1025-00006 · Graystone Forensics LLC · Vendor Accountability

rebuttal-letter-palomar-causation.docx DOCUMENT Data Privacy

86 / 88 ← → ✕

Contract analysis Extract to table

CALDERWOOD & HARKNESS LLP Attorneys at Law

1700 K Street NW, Suite 900 Washington, D.C. 20006

Telephone: (202) 554-8800 Facsimile: (202) 554-8801 www.calderwoodharkness.com

July 25, 2023

VIA EMAIL AND Sundial Data Systems

Catherine Langford, Esq. Partner Mercer, Haight & Dunlop LLP 2100 Ross Avenue, Suite 3600 Dallas, TX 75201

Re: Quorum Insurance Holdings Corp. — Indemnification Demand Against Palomar Data Solutions, Inc.; Response to Your Letter of July 7, 2023 Calderwood & Harkness Matter No. 1025-00006 Master Services Agreement dated November 12, 2019, as amended (the "MSA")

Dear Ms. Langford:

I write on behalf of our client, Quorum Insurance Holdings Corp. ("Quorum" or "QIH"), a Delaware corporation publicly traded on the Nasdaq Stock Market (ticker symbol: QIHC), with its principal offices at 400 Constitution Plaza, Suite 2200, Hartford, Connecticut 06103. I serve as the responsible partner for this engagement in the Privacy & Data Security practice of Calderwood & Harkness LLP.

We acknowledge receipt of your letter dated July 7, 2023, transmitted on behalf of your client, Palomar Data Solutions, Inc. ("Palomar"), a Texas corporation with its principal offices at 7100 Greenville Avenue, Suite 450, Dallas, Texas 75231. We have reviewed your letter and its arguments carefully, and we write to respond substantively to each of the causation defenses and liability-limitation arguments advanced therein.

The purpose of this letter is threefold: (1) to rebut, in detail, the causation defenses asserted by Palomar in its July 7, 2023 response; (2) to reject the $1,500,000 "goodwill credit" offered by Palomar as wholly inadequate and unresponsive to Quorum's indemnification demand; and (3) to reassert, in full, Quorum's indemnification demand in the amount of $8,230,250 pursuant to Section 12.2 of the MSA. Quorum continues to reserve all rights and remedies available to it under the MSA, at law, and in equity, and nothing in this letter shall be construed as a waiver or limitation of any such right or remedy.

We address each of these matters in turn below.

I. SUMMARY OF QUORUM'S INDEMNIFICATION DEMAND

By way of background and to ensure a complete record, we briefly restate the substance of the formal breach-of-contract and indemnification demand letter transmitted by this office to Mercer, Haight & Dunlop on June 20, 2023 (the "Demand Letter"). We incorporate the Demand Letter and all supporting materials previously transmitted therewith by reference as though fully set forth herein.

The Demand Letter identified two independent but related breaches of the MSA by Palomar. First, Palomar breached its data security obligations under the MSA, specifically those set forth in Exhibit D to the MSA (the "Data Security Exhibit"), as amended by Amendment No. 2 to the MSA dated September 15, 2022 ("Amendment 2"). The Data Security Exhibit, as so amended, imposes detailed and specific data security obligations on Palomar with respect to the Quorum data entrusted to Palomar for processing, storage, and management. As described in detail in the Demand Letter and further elaborated in this response, Palomar failed to satisfy those obligations in critical respects, and that failure was the direct and proximate cause of the security incident at issue.

Second, Palomar breached the incident notification obligations set forth in Section 9.4 of the MSA, which requires Palomar to provide written notice to Quorum within forty-eight (48) hours of Palomar's discovery of any security incident affecting Quorum data. As described in Section III below, Palomar failed to comply with this timeline, further compounding the harm to Quorum and the individuals whose data was compromised.

As set forth in the Demand Letter, Quorum has incurred total incident response costs of $8,230,250 as a direct result of Palomar's breaches. Those costs are itemized as follows:

We note that this demand is well within the contractual indemnification cap established under the MSA, as amended. Pursuant to Amendment No. 1 to the MSA dated March 3, 2021 ("Amendment 1"), the annual service fees payable by Quorum to Palomar were established at $16,300,000 per year. The indemnification cap under Section 12.4 of the MSA is set at two times (2×) the trailing twelve-month fees, yielding a cap of $32,600,000. Quorum's demand of $8,230,250 represents approximately 25.2% of the available indemnification cap — a figure that is both reasonable and proportionate given the severity of the data breach and the scope of Palomar's contractual failures.

II. REBUTTAL OF PALOMAR'S CAUSATION DEFENSES

Your July 7, 2023 letter advances several arguments that, individually and collectively, seek to negate or diminish Palomar's responsibility for the data breach. We address each of these arguments below and demonstrate that none of them has merit.

A. Palomar's "Sophisticated Attack" Argument Is Unavailing

Your letter characterizes the cyberattack at issue as a "sophisticated" intrusion by a "highly capable threat actor" that was, in Palomar's telling, beyond Palomar's reasonable ability to prevent. Specifically, you assert that the exploitation of CVE-2023-0669 — a remote code execution vulnerability in the GoAnywhere MFT file transfer appliance deployed in Palomar's environment — constituted a sophisticated attack that should excuse or mitigate Palomar's liability.

This argument fails on multiple grounds.

First, CVE-2023-0669 was not a zero-day vulnerability at the time of the initial unauthorized access on March 14, 2023. The vulnerability had been publicly disclosed and assigned a Common Vulnerabilities and Exposures (CVE) identifier prior to that date. The software vendor, Severin Corporation (formerly Strathmore Industries), had issued a patch and remediation guidance for the vulnerability before March 14, 2023. The vulnerability was therefore a known, patchable security flaw — not an unknown or undisclosed weakness in the software. A threat actor exploiting a publicly known vulnerability for which a patch is available is not engaging in the kind of novel, zero-day exploitation that might plausibly be characterized as "sophisticated" in a manner relevant to a contractual defense.

Second, the exploitation of CVE-2023-0669 was not an isolated or obscure event. Prior to March 14, 2023, multiple cybersecurity research organizations and government agencies had publicly reported active exploitation of CVE-2023-0669 in the wild by threat actors targeting GoAnywhere MFT deployments. The Cybersecurity and Infrastructure Security Agency (CISA) had added CVE-2023-0669 to its Known Exploited Vulnerabilities Catalog, and security researchers had widely disseminated indicators of compromise and detailed technical analyses of the exploitation methodology. In short, the cybersecurity community had sounded a clear and unambiguous alarm regarding this specific vulnerability, and any organization maintaining a GoAnywhere MFT appliance should have been on heightened alert.

Third, Palomar's contractual obligations under the Data Security Exhibit were not structured as a general "best efforts" or "commercially reasonable" standard applicable only to unknown or unforeseeable threats. As discussed in greater detail in Section II.B below, Exhibit D imposed specific, measurable patching obligations that Palomar was required to satisfy irrespective of Palomar's subjective assessment of the "sophistication" of any particular threat. The sophistication (or lack thereof) of the threat actor is therefore irrelevant to the question of whether Palomar satisfied its contractual obligations — and the forensic evidence conclusively demonstrates that it did not.

Fourth, we note that the characterization of a threat actor exploiting an unpatched, publicly known vulnerability as "sophisticated" strains credulity. The exploitation of CVE-2023-0669 required no novel techniques, no proprietary tools, and no insider knowledge. Proof-of-concept exploit code was publicly available. The attack was, in essence, the predictable and foreseeable consequence of Palomar's failure to apply a readily available patch to a publicly known vulnerability that was being actively exploited in the wild. Palomar's attempt to recast this basic failure of cyber hygiene as an encounter with an insurmountable adversary is not supported by the facts and does not absolve Palomar of its contractual duties.

B. Palomar's Failure to Patch Within 30 Days Violated Exhibit D

The central factual issue in this matter is straightforward, and it is one that Palomar's July 7 letter conspicuously fails to address directly: Palomar did not apply the available patch for CVE-2023-0669 before the initial unauthorized access on March 14, 2023, and that failure violated the specific patching obligations set forth in Exhibit D to the MSA.

Exhibit D, as amended by Amendment 2 dated September 15, 2022, contains detailed data security requirements that Palomar was obligated to maintain throughout the term of the MSA. Among these requirements, Section 3.4 of Exhibit D expressly provides that Palomar shall apply patches and remediation for vulnerabilities designated as "critical" or "high" severity within thirty (30) days of the date such patches or remediations are made available by the relevant software vendor. This is not an aspirational target or a general guideline — it is a specific, contractually binding obligation with a defined timeline.

CVE-2023-0669 was designated as a critical-severity vulnerability. The vendor patch was made available prior to the date of initial unauthorized access on March 14, 2023. Yet at the time of the initial compromise, Palomar had not deployed the patch to the GoAnywhere MFT appliance in its production environment. The forensic investigation conducted by Graystone Forensics LLC confirmed that the GoAnywhere MFT appliance exploited by the threat actor was running an unpatched version of the software at the time of the initial access event on March 14, 2023. This is not a disputed fact — it is a forensic finding based on system logs, configuration data, and artifact analysis.

The causal chain flowing from this breach is direct, unbroken, and well-documented:

1. Palomar failed to apply the available critical patch to its GoAnywhere MFT appliance in violation of Section 3.4 of Exhibit D.

2. On or about March 14, 2023, a threat actor exploited the unpatched CVE-2023-0669 vulnerability to gain initial unauthorized access to Palomar's network through the GoAnywhere MFT appliance.

3. Having gained initial access, the threat actor conducted lateral movement within Palomar's network environment over an approximately thirty-five (35) day period, from March 14 through April 18, 2023.

4. During this period, the threat actor identified, staged, and ultimately exfiltrated structured data files containing the personally identifiable information ("PII"), financial information, and protected health information ("PHI") of 318,247 Quorum policyholders and claimants located across twenty-nine (29) states and the District of Columbia.

5. The exfiltration of this data triggered Quorum's obligations under applicable state breach notification statutes, the HIPAA Breach Notification Rule, and the Connecticut Insurance Data Security Law, and necessitated the comprehensive incident response effort for which Quorum now seeks indemnification.

Each link in this chain is supported by the forensic evidence developed by Graystone Forensics LLC, which was retained under privilege to conduct the forensic investigation and has produced a detailed forensic report documenting the attack timeline, entry vector, lateral movement, and data exfiltration methodology.

We note that your July 7 letter appears to suggest, in passing, that other security controls within Palomar's environment might have detected or prevented the attack even if the GoAnywhere MFT appliance had not been patched. This argument misapprehends the nature of Palomar's contractual obligation. Exhibit D imposed a specific, measurable obligation to patch critical vulnerabilities within 30 days. It did not impose a general duty to maintain a layered security architecture that would compensate for failures to satisfy individual, enumerated requirements. Whether Palomar's other security controls could or should have detected the intrusion is a separate question that does not negate the threshold breach: Palomar failed to patch a critical vulnerability within the contractually required timeframe, and that failure was the direct cause of the unauthorized access. The patching obligation was not a best-efforts standard subject to substitution with alternative controls at Palomar's discretion — it was a defined contractual commitment, and Palomar failed to honor it.

C. Palomar Cannot Shift Responsibility to Quorum

Your July 7 letter contains several passages that appear to suggest, either directly or by implication, that Quorum bore some measure of responsibility for the data breach or its consequences. To the extent this constitutes a contributory fault or comparative responsibility defense, it is wholly without foundation.

Quorum entrusted its policyholder and claimant data to Palomar under the MSA precisely because Palomar contractually committed to maintaining specified data security safeguards. The entire premise of the vendor relationship was that Palomar would process, store, and manage Quorum's sensitive data in accordance with the security standards set forth in Exhibit D and the other data protection provisions of the MSA. Quorum relied on those commitments in making the business decision to outsource its personal lines claims data processing to Palomar, and Palomar accepted those obligations in exchange for annual service fees of $16,300,000.

The data compromised in this incident was resident on Palomar's network infrastructure. It was processed on Palomar's systems. The GoAnywhere MFT appliance exploited by the threat actor was Palomar's infrastructure, deployed in Palomar's environment, and managed by Palomar's personnel. Quorum had no administrative access to, and no ability to patch, configure, or control, Palomar's GoAnywhere MFT appliance or any other component of Palomar's network environment. The suggestion that Quorum should have somehow intervened to remediate a vulnerability on Palomar's own system is inconsistent with the fundamental structure of the parties' relationship as data controller and data processor.

Moreover, Quorum fulfilled its own obligations under the MSA with respect to vendor oversight and risk management. Quorum maintained an active vendor risk management program, overseen by Priya Deshmukh, Vice President, Vendor Risk Management, which included periodic risk assessments of Palomar's data security posture. In addition, Amendment 2 to the MSA, executed on September 15, 2022, added a requirement for Palomar to obtain and maintain a SOC 2 Type II report covering the security, availability, and confidentiality trust service criteria. Palomar's most recent SOC 2 Type II report was issued by the independent auditing firm Kessler, Park & Associates CPA, PLLC. Quorum reviewed that report as part of its vendor oversight activities. Quorum was entitled to rely on Palomar's representations regarding its security posture, including as reflected in the SOC 2 report, and had no independent means of verifying on a real-time basis whether Palomar was in fact applying critical patches within the timeframes specified in Exhibit D.

The breach occurred entirely within Palomar's environment, as a direct result of Palomar's failure to satisfy its contractual data security obligations. Quorum is the injured party in this matter. Any attempt to shift responsibility to Quorum is factually unsupported and legally untenable.

D. Palomar's Scope-of-Liability Arguments Lack Merit

Your July 7 letter also contends that the scope of the compromised data should be narrowed and that certain categories of Quorum's incident response costs are not attributable to Palomar's breach. These arguments are likewise without merit.

The forensic investigation conducted by Graystone Forensics LLC confirmed that the data exfiltrated by the threat actor encompassed the following categories of sensitive information:

• Personally Identifiable Information (PII): Full names, dates of birth, Social Security numbers, and driver's license numbers for all 318,247 affected individuals.

• Financial Information: Bank account numbers and/or payment card numbers for a subset of 84,619 affected individuals.

• Protected Health Information (PHI): Health conditions, diagnosis codes, and treatment information derived from workers' compensation claims and health-related insurance claims for a subset of 41,203 affected individuals.

All of this data was processed and stored by Palomar under the MSA for the specific purpose of supporting Quorum's personal lines claims division. The data resided on Palomar's systems, was within Palomar's custody and control, and was compromised as a direct result of the threat actor's exploitation of a vulnerability on Palomar's GoAnywhere MFT appliance. There is no basis for excluding any portion of the compromised data from the scope of Palomar's liability.

Every category of cost incurred by Quorum in response to this incident flows directly and foreseeably from the unauthorized access to and exfiltration of data from Palomar's network. We address each category briefly:

• Forensic investigation (Graystone Forensics LLC — $1,847,000): The forensic investigation was necessary to determine the scope, nature, and timeline of the compromise, identify the attack vector and the data affected, and support Quorum's legal and regulatory response obligations. This is a standard and necessary component of any data breach response.

• Consumer notification and credit monitoring (Clearfield Notification Services LLC — $3,214,500): Quorum's notification obligations were triggered under the breach notification statutes of each of the twenty-nine (29) states and the District of Columbia in which affected individuals reside, as well as under the HIPAA Breach Notification Rule at 45 C.F.R. § 164.408 (with respect to the PHI subset of 41,203 individuals) and the Connecticut Insurance Data Security Law at Conn. Gen. Stat. § 38a-999b (with respect to Connecticut-resident policyholders). The notification costs include preparation and mailing of individualized notification letters, operation of a dedicated call center to handle consumer inquiries, and enrollment of affected individuals in credit monitoring and identity theft protection services. These obligations were triggered solely by the compromise of data in Palomar's custody.

• Crisis communications (BrightPath Consulting Group Inc. — $385,000): The retention of a crisis communications firm was a prudent and necessary response to manage public disclosure of the incident, coordinate media inquiries, and protect Quorum's reputation and brand in the marketplace.

• Legal fees (Calderwood & Harkness LLP — $2,163,750): Outside counsel was retained to manage the incident response, advise on regulatory notification obligations, coordinate with forensic investigators, prepare and submit regulatory filings, and pursue Quorum's indemnification rights against Palomar.

• Internal costs (Quorum — $620,000): Quorum's internal costs include IT remediation and systems hardening to address the compromise, employee overtime for personnel involved in the incident response, and management oversight and coordination of the response effort.

Each of these costs is a direct, foreseeable, and reasonable consequence of the data breach caused by Palomar's failure to patch a critical vulnerability on its own network infrastructure. Section 12.2 of the MSA provides that Palomar shall indemnify and hold harmless Quorum from and against all "losses arising from Palomar's breach of its data security obligations." The costs itemized above are paradigmatic losses arising from precisely such a breach, and Palomar's attempt to disclaim liability for some or all of these costs is inconsistent with both the plain language of the MSA and the undisputed facts of this matter.

III. PALOMAR'S LATE NOTIFICATION COMPOUNDED THE HARM

Independent of and in addition to its breach of the data security obligations under Exhibit D, Palomar also breached the incident notification obligations set forth in Section 9.4 of the MSA. This breach constitutes a separate and independent basis for Quorum's indemnification demand and further underscores the inadequacy of Palomar's response to date.

Section 9.4 of the MSA provides, in relevant part, that Palomar shall provide written notice to Quorum within forty-eight (48) hours of Palomar's discovery of any security incident that affects, or is reasonably likely to affect, the confidentiality, integrity, or availability of Quorum data. This requirement was a material term of the MSA, negotiated by the parties and included in the agreement for the express purpose of ensuring that Quorum would have timely notice of any security event affecting its data, so that Quorum could promptly activate its own incident response plan and take steps to mitigate harm to its policyholders and claimants.

The relevant timeline is as follows:

• April 18, 2023: Palomar's Security Operations Center ("SOC") detected anomalous outbound data transfers from Palomar's network. This detection event constituted Palomar's "Discovery" of a security incident affecting Quorum data within the meaning of Section 9.4.

• April 21, 2023: Palomar provided its first notification to Quorum, via email from Derek Copeland, Palomar's General Counsel, to Thomas R. Whitfield, Quorum's General Counsel, and David Naranjo, Quorum's Chief Information Security Officer. This notification was transmitted approximately seventy-two (72) hours after discovery.

The 48-hour notification requirement under Section 9.4 would have required Palomar to notify Quorum no later than April 20, 2023. Palomar's notification on April 21, 2023 was therefore approximately twenty-four (24) hours late — a delay of roughly fifty percent beyond the contractual deadline.

While twenty-four hours may seem a modest interval in ordinary circumstances, in the context of an active data breach response, every hour matters. The delay in notification had concrete and measurable consequences for Quorum's response:

• Quorum was unable to activate its incident response plan until April 21, 2023, rather than April 20, 2023, delaying the engagement of outside counsel, forensic investigators, and crisis communications resources.

• The delay reduced the time available for Quorum to assess the scope of the compromise before statutory notification deadlines began to run.

• Every hour of delay in the aftermath of a data breach increases the risk of further harm to affected individuals — including the risk of identity theft, fraud, and financial loss — and complicates the overall response effort.

• The late notification required Quorum to compress the initial assessment and triage phase of its response, increasing costs and reducing the efficiency of the response.

The breach of Section 9.4 is an independent basis for indemnification under Section 12.2 of the MSA, which covers losses arising from Palomar's breach of its obligations under the MSA generally, including its notification obligations. Moreover, the late notification exacerbated the costs and complexity of the incident response, contributing to the total cost figure for which Quorum now seeks indemnification. Palomar's July 7 letter does not meaningfully address this separate breach, and any resolution of this matter must account for both the underlying data security failure and the notification failure.

IV. REJECTION OF THE $1,500,000 GOODWILL CREDIT

Palomar's July 7 letter proposes a $1,500,000 "goodwill credit" against future service fees payable by Quorum under the MSA, offered in lieu of direct indemnification. We have discussed this proposal with our client, and Quorum rejects it as wholly inadequate and unresponsive to Quorum's indemnification demand. We explain our client's position in detail below.

First, the proposed credit of $1,500,000 represents only approximately 18.2% of Quorum's total documented incident response costs of $8,230,250. There is no basis in the facts, in the MSA, or in applicable law for limiting Palomar's liability to less than one-fifth of the actual costs directly caused by Palomar's breaches. Quorum's demand is already far below the contractual indemnification cap of $32,600,000, and the costs Quorum has incurred are fully documented and directly attributable to Palomar's failures. An offer of 18.2% of actual losses is not a good-faith indemnification proposal — it is a nominal gesture that fails to reflect the severity of Palomar's breach or the magnitude of the resulting harm.

Second, the characterization of the proposed payment as a "goodwill" credit is troubling because it implicitly disclaims Palomar's legal and contractual responsibility for the breach. Palomar's liability is not a matter of goodwill — it is a matter of contractual obligation. Section 12.2 of the MSA imposes a binding indemnification obligation on Palomar for losses arising from breaches of its data security obligations. The forensic evidence unambiguously establishes that Palomar breached those obligations and that Quorum's losses arose directly from that breach. Any settlement or resolution of this matter must be grounded in an acknowledgment of Palomar's contractual liability, not in a characterization that suggests Palomar is making a voluntary concession of grace.

Third, the proposed credit is structured as a credit against future service fees, not as a cash payment. This structure is unacceptable for several reasons. A fee credit provides no actual cash recovery to Quorum; it merely reduces the amount Quorum will pay for future services. This effectively requires Quorum to continue purchasing services from the very vendor that caused the data breach in order to realize the value of the credit — a perverse incentive structure that is inconsistent with Quorum's legitimate interest in evaluating whether to continue the vendor relationship at all. Moreover, a fee credit has no value if Quorum exercises its contractual right to terminate the MSA for cause, as discussed in Section VI below.

Fourth, the proposal fails entirely to address any of the remediation, enhanced security, or independent audit requirements that Quorum will require as conditions for continuing the vendor relationship through the remaining term of the MSA, which does not expire until November 11, 2024. A financial payment alone — even if it were adequate in amount, which the proposed credit is not — cannot resolve this matter. Any resolution must include concrete commitments by Palomar to remediate the security failures that led to the breach and to implement enhanced safeguards to protect Quorum's data going forward.

Fifth, Quorum's demand of $8,230,250 is approximately 25.2% of the indemnification cap of $32,600,000. This is a reasonable and proportional claim given the severity of the breach — which involved the exfiltration of sensitive PII, financial data, and PHI for over 318,000 individuals across 30 jurisdictions, triggered notification obligations under dozens of state statutes as well as federal law, and required a comprehensive and costly incident response effort. The contractual indemnification cap exists to allocate risk between the parties; Quorum's claim falls comfortably within the bounds of that allocation, and Palomar's attempt to settle for a fraction of the actual costs is inconsistent with the risk allocation framework the parties negotiated.

For all of these reasons, the $1,500,000 goodwill credit is rejected.

V. REASSERTION OF FULL INDEMNIFICATION DEMAND

In light of the foregoing, Quorum hereby reasserts its demand for full indemnification in the amount of $8,230,250 pursuant to Section 12.2 of the MSA. This amount represents the total incident response costs incurred by Quorum through the date of this letter as a direct result of Palomar's breaches of the Data Security Exhibit and Section 9.4 of the MSA.

We note that Quorum's total incident response costs may continue to increase as the various workstreams of the response effort proceed. As of the date of this letter, the following activities remain ongoing:

• Consumer notification mailings to affected individuals commenced on August 18, 2023 (following finalization of the notification population and preparation of jurisdiction-specific notification letters) and are expected to continue through at least September 2023.

• Regulatory filings are being submitted to the attorneys general and insurance regulators of the affected jurisdictions, with filings submitted between August 14 and August 25, 2023, and additional filings expected.

• Credit monitoring and identity theft protection enrollment for affected individuals is ongoing, and the costs of those services will continue to accrue over the monitoring period.

• Quorum's regulatory engagement, including responding to inquiries and information requests from state regulators, is ongoing and expected to continue for several months.

Quorum expressly reserves the right to supplement its indemnification demand to include any additional costs incurred in connection with the incident response, regulatory compliance, and any other losses arising from Palomar's breaches. The demand amount of $8,230,250 should be understood as a floor, not a ceiling, and Quorum will provide updated cost information as additional costs are incurred and documented.

Quorum demands that Palomar respond substantively to this letter no later than August 15, 2023 — twenty-one (21) days from the date of this letter — with a concrete indemnification proposal that reflects the actual scope of Palomar's contractual liability. A further offer of nominal credits or goodwill gestures will not be deemed a substantive response. Quorum expects Palomar's response to address both the financial indemnification demand and the remediation and enhanced security requirements discussed in Section VI below.

VI. TERMINATION RIGHTS AND CONTINUED VENDOR RELATIONSHIP

Palomar's breaches of the Data Security Exhibit (Exhibit D) and Section 9.4 (notification obligations) of the MSA constitute material breaches of the MSA within the meaning of Section 14.2 (Termination for Cause). Under Section 14.2, Quorum has the right to terminate the MSA upon written notice if Palomar commits a material breach and fails to cure such breach within thirty (30) days after receiving written notice thereof.

Quorum is actively evaluating its termination rights under Section 14.2. We note that the nature of the breaches at issue — the failure to patch a critical vulnerability that led to the exfiltration of data for over 318,000 individuals, compounded by a late notification that delayed Quorum's response — may not be susceptible to "cure" within the ordinary meaning of that term. The data has already been exfiltrated; the harm to Quorum and the affected individuals has already occurred. Nevertheless, Quorum is not at this time exercising its termination rights, in order to preserve the possibility of a negotiated resolution.

However, Quorum wishes to make clear that any continued relationship with Palomar through the remaining term of the MSA (which does not expire until November 11, 2024) will require, at a minimum, the following commitments from Palomar:

1. Substantial financial indemnification. Palomar must provide full and adequate financial indemnification for the incident response costs incurred by Quorum, as set forth in this letter and the Demand Letter.

2. Significant enhancements to Palomar's data security program. At a minimum, Quorum will require:

(a) Shortened patching timelines for critical and high-severity vulnerabilities, reduced from the current 30-day window to no more than fourteen (14) days, with emergency patches for actively exploited vulnerabilities to be deployed within seventy-two (72) hours;

(b) Enhanced endpoint detection and response ("EDR") capabilities deployed across all systems that process, store, or transmit Quorum data;

(c) Mandatory quarterly vulnerability scanning of all systems in the Palomar environment that interact with or have access to Quorum data, with results reported to Quorum's vendor risk management team within ten (10) business days of each scan; and

(d) Such other enhancements as Quorum may reasonably require following completion of its review of the forensic findings and the current state of Palomar's security program.

3. Independent third-party security assessments at Palomar's expense. Quorum will require Palomar to engage, at Palomar's sole cost, an independent third-party security firm (to be mutually agreed upon by the parties) to conduct a comprehensive assessment of Palomar's data security program, including penetration testing and vulnerability assessment, with the results reported to Quorum. This requirement is in addition to, and not in substitution for, the existing SOC 2 Type II report requirement.

4. Shortened incident notification timeline. The current 48-hour notification window in Section 9.4 has proven inadequate. Quorum will require that the notification timeline be reduced to no more than twenty-four (24) hours, with immediate telephonic notice required for incidents involving confirmed data exfiltration.

These requirements are non-exhaustive, and Quorum reserves the right to identify additional conditions as its review of this matter continues.

Quorum's willingness to consider continuing the vendor relationship should not be construed as a waiver of any right, claim, or remedy available to Quorum under the MSA, at law, or in equity. If Palomar is unwilling or unable to satisfy the conditions necessary for a continued relationship, Quorum will exercise its termination rights and pursue all available remedies.

VII. RESERVATION OF RIGHTS

Quorum expressly reserves all rights and remedies available to it under the MSA, at law, and in equity, including without limitation the following:

• The right to pursue claims for breach of contract arising from Palomar's breaches of the Data Security Exhibit and Section 9.4 of the MSA;

• The right to pursue claims for negligence, gross negligence, and any other applicable causes of action arising from Palomar's failure to maintain adequate data security safeguards;

• The right to seek termination of the MSA for cause under Section 14.2;

• The right to supplement its indemnification demand to include additional costs incurred in connection with the ongoing incident response, regulatory compliance, litigation, and any other losses arising from Palomar's breaches;

• The right to seek consequential, incidental, and any other categories of damages to the extent permitted by the MSA and applicable law; and

• All other rights and remedies available under the MSA, at law, or in equity.

Nothing in this letter, in the Demand Letter dated June 20, 2023, or in any prior correspondence, communication, or course of dealing between the parties or their counsel constitutes a waiver, release, or limitation of any right, claim, defense, or remedy available to Quorum. This letter is written and transmitted entirely without prejudice to any claim, position, or argument that Quorum may assert in any forum, and nothing herein shall be construed as an admission of any fact, liability, or defense.

CLOSING

We request that you confirm receipt of this letter promptly and that you provide a substantive response to Quorum's indemnification demand no later than August 15, 2023. As noted above, Quorum expects Palomar's response to include a concrete indemnification proposal that reflects the full scope of Palomar's contractual liability, as well as a meaningful proposal for remediation and enhanced data security commitments.

Quorum remains willing to engage in good-faith negotiations to resolve this matter efficiently and to avoid protracted and costly disputes. We believe that a negotiated resolution is in the interests of both parties, particularly given the remaining term of the MSA and the ongoing nature of the incident response effort. However, we must be clear: any resolution must reflect the full scope of Palomar's contractual liability for the losses Quorum has incurred and must include meaningful, verifiable remediation commitments sufficient to protect Quorum's data for the remainder of the contractual relationship.

We are available to discuss this matter at your convenience and welcome a call or meeting to explore the possibility of a resolution. Please do not hesitate to contact me directly at the number below.

Very truly yours,

CALDERWOOD & HARKNESS LLP

By: ________

Kevin Ostrowski Partner, Privacy & Data Security 1700 K Street NW, Suite 900 Washington, D.C. 20006 Direct: (202) 554-8847

Email: kostrowski@calderwoodharkness.com

cc:

Thomas R. Whitfield, Esq., General Counsel, Quorum Insurance Holdings Corp. Jennifer Liang, Chief Privacy Officer, Quorum Insurance Holdings Corp. Rachel Bernstein, Esq., Partner, Calderwood & Harkness LLP (51 West 52nd Street, 34th Floor, New York, NY 10019) Alan Burke, Esq., Associate, Calderwood & Harkness LLP Brian Soto, Esq., Associate, Mercer, Haight & Dunlop LLP

Enclosures: None. (Supporting materials were transmitted with our letter of June 20, 2023.)

Vendor / Cost Category	Amount
Graystone Forensics LLC — Forensic investigation fees	$1,847,000
Clearfield Notification Services LLC — Notification mailing, call center operations, credit monitoring, and identity theft protection enrollment	$3,214,500
BrightPath Consulting Group Inc. — Crisis communications and public relations	$385,000
Calderwood & Harkness LLP — Legal fees (outside counsel, incident response, regulatory compliance, and indemnification demand)	$2,163,750
Quorum internal costs — IT remediation, systems hardening, employee overtime, and management oversight	$620,000
Total	$8,230,250

CALDERWOOD & HARKNESS LLP Attorneys at Law
1700 K Street NW, Suite 900 Washington, D.C. 20006
Telephone: (202) 554-8800 Facsimile: (202) 554-8801 www.calderwoodharkness.com
July 25, 2023
VIA EMAIL AND Sundial Data Systems
Catherine Langford, Esq. Partner Mercer, Haight & Dunlop LLP 2100 Ross Avenue, Suite 3600 Dallas, TX 75201
Re: Quorum Insurance Holdings Corp. — Indemnification Demand Against Palomar Data Solutions, Inc.; Response to Your Letter of July 7, 2023 Calderwood & Harkness Matter No. 1025-00006 Master Services Agreement dated November 12, 2019, as amended (the "MSA")
Dear Ms. Langford:
I write on behalf of our client, Quorum Insurance Holdings Corp. ("Quorum" or "QIH"), a Delaware corporation publicly traded on the Nasdaq Stock Market (ticker symbol: QIHC), with its principal offices at 400 Constitution Plaza, Suite 2200, Hartford, Connecticut 06103. I serve as the responsible partner for this engagement in the Privacy & Data Security practice of Calderwood & Harkness LLP.
We acknowledge receipt of your letter dated July 7, 2023, transmitted on behalf of your client, Palomar Data Solutions, Inc. ("Palomar"), a Texas corporation with its principal offices at 7100 Greenville Avenue, Suite 450, Dallas, Texas 75231. We have reviewed your letter and its arguments carefully, and we write to respond substantively to each of the causation defenses and liability-limitation arguments advanced therein.
The purpose of this letter is threefold: (1) to rebut, in detail, the causation defenses asserted by Palomar in its July 7, 2023 response; (2) to reject the $1,500,000 "goodwill credit" offered by Palomar as wholly inadequate and unresponsive to Quorum's indemnification demand; and (3) to reassert, in full, Quorum's indemnification demand in the amount of $8,230,250 pursuant to Section 12.2 of the MSA. Quorum continues to reserve all rights and remedies available to it under the MSA, at law, and in equity, and nothing in this letter shall be construed as a waiver or limitation of any such right or remedy.
We address each of these matters in turn below.
I. SUMMARY OF QUORUM'S INDEMNIFICATION DEMAND
By way of background and to ensure a complete record, we briefly restate the substance of the formal breach-of-contract and indemnification demand letter transmitted by this office to Mercer, Haight & Dunlop on June 20, 2023 (the "Demand Letter"). We incorporate the Demand Letter and all supporting materials previously transmitted therewith by reference as though fully set forth herein.
The Demand Letter identified two independent but related breaches of the MSA by Palomar. First, Palomar breached its data security obligations under the MSA, specifically those set forth in Exhibit D to the MSA (the "Data Security Exhibit"), as amended by Amendment No. 2 to the MSA dated September 15, 2022 ("Amendment 2"). The Data Security Exhibit, as so amended, imposes detailed and specific data security obligations on Palomar with respect to the Quorum data entrusted to Palomar for processing, storage, and management. As described in detail in the Demand Letter and further elaborated in this response, Palomar failed to satisfy those obligations in critical respects, and that failure was the direct and proximate cause of the security incident at issue.
Second, Palomar breached the incident notification obligations set forth in Section 9.4 of the MSA, which requires Palomar to provide written notice to Quorum within forty-eight (48) hours of Palomar's discovery of any security incident affecting Quorum data. As described in Section III below, Palomar failed to comply with this timeline, further compounding the harm to Quorum and the individuals whose data was compromised.
As set forth in the Demand Letter, Quorum has incurred total incident response costs of $8,230,250 as a direct result of Palomar's breaches. Those costs are itemized as follows:
We note that this demand is well within the contractual indemnification cap established under the MSA, as amended. Pursuant to Amendment No. 1 to the MSA dated March 3, 2021 ("Amendment 1"), the annual service fees payable by Quorum to Palomar were established at $16,300,000 per year. The indemnification cap under Section 12.4 of the MSA is set at two times (2×) the trailing twelve-month fees, yielding a cap of $32,600,000. Quorum's demand of $8,230,250 represents approximately 25.2% of the available indemnification cap — a figure that is both reasonable and proportionate given the severity of the data breach and the scope of Palomar's contractual failures.
II. REBUTTAL OF PALOMAR'S CAUSATION DEFENSES
Your July 7, 2023 letter advances several arguments that, individually and collectively, seek to negate or diminish Palomar's responsibility for the data breach. We address each of these arguments below and demonstrate that none of them has merit.
A. Palomar's "Sophisticated Attack" Argument Is Unavailing
Your letter characterizes the cyberattack at issue as a "sophisticated" intrusion by a "highly capable threat actor" that was, in Palomar's telling, beyond Palomar's reasonable ability to prevent. Specifically, you assert that the exploitation of CVE-2023-0669 — a remote code execution vulnerability in the GoAnywhere MFT file transfer appliance deployed in Palomar's environment — constituted a sophisticated attack that should excuse or mitigate Palomar's liability.
This argument fails on multiple grounds.
First, CVE-2023-0669 was not a zero-day vulnerability at the time of the initial unauthorized access on March 14, 2023. The vulnerability had been publicly disclosed and assigned a Common Vulnerabilities and Exposures (CVE) identifier prior to that date. The software vendor, Severin Corporation (formerly Strathmore Industries), had issued a patch and remediation guidance for the vulnerability before March 14, 2023. The vulnerability was therefore a known, patchable security flaw — not an unknown or undisclosed weakness in the software. A threat actor exploiting a publicly known vulnerability for which a patch is available is not engaging in the kind of novel, zero-day exploitation that might plausibly be characterized as "sophisticated" in a manner relevant to a contractual defense.
Second, the exploitation of CVE-2023-0669 was not an isolated or obscure event. Prior to March 14, 2023, multiple cybersecurity research organizations and government agencies had publicly reported active exploitation of CVE-2023-0669 in the wild by threat actors targeting GoAnywhere MFT deployments. The Cybersecurity and Infrastructure Security Agency (CISA) had added CVE-2023-0669 to its Known Exploited Vulnerabilities Catalog, and security researchers had widely disseminated indicators of compromise and detailed technical analyses of the exploitation methodology. In short, the cybersecurity community had sounded a clear and unambiguous alarm regarding this specific vulnerability, and any organization maintaining a GoAnywhere MFT appliance should have been on heightened alert.
Third, Palomar's contractual obligations under the Data Security Exhibit were not structured as a general "best efforts" or "commercially reasonable" standard applicable only to unknown or unforeseeable threats. As discussed in greater detail in Section II.B below, Exhibit D imposed specific, measurable patching obligations that Palomar was required to satisfy irrespective of Palomar's subjective assessment of the "sophistication" of any particular threat. The sophistication (or lack thereof) of the threat actor is therefore irrelevant to the question of whether Palomar satisfied its contractual obligations — and the forensic evidence conclusively demonstrates that it did not.
Fourth, we note that the characterization of a threat actor exploiting an unpatched, publicly known vulnerability as "sophisticated" strains credulity. The exploitation of CVE-2023-0669 required no novel techniques, no proprietary tools, and no insider knowledge. Proof-of-concept exploit code was publicly available. The attack was, in essence, the predictable and foreseeable consequence of Palomar's failure to apply a readily available patch to a publicly known vulnerability that was being actively exploited in the wild. Palomar's attempt to recast this basic failure of cyber hygiene as an encounter with an insurmountable adversary is not supported by the facts and does not absolve Palomar of its contractual duties.
B. Palomar's Failure to Patch Within 30 Days Violated Exhibit D
The central factual issue in this matter is straightforward, and it is one that Palomar's July 7 letter conspicuously fails to address directly: Palomar did not apply the available patch for CVE-2023-0669 before the initial unauthorized access on March 14, 2023, and that failure violated the specific patching obligations set forth in Exhibit D to the MSA.
Exhibit D, as amended by Amendment 2 dated September 15, 2022, contains detailed data security requirements that Palomar was obligated to maintain throughout the term of the MSA. Among these requirements, Section 3.4 of Exhibit D expressly provides that Palomar shall apply patches and remediation for vulnerabilities designated as "critical" or "high" severity within thirty (30) days of the date such patches or remediations are made available by the relevant software vendor. This is not an aspirational target or a general guideline — it is a specific, contractually binding obligation with a defined timeline.
CVE-2023-0669 was designated as a critical-severity vulnerability. The vendor patch was made available prior to the date of initial unauthorized access on March 14, 2023. Yet at the time of the initial compromise, Palomar had not deployed the patch to the GoAnywhere MFT appliance in its production environment. The forensic investigation conducted by Graystone Forensics LLC confirmed that the GoAnywhere MFT appliance exploited by the threat actor was running an unpatched version of the software at the time of the initial access event on March 14, 2023. This is not a disputed fact — it is a forensic finding based on system logs, configuration data, and artifact analysis.
The causal chain flowing from this breach is direct, unbroken, and well-documented:
1. Palomar failed to apply the available critical patch to its GoAnywhere MFT appliance in violation of Section 3.4 of Exhibit D.
2. On or about March 14, 2023, a threat actor exploited the unpatched CVE-2023-0669 vulnerability to gain initial unauthorized access to Palomar's network through the GoAnywhere MFT appliance.
3. Having gained initial access, the threat actor conducted lateral movement within Palomar's network environment over an approximately thirty-five (35) day period, from March 14 through April 18, 2023.
4. During this period, the threat actor identified, staged, and ultimately exfiltrated structured data files containing the personally identifiable information ("PII"), financial information, and protected health information ("PHI") of 318,247 Quorum policyholders and claimants located across twenty-nine (29) states and the District of Columbia.
5. The exfiltration of this data triggered Quorum's obligations under applicable state breach notification statutes, the HIPAA Breach Notification Rule, and the Connecticut Insurance Data Security Law, and necessitated the comprehensive incident response effort for which Quorum now seeks indemnification.
Each link in this chain is supported by the forensic evidence developed by Graystone Forensics LLC, which was retained under privilege to conduct the forensic investigation and has produced a detailed forensic report documenting the attack timeline, entry vector, lateral movement, and data exfiltration methodology.
We note that your July 7 letter appears to suggest, in passing, that other security controls within Palomar's environment might have detected or prevented the attack even if the GoAnywhere MFT appliance had not been patched. This argument misapprehends the nature of Palomar's contractual obligation. Exhibit D imposed a specific, measurable obligation to patch critical vulnerabilities within 30 days. It did not impose a general duty to maintain a layered security architecture that would compensate for failures to satisfy individual, enumerated requirements. Whether Palomar's other security controls could or should have detected the intrusion is a separate question that does not negate the threshold breach: Palomar failed to patch a critical vulnerability within the contractually required timeframe, and that failure was the direct cause of the unauthorized access. The patching obligation was not a best-efforts standard subject to substitution with alternative controls at Palomar's discretion — it was a defined contractual commitment, and Palomar failed to honor it.
C. Palomar Cannot Shift Responsibility to Quorum
Your July 7 letter contains several passages that appear to suggest, either directly or by implication, that Quorum bore some measure of responsibility for the data breach or its consequences. To the extent this constitutes a contributory fault or comparative responsibility defense, it is wholly without foundation.
Quorum entrusted its policyholder and claimant data to Palomar under the MSA precisely because Palomar contractually committed to maintaining specified data security safeguards. The entire premise of the vendor relationship was that Palomar would process, store, and manage Quorum's sensitive data in accordance with the security standards set forth in Exhibit D and the other data protection provisions of the MSA. Quorum relied on those commitments in making the business decision to outsource its personal lines claims data processing to Palomar, and Palomar accepted those obligations in exchange for annual service fees of $16,300,000.
The data compromised in this incident was resident on Palomar's network infrastructure. It was processed on Palomar's systems. The GoAnywhere MFT appliance exploited by the threat actor was Palomar's infrastructure, deployed in Palomar's environment, and managed by Palomar's personnel. Quorum had no administrative access to, and no ability to patch, configure, or control, Palomar's GoAnywhere MFT appliance or any other component of Palomar's network environment. The suggestion that Quorum should have somehow intervened to remediate a vulnerability on Palomar's own system is inconsistent with the fundamental structure of the parties' relationship as data controller and data processor.
Moreover, Quorum fulfilled its own obligations under the MSA with respect to vendor oversight and risk management. Quorum maintained an active vendor risk management program, overseen by Priya Deshmukh, Vice President, Vendor Risk Management, which included periodic risk assessments of Palomar's data security posture. In addition, Amendment 2 to the MSA, executed on September 15, 2022, added a requirement for Palomar to obtain and maintain a SOC 2 Type II report covering the security, availability, and confidentiality trust service criteria. Palomar's most recent SOC 2 Type II report was issued by the independent auditing firm Kessler, Park & Associates CPA, PLLC. Quorum reviewed that report as part of its vendor oversight activities. Quorum was entitled to rely on Palomar's representations regarding its security posture, including as reflected in the SOC 2 report, and had no independent means of verifying on a real-time basis whether Palomar was in fact applying critical patches within the timeframes specified in Exhibit D.
The breach occurred entirely within Palomar's environment, as a direct result of Palomar's failure to satisfy its contractual data security obligations. Quorum is the injured party in this matter. Any attempt to shift responsibility to Quorum is factually unsupported and legally untenable.
D. Palomar's Scope-of-Liability Arguments Lack Merit
Your July 7 letter also contends that the scope of the compromised data should be narrowed and that certain categories of Quorum's incident response costs are not attributable to Palomar's breach. These arguments are likewise without merit.
The forensic investigation conducted by Graystone Forensics LLC confirmed that the data exfiltrated by the threat actor encompassed the following categories of sensitive information:
• Personally Identifiable Information (PII): Full names, dates of birth, Social Security numbers, and driver's license numbers for all 318,247 affected individuals.
• Financial Information: Bank account numbers and/or payment card numbers for a subset of 84,619 affected individuals.
• Protected Health Information (PHI): Health conditions, diagnosis codes, and treatment information derived from workers' compensation claims and health-related insurance claims for a subset of 41,203 affected individuals.
All of this data was processed and stored by Palomar under the MSA for the specific purpose of supporting Quorum's personal lines claims division. The data resided on Palomar's systems, was within Palomar's custody and control, and was compromised as a direct result of the threat actor's exploitation of a vulnerability on Palomar's GoAnywhere MFT appliance. There is no basis for excluding any portion of the compromised data from the scope of Palomar's liability.
Every category of cost incurred by Quorum in response to this incident flows directly and foreseeably from the unauthorized access to and exfiltration of data from Palomar's network. We address each category briefly:
• Forensic investigation (Graystone Forensics LLC — $1,847,000): The forensic investigation was necessary to determine the scope, nature, and timeline of the compromise, identify the attack vector and the data affected, and support Quorum's legal and regulatory response obligations. This is a standard and necessary component of any data breach response.
• Consumer notification and credit monitoring (Clearfield Notification Services LLC — $3,214,500): Quorum's notification obligations were triggered under the breach notification statutes of each of the twenty-nine (29) states and the District of Columbia in which affected individuals reside, as well as under the HIPAA Breach Notification Rule at 45 C.F.R. § 164.408 (with respect to the PHI subset of 41,203 individuals) and the Connecticut Insurance Data Security Law at Conn. Gen. Stat. § 38a-999b (with respect to Connecticut-resident policyholders). The notification costs include preparation and mailing of individualized notification letters, operation of a dedicated call center to handle consumer inquiries, and enrollment of affected individuals in credit monitoring and identity theft protection services. These obligations were triggered solely by the compromise of data in Palomar's custody.
• Crisis communications (BrightPath Consulting Group Inc. — $385,000): The retention of a crisis communications firm was a prudent and necessary response to manage public disclosure of the incident, coordinate media inquiries, and protect Quorum's reputation and brand in the marketplace.
