SETTLEMENT AGREEMENT AND MUTUAL RELEASE
Dated as of October 27, 2023
by and between
QUORUM INSURANCE HOLDINGS CORP.
a Delaware corporation
and
PALOMAR DATA SOLUTIONS, INC.
a Texas corporation
CONFIDENTIAL TREATMENT REQUESTED
SETTLEMENT AGREEMENT AND MUTUAL RELEASE
This SETTLEMENT AGREEMENT AND MUTUAL RELEASE (this "Agreement") is entered into as of October 27, 2023 (the "Effective Date"), by and between:
QUORUM INSURANCE HOLDINGS CORP., a Delaware corporation ("Quorum" or "QIH"), with its principal place of business at 400 Constitution Plaza, Suite 2200, Hartford, CT 06103;
and
PALOMAR DATA SOLUTIONS, INC., a Texas corporation ("Palomar" or "PDS"), with its principal place of business at 7100 Greenville Avenue, Suite 450, Dallas, TX 75231.
Quorum and Palomar are sometimes referred to herein collectively as the "Parties" and each individually as a "Party."
RECITALS
WHEREAS:
A. The MSA Relationship. Quorum and Palomar are parties to that certain Master Services Agreement dated November 12, 2019 (the "MSA"), as amended by Amendment No. 1 dated March 3, 2021, and Amendment No. 2 dated September 15, 2022 (collectively, the "MSA, as amended"), pursuant to which Palomar provides claims data processing, document management, and analytics services to Quorum's personal lines division. The annual contract value under the MSA, as amended, is Sixteen Million Three Hundred Thousand Dollars ($16,300,000) per year. The MSA has a five-year initial term expiring November 11, 2024.
B. The Security Incident. On or about March 14, 2023, a threat actor exploited a known remote code execution vulnerability (CVE-2023-0669) in Palomar's GoAnywhere MFT file transfer appliance, gaining unauthorized access to Palomar's network (the "Security Incident"). The threat actor maintained unauthorized access to Palomar's network and exfiltrated data therefrom over an approximately thirty-five (35) day period from on or about March 14, 2023 through on or about April 18, 2023. On April 18, 2023, Palomar's security operations center discovered anomalous outbound data transfers indicative of unauthorized exfiltration. On April 21, 2023, Palomar notified Quorum of the Security Incident.
C. Affected Data. The Security Incident resulted in the unauthorized access to and exfiltration of personally identifiable information ("PII"), protected health information ("PHI"), and financial data of approximately three hundred eighteen thousand two hundred forty-seven (318,247) Quorum policyholders and claimants across twenty-nine (29) states and the District of Columbia. Compromised data included: (i) names, dates of birth, Social Security numbers, and driver's license numbers for all 318,247 individuals; (ii) bank account numbers and payment card numbers for approximately eighty-four thousand six hundred nineteen (84,619) individuals; and (iii) health conditions, diagnosis codes, and treatment information from workers' compensation and health-related claims for approximately forty-one thousand two hundred three (41,203) individuals.
D. Quorum's Claims. Quorum has asserted claims against Palomar for, among other things: (i) breach of the data security obligations set forth in Exhibit D of the MSA, as amended, including Palomar's failure to patch the CVE-2023-0669 vulnerability within thirty (30) days of vendor patch release as required thereunder; (ii) breach of the notification obligations set forth in Section 9.4 of the MSA, which required Palomar to notify Quorum within forty-eight (48) hours of discovering a security incident (Palomar's notification on April 21, 2023 was approximately twenty-four (24) hours late); and (iii) indemnification under Section 12.2 of the MSA for all losses arising from the Security Incident, subject to the contractual liability cap of two times the trailing twelve-month fees paid, which equals Thirty-Two Million Six Hundred Thousand Dollars ($32,600,000). Total incident response costs incurred by Quorum in connection with the Security Incident are Eight Million Two Hundred Thirty Thousand Two Hundred Fifty Dollars ($8,230,250), as itemized in Exhibit C attached hereto.
E. Palomar's Position. Palomar has disputed certain aspects of causation and the scope of its liability in connection with the Security Incident, including, without limitation, the appropriateness and magnitude of certain costs included in Quorum's indemnification demand, but has agreed to resolve the dispute on the terms set forth herein without any admission of liability, fault, or wrongdoing.
F. Desire to Resolve. The Parties desire to fully and finally resolve all claims, disputes, and controversies between them arising from or related to the Security Incident on the terms and conditions set forth in this Agreement. Contemporaneously with the execution of this Agreement, the Parties are executing Amendment No. 3 to the MSA, dated as of the date hereof, which provides for enhanced data security and audit provisions (the "MSA Amendment 3"), a copy of which is attached hereto as Exhibit B and incorporated herein by reference.
NOW, THEREFORE, in consideration of the mutual covenants, agreements, representations, and warranties set forth herein, and for other good and valuable consideration, the receipt and sufficiency of which are hereby acknowledged, the Parties agree as follows:
ARTICLE I — DEFINITIONS
Section 1.1 — Defined Terms
As used in this Agreement, the following terms shall have the meanings set forth below. Capitalized terms used but not otherwise defined in this Article I shall have the meanings ascribed to them elsewhere in this Agreement or in the Recitals, which are incorporated herein by reference.
(a) "Agreement" means this Settlement Agreement and Mutual Release, including all exhibits and schedules attached hereto, as the same may be amended, supplemented, or modified from time to time in accordance with the terms hereof.
(b) "Claims" means all claims, demands, actions, causes of action, suits, damages, losses, liabilities, costs, expenses (including reasonable attorneys' fees and disbursements), obligations, judgments, liens, penalties, fines, and assessments of every kind and nature whatsoever, whether known or unknown, suspected or unsuspected, matured or unmatured, fixed or contingent, direct or indirect, at law or in equity, whether sounding in contract, tort, statute, or otherwise, arising from or related to the Security Incident.
(c) "Effective Date" means October 27, 2023.
(d) "Fee Reduction Period" means the eighteen (18) month period beginning on November 1, 2023 and ending on April 30, 2025.
(e) "Incident Response Costs" means the total costs incurred by Quorum in connection with its response to the Security Incident, totaling Eight Million Two Hundred Thirty Thousand Two Hundred Fifty Dollars ($8,230,250), consisting of the following components:
(i) forensic investigation fees (Graystone Forensics LLC): One Million Eight Hundred Forty-Seven Thousand Dollars ($1,847,000);
(ii) notification and credit monitoring vendor fees (Clearfield Notification Services LLC): Three Million Two Hundred Fourteen Thousand Five Hundred Dollars ($3,214,500);
(iii) crisis communications fees (BrightPath Consulting Group Inc.): Three Hundred Eighty-Five Thousand Dollars ($385,000);
(iv) outside legal counsel fees (Calderwood & Harkness LLP): Two Million One Hundred Sixty-Three Thousand Seven Hundred Fifty Dollars ($2,163,750); and
(v) internal costs (IT remediation, employee overtime, and related expenses): Six Hundred Twenty Thousand Dollars ($620,000) (estimated).
A detailed itemization of the Incident Response Costs is set forth in Exhibit C attached hereto.
(f) "MSA" means the Master Services Agreement dated November 12, 2019, by and between Quorum and Palomar, as amended by Amendment No. 1 dated March 3, 2021, Amendment No. 2 dated September 15, 2022, and as further amended by MSA Amendment 3 executed contemporaneously herewith.
(g) "MSA Amendment 3" means Amendment No. 3 to the MSA, executed contemporaneously herewith and attached hereto as Exhibit B.
(h) "Released Claims" has the meaning set forth in Sections 4.1 and 4.2, respectively.
(i) "Security Incident" has the meaning set forth in Recital B of this Agreement.
(j) "Settlement Payment" means Four Million Two Hundred Thousand Dollars ($4,200,000).
Section 1.2 — Rules of Construction
Unless the context otherwise requires: (a) words importing the singular include the plural and vice versa; (b) references to "including" mean "including, without limitation"; (c) references to any statute or regulation include all amendments, replacements, and successor statutes and regulations; and (d) references to "dollars" or "$" mean United States dollars.
ARTICLE II — SETTLEMENT CONSIDERATION
Section 2.1 — Cash Payment
(a) Within thirty (30) calendar days of the Effective Date, Palomar shall pay to Quorum the Settlement Payment in the amount of Four Million Two Hundred Thousand Dollars ($4,200,000). Payment shall be made by wire transfer of immediately available funds to a bank account designated by Quorum in writing in accordance with the wire transfer instructions to be provided pursuant to Section 2.1(b) below.
(b) Quorum shall provide Palomar with complete wire transfer instructions, including the name and address of the receiving financial institution, the ABA routing number, account number, and account name, within five (5) business days of the Effective Date. Quorum's wire transfer instructions shall be delivered in writing to Derek Copeland, General Counsel, Palomar Data Solutions, Inc., at the notice address set forth in Section 11.5 of this Agreement. A form of such instructions is attached hereto as Exhibit A.
(c) If the Settlement Payment is not received in full by Quorum within the thirty (30) day period specified in Section 2.1(a), interest shall accrue on the unpaid amount at the rate of the lesser of eighteen percent (18%) per annum or the maximum rate permitted by applicable law, calculated from the date the Settlement Payment was due until the date the Settlement Payment is received in full by Quorum.
(d) Palomar's obligation to make the Settlement Payment is absolute and unconditional and shall not be subject to any setoff, counterclaim, deduction, or defense of any kind or nature whatsoever.
Section 2.2 — Fee Reduction
(a) During the Fee Reduction Period (the eighteen (18) month period beginning November 1, 2023 and ending April 30, 2025), the annual contract value under the MSA, as amended, shall be reduced by eight percent (8%), from Sixteen Million Three Hundred Thousand Dollars ($16,300,000) per annum to Fourteen Million Nine Hundred Ninety-Six Thousand Dollars ($14,996,000) per annum.
(b) The total value of the fee reduction over the eighteen (18) month Fee Reduction Period is One Million Nine Hundred Fifty-Six Thousand Dollars ($1,956,000), calculated as follows: $16,300,000 × 8% × 1.5 years = $1,956,000.
(c) The fee reduction shall apply to all invoices issued by Palomar to Quorum during the Fee Reduction Period and shall be reflected as a separate line-item credit on each monthly invoice. Palomar shall clearly label such credit as "Settlement Fee Reduction — SA dated 10/27/2023" or substantially similar language on each applicable invoice.
(d) Following the expiration of the Fee Reduction Period on April 30, 2025, fees under the MSA shall revert to the rate then in effect under the MSA, as amended, subject to any other adjustments provided for in MSA Amendment 3 or any subsequent amendments to the MSA agreed to by the Parties.
Section 2.3 — Total Effective Recovery
The Parties acknowledge and agree that the total effective value of the settlement consideration provided for under Sections 2.1 and 2.2 of this Agreement is Six Million One Hundred Fifty-Six Thousand Dollars ($6,156,000), comprised of the Settlement Payment in the amount of Four Million Two Hundred Thousand Dollars ($4,200,000) and the aggregate fee reduction in the amount of One Million Nine Hundred Fifty-Six Thousand Dollars ($1,956,000). The Parties further acknowledge that this settlement consideration represents a compromise and does not reflect any determination as to the merits or value of any Claims released hereunder.
Section 2.4 — Tax Treatment
(a) Each Party shall be solely responsible for its own tax obligations, including any federal, state, or local income taxes, arising from or in connection with the settlement consideration provided for under this Article II. Neither Party makes any representation or warranty to the other Party regarding the tax treatment or consequences of the settlement consideration.
(b) No Party shall be required to withhold taxes on the Settlement Payment or the fee reduction unless required by applicable law, in which case the withholding Party shall promptly notify the other Party of the basis for such withholding and shall provide reasonable cooperation in connection with any applicable tax filings.
(c) The Parties shall cooperate in good faith regarding any tax reporting obligations arising from the settlement consideration, including the preparation and filing of any applicable IRS Forms 1099 or other information returns.
ARTICLE III — ENHANCED SECURITY AND REMEDIATION OBLIGATIONS
Section 3.1 — Independent Third-Party Security Assessment
(a) Within sixty (60) calendar days of the Effective Date, Palomar shall engage an independent, nationally recognized third-party information security assessment firm (the "Independent Assessor"), subject to Quorum's reasonable prior approval of the selection of such firm. Palomar shall submit the names of no fewer than three (3) proposed firms to Quorum for approval within thirty (30) calendar days of the Effective Date, and Quorum shall respond with its approval or reasonable objection within ten (10) business days thereafter. If the Parties are unable to agree on the selection of the Independent Assessor, the Parties shall jointly request that the American Arbitration Association designate a qualified firm.
(b) The Independent Assessor shall conduct an initial comprehensive security assessment of Palomar's information security program, infrastructure, policies, procedures, and controls, with a particular focus on all systems, applications, and network components that process, store, or transmit Quorum data. The scope of such initial assessment shall include, at a minimum: (i) network architecture and segmentation; (ii) access control and identity management; (iii) vulnerability management and patch administration; (iv) endpoint protection; (v) logging, monitoring, and incident detection capabilities; (vi) data encryption at rest and in transit; (vii) third-party risk management; and (viii) employee security awareness training.
(c) Following the initial comprehensive assessment, the Independent Assessor shall conduct annual security assessments for the remaining term of the MSA, as amended, with each annual assessment to be completed within sixty (60) calendar days prior to the anniversary of the initial assessment.
(d) All costs and expenses associated with the engagement of the Independent Assessor and the performance of all assessments pursuant to this Section 3.1, including travel, technology, and report preparation costs, shall be borne solely by Palomar.
(e) Palomar shall provide Quorum with complete and unredacted copies of all assessment reports, findings, and recommendations prepared by the Independent Assessor within fifteen (15) business days of Palomar's receipt thereof. Palomar shall develop and implement remediation plans for any findings rated "high" or "critical" by the Independent Assessor within the timeframes specified in the applicable assessment report, and in no event later than ninety (90) calendar days from the date of the report for "critical" findings and one hundred twenty (120) calendar days from the date of the report for "high" findings.
(f) The obligations set forth in this Section 3.1 are in addition to, and not in lieu of, Palomar's existing obligation to maintain a SOC 2 Type II report as required by Amendment No. 2 to the MSA (audited by Kessler, Park & Associates CPA, PLLC or a successor firm reasonably acceptable to Quorum), and Palomar shall continue to provide Quorum with copies of its SOC 2 Type II reports in accordance with the MSA, as amended.
Section 3.2 — Enhanced Patch Management
(a) Within ninety (90) calendar days of the Effective Date, Palomar shall implement an enhanced patch management program that meets or exceeds the following requirements:
(i) Critical Vulnerabilities. Patching of all critical-severity vulnerabilities (as rated by the Common Vulnerability Scoring System ("CVSS") with a base score of 9.0 or higher, or as designated "critical" by the applicable software vendor) within fourteen (14) calendar days of vendor patch release, reduced from the prior thirty (30) day requirement set forth in Exhibit D of the MSA;
(ii) High-Severity Vulnerabilities. Patching of all high-severity vulnerabilities (as rated by CVSS with a base score of 7.0 to 8.9, or as designated "high" by the applicable software vendor) within thirty (30) calendar days of vendor patch release; and
(iii) Patch Compliance Reporting. Documented patch compliance reporting to Quorum's Chief Information Security Officer on a quarterly basis, in a format reasonably acceptable to Quorum, detailing: (A) all patches applied during the reporting period; (B) any patches not applied within the required timeframe, together with the reasons for delay and the anticipated remediation date; and (C) any compensating controls implemented pending patch deployment.
(b) This requirement is further memorialized in MSA Amendment 3 and shall survive the termination or expiration of this Agreement to the extent set forth therein.
Section 3.3 — Endpoint Detection and Response
(a) Within ninety (90) calendar days of the Effective Date, Palomar shall deploy enterprise-grade endpoint detection and response ("EDR") solutions across all systems that process, store, or transmit Quorum data, and across all systems that have network connectivity to such systems, including all servers, workstations, laptops, and virtual machines within the scope of Quorum data processing environments.
(b) Palomar shall maintain and monitor the EDR solution on a continuous, twenty-four hours per day, seven days per week, three hundred sixty-five days per year (24/7/365) basis, whether through internal security operations personnel or a qualified managed detection and response ("MDR") provider.
(c) Palomar shall promptly notify Quorum of any EDR alert or detection event that may indicate a potential compromise of Quorum data, in accordance with the enhanced incident notification obligations set forth in Section 3.4 below.
(d) This requirement is further memorialized in MSA Amendment 3 and shall survive the termination or expiration of this Agreement to the extent set forth therein.
Section 3.4 — Enhanced Incident Notification
(a) The Parties acknowledge that MSA Amendment 3 reduces the contractual incident notification window from forty-eight (48) hours to twenty-four (24) hours, effective as of the Effective Date.
(b) In connection with any future security incident, suspected security incident, or data breach (each, a "Reportable Event") affecting Quorum data or systems processing Quorum data, Palomar shall provide initial notification to Quorum's General Counsel (currently Thomas R. Whitfield) and Chief Information Security Officer (currently David Naranjo) within twenty-four (24) hours of discovery of the Reportable Event, by telephone and email, to the contact information set forth in MSA Amendment 3 or as otherwise provided by Quorum in writing from time to time.
(c) Such initial notification shall include, to the extent known at the time: (i) a description of the nature of the Reportable Event; (ii) the date and time of discovery; (iii) the systems and data potentially affected; (iv) the initial assessment of scope and severity; and (v) the immediate containment and response actions taken or planned.
Section 3.5 — Quarterly Vulnerability Scanning
(a) Palomar shall conduct quarterly vulnerability scans of all systems, applications, and network infrastructure that process, store, or transmit Quorum data. Such scans shall be conducted using industry-standard vulnerability scanning tools and methodologies and shall cover both internal and external attack surfaces.
(b) Palomar shall provide Quorum with summary reports of each quarterly vulnerability scan within fifteen (15) business days of each scan's completion. Such summary reports shall identify all vulnerabilities detected, their severity ratings, and the planned or completed remediation actions for each vulnerability.
(c) This requirement is further memorialized in MSA Amendment 3 and shall survive the termination or expiration of this Agreement to the extent set forth therein.
Section 3.6 — Verification and Audit Rights
(a) Quorum (or its designated representative, including its internal audit team, its external auditors, or a qualified third-party assessor engaged by Quorum) shall have the right, upon no fewer than fifteen (15) business days' prior written notice and during normal business hours, to verify Palomar's compliance with the obligations set forth in this Article III and in MSA Amendment 3.
(b) Such verification may include, without limitation: (i) review of documentation, records, logs, and reports related to Palomar's security program, patch management activities, EDR deployment and monitoring, and vulnerability scan results; (ii) interviews with Palomar personnel, including Palomar's Chief Technology Officer (currently Anita Raghavan) or her successor, and other relevant technical and management personnel; and (iii) inspection of relevant systems, network configurations, and security infrastructure.
(c) Palomar shall provide reasonable cooperation and access in connection with any verification activities conducted pursuant to this Section 3.6, subject to reasonable confidentiality protections with respect to Palomar's proprietary information that is unrelated to Quorum data or the Security Incident.
(d) Quorum's exercise or non-exercise of its verification and audit rights under this Section 3.6 shall not relieve Palomar of any of its obligations under this Agreement or MSA Amendment 3, nor shall any verification activity create any liability on the part of Quorum for any deficiency in Palomar's security program.
ARTICLE IV — MUTUAL RELEASE
Section 4.1 — Release by Quorum
Effective upon receipt by Quorum of the full Settlement Payment in accordance with Section 2.1, Quorum, on behalf of itself and its subsidiaries, affiliates, parent companies, divisions, officers, directors (including, without limitation, Franklin Reeves), employees, agents, representatives, attorneys, successors, and assigns (collectively, the "Quorum Releasing Parties"), hereby fully and forever releases and discharges Palomar and its subsidiaries, affiliates, parent companies, divisions, officers (including, without limitation, Marcus J. Trevino), directors, employees (including, without limitation, Anita Raghavan and Derek Copeland), agents, representatives, attorneys, insurers, successors, and assigns (collectively, the "Palomar Released Parties") from any and all Claims arising from or related to the Security Incident (the "Quorum Released Claims").
This release includes, without limitation, claims for breach of the MSA (including Sections 9.4 and 12.2 thereof and Exhibit D thereto), breach of data security obligations, negligence, gross negligence, willful misconduct, breach of fiduciary duty, indemnification, contribution, unjust enrichment, and any and all other claims, whether arising under contract, tort, statute, or otherwise, related to the unauthorized access to, exfiltration of, or compromise of Quorum data in connection with the Security Incident, including all claims for Incident Response Costs, consequential damages, lost profits, reputational harm, diminution in value, and any other direct or indirect damages arising therefrom.
Section 4.2 — Release by Palomar
Palomar, on behalf of itself and its subsidiaries, affiliates, parent companies, divisions, officers, directors, employees, agents, representatives, attorneys, successors, and assigns (collectively, the "Palomar Releasing Parties"), hereby fully and forever releases and discharges Quorum and its subsidiaries, affiliates, parent companies, divisions, officers (including, without limitation, Margaret D. Calloway and Thomas R. Whitfield), directors, employees (including, without limitation, David Naranjo, Jennifer Liang, Priya Deshmukh, and Robert Wentworth), agents, representatives, attorneys, insurers, successors, and assigns (collectively, the "Quorum Released Parties") from any and all Claims arising from or related to the Security Incident (the "Palomar Released Claims," and together with the Quorum Released Claims, the "Released Claims").
This release includes, without limitation, any claims related to Quorum's indemnification demand, Quorum's public disclosures regarding the Security Incident (including its Current Report on Form 8-K filed with the Securities and Exchange Commission on April 28, 2023 and subsequent public statements), Quorum's communications with regulators or governmental authorities regarding the Security Incident, any actions taken by Quorum in connection with the Security Incident response, and any claims for defamation, disparagement, tortious interference, or any other claims arising from or related to Quorum's response to or characterization of the Security Incident.
Section 4.3 — Scope of Release — Carve-Outs
Notwithstanding the foregoing, the releases set forth in Sections 4.1 and 4.2 do not release or affect:
(a) the Parties' respective ongoing obligations under the MSA, as amended (including, without limitation, MSA Amendment 3), which shall continue in full force and effect in accordance with their terms;
(b) the Parties' respective obligations under this Agreement, including, without limitation, Palomar's obligations under Article II (Settlement Consideration) and Article III (Enhanced Security and Remediation Obligations);
(c) any claims arising from conduct or events occurring after the Effective Date that are unrelated to the Security Incident;
(d) any claims by third parties (including, without limitation, affected individuals, regulators, governmental authorities, class action plaintiffs, or other persons or entities) that are not parties to this Agreement; and
(e) Palomar's indemnification obligations under Section 12.2 of the MSA with respect to third-party claims arising from or related to the Security Incident, as further addressed in Article VIII hereof.
For the avoidance of doubt, nothing in this Agreement releases Palomar from its obligations under Article III hereof or under MSA Amendment 3, and any breach by Palomar of such obligations shall give rise to all rights and remedies available to Quorum under the MSA, as amended, at law, or in equity.
Section 4.4 — Unknown Claims Waiver
Each Party acknowledges that it may discover facts in addition to or different from those it now knows or believes to be true regarding the Security Incident, the Claims, or the subject matter of this Agreement, and each Party expressly agrees that this Agreement shall be and remain effective in all respects notwithstanding any such discovery. Each Party assumes the risk of any such additional or different facts and agrees that this Agreement shall not be subject to rescission or modification by reason thereof.
To the extent permitted by applicable law, each Party expressly waives and relinquishes any and all rights and benefits that it may have under any statute, rule, regulation, or principle of law providing that a general release does not extend to claims that the releasing party does not know or suspect to exist in its favor at the time of executing the release, which if known by it would have materially affected its settlement with the released party, including, without limitation and to the extent applicable, California Civil Code Section 1542 (which provides: "A GENERAL RELEASE DOES NOT EXTEND TO CLAIMS THAT THE CREDITOR OR RELEASING PARTY DOES NOT KNOW OR SUSPECT TO EXIST IN HIS OR HER FAVOR AT THE TIME OF EXECUTING THE RELEASE AND THAT, IF KNOWN BY HIM OR HER, WOULD HAVE MATERIALLY AFFECTED HIS OR HER SETTLEMENT WITH THE DEBTOR OR RELEASED PARTY"), and any analogous provision of any other jurisdiction's laws, whether statutory or common law.
Each Party has been advised by its respective counsel regarding the significance and consequences of this specific waiver of unknown claims and has voluntarily agreed to the terms of this waiver after due deliberation.
ARTICLE V — REPRESENTATIONS AND WARRANTIES
Section 5.1 — Mutual Representations and Warranties
Each Party represents and warrants to the other Party as of the Effective Date as follows:
(a) Organization and Good Standing. Such Party is duly organized, validly existing, and in good standing under the laws of its jurisdiction of organization (in the case of Quorum, the State of Delaware; in the case of Palomar, the State of Texas) and has all requisite corporate power and authority to own, lease, and operate its properties and to carry on its business as currently conducted.
(b) Authority. Such Party has full corporate power and authority to execute, deliver, and perform this Agreement and to consummate the transactions contemplated hereby.
(c) Authorization. The execution, delivery, and performance of this Agreement by such Party, and the consummation of the transactions contemplated hereby, have been duly authorized by all necessary corporate action on the part of such Party, including any requisite board of directors approvals, and no other corporate proceedings on the part of such Party are necessary to authorize this Agreement or to consummate the transactions contemplated hereby.
(d) Enforceability. This Agreement constitutes a valid and binding obligation of such Party, enforceable against such Party in accordance with its terms, subject to applicable bankruptcy, insolvency, reorganization, moratorium, fraudulent transfer, and other similar laws relating to or affecting creditors' rights generally and to general principles of equity (regardless of whether such enforceability is considered in a proceeding at law or in equity).
(e) No Conflicts. The execution, delivery, and performance of this Agreement by such Party, and the consummation of the transactions contemplated hereby, do not and will not: (i) conflict with or violate any provision of the certificate of incorporation, bylaws, or other organizational documents of such Party; (ii) conflict with, result in any breach of, or constitute a default under any law, statute, regulation, rule, judgment, order, decree, or governmental permit or license applicable to such Party; or (iii) conflict with, result in any breach of, constitute a default under, result in the acceleration of, or create in any party the right to accelerate, terminate, modify, or cancel, any material agreement, contract, lease, license, or instrument to which such Party is a party or by which such Party is bound.
Section 5.2 — Quorum's Additional Representations and Warranties
Quorum further represents and warrants to Palomar as of the Effective Date as follows:
(a) No Assignment of Claims. Quorum has not sold, assigned, transferred, pledged, hypothecated, or otherwise encumbered, in whole or in part, any of the Claims released herein, and no person or entity other than Quorum has any ownership interest in or lien upon any of such Claims.
(b) Incident Response Costs. As of the Effective Date, the total Incident Response Costs incurred by Quorum in connection with the Security Incident are Eight Million Two Hundred Thirty Thousand Two Hundred Fifty Dollars ($8,230,250), as itemized in Exhibit C attached hereto. Such costs reflect actual amounts paid or accrued by Quorum through the Effective Date and were incurred in good faith in connection with Quorum's response to the Security Incident.
Section 5.3 — Palomar's Additional Representations and Warranties
Palomar further represents and warrants to Quorum as of the Effective Date as follows:
(a) Financial Capacity. Palomar has the financial capacity and available resources to make the Settlement Payment in accordance with Section 2.1 and to perform all of its obligations under Article III of this Agreement and under MSA Amendment 3.
(b) Insurance. Palomar currently maintains cyber-liability insurance coverage with aggregate policy limits of not less than Ten Million Dollars ($10,000,000), as required by Exhibit E of the MSA, as amended. Palomar has notified its cyber-liability insurance carrier(s) of the Security Incident and the settlement contemplated by this Agreement.
ARTICLE VI — CONFIDENTIALITY
Section 6.1 — Confidential Treatment
The terms and conditions of this Agreement, including, without limitation, the amount of the Settlement Payment, the fee reduction, and the specific security remediation obligations set forth herein, shall be treated as strictly confidential by both Parties and shall not be disclosed to any third party, except:
(a) as required by applicable law, regulation, or legal process, including securities disclosure obligations applicable to Quorum as a publicly traded company listed on the Nasdaq Stock Market under the ticker symbol QIHC;
(b) to the disclosing Party's respective officers, directors, employees, attorneys, accountants, auditors, financial advisors, and insurance carriers who have a legitimate business need to know the terms of this Agreement and who are bound by confidentiality obligations no less protective than those set forth herein; for the avoidance of doubt, this includes disclosure to Calderwood & Harkness LLP (outside counsel for Quorum), Mercer, Haight & Dunlop LLP (outside counsel for Palomar), Halstead & Monroe LLP (accountants for Quorum), Kessler, Park & Associates CPA, PLLC (accountants for Palomar), Atlas Mutual Insurance Company and Pinnacle Surplus Lines Insurance Corp. (insurance carriers for Quorum), and Palomar's cyber-liability insurance carrier(s);
(c) to regulators or governmental authorities in connection with regulatory inquiries, investigations, enforcement proceedings, or examinations related to the Security Incident, including, without limitation, the Connecticut Attorney General's Office, the New York Attorney General's Office, the Connecticut Insurance Department, the U.S. Department of Health and Human Services Office for Civil Rights, and any other participating attorneys general in the twenty-nine (29) state multistate coalition; and
(d) with the prior written consent of the other Party.
Section 6.2 — Public Statements
(a) Neither Party shall issue any press release, public statement, or public filing regarding this Agreement or the terms hereof without the prior written consent of the other Party, except as required by applicable law or regulation.
(b) Notwithstanding the foregoing, the Parties acknowledge that Quorum may be required to make disclosures regarding this Agreement and the settlement contemplated hereby in connection with Quorum's periodic and current reporting obligations under the Securities Exchange Act of 1934, as amended, including in its Annual Report on Form 10-K, Quarterly Reports on Form 10-Q, and Current Reports on Form 8-K, and in connection with Quorum's financial statement disclosures prepared in accordance with generally accepted accounting principles. Quorum shall provide Palomar with reasonable advance notice of any such public disclosure (and, where practicable, at least five (5) business days' advance notice), together with a copy of the proposed disclosure, and shall consider in good faith any comments provided by Palomar, provided that Quorum shall retain sole discretion with respect to the content of any disclosure required by applicable law or regulation.
ARTICLE VII — NO ADMISSION OF LIABILITY
Section 7.1 — No Admission
(a) This Agreement is entered into by the Parties solely for the purpose of resolving a disputed matter and avoiding the expense, burden, and uncertainty of continued dispute and potential litigation. Nothing in this Agreement, including the payment of the Settlement Payment, the fee reduction, or the implementation of enhanced security measures, shall be construed as, or deemed to constitute, an admission of liability, fault, wrongdoing, or responsibility by either Party with respect to the Security Incident, the Claims, or any other matter.
(b) Palomar expressly denies any and all liability for the Claims asserted by Quorum and enters into this Agreement solely to achieve a full and final resolution of the dispute between the Parties on mutually acceptable terms.
(c) Quorum maintains that the Claims it has asserted against Palomar are valid, meritorious, and well-founded, and enters into this Agreement in consideration of the settlement terms set forth herein.
(d) Neither this Agreement nor any of its terms, provisions, or recitals, nor the fact of settlement, nor any actions taken in connection with the negotiation, execution, or performance of this Agreement, shall be offered, received, or admitted in evidence in any judicial, administrative, arbitral, or other proceeding of any kind as evidence of liability, fault, wrongdoing, or responsibility, or as evidence of the truth or falsity of any fact or matter, except in a proceeding to enforce the terms of this Agreement or as otherwise required by applicable law.
ARTICLE VIII — INDEMNIFICATION FOR THIRD-PARTY CLAIMS
Section 8.1 — Continuing Indemnification Obligations Under the MSA
The Parties acknowledge and agree that the mutual releases set forth in Article IV of this Agreement apply only to Claims between the Parties and do not extinguish, release, or modify Palomar's indemnification obligations under Section 12.2 of the MSA with respect to third-party claims arising from or related to the Security Incident. For the avoidance of doubt, such third-party claims include, without limitation, any claims, lawsuits, class actions, regulatory actions, administrative proceedings, or enforcement actions brought by or on behalf of affected individuals, consumer advocacy organizations, or governmental authorities, except to the extent such third-party claims are specifically addressed by Section 8.2 below. Palomar's indemnification obligations under Section 12.2 of the MSA shall remain in full force and effect, subject to the indemnification cap and other terms and conditions set forth therein, as further addressed in Section 9.3 of this Agreement.
