is, no later than July 20, 2023.

Palomar's response should address, at a minimum, the following:

(a) Palomar's acknowledgment of its indemnification obligations under Section 12.2 of the MSA with respect to the losses described herein;

(b) Palomar's acceptance of Quorum's demand for indemnification in the amount of $8,230,250, or, in the alternative, a detailed explanation of any basis on which Palomar disputes any portion of the demand;

(c) A proposed timeline and mechanism for payment of the demanded amount, including whether Palomar intends to fund payment through its cyber liability insurance coverage or otherwise; and

(d) The status of Palomar's own investigation into the security incident, including any findings relevant to the scope of compromised data.

In the event Palomar fails to respond within the time specified, or disputes its indemnification obligations in whole or in part, Quorum will evaluate all available remedies, including without limitation the commencement of litigation to enforce its rights under the MSA and at law. Quorum trusts that such measures will not be necessary and that Palomar will honor its contractual commitments.

All communications regarding this matter should be directed exclusively to the undersigned:

Kevin Ostrowski, Esq. Calderwood & Harkness LLP 1700 K Street NW, Suite 900 Washington, D.C. 20006 Telephone: (202) 555-8400

Email: kostrowski@calderwoodharkness.com

Reference: Calderwood & Harkness Matter No. 1025-00006

X. Closing

Quorum looks forward to Palomar's prompt and good-faith response to this letter and to the resolution of this matter in a manner that respects the parties' contractual rights and obligations. Quorum remains willing to engage in constructive discussions regarding the resolution of its indemnification demand, including with respect to the timing and mechanics of payment. However, Quorum will not delay or forego the pursuit of its contractual and legal rights, and it expects that Palomar will treat this matter with the urgency and seriousness that it warrants.

We are available to discuss this matter at your convenience.

Respectfully,

CALDERWOOD & HARKNESS LLP

By: ________

Kevin Ostrowski Partner, Privacy & Data Security Practice

On behalf of Quorum Insurance Holdings Corp.

cc (via email):

Thomas R. Whitfield, General Counsel, Quorum Insurance Holdings Corp. Jennifer Liang, Chief Privacy Officer, Quorum Insurance Holdings Corp. David Naranjo, Chief Information Security Officer, Quorum Insurance Holdings Corp. Rachel Bernstein, Partner, Calderwood & Harkness LLP Alan Burke, Associate, Calderwood & Harkness LLP

Enclosures:

1. Copy of Master Services Agreement dated November 12, 2019

2. Copy of Amendment 1 dated March 3, 2021

3. Copy of Amendment 2 dated September 15, 2022

4. Copy of Palomar breach notification email dated April 21, 2023 (Derek Copeland to Thomas R. Whitfield and David Naranjo)

Attorney	Role	Hourly Rate
Kevin Ostrowski, Partner	Lead Engagement Partner	$1,250
Rachel Bernstein, Partner	Regulatory and Compliance	$1,175
Alan Burke, Associate	Notification Compliance and Vendor Accountability	$825
Sarah Hendricks, Associate	Forensic Oversight and Data Mining Coordination	$650
Category	Estimated Amount
Forensic Investigation (Graystone Forensics LLC)	$1,847,000
Notification and Credit Monitoring (Clearfield Notification Services LLC)	$3,214,500
Crisis Communications (BrightPath Consulting Group Inc.)	$385,000
Legal Fees (Calderwood & Harkness LLP)	$2,163,750
Internal Costs (Quorum)	$620,000
Total	$8,230,250

CONFIDENTIAL — SUBJECT TO ATTORNEY-CLIENT PRIVILEGE AND WORK PRODUCT PROTECTION
CALDERWOOD & HARKNESS LLP Attorneys at Law
1700 K Street NW, Suite 900 Washington, D.C. 20006
Telephone: (202) 555-8400 Facsimile: (202) 555-8401 www.calderwoodharkness.com
June 20, 2023
VIA EMAIL AND OVERNIGHT COURIER
Catherine Langford, Esq. Partner Mercer, Haight & Dunlop LLP 2100 Ross Avenue, Suite 3600 Dallas, TX 75201
Re: Breach of Data Security Obligations and Indemnification Demand — Master Services Agreement dated November 12, 2019 (as amended) between Quorum Insurance Holdings Corp. and Palomar Data Solutions, Inc.
Matter Reference: Calderwood & Harkness Matter No. 1025-00006
Dear Ms. Langford:
I. Introduction and Representation
We write on behalf of our client, Quorum Insurance Holdings Corp. ("Quorum" or "QIH"), a Delaware corporation publicly traded on the Nasdaq Global Select Market under the ticker symbol QIHC, with its principal executive offices located at 400 Constitution Plaza, Suite 2200, Hartford, Connecticut 06103. Quorum is a top-25 United States insurance holding company with operating subsidiaries licensed and doing business in all fifty states and the District of Columbia. Quorum offers a broad portfolio of personal and commercial lines insurance products, specialty insurance, and operates a proprietary digital underwriting platform known as QuorumEdge. For the fiscal year ended December 31, 2022, Quorum reported consolidated revenue of approximately $4.82 billion and employed approximately 11,400 individuals across its enterprise.
This letter is directed to Mercer, Haight & Dunlop LLP ("MHD") in its capacity as outside counsel to Palomar Data Solutions, Inc. ("Palomar" or "PDS"), a Texas corporation headquartered at 7100 Greenville Avenue, Suite 450, Dallas, Texas 75231. We understand that MHD has been engaged by Palomar in connection with the matters described herein, and we ask that you confirm your representation at your earliest convenience.
The purpose of this letter is to provide Palomar with formal notice of its material breaches of the Master Services Agreement dated November 12, 2019, as amended by Amendment 1 dated March 3, 2021, and Amendment 2 dated September 15, 2022 (collectively, the "MSA"), and to demand full indemnification under Section 12.2 of the MSA for all losses, costs, damages, and expenses arising from a significant data security incident that originated from Palomar's network and that was caused by Palomar's failure to comply with its contractual data security obligations. As set forth in detail below, Quorum has incurred and continues to incur substantial losses as a direct and proximate result of Palomar's breaches, and Quorum hereby demands indemnification in the amount of $8,230,250, subject to supplementation as additional costs are incurred or finalized.
Quorum expressly reserves all rights, claims, and remedies available to it under the MSA, at law, and in equity, including without limitation the right to seek additional indemnification up to the full contractual liability cap, the right to terminate the MSA for cause, and the right to pursue any and all applicable causes of action. Nothing in this letter shall be construed as a waiver, limitation, or relinquishment of any such right or remedy, whether or not specifically referenced herein.
II. Background — The Contractual Relationship
A. The Master Services Agreement
On November 12, 2019, Quorum and Palomar entered into the Master Services Agreement pursuant to which Palomar agreed to provide claims data processing, document management, and analytics services for Quorum's personal lines insurance division. The MSA has a five-year term commencing on November 12, 2019, and expiring on November 11, 2024, unless earlier terminated in accordance with its terms.
Under the MSA, Palomar serves as a critical vendor in Quorum's claims operations infrastructure. Palomar receives, processes, stores, and manages large volumes of sensitive data relating to Quorum's policyholders and claimants, including claims intake data, adjuster notes, settlement calculations, and associated documentation. Palomar also performs analytics services that support Quorum's actuarial and loss-reserving functions.
The original annual contract value ("ACV") under the MSA was $14,200,000, resulting in a five-year total contract value of approximately $71,000,000. Quorum is, and has been throughout the term of the MSA, Palomar's second-largest client by revenue, representing a significant portion of Palomar's annual revenue base. The scale and importance of this engagement underscores the gravity of Palomar's obligations under the MSA, particularly with respect to the security and confidentiality of the data entrusted to Palomar.
B. Amendment 1 (March 3, 2021)
On March 3, 2021, the parties executed Amendment 1 to the MSA. Amendment 1 expanded the scope of services to include data processing and integration services in connection with Quorum's proprietary QuorumEdge digital underwriting platform. The addition of QuorumEdge services reflected Quorum's growing reliance on Palomar as a data processing vendor and significantly increased the volume and sensitivity of data flowing through Palomar's systems. In connection with the expanded scope, the annual contract value was increased by $2,100,000, from $14,200,000 to $16,300,000 per year, effective as of April 1, 2021.
C. Amendment 2 (September 15, 2022)
On September 15, 2022, the parties executed Amendment 2 to the MSA. Amendment 2 was negotiated at Quorum's initiative and was designed to strengthen the data security framework governing Palomar's handling of Quorum data. Specifically, Amendment 2 updated the Data Security Exhibit (Exhibit D) to incorporate enhanced security requirements consistent with evolving industry standards and the increased threat landscape facing organizations in the insurance and financial services sectors. Among other things, Amendment 2 added a requirement that Palomar obtain and provide to Quorum an annual SOC 2 Type II audit report covering the systems and controls relevant to the services provided under the MSA. Amendment 2 also updated the minimum cyber insurance requirements applicable to Palomar, as reflected in Exhibit E. These enhanced requirements were specifically negotiated by the parties in recognition of the sensitivity of the data processed by Palomar and the critical importance of maintaining robust security controls.
D. Nature of Data Processed
The data that Palomar processes and to which Palomar has access under the MSA includes highly sensitive categories of information concerning Quorum's policyholders and claimants. This data encompasses, without limitation:
• Full names, dates of birth, and contact information;
• Social Security numbers;
• Driver's license numbers and state identification numbers;
• Bank account numbers and routing numbers;
• Payment card numbers;
• Health conditions, medical diagnoses, diagnosis codes (including ICD-10 codes), treatment information, and provider information derived from workers' compensation claims and health-related insurance claims; and
• Other categories of personally identifiable information ("PII"), protected health information ("PHI"), and financial data as those terms are defined under applicable federal and state law, including without limitation the Health Insurance Portability and Accountability Act ("HIPAA"), the Gramm-Leach-Bliley Act ("GLBA"), and the various state data breach notification and data protection statutes.
Palomar holds this data in a position of trust and confidence. The MSA, including its data security and confidentiality provisions, was specifically designed to ensure that Palomar would maintain appropriate safeguards over this data at all times. Palomar's obligations with respect to this data are not merely contractual — they are fundamental to the protection of hundreds of thousands of individuals whose most sensitive personal, financial, and health information was entrusted, through Quorum, to Palomar's care.
III. Key Contractual Obligations at Issue
This Section summarizes the specific contractual provisions that Palomar has breached or that are otherwise relevant to Quorum's indemnification demand. Quorum's recitation of these provisions is not intended to be exhaustive, and Quorum reserves the right to identify additional breached provisions as the investigation continues.
A. Data Security Obligations — Exhibit D (as Amended)
Exhibit D to the MSA, as amended by Amendment 2 dated September 15, 2022 (the "Data Security Exhibit"), sets forth Palomar's data security obligations with respect to Quorum data. The Data Security Exhibit requires Palomar, at its own cost and expense, to implement and maintain "commercially reasonable" administrative, technical, and physical safeguards designed to protect the confidentiality, integrity, and availability of Quorum data against unauthorized access, use, disclosure, alteration, or destruction. These safeguards must be consistent with industry standards, including the standards published by the National Institute of Standards and Technology ("NIST") and other applicable frameworks.
Of particular relevance to the matters at hand, the Data Security Exhibit includes the following critical requirements:
Critical Patching Obligation. Exhibit D, Section 4.3(b), requires Palomar to apply patches for critical and high-severity vulnerabilities within thirty (30) calendar days of the date on which the applicable vendor makes the patch generally available. This patching obligation is a cornerstone of any reasonable vulnerability management program and reflects the parties' mutual understanding that timely remediation of known vulnerabilities is essential to the security of the data environment. As set forth below, Palomar's failure to comply with this obligation was the direct and proximate cause of the security incident at issue.
Annual Penetration Testing. Exhibit D, Section 5.1, requires Palomar to conduct annual penetration testing of its systems and networks relevant to the services provided under the MSA, using qualified third-party security professionals, and to promptly remediate any critical or high-severity findings.
SOC 2 Type II Audit Reports. As added by Amendment 2, Exhibit D, Section 6.2, requires Palomar to obtain and provide to Quorum an annual SOC 2 Type II audit report covering the design and operating effectiveness of Palomar's controls relevant to the Trust Services Criteria applicable to the services performed under the MSA.
B. Breach Notification Obligation — Section 9.4
Section 9.4 of the MSA imposes a time-critical notification obligation on Palomar. Specifically, Section 9.4 requires Palomar to notify Quorum in writing within forty-eight (48) hours of discovering any security incident, data breach, or unauthorized access, use, or disclosure involving or reasonably believed to involve Quorum data. The notification must include, to the extent known at the time, a description of the nature and scope of the incident, the categories of data affected, the actions taken or planned by Palomar in response, and the identity of a designated point of contact at Palomar.
This 48-hour notification window reflects the parties' shared understanding that timely notification is essential. Quorum, as the data controller and the entity with direct relationships with affected policyholders and claimants, must be in a position to promptly assess the nature and scope of any incident, activate its own incident response protocols, engage its regulatory counsel and cybersecurity advisors, evaluate its notification obligations under the patchwork of federal and state data breach notification laws, and take protective action on behalf of affected individuals. Every hour of delay in notification translates directly into delay in Quorum's ability to discharge these critical responsibilities.
C. Indemnification — Section 12.2
Section 12.2 of the MSA provides that Palomar shall indemnify, defend, and hold harmless Quorum and its affiliates, directors, officers, employees, agents, and representatives (collectively, the "Quorum Indemnitees") from and against any and all losses, liabilities, damages, costs, and expenses, including reasonable attorneys' fees and expenses, arising out of or relating to any breach by Palomar of its data security, confidentiality, or privacy obligations under the MSA or any exhibit thereto.
The indemnification obligations under Section 12.2 are subject to a liability cap equal to two times (2×) the aggregate fees paid by Quorum to Palomar during the twelve (12) month period immediately preceding the event giving rise to the indemnification claim. Based on the current annual contract value of $16,300,000, the applicable indemnification cap is $32,600,000. As set forth below, Quorum's current demand of $8,230,250 is well within this cap.
D. Insurance Requirements — Exhibit E
Exhibit E to the MSA sets forth minimum insurance requirements applicable to Palomar. As amended by Amendment 2, Exhibit E requires Palomar to procure and maintain, at its own expense, cyber liability insurance coverage with a minimum limit of not less than $10,000,000 per occurrence and in the aggregate. Palomar is required to name Quorum as an additional insured under such policy and to provide certificates of insurance to Quorum upon request. Quorum expects Palomar to tender this matter to its cyber liability insurer promptly, if it has not already done so, and to keep Quorum apprised of the status of any insurance coverage available to fund Palomar's indemnification obligations.
E. Termination for Cause — Section 14.2
Section 14.2 of the MSA provides that either party may terminate the MSA upon written notice if the other party commits a material breach of the MSA and fails to cure such breach within thirty (30) calendar days after receipt of written notice specifying the nature of the breach. As discussed in Section V.C below, the breaches at issue are not susceptible to cure — the data has been exfiltrated and the harm to Quorum and its policyholders and claimants has already been suffered. Quorum expressly reserves its right to terminate the MSA for cause under Section 14.2 and will evaluate the exercise of that right in due course.
IV. The Security Incident — Facts
Based on the information available to Quorum as of the date of this letter — including Palomar's breach notification, subsequent communications between the parties, and the preliminary findings of the forensic investigation conducted under the direction of this firm — the relevant facts are as follows.
A. Unauthorized Access and Exploitation
On or about March 14, 2023, a threat actor exploited a known remote code execution vulnerability identified as CVE-2023-0669 in a GoAnywhere MFT (Managed File Transfer) appliance operated by Palomar as part of its file transfer infrastructure. The GoAnywhere MFT appliance is a widely used enterprise file transfer solution, and Palomar utilized this appliance in connection with the secure transfer of data files between Palomar's systems and those of its clients, including Quorum.
CVE-2023-0669 is a well-documented, publicly disclosed vulnerability that was assigned a critical severity rating. The vulnerability was publicly disclosed in early February 2023, and the vendor, Severin Corporation (formerly Strathmore Industries), issued a security patch to remediate the vulnerability prior to March 14, 2023. Exploitation of this vulnerability was widely reported in the cybersecurity community, including by the Cybersecurity and Infrastructure Security Agency ("CISA"), which added CVE-2023-0669 to its Known Exploited Vulnerabilities Catalog and issued advisories urging organizations to apply the vendor patch immediately.
Despite the public availability of the vendor-issued patch, the well-documented critical severity of the vulnerability, and the active exploitation campaigns reported by CISA and other authorities, Palomar failed to apply the patch within the thirty (30) day window required by Section 4.3(b) of Exhibit D to the MSA. The GoAnywhere MFT appliance remained unpatched and vulnerable at the time of the threat actor's exploitation on or about March 14, 2023. This failure to patch was the direct gateway through which the threat actor gained unauthorized access to Palomar's network.
B. Lateral Movement and Data Exfiltration
Following the initial unauthorized access through the unpatched GoAnywhere MFT appliance, the threat actor moved laterally through Palomar's internal network, escalating privileges and accessing systems and data stores within Palomar's claims processing environment. The threat actor identified and staged data files containing Quorum policyholder and claimant information for exfiltration.
The data exfiltration window spanned approximately thirty-five (35) days, from on or about March 14, 2023, through April 18, 2023. During this period, the threat actor systematically exfiltrated structured data files from Palomar's environment. The prolonged duration of the exfiltration window — more than five weeks — raises serious questions regarding the adequacy of Palomar's network monitoring, intrusion detection, and data loss prevention capabilities. A threat actor operating undetected within a vendor's network for thirty-five days, exfiltrating large volumes of sensitive client data, is indicative of significant deficiencies in Palomar's security posture that extend well beyond the patching failure itself.
C. Palomar's discovery
On April 18, 2023, Palomar's security operations center ("SOC") detected anomalous outbound data transfers from Palomar's network. Upon detection, Palomar's SOC took steps to contain the incident and terminate the unauthorized data exfiltration. Palomar subsequently engaged its own forensic investigators and outside counsel to assess the scope and nature of the incident.
D. Palomar's Late Notification to Quorum
Palomar notified Quorum of the security incident on April 21, 2023, via email from Derek Copeland, General Counsel of Palomar, to Thomas R. Whitfield, General Counsel of Quorum, and David Naranjo, Chief Information Security Officer of Quorum. While Quorum acknowledges that Palomar did ultimately provide notification, the timing of that notification fell short of Palomar's contractual obligations.
Palomar's internal discovery of the security incident occurred on April 18, 2023. Under Section 9.4 of the MSA, Palomar was required to notify Quorum within forty-eight (48) hours of such discovery — that is, no later than April 20, 2023. Palomar's notification was not provided until April 21, 2023, approximately twenty-four (24) hours past the contractual deadline.
The delay, while it may appear modest in isolation, was consequential. In the immediate aftermath of a data security incident of this magnitude, every hour matters. The 24-hour delay hampered Quorum's ability to promptly activate its own incident response team, engage outside counsel and forensic advisors, begin assessing the scope of affected data and individuals, evaluate its notification obligations under the data breach notification statutes of the fifty states and applicable federal laws, communicate with its regulators, and take protective action on behalf of affected policyholders and claimants. Quorum was deprived of a critical day of response time at the most pivotal stage of incident management, and that delay contributed to the overall costs and complexity of Quorum's response.
E. Scope of Compromised Data — Forensic Investigation Findings
Following Palomar's April 21, 2023 notification, Quorum moved expeditiously to understand the scope and impact of the incident. On May 4, 2023, Quorum engaged Calderwood & Harkness LLP as breach response counsel. On May 5, 2023, this firm retained Graystone Forensics LLC ("Graystone"), a nationally recognized digital forensics and incident response firm, to conduct a comprehensive forensic investigation under the protection of the attorney-client privilege and work product doctrine. The engagement is directed by Dr. Nolan Briggs, Managing Director, Incident Response, at Graystone.
On June 2, 2023, Graystone delivered its preliminary forensic findings to Calderwood & Harkness. The preliminary findings confirmed that the threat actor successfully exfiltrated structured data files from Palomar's claims processing environment. These files contained data relating to Quorum policyholders and claimants, including PII, financial information, and PHI of the categories described in Section II.D above.
The forensic investigation is ongoing. Based on information available to date — including Graystone's preliminary findings and the ongoing data mining and individual identification process — the breach is expected to affect a substantial number of Quorum policyholders and claimants across multiple states. Current estimates, which are subject to refinement as the data mining process continues, indicate that approximately 318,247 unique individuals may be affected. The compromised data includes names, Social Security numbers, dates of birth, driver's license numbers, financial account information, and protected health information, creating a multi-vector risk of identity theft, financial fraud, and privacy harm for each affected individual.
Graystone's final forensic report is expected to be delivered in approximately mid-July 2023, with the individual identification and data mining process extending beyond that date. As additional information becomes available and the full scope of the incident is determined, Quorum's total costs will increase accordingly. The demand amount set forth in this letter represents Quorum's reasonable estimate of its total incident response costs based on information currently available and reasonable projections of anticipated costs. Quorum expressly reserves the right to supplement this demand as actual costs are incurred and finalized.
V. Palomar's Breaches of the MSA
Based on the foregoing facts, Palomar has committed the following material breaches of the MSA.
A. Breach of Data Security Obligations (Exhibit D)
Failure to Timely Patch Critical Vulnerability. Palomar failed to apply the vendor-issued patch for CVE-2023-0669 within thirty (30) calendar days of the date on which the patch was made generally available by the vendor, as required by Section 4.3(b) of Exhibit D to the MSA (as amended by Amendment 2, dated September 15, 2022). The GoAnywhere MFT appliance remained unpatched and vulnerable on or about March 14, 2023, when the threat actor exploited the vulnerability to gain unauthorized access to Palomar's network.
This failure constitutes a direct and material breach of Palomar's data security obligations under Exhibit D. The obligation to timely patch critical vulnerabilities is not a mere aspirational guideline — it is a specific, time-bound contractual requirement that Palomar agreed to as a condition of its engagement by Quorum. The requirement exists precisely because unpatched critical vulnerabilities represent the single most common and preventable attack vector in the modern threat landscape. Palomar's failure to comply with this fundamental obligation was the proximate cause of the threat actor's unauthorized access to Palomar's network and the subsequent exfiltration of Quorum data. But for Palomar's failure to apply the available patch within the required timeframe, the exploitation of CVE-2023-0669 would not have occurred, the threat actor would not have gained access to Palomar's network through this vector, and the data exfiltration that followed would not have taken place.
In addition to the specific patching failure, Palomar's failure to detect the threat actor's presence within its network for approximately thirty-five (35) days — during which time the threat actor moved laterally, escalated privileges, staged data, and systematically exfiltrated files — demonstrates a broader failure to maintain "commercially reasonable" administrative, technical, and physical safeguards as required by the overarching security standard set forth in Exhibit D. A commercially reasonable security program would include network monitoring, intrusion detection, and data loss prevention controls sufficient to detect and respond to the kind of sustained, large-scale data exfiltration that occurred here. Palomar's apparent failure to detect the intrusion for more than five weeks constitutes an additional and independent breach of the commercially reasonable safeguards standard.
B. Breach of Notification Obligation (Section 9.4)
Palomar failed to notify Quorum within the contractually required forty-eight (48) hour window following Palomar's discovery of the security incident on April 18, 2023. Notification was not provided until April 21, 2023 — approximately twenty-four (24) hours past the contractual deadline established by Section 9.4 of the MSA.
This breach is independently actionable. The notification obligation is a distinct and separately enforceable provision of the MSA, and Palomar's failure to comply with it is a breach regardless of whether Palomar also breached its data security obligations. The late notification compounded the harm to Quorum by delaying the activation of Quorum's incident response protocols, compressing the timeline for Quorum's regulatory and legal assessments, and increasing the overall cost and complexity of Quorum's response effort. In the context of a data breach affecting hundreds of thousands of individuals across multiple states, a 24-hour delay in notification has real and measurable consequences.
C. Materiality of Breaches
Both of the foregoing breaches are material under any reasonable standard. The patching failure directly caused the unauthorized access to and exfiltration of sensitive personal, financial, and health information of an estimated 318,247 Quorum policyholders and claimants. The consequences of this breach are severe and far-reaching: Quorum faces substantial incident response costs, regulatory scrutiny, potential enforcement actions, litigation risk, reputational harm, and the ongoing obligation to provide notification and remediation services to affected individuals. The late notification compounded Quorum's exposure by delaying its response at a critical juncture.
Importantly, these breaches are not susceptible to cure within the meaning of Section 14.2 of the MSA. The data has already been exfiltrated from Palomar's network and is in the possession of one or more threat actors. The harm to Quorum and to the affected individuals has already occurred and cannot be undone by any post-hoc remedial action by Palomar. While Palomar may take steps to improve its security posture going forward — and Quorum expects that it will do so — such steps cannot cure the breaches that have already occurred or reverse the harm that has already been suffered.
VI. Damages and Losses Arising from Palomar's Breaches
A. Overview. As a direct and proximate result of Palomar's material breaches of the MSA, Quorum has incurred and will continue to incur substantial losses, costs, and expenses in connection with its response to the security incident. These losses include, without limitation, the costs of forensic investigation, consumer notification and credit monitoring, crisis communications, legal fees, and internal remediation efforts. Quorum demands full indemnification under Section 12.2 of the MSA for all such losses, as detailed below.
B. Categories of Losses
The following is a summary of the losses Quorum has incurred or reasonably expects to incur in connection with the security incident, based on information available as of the date of this letter. As noted, these figures represent Quorum's current estimates and projections, and Quorum reserves the right to supplement this demand as additional costs are incurred or finalized.
1. Forensic Investigation Costs — $1,847,000. Quorum has retained Graystone Forensics LLC under the direction of this firm to conduct the forensic investigation into the security incident. The engagement is led by Dr. Nolan Briggs, Managing Director, Incident Response, a nationally recognized expert in digital forensics and incident response. Graystone's scope of work includes technical forensic analysis of Palomar's network and systems, identification of the attack vector and threat actor methodology, assessment of the scope and nature of data exfiltrated, data mining to identify affected individuals, and preparation of a comprehensive forensic report. Based on fees incurred to date and projected fees through the completion of the engagement (including data mining and individual identification), Quorum's total forensic investigation costs are estimated at $1,847,000.
2. Notification and Credit Monitoring Costs — $3,214,500. Quorum has contracted with Clearfield Notification Services LLC ("Clearfield") to manage the consumer notification and credit monitoring program for affected individuals. The Clearfield engagement is managed by Jerome Tillman, Account Manager, and encompasses the following components:
(a) Notification Printing and Mailing. Clearfield will prepare, print, and mail individualized notification letters to approximately 318,247 affected individuals in compliance with the notification requirements of each applicable state's data breach notification statute. Estimated cost: $636,000.
(b) Call Center Operations. Clearfield will operate a dedicated toll-free call center staffed with trained agents to handle inquiries from affected individuals during a twelve (12) week operational window following the mailing of notification letters. Estimated cost: $478,500.
