Contract analysis

I. EXECUTIVE SUMMARY This memorandum serves as the final privileged briefing to the Audit Committee and Board of Directors of Quorum Insurance Holdings Corp. ("Quorum" or the "Company") regarding the successful resolution and closure of all regulatory engagements and vendor accountability matters arising from the vendor-originated data security incident at Palomar Data Solutions, Inc. ("Palomar"). Calderwood & Harkne

II. BACKGROUND — INCIDENT SUMMARY For the benefit of any Board member who may not have been present for all prior briefings, and to provide complete context for this closing report, we summarize below the key facts of the data security incident that gave rise to this engagement. Origin of the Incident The incident at issue arose not from any failure or vulnerability within Quorum's own information systems, but rather

III. CONSUMER AND REGULATORY NOTIFICATION COMPLETION A. Consumer Notifications Following the completion of Graystone's forensic investigation and the identification of affected data types, Calderwood & Harkness coordinated a comprehensive consumer notification program in compliance with the breach notification statutes of all 29 affected states and the District of Columbia, as well as the Health Insurance Portability

1. General PII Version: Sent to individuals whose names, dates of birth, Social Security numbers, and/or driver's license numbers were compromised, but who did not have financial information or PHI affected.

2. SSN + Financial Data Version: Sent to the subset of 84,619 individuals whose financial information (bank account numbers and/or payment card numbers) was compromised in addition to PII.

3. PHI Version (HIPAA-Compliant): Sent to the subset of 41,203 individuals whose protected health information was compromised. This version was drafted in compliance with the content requirements of 45 C.F.R. § 164.404(c), including a description of the types of PHI involved, steps individuals should take to protect themselves, a description of what Quorum is doing to investigate and mitigate the breach, and contact

IV. RESOLUTION OF REGULATORY ENGAGEMENTS This Section describes the resolution of each of the three regulatory engagement tracks that arose from the incident. As noted in the Executive Summary, all three tracks have concluded without any adverse action against Quorum. A. Multistate Attorney General Coalition (29 States) Joint Demand Letter. On September 8, 2023, Calderwood & Harkness received a joint demand letter fr

1. Vendor-Originated Breach: The breach occurred in Palomar's systems, not Quorum's. Quorum's own information systems were not compromised, and the vulnerability that was exploited (CVE-2023-0669) existed in Palomar's GoAnywhere MFT environment, not in any Quorum-owned or Quorum-operated system.

2. Robust Information Security Program: Quorum maintains a mature, well-resourced information security program that meets or exceeds industry standards for organizations of its size and complexity, including compliance with the NIST Cybersecurity Framework and applicable state insurance data security laws.

3. Timely Consumer and Regulatory Notifications: Quorum completed all consumer and regulatory notifications within the timeframes required by applicable law in all 29 affected states and the District of Columbia.

4. Proactive Vendor Accountability: Quorum took prompt and decisive action to hold Palomar accountable for its contractual breaches, including issuing a formal indemnification demand and negotiating a settlement that yielded substantial financial recovery for the Company and enhanced security protections going forward.

5. Comprehensive Remediation: Quorum implemented a comprehensive remediation program, including enhanced vendor oversight measures, contractual amendments with Palomar, and credit monitoring and identity theft protection services for all affected individuals. Supplemental Submission. On November 3, 2023, Calderwood & Harkness submitted a supplemental information package to the coalition, providing updated credit moni

V. VENDOR ACCOUNTABILITY — PALOMAR DATA SOLUTIONS SETTLEMENT A. Contractual Basis for Claims As detailed in prior briefings, Quorum identified two distinct breaches of the MSA by Palomar that formed the basis for Quorum's indemnification claims: First, Palomar breached its obligation under Exhibit D (the Data Security Exhibit), as amended by Amendment 2 (executed September 15, 2022), to patch critical and high-severi

VI. FINANCIAL SUMMARY — TOTAL COSTS, INSURANCE RECOVERY, AND NET IMPