Contract analysis

I. Executive Summary The purpose of this memorandum is to provide the Audit Committee and the full Board of Directors of Quorum Insurance Holdings Corp. ("Quorum" or the "Company") with an initial confidential briefing regarding a significant data security incident that originated from Quorum's third-party claims-processing vendor, Palomar Data Solutions, Inc. ("Palomar" or "PDS"). This briefing is being provided und

II. Background — Quorum's Relationship with Palomar Data Solutions A. Palomar Overview Palomar Data Solutions, Inc. ("Palomar" or "PDS") is a Texas corporation headquartered at 7100 Greenville Avenue, Suite 450, Dallas, Texas 75231. Palomar provides claims data processing, document management, and data analytics services to mid-to-large insurance carriers across the United States. Palomar has been in operation since

III. Incident discovery and Timeline A. Chronology of Events The following chronology sets forth the key events related to the incident, based on information available as of the date of this memorandum. This timeline is preliminary and subject to revision as the forensic investigation progresses and additional information becomes available. On or about March 14, 2023: A threat actor exploited a known but unpatched re

IV. Preliminary Assessment of Potential Scope and Impact A. Data Types Potentially Compromised Based on Palomar's initial notification to Quorum and Calderwood & Harkness's preliminary assessment of the categories of Quorum data processed by Palomar under the MSA, the incident potentially involves the following categories of Quorum data: Personally Identifiable Information (PII): Full names, dates of birth, Social Se

V. Engagement of Outside Counsel and Forensic Investigators A. Calderwood & Harkness LLP Calderwood & Harkness LLP was formally engaged by Quorum on May 4, 2023, to serve as outside counsel for the legal response to this incident (Matter No. 1025-00006). The engagement is managed through the Firm's Privacy & Data Security practice group, headquartered in Washington, D.C. Calderwood & Harkness's scope of engagement en

VI. Insurance Coverage and Claim Status A. Quorum's Cyber-Liability Insurance Tower Quorum maintains a two-layer cyber-liability insurance tower, as described below. The policies were placed through Quorum's cyber-insurance broker, Whitmore Risk Advisors Inc. (Sandra Whitmore-Kim, Lead Broker), located at 390 Park Avenue, 18th Floor, New York, New York 10022. Primary Policy: The Atlas primary policy covers, among oth

VII. Immediate Response Actions Taken A. Internal Quorum Actions Upon engagement of Calderwood & Harkness on May 4, 2023, Quorum's incident response plan was formally activated under the direction of outside counsel. The Quorum incident response team was assembled, consisting of the following individuals: • David Naranjo, Chief Information Security Officer • Jennifer Liang, Chief Privacy Officer • Thomas R. Whitfield

VIII. Anticipated Next Steps and Timeline The following is the anticipated timeline for the next phases of the incident response. All dates are estimates and are subject to revision based on the progress of the forensic investigation and other developments. Calderwood & Harkness and the General Counsel's Office will provide the Audit Committee with updated briefings at key milestones, including but not limited to the

IX. Estimated Financial Exposure (Preliminary) At this early stage of the investigation, precise cost estimates are not available, and any projections are inherently subject to significant variability based on the ultimate scope of the incident. However, based on Calderwood & Harkness's experience advising clients on incidents of this general nature and scale, the following preliminary cost categories and order-of-ma

X. Recommendations The Audit Committee is asked to note and consider the following recommendations from Calderwood & Harkness LLP and the General Counsel's Office:

1. Continue Privileged Forensic Investigation. The Audit Committee should authorize the continuation of the privileged forensic investigation through Graystone Forensics under the Calderwood & Harkness privilege umbrella, with milestone reporting to the Audit Committee as described in Section VIII above. The forensic investigation is essential to determining the scope of the incident, identifying affected individuals

2. Preserve Vendor Accountability Rights. Calderwood & Harkness and the General Counsel's Office recommend that Quorum take all steps necessary to document and preserve its contractual rights against Palomar, including documenting Palomar's breaches of the MSA (specifically, the failure to patch the critical vulnerability within the required thirty-day window under Exhibit D and the late notification under Section 9.

3. Monitor Regulatory Landscape. The incident response team, under the direction of Calderwood & Harkness, should actively monitor for any incoming regulatory inquiries, demand letters, or enforcement actions from state attorneys general, the Connecticut Insurance Department, the HHS Office for Civil Rights, or any other regulatory authority. Quorum's regulatory compliance posture should remain proactive and cooperat

4. Coordinate with Insurance Carriers. Calderwood & Harkness and Whitmore Risk Advisors should continue to coordinate with Atlas Mutual and Pinnacle to ensure compliance with all policy terms and conditions, including cooperation requirements, consent-to-settle provisions, and timely submission of covered cost documentation. The objective is to maximize insurance recovery and to ensure that the claim process proceeds

5. Defer Public Disclosure. Public disclosure of the incident should be deferred until the scope of the incident is confirmed through the forensic investigation and regulatory or legal notification obligations are triggered. Premature disclosure could compromise the investigation, create unnecessary alarm among policyholders and the market, and potentially prejudice Quorum's legal position. BrightPath Consulting Grou

6. SEC Disclosure Assessment. The SEC disclosure assessment is ongoing. A formal materiality analysis under Item 1.05 of Form 8-K and applicable 10-Q risk factor disclosure requirements will be conducted upon receipt of the final forensic report from Graystone, at which point a definitive recommendation regarding the timing, content, and form of any public disclosure will be provided to the Audit Committee and the Ch

XI. Contacts The following is a list of key contacts for the matter. All communications regarding this incident should be directed through Thomas R. Whitfield, General Counsel, or Kevin Ostrowski, Calderwood & Harkness LLP, to preserve the attorney-client privilege.

XII. Closing Privilege Reminder This memorandum is protected in its entirety by the attorney-client privilege and the work product doctrine. It was prepared by Calderwood & Harkness LLP and the Quorum Insurance Holdings Corp. General Counsel's Office in anticipation of litigation and for the purpose of providing legal advice to the Audit Committee and the Board of Directors of Quorum Insurance Holdings Corp. The memo