(c) Credit Monitoring and Identity Theft Protection. Clearfield will offer a twenty-four (24) month credit monitoring and identity theft protection program to all affected individuals. Based on an estimated take-rate of approximately forty percent (40%), or approximately 127,299 enrollees, the negotiated flat-fee cost for this program is: $2,100,000.
The total estimated cost for notification and credit monitoring services through Clearfield is $3,214,500.
3. Crisis Communications Costs — $385,000. Quorum has retained BrightPath Consulting Group Inc. ("BrightPath"), a leading crisis communications firm, to manage external and internal communications strategy in connection with the security incident. The engagement is led by Meredith Ashford, Managing Director. BrightPath's scope of work includes preparation and coordination of press statements and media inquiries, development and delivery of internal employee communications, preparation of investor-facing disclosures and talking points, and ongoing strategic communications counsel. Fees incurred and projected through the completion of the engagement are estimated at $385,000.
4. Legal Fees — $2,163,750. Calderwood & Harkness LLP was engaged by Quorum on May 4, 2023, to serve as outside breach response counsel. The scope of this firm's engagement encompasses incident response coordination and management, oversight and direction of the forensic investigation, fifty-state notification compliance analysis and implementation, regulatory defense and preparation for potential regulatory inquiries or enforcement actions, and vendor accountability, including the preparation of this demand and any subsequent proceedings. Based on fees incurred to date and projected fees through the current phase of the engagement, Quorum's legal fees are estimated at $2,163,750. This estimate is based on approximately 2,400 hours of professional time at the following blended rates:
These rates are consistent with the prevailing market rates for attorneys of comparable experience and expertise in the data security and incident response practice area in the Washington, D.C. metropolitan area, and are reasonable in light of the complexity, scope, and urgency of this engagement.
5. Internal Costs — $620,000. Quorum has incurred and continues to incur significant internal costs in connection with its response to the security incident, including IT remediation efforts to secure Quorum's own systems and assess any residual risk from the compromise of data within Palomar's environment, employee overtime for members of Quorum's information security, legal, compliance, and customer service teams who have been diverted from their ordinary responsibilities to support the incident response effort, and other related operational costs. Quorum's internal costs are estimated at approximately $620,000.
C. Total Demand
The following table summarizes Quorum's current estimated losses:
This total demand of $8,230,250 is well within the contractual indemnification cap of $32,600,000 (calculated as two times the trailing twelve-month fees of $16,300,000) established by Section 12.2 of the MSA. Quorum hereby demands that Palomar indemnify Quorum in the full amount of $8,230,250 in accordance with its obligations under Section 12.2.
Quorum expressly reserves the right to supplement this demand as additional costs are incurred or finalized, including without limitation costs arising from the completion of the forensic investigation, completion of the data mining and individual identification process, regulatory inquiries or enforcement proceedings, third-party litigation, and any other losses or expenses attributable to Palomar's breaches. Quorum's total losses may increase materially as the investigation and response effort progresses.
VII. Quorum's Remediation Efforts and Mitigation
Quorum wishes to make clear that it has acted promptly, diligently, and responsibly to mitigate harm following its discovery of the security incident. From the moment Quorum received Palomar's notification on April 21, 2023, Quorum mobilized its internal incident response team, including its General Counsel, Chief Information Security Officer, Chief Privacy Officer, and senior members of its information technology and compliance organizations.
Within approximately two weeks of Palomar's notification, Quorum engaged Calderwood & Harkness LLP as outside breach response counsel. This firm immediately retained Graystone Forensics LLC on May 5, 2023, to initiate the forensic investigation. Quorum also moved promptly to engage Clearfield Notification Services LLC and BrightPath Consulting Group Inc. to begin preparing for consumer notification and managing communications, respectively.
On May 8, 2023, Quorum filed a claim with its cyber liability insurer, Atlas Mutual Insurance Company, under Policy No. CYB-2023-041587 (Claim No. CYB-CLM-2023-05892). Quorum is actively pursuing its insurance recovery in parallel with this indemnification demand. Any recovery obtained by Quorum under its own cyber insurance policy does not diminish or offset Palomar's indemnification obligations under Section 12.2 of the MSA, except to the extent, if any, expressly required by the MSA or applicable law.
Consumer notification planning is actively underway, with the notification timeline to be determined based on the completion of the data mining and individual identification process. Quorum's regulatory notification analysis — encompassing the data breach notification requirements of all fifty states, the District of Columbia, and applicable federal regulators — is also in progress.
Quorum's diligent mitigation efforts do not in any way diminish Palomar's indemnification obligations. To the contrary, they reflect Quorum's responsible efforts to minimize the harm caused by Palomar's breaches and to protect the interests of affected policyholders and claimants. Quorum expects that Palomar will recognize and fulfill its contractual obligation to bear the costs of these efforts.
VIII. Reservation of Rights