• Legal fees (Calderwood & Harkness LLP — $2,163,750): Outside counsel was retained to manage the incident response, advise on regulatory notification obligations, coordinate with forensic investigators, prepare and submit regulatory filings, and pursue Quorum's indemnification rights against Palomar.
• Internal costs (Quorum — $620,000): Quorum's internal costs include IT remediation and systems hardening to address the compromise, employee overtime for personnel involved in the incident response, and management oversight and coordination of the response effort.
Each of these costs is a direct, foreseeable, and reasonable consequence of the data breach caused by Palomar's failure to patch a critical vulnerability on its own network infrastructure. Section 12.2 of the MSA provides that Palomar shall indemnify and hold harmless Quorum from and against all "losses arising from Palomar's breach of its data security obligations." The costs itemized above are paradigmatic losses arising from precisely such a breach, and Palomar's attempt to disclaim liability for some or all of these costs is inconsistent with both the plain language of the MSA and the undisputed facts of this matter.
III. PALOMAR'S LATE NOTIFICATION COMPOUNDED THE HARM
Independent of and in addition to its breach of the data security obligations under Exhibit D, Palomar also breached the incident notification obligations set forth in Section 9.4 of the MSA. This breach constitutes a separate and independent basis for Quorum's indemnification demand and further underscores the inadequacy of Palomar's response to date.
Section 9.4 of the MSA provides, in relevant part, that Palomar shall provide written notice to Quorum within forty-eight (48) hours of Palomar's discovery of any security incident that affects, or is reasonably likely to affect, the confidentiality, integrity, or availability of Quorum data. This requirement was a material term of the MSA, negotiated by the parties and included in the agreement for the express purpose of ensuring that Quorum would have timely notice of any security event affecting its data, so that Quorum could promptly activate its own incident response plan and take steps to mitigate harm to its policyholders and claimants.
The relevant timeline is as follows:
• April 18, 2023: Palomar's Security Operations Center ("SOC") detected anomalous outbound data transfers from Palomar's network. This detection event constituted Palomar's "Discovery" of a security incident affecting Quorum data within the meaning of Section 9.4.
• April 21, 2023: Palomar provided its first notification to Quorum, via email from Derek Copeland, Palomar's General Counsel, to Thomas R. Whitfield, Quorum's General Counsel, and David Naranjo, Quorum's Chief Information Security Officer. This notification was transmitted approximately seventy-two (72) hours after discovery.
The 48-hour notification requirement under Section 9.4 would have required Palomar to notify Quorum no later than April 20, 2023. Palomar's notification on April 21, 2023 was therefore approximately twenty-four (24) hours late — a delay of roughly fifty percent beyond the contractual deadline.
While twenty-four hours may seem a modest interval in ordinary circumstances, in the context of an active data breach response, every hour matters. The delay in notification had concrete and measurable consequences for Quorum's response:
• Quorum was unable to activate its incident response plan until April 21, 2023, rather than April 20, 2023, delaying the engagement of outside counsel, forensic investigators, and crisis communications resources.
• The delay reduced the time available for Quorum to assess the scope of the compromise before statutory notification deadlines began to run.
• Every hour of delay in the aftermath of a data breach increases the risk of further harm to affected individuals — including the risk of identity theft, fraud, and financial loss — and complicates the overall response effort.
• The late notification required Quorum to compress the initial assessment and triage phase of its response, increasing costs and reducing the efficiency of the response.
The breach of Section 9.4 is an independent basis for indemnification under Section 12.2 of the MSA, which covers losses arising from Palomar's breach of its obligations under the MSA generally, including its notification obligations. Moreover, the late notification exacerbated the costs and complexity of the incident response, contributing to the total cost figure for which Quorum now seeks indemnification. Palomar's July 7 letter does not meaningfully address this separate breach, and any resolution of this matter must account for both the underlying data security failure and the notification failure.
IV. REJECTION OF THE $1,500,000 GOODWILL CREDIT
Palomar's July 7 letter proposes a $1,500,000 "goodwill credit" against future service fees payable by Quorum under the MSA, offered in lieu of direct indemnification. We have discussed this proposal with our client, and Quorum rejects it as wholly inadequate and unresponsive to Quorum's indemnification demand. We explain our client's position in detail below.
First, the proposed credit of $1,500,000 represents only approximately 18.2% of Quorum's total documented incident response costs of $8,230,250. There is no basis in the facts, in the MSA, or in applicable law for limiting Palomar's liability to less than one-fifth of the actual costs directly caused by Palomar's breaches. Quorum's demand is already far below the contractual indemnification cap of $32,600,000, and the costs Quorum has incurred are fully documented and directly attributable to Palomar's failures. An offer of 18.2% of actual losses is not a good-faith indemnification proposal — it is a nominal gesture that fails to reflect the severity of Palomar's breach or the magnitude of the resulting harm.
Second, the characterization of the proposed payment as a "goodwill" credit is troubling because it implicitly disclaims Palomar's legal and contractual responsibility for the breach. Palomar's liability is not a matter of goodwill — it is a matter of contractual obligation. Section 12.2 of the MSA imposes a binding indemnification obligation on Palomar for losses arising from breaches of its data security obligations. The forensic evidence unambiguously establishes that Palomar breached those obligations and that Quorum's losses arose directly from that breach. Any settlement or resolution of this matter must be grounded in an acknowledgment of Palomar's contractual liability, not in a characterization that suggests Palomar is making a voluntary concession of grace.
Third, the proposed credit is structured as a credit against future service fees, not as a cash payment. This structure is unacceptable for several reasons. A fee credit provides no actual cash recovery to Quorum; it merely reduces the amount Quorum will pay for future services. This effectively requires Quorum to continue purchasing services from the very vendor that caused the data breach in order to realize the value of the credit — a perverse incentive structure that is inconsistent with Quorum's legitimate interest in evaluating whether to continue the vendor relationship at all. Moreover, a fee credit has no value if Quorum exercises its contractual right to terminate the MSA for cause, as discussed in Section VI below.
Fourth, the proposal fails entirely to address any of the remediation, enhanced security, or independent audit requirements that Quorum will require as conditions for continuing the vendor relationship through the remaining term of the MSA, which does not expire until November 11, 2024. A financial payment alone — even if it were adequate in amount, which the proposed credit is not — cannot resolve this matter. Any resolution must include concrete commitments by Palomar to remediate the security failures that led to the breach and to implement enhanced safeguards to protect Quorum's data going forward.
Fifth, Quorum's demand of $8,230,250 is approximately 25.2% of the indemnification cap of $32,600,000. This is a reasonable and proportional claim given the severity of the breach — which involved the exfiltration of sensitive PII, financial data, and PHI for over 318,000 individuals across 30 jurisdictions, triggered notification obligations under dozens of state statutes as well as federal law, and required a comprehensive and costly incident response effort. The contractual indemnification cap exists to allocate risk between the parties; Quorum's claim falls comfortably within the bounds of that allocation, and Palomar's attempt to settle for a fraction of the actual costs is inconsistent with the risk allocation framework the parties negotiated.
For all of these reasons, the $1,500,000 goodwill credit is rejected.
V. REASSERTION OF FULL INDEMNIFICATION DEMAND
In light of the foregoing, Quorum hereby reasserts its demand for full indemnification in the amount of $8,230,250 pursuant to Section 12.2 of the MSA. This amount represents the total incident response costs incurred by Quorum through the date of this letter as a direct result of Palomar's breaches of the Data Security Exhibit and Section 9.4 of the MSA.
We note that Quorum's total incident response costs may continue to increase as the various workstreams of the response effort proceed. As of the date of this letter, the following activities remain ongoing:
• Consumer notification mailings to affected individuals commenced on August 18, 2023 (following finalization of the notification population and preparation of jurisdiction-specific notification letters) and are expected to continue through at least September 2023.