Section 8.2 — Regulatory Matters
(a) The Parties acknowledge that, as of the Effective Date, the following regulatory matters are pending or ongoing in connection with the Security Incident:
(i) The multistate attorney general coalition, consisting of twenty-nine (29) states and led jointly by the Connecticut Attorney General and the New York Attorney General, issued a joint demand letter dated September 8, 2023 addressed to both Quorum and Palomar. Quorum, in consultation with its counsel Calderwood & Harkness LLP, submitted a comprehensive response dated October 13, 2023. No formal enforcement action has been filed as of the Effective Date.
(ii) The Connecticut Insurance Department has opened a formal market conduct inquiry into Quorum's data security practices and vendor oversight in connection with the Security Incident.
(iii) Quorum filed a breach notification with the U.S. Department of Health and Human Services Office for Civil Rights ("HHS OCR") in connection with the PHI compromised in the Security Incident, and HHS OCR has acknowledged receipt of such notification.
(b) Quorum shall have sole control and management of the regulatory response in connection with the Security Incident, including all communications, submissions, and negotiations with the multistate attorney general coalition, the Connecticut Insurance Department, HHS OCR, and any other regulatory or governmental authorities. Quorum shall consult with its counsel, Calderwood & Harkness LLP, in connection with all material regulatory matters and shall keep Palomar reasonably informed of significant developments.
(c) Palomar shall cooperate fully and in good faith with Quorum and its counsel in connection with any regulatory inquiries, investigations, examinations, or enforcement proceedings related to the Security Incident, including, without limitation: (i) providing information, documentation, and data as reasonably requested by Quorum or its counsel; (ii) making Palomar personnel available for interviews or testimony as reasonably required; (iii) reviewing and commenting on draft responses and submissions to regulatory authorities to the extent Palomar's cooperation is relevant; and (iv) complying with any remedial measures or undertakings agreed to or imposed in connection with regulatory resolutions.
(d) Palomar's cooperation obligations under this Section 8.2 shall survive the expiration or termination of the MSA, as amended, and shall continue for so long as any regulatory matter related to the Security Incident remains pending or unresolved.
ARTICLE IX — RELATIONSHIP OF THIS AGREEMENT TO THE MSA
Section 9.1 — MSA Remains in Effect
Except as expressly modified by MSA Amendment 3 (executed contemporaneously herewith and attached as Exhibit B), the MSA, as amended, shall remain in full force and effect in accordance with its terms through the expiration of its current term on November 11, 2024, and through any renewal term to the extent the MSA is renewed in accordance with its terms. The Parties' entry into this Agreement shall not constitute a waiver, modification, or amendment of any provision of the MSA except as expressly set forth herein or in MSA Amendment 3. Nothing in this Agreement shall be construed as a waiver of Quorum's right to terminate the MSA for cause under Section 14.2 thereof, or to exercise any other termination right under the MSA, for breaches by Palomar occurring after the Effective Date.
Section 9.2 — MSA Amendment 3
(a) The Parties acknowledge that MSA Amendment 3, executed contemporaneously herewith and attached as Exhibit B, incorporates the enhanced data security obligations set forth in Article III of this Agreement and the fee reduction set forth in Section 2.2 of this Agreement into the MSA. MSA Amendment 3 is an integral part of the settlement contemplated by this Agreement and is executed in consideration thereof.
(b) In the event of any conflict or inconsistency between the terms of this Agreement and the terms of MSA Amendment 3 with respect to the subject matter of the settlement, the terms of this Agreement shall control. In the event of any conflict or inconsistency between the terms of MSA Amendment 3 and the terms of the MSA (as previously amended), the terms of MSA Amendment 3 shall control, as set forth therein.
Section 9.3 — No Modification of Indemnification Cap
Except as specifically provided in this Agreement, the indemnification cap set forth in Section 12.2 of the MSA, which provides for a maximum aggregate liability of two times (2×) the trailing twelve-month fees paid (currently equal to Thirty-Two Million Six Hundred Thousand Dollars ($32,600,000)), shall remain in full force and effect and shall not be deemed waived, modified, reduced, exhausted, or otherwise affected by the settlement consideration paid or provided under this Agreement. For the avoidance of doubt, the Settlement Payment and the fee reduction shall not reduce the amount of indemnification available to Quorum under Section 12.2 of the MSA with respect to third-party claims arising from the Security Incident.
ARTICLE X — DISPUTE RESOLUTION
Section 10.1 — Governing Law
This Agreement shall be governed by and construed in accordance with the laws of the State of Connecticut, without giving effect to any choice of law or conflict of laws rules or provisions (whether of the State of Connecticut or any other jurisdiction) that would cause the application of the laws of any jurisdiction other than the State of Connecticut. The Parties acknowledge that this governing law provision is consistent with Section 15.1 of the MSA.
Section 10.2 — Mediation
Any dispute, controversy, or claim arising out of or relating to this Agreement, or the breach, termination, or validity thereof, shall first be submitted to non-binding mediation before a mutually agreed-upon mediator. The mediation shall be conducted in Hartford, Connecticut, in accordance with the mediation procedures of the American Arbitration Association then in effect, unless the Parties otherwise agree. The costs of mediation shall be shared equally by the Parties. If the Parties are unable to resolve the dispute through mediation within sixty (60) calendar days after the date on which mediation is first requested (or such longer period as the Parties may agree), either Party may proceed to litigation in accordance with Section 10.3.
