Contract analysis

I. EXECUTIVE SUMMARY The purpose of this memorandum is to provide the Audit Committee of the Board of Directors of Quorum Insurance Holdings Corp. with a comprehensive update on the forensic investigation findings, the planned consumer and regulatory notification strategy, estimated incident response costs, the Company's insurance coverage posture, and our assessment of the Company's vendor accountability position wi

II. BACKGROUND — INCIDENT SUMMARY This Section provides a brief recap of the incident for Audit Committee context. A more detailed background was provided in the Initial Briefing Memo dated May 11, 2023. Quorum outsources claims data processing for its personal lines division to Palomar Data Solutions, Inc. ("Palomar"), a Texas corporation headquartered at 7100 Greenville Avenue, Suite 450, Dallas, Texas 75231. The o

III. FORENSIC INVESTIGATION — FINAL FINDINGS A. Investigation Overview Graystone Forensics LLC ("Graystone"), based in Tysons Corner, Virginia, conducted the forensic investigation under the direction and at the request of Calderwood & Harkness in order to preserve the attorney-client privilege and attorney work product protections applicable to the investigation and its findings. The investigation was led by Dr. Nol

IV. NOTIFICATION OBLIGATION ANALYSIS A. State Breach Notification Laws Calderwood & Harkness completed a comprehensive 50-state breach notification law survey on June 8, 2023, identifying the specific statutory requirements, triggers, timelines, content requirements, and regulatory filing obligations applicable in each jurisdiction. On July 20, 2023, Calderwood & Harkness completed its notification trigger analysis,

V. CONSUMER AND REGULATORY NOTIFICATION PLAN A. Consumer Notification Strategy Calderwood & Harkness, in coordination with Quorum's legal, privacy, and corporate communications teams, has developed a comprehensive consumer notification strategy designed to achieve timely compliance with all applicable state, federal, and sector-specific notification requirements. The strategy encompasses tailored notification letters

VI. ESTIMATED INCIDENT RESPONSE COSTS A. Cost Breakdown The following table summarizes the estimated and incurred costs associated with the incident response as of the date of this memorandum: A more detailed breakdown of the Clearfield and Calderwood & Harkness cost components is provided below. Clearfield Notification Services LLC — $3,214,500 (estimated) • Notification printing and mailing: $636,000, based on 318,

VII. VENDOR ACCOUNTABILITY — PALOMAR DATA SOLUTIONS A. Contractual Basis for Indemnification As noted above, the outsourcing relationship between Quorum and Palomar is governed by the MSA dated November 12, 2019, as amended by Amendment 1 (effective March 3, 2021) and Amendment 2 (effective September 15, 2022). Calderwood & Harkness has conducted a thorough review of the MSA and its amendments to identify all contrac

1. Failure to Timely Patch. Palomar failed to apply the vendor-issued patch for CVE-2023-0669 within the 30-day window required by Exhibit D of the MSA. The patch was publicly available prior to the date of initial exploitation (on or about March 14, 2023). This failure was the direct and proximate cause of the threat actor's initial access to Palomar's network and the subsequent data exfiltration. This constitutes a

2. Late Breach Notification. Palomar's notification to Quorum on April 21, 2023, approximately 72 hours after its SOC detected the anomalous activity on April 18, 2023, was approximately 24 hours past the contractual 48-hour notification deadline under Section 9.4 of the MSA. While the late notification did not itself cause the breach, it delayed Quorum's ability to initiate its own incident response procedures and e

VIII. SEC DISCLOSURE CONSIDERATIONS Calderwood & Harkness has prepared a separate SEC Disclosure Analysis Memorandum dated July 19, 2023 (the "SEC Memo"), which provides a detailed analysis of Quorum's disclosure obligations under Item 1.05 of Form 8-K (cybersecurity incident disclosure, effective December 2023) and the potential need to update risk factor disclosures in Quorum's upcoming 10-Q filing. The SEC Memo ha

IX. ANTICIPATED REGULATORY ENGAGEMENT Based on Calderwood & Harkness's experience with incidents of comparable scope and scale, we anticipate that the regulatory notification filings will likely prompt follow-up inquiries from one or more regulatory agencies. The regulators most likely to engage are: • Connecticut Attorney General's Office: AAG Diane Marchetti, Consumer Protection Division, is the likely point of con

X. RECOMMENDED NEXT STEPS AND TIMELINE Based on the foregoing analysis, Calderwood & Harkness recommends the following next steps and timeline:

1. By August 4, 2023: Finalize the data mining and affected individual identification process, which is currently in its final stages. Calderwood & Harkness will confirm the final affected individual counts and any necessary adjustments to the notification letters upon completion.

2. By August 6, 2023: Execute the statement of work with Clearfield Notification Services LLC for notification mailing, call center operations, and credit monitoring enrollment services. The statement of work is in final draft and has been reviewed by Calderwood & Harkness.

3. By August 14, 2023: File regulatory notifications with the Connecticut Attorney General and the Connecticut Insurance Department, initiating the regulatory notification sequence.

4. By August 15, 2023: File the HHS-OCR HIPAA breach notification through the HHS breach reporting portal and issue the required media notice under 45 C.F.R. § 164.406.

5. August 16–25, 2023: File remaining state attorney general and regulator notifications on a rolling basis, in accordance with the regulatory notification timeline set forth in Section V.B above.

6. August 18 – September 15, 2023: Mail consumer notification letters through Clearfield on a rolling basis over the approximately 28-day mailing window.

7. Ongoing: Continue Palomar indemnification negotiations. Send rebuttal letter (anticipated July 25, 2023) rejecting Palomar's causation defenses and the inadequate goodwill offer. Develop and implement negotiation strategy to achieve full or near-full indemnification recovery.

8. Ongoing: Coordinate with Atlas Mutual Insurance Company on claim documentation and reimbursement for qualifying costs above the SIR. No excess layer (Pinnacle Surplus Lines) involvement is anticipated at current cost levels.

9. Ongoing: Monitor for and respond to any regulatory follow-up inquiries or information requests from state attorneys general, the Connecticut Insurance Department, HHS-OCR, or other regulatory agencies.

10. Ongoing: BrightPath Consulting Group Inc. to manage external and internal communications in accordance with the coordinated communications strategy, including the press statement, employee communications, and investor-facing disclosure language.

11. As Needed: Provide further updates to the Audit Committee as material developments occur. Calderwood & Harkness anticipates that the next full briefing will be appropriate after the completion of the regulatory filings and the substantial completion of the consumer notification mailings, which is expected by late September or early October 2023.

XI. CONCLUSION The forensic investigation conducted by Graystone Forensics LLC, under the direction of Calderwood & Harkness, has confirmed a significant but manageable data security incident affecting 318,247 individuals across 29 states and the District of Columbia. The incident originated entirely from Palomar Data Solutions' failure to maintain the security controls required by the Master Services Agreement — spe