• Regulatory filings are being submitted to the attorneys general and insurance regulators of the affected jurisdictions, with filings submitted between August 14 and August 25, 2023, and additional filings expected.
• Credit monitoring and identity theft protection enrollment for affected individuals is ongoing, and the costs of those services will continue to accrue over the monitoring period.
• Quorum's regulatory engagement, including responding to inquiries and information requests from state regulators, is ongoing and expected to continue for several months.
Quorum expressly reserves the right to supplement its indemnification demand to include any additional costs incurred in connection with the incident response, regulatory compliance, and any other losses arising from Palomar's breaches. The demand amount of $8,230,250 should be understood as a floor, not a ceiling, and Quorum will provide updated cost information as additional costs are incurred and documented.
Quorum demands that Palomar respond substantively to this letter no later than August 15, 2023 — twenty-one (21) days from the date of this letter — with a concrete indemnification proposal that reflects the actual scope of Palomar's contractual liability. A further offer of nominal credits or goodwill gestures will not be deemed a substantive response. Quorum expects Palomar's response to address both the financial indemnification demand and the remediation and enhanced security requirements discussed in Section VI below.
VI. TERMINATION RIGHTS AND CONTINUED VENDOR RELATIONSHIP
Palomar's breaches of the Data Security Exhibit (Exhibit D) and Section 9.4 (notification obligations) of the MSA constitute material breaches of the MSA within the meaning of Section 14.2 (Termination for Cause). Under Section 14.2, Quorum has the right to terminate the MSA upon written notice if Palomar commits a material breach and fails to cure such breach within thirty (30) days after receiving written notice thereof.
Quorum is actively evaluating its termination rights under Section 14.2. We note that the nature of the breaches at issue — the failure to patch a critical vulnerability that led to the exfiltration of data for over 318,000 individuals, compounded by a late notification that delayed Quorum's response — may not be susceptible to "cure" within the ordinary meaning of that term. The data has already been exfiltrated; the harm to Quorum and the affected individuals has already occurred. Nevertheless, Quorum is not at this time exercising its termination rights, in order to preserve the possibility of a negotiated resolution.
However, Quorum wishes to make clear that any continued relationship with Palomar through the remaining term of the MSA (which does not expire until November 11, 2024) will require, at a minimum, the following commitments from Palomar:
1. Substantial financial indemnification. Palomar must provide full and adequate financial indemnification for the incident response costs incurred by Quorum, as set forth in this letter and the Demand Letter.
2. Significant enhancements to Palomar's data security program. At a minimum, Quorum will require:
(a) Shortened patching timelines for critical and high-severity vulnerabilities, reduced from the current 30-day window to no more than fourteen (14) days, with emergency patches for actively exploited vulnerabilities to be deployed within seventy-two (72) hours;
(b) Enhanced endpoint detection and response ("EDR") capabilities deployed across all systems that process, store, or transmit Quorum data;
(c) Mandatory quarterly vulnerability scanning of all systems in the Palomar environment that interact with or have access to Quorum data, with results reported to Quorum's vendor risk management team within ten (10) business days of each scan; and
(d) Such other enhancements as Quorum may reasonably require following completion of its review of the forensic findings and the current state of Palomar's security program.
3. Independent third-party security assessments at Palomar's expense. Quorum will require Palomar to engage, at Palomar's sole cost, an independent third-party security firm (to be mutually agreed upon by the parties) to conduct a comprehensive assessment of Palomar's data security program, including penetration testing and vulnerability assessment, with the results reported to Quorum. This requirement is in addition to, and not in substitution for, the existing SOC 2 Type II report requirement.
4. Shortened incident notification timeline. The current 48-hour notification window in Section 9.4 has proven inadequate. Quorum will require that the notification timeline be reduced to no more than twenty-four (24) hours, with immediate telephonic notice required for incidents involving confirmed data exfiltration.
These requirements are non-exhaustive, and Quorum reserves the right to identify additional conditions as its review of this matter continues.
Quorum's willingness to consider continuing the vendor relationship should not be construed as a waiver of any right, claim, or remedy available to Quorum under the MSA, at law, or in equity. If Palomar is unwilling or unable to satisfy the conditions necessary for a continued relationship, Quorum will exercise its termination rights and pursue all available remedies.
VII. RESERVATION OF RIGHTS
Quorum expressly reserves all rights and remedies available to it under the MSA, at law, and in equity, including without limitation the following:
• The right to pursue claims for breach of contract arising from Palomar's breaches of the Data Security Exhibit and Section 9.4 of the MSA;
• The right to pursue claims for negligence, gross negligence, and any other applicable causes of action arising from Palomar's failure to maintain adequate data security safeguards;
• The right to seek termination of the MSA for cause under Section 14.2;
• The right to supplement its indemnification demand to include additional costs incurred in connection with the ongoing incident response, regulatory compliance, litigation, and any other losses arising from Palomar's breaches;
• The right to seek consequential, incidental, and any other categories of damages to the extent permitted by the MSA and applicable law; and
• All other rights and remedies available under the MSA, at law, or in equity.
Nothing in this letter, in the Demand Letter dated June 20, 2023, or in any prior correspondence, communication, or course of dealing between the parties or their counsel constitutes a waiver, release, or limitation of any right, claim, defense, or remedy available to Quorum. This letter is written and transmitted entirely without prejudice to any claim, position, or argument that Quorum may assert in any forum, and nothing herein shall be construed as an admission of any fact, liability, or defense.
CLOSING
We request that you confirm receipt of this letter promptly and that you provide a substantive response to Quorum's indemnification demand no later than August 15, 2023. As noted above, Quorum expects Palomar's response to include a concrete indemnification proposal that reflects the full scope of Palomar's contractual liability, as well as a meaningful proposal for remediation and enhanced data security commitments.
Quorum remains willing to engage in good-faith negotiations to resolve this matter efficiently and to avoid protracted and costly disputes. We believe that a negotiated resolution is in the interests of both parties, particularly given the remaining term of the MSA and the ongoing nature of the incident response effort. However, we must be clear: any resolution must reflect the full scope of Palomar's contractual liability for the losses Quorum has incurred and must include meaningful, verifiable remediation commitments sufficient to protect Quorum's data for the remainder of the contractual relationship.
We are available to discuss this matter at your convenience and welcome a call or meeting to explore the possibility of a resolution. Please do not hesitate to contact me directly at the number below.
Very truly yours,
CALDERWOOD & HARKNESS LLP
By: ________
Kevin Ostrowski Partner, Privacy & Data Security 1700 K Street NW, Suite 900 Washington, D.C. 20006 Direct: (202) 554-8847
Email: kostrowski@calderwoodharkness.com
cc:
Thomas R. Whitfield, Esq., General Counsel, Quorum Insurance Holdings Corp. Jennifer Liang, Chief Privacy Officer, Quorum Insurance Holdings Corp. Rachel Bernstein, Esq., Partner, Calderwood & Harkness LLP (51 West 52nd Street, 34th Floor, New York, NY 10019) Alan Burke, Esq., Associate, Calderwood & Harkness LLP Brian Soto, Esq., Associate, Mercer, Haight & Dunlop LLP
Enclosures: None. (Supporting materials were transmitted with our letter of June 20, 2023.)
Vendor / Cost Category | Amount
Graystone Forensics LLC — Forensic investigation fees | $1,847,000
Clearfield Notification Services LLC — Notification mailing, call center operations, credit monitoring, and identity theft protection enrollment | $3,214,500
BrightPath Consulting Group Inc. — Crisis communications and public relations | $385,000
Calderwood & Harkness LLP — Legal fees (outside counsel, incident response, regulatory compliance, and indemnification demand) | $2,163,750
Quorum internal costs — IT remediation, systems hardening, employee overtime, and management oversight | $620,000
Total | $8,230,250

CALDERWOOD & HARKNESS LLP Attorneys at Law

I. SUMMARY OF QUORUM'S INDEMNIFICATION DEMAND

II. REBUTTAL OF PALOMAR'S CAUSATION DEFENSES

III. PALOMAR'S LATE NOTIFICATION COMPOUNDED THE HARM

V. REASSERTION OF FULL INDEMNIFICATION DEMAND

VI. TERMINATION RIGHTS AND CONTINUED VENDOR RELATIONSHIP

VII. RESERVATION OF RIGHTS

CLOSING

CALDERWOOD & HARKNESS LLP

Record

Parties

Dates

Amounts