Section 10.3 — Jurisdiction and Venue
If mediation is unsuccessful or if a Party seeks emergency or injunctive relief, each Party irrevocably and unconditionally consents and submits to the exclusive jurisdiction and venue of the state courts of the State of Connecticut located in Hartford County and the United States District Court for the District of Connecticut sitting in Hartford, Connecticut, for any action, suit, or proceeding arising out of or relating to this Agreement, and each Party irrevocably waives any objection that it may now or hereafter have to the laying of venue or any claim that any such action, suit, or proceeding has been brought in an inconvenient forum. Each Party agrees that service of process may be effected in the manner provided for notices under Section 11.5 of this Agreement.
Section 10.4 — Attorneys' Fees
In any action, suit, or proceeding to enforce this Agreement or to resolve any dispute arising hereunder, the prevailing Party shall be entitled to recover its reasonable attorneys' fees, costs, and expenses (including expert witness fees and court costs) from the non-prevailing Party, in addition to any other relief to which such prevailing Party may be entitled.
ARTICLE XI — MISCELLANEOUS PROVISIONS
Section 11.1 — Entire Agreement
This Agreement, together with MSA Amendment 3 (attached as Exhibit B) and the Exhibits attached hereto, constitutes the entire agreement between the Parties with respect to the subject matter hereof and supersedes all prior and contemporaneous discussions, negotiations, proposals, term sheets, letters of intent, memoranda of understanding, and agreements (whether oral or written) between the Parties with respect to the settlement of Claims arising from the Security Incident, including, without limitation, Palomar's prior goodwill credit offer of One Million Five Hundred Thousand Dollars ($1,500,000) communicated on or about June 15, 2023, and all subsequent settlement proposals and counterproposals exchanged by the Parties and their respective counsel. Each Party acknowledges that, in entering into this Agreement, it has not relied on any representation, warranty, promise, inducement, or statement of the other Party that is not expressly set forth in this Agreement.
Section 11.2 — Amendments
This Agreement may not be amended, modified, supplemented, or otherwise changed except by a written instrument duly executed by an authorized representative of each Party. No course of dealing between the Parties and no delay or failure by either Party in exercising any right under this Agreement shall constitute an amendment or modification of the terms of this Agreement.
Section 11.3 — Severability
If any provision of this Agreement is held by a court of competent jurisdiction or arbitral body to be invalid, illegal, void, or unenforceable under any applicable law, such provision shall be modified to the minimum extent necessary to make it valid and enforceable, and the validity, legality, and enforceability of the remaining provisions of this Agreement shall not be affected or impaired thereby. In the event any provision cannot be so modified, it shall be severed from this Agreement, and the remaining provisions shall continue in full force and effect. The Parties shall negotiate in good faith to replace any severed provision with a valid and enforceable provision that achieves, to the greatest extent possible, the economic, business, and legal objectives of the severed provision.
Section 11.4 — Waiver
No waiver of any provision of this Agreement shall be effective unless made in writing and signed by the waiving Party. No failure or delay by either Party in exercising any right, power, or privilege under this Agreement shall operate as a waiver thereof, nor shall any single or partial exercise of any right, power, or privilege preclude any other or further exercise thereof or the exercise of any other right, power, or privilege. The rights and remedies provided in this Agreement are cumulative and not exclusive of any rights or remedies provided by law or in equity.
Section 11.5 — Notices
All notices, demands, requests, consents, approvals, and other communications required or permitted under this Agreement shall be in writing and shall be deemed to have been duly given when: (a) delivered personally; (b) sent by confirmed email transmission (with a copy sent by one of the other methods specified herein); (c) sent by nationally recognized overnight courier service, prepaid; or (d) sent by certified or registered mail, return receipt requested, postage prepaid. Notices shall be addressed as follows:
If to Quorum:
Thomas R. Whitfield General Counsel Quorum Insurance Holdings Corp. 400 Constitution Plaza, Suite 2200 Hartford, CT 06103
Email: twhitfield@quoruminsurance.com
with a copy (which shall not constitute notice) to:
Kevin Ostrowski, Esq. Calderwood & Harkness LLP 1700 K Street NW, Suite 900 Washington, D.C. 20006
Email: kostrowski@calderwoodharkness.com
If to Palomar:
Derek Copeland General Counsel Palomar Data Solutions, Inc. 7100 Greenville Avenue, Suite 450 Dallas, TX 75231
Email: dcopeland@palomardata.com
with a copy (which shall not constitute notice) to:
Catherine Langford, Esq. Mercer, Haight & Dunlop LLP 2100 Ross Avenue, Suite 3600 Dallas, TX 75201
Email: clangford@mhdlaw.com
Either Party may change its address for notice purposes by providing written notice to the other Party in accordance with this Section 11.5.
Section 11.6 — Counterparts and Electronic Signatures
This Agreement may be executed in one or more counterparts, each of which shall be deemed an original and all of which, taken together, shall constitute one and the same instrument. Delivery of an executed counterpart of a signature page of this Agreement by portable document format (PDF) or other electronic transmission shall be effective as delivery of an original executed counterpart. Electronic signatures, including signatures transmitted via Brightwater Software, Ashford Health IT, or similar platforms, shall have the same legal force and effect as original ink signatures.
Section 11.7 — Assignment