Quorum expressly reserves all rights, claims, and remedies available to it under the MSA, at law, and in equity, including without limitation the following:
(a) The right to seek indemnification under Section 12.2 of the MSA up to the full contractual liability cap of $32,600,000, including for losses and expenses not yet incurred or not yet quantified as of the date of this letter;
(b) The right to terminate the MSA for cause under Section 14.2, with or without providing a cure period, to the extent the breaches at issue are not susceptible to cure;
(c) The right to pursue claims for breach of contract, negligence, gross negligence, and any other applicable causes of action arising from Palomar's conduct, whether under the MSA or under applicable common law or statutory provisions;
(d) The right to seek consequential, incidental, special, and other categories of damages to the extent permitted by the MSA and applicable law;
(e) The right to supplement this demand as additional costs are incurred, as the forensic investigation and data mining process are completed, as regulatory and litigation developments unfold, and as the full scope of Quorum's losses becomes known;
(f) The right to seek recovery directly from Palomar's cyber liability insurer to the extent permitted by law and by the terms of Palomar's insurance policy; and
(g) The right to pursue any and all other remedies available to Quorum, whether or not specifically identified in this letter.
Nothing in this letter, and no action or inaction by Quorum, shall be construed as a waiver, relinquishment, or limitation of any right, claim, or remedy available to Quorum. Quorum's acceptance of any partial payment, credit, or other consideration from Palomar in connection with this matter shall not be deemed a waiver, release, satisfaction, or accord with respect to any remaining claim or demand. Quorum's decision not to exercise any particular right or remedy at this time shall not be construed as a waiver of that right or remedy and shall not preclude Quorum from exercising such right or remedy in the future.
IX. Demand for Response
Quorum hereby demands a substantive written response from Palomar, through counsel, within thirty (30) calendar days of the date of this letter — that is, no later than July 20, 2023.
Palomar's response should address, at a minimum, the following:
(a) Palomar's acknowledgment of its indemnification obligations under Section 12.2 of the MSA with respect to the losses described herein;
(b) Palomar's acceptance of Quorum's demand for indemnification in the amount of $8,230,250, or, in the alternative, a detailed explanation of any basis on which Palomar disputes any portion of the demand;
(c) A proposed timeline and mechanism for payment of the demanded amount, including whether Palomar intends to fund payment through its cyber liability insurance coverage or otherwise; and
(d) The status of Palomar's own investigation into the security incident, including any findings relevant to the scope of compromised data.
In the event Palomar fails to respond within the time specified, or disputes its indemnification obligations in whole or in part, Quorum will evaluate all available remedies, including without limitation the commencement of litigation to enforce its rights under the MSA and at law. Quorum trusts that such measures will not be necessary and that Palomar will honor its contractual commitments.
All communications regarding this matter should be directed exclusively to the undersigned:
Kevin Ostrowski, Esq. Calderwood & Harkness LLP 1700 K Street NW, Suite 900 Washington, D.C. 20006 Telephone: (202) 555-8400
Email: kostrowski@calderwoodharkness.com
Reference: Calderwood & Harkness Matter No. 1025-00006
X. Closing
Quorum looks forward to Palomar's prompt and good-faith response to this letter and to the resolution of this matter in a manner that respects the parties' contractual rights and obligations. Quorum remains willing to engage in constructive discussions regarding the resolution of its indemnification demand, including with respect to the timing and mechanics of payment. However, Quorum will not delay or forego the pursuit of its contractual and legal rights, and it expects that Palomar will treat this matter with the urgency and seriousness that it warrants.
We are available to discuss this matter at your convenience.
Respectfully,
CALDERWOOD & HARKNESS LLP
By: ________
Kevin Ostrowski Partner, Privacy & Data Security Practice
On behalf of Quorum Insurance Holdings Corp.
cc (via email):
Thomas R. Whitfield, General Counsel, Quorum Insurance Holdings Corp. Jennifer Liang, Chief Privacy Officer, Quorum Insurance Holdings Corp. David Naranjo, Chief Information Security Officer, Quorum Insurance Holdings Corp. Rachel Bernstein, Partner, Calderwood & Harkness LLP Alan Burke, Associate, Calderwood & Harkness LLP
Enclosures:
1. Copy of Master Services Agreement dated November 12, 2019
2. Copy of Amendment 1 dated March 3, 2021
3. Copy of Amendment 2 dated September 15, 2022
4. Copy of Palomar breach notification email dated April 21, 2023 (Derek Copeland to Thomas R. Whitfield and David Naranjo)
Attorney | Role | Hourly Rate
Kevin Ostrowski, Partner | Lead Engagement Partner | $1,250
Rachel Bernstein, Partner | Regulatory and Compliance | $1,175
Alan Burke, Associate | Notification Compliance and Vendor Accountability | $825
Sarah Hendricks, Associate | Forensic Oversight and Data Mining Coordination | $650
Category | Estimated Amount
Forensic Investigation (Graystone Forensics LLC) | $1,847,000
Notification and Credit Monitoring (Clearfield Notification Services LLC) | $3,214,500
Crisis Communications (BrightPath Consulting Group Inc.) | $385,000
Legal Fees (Calderwood & Harkness LLP) | $2,163,750
Internal Costs (Quorum) | $620,000
Total | $8,230,250

CONFIDENTIAL — SUBJECT TO ATTORNEY-CLIENT PRIVILEGE AND WORK PRODUCT PROTECTION

VIA EMAIL AND OVERNIGHT COURIER

CALDERWOOD & HARKNESS LLP

Record

Parties

Dates

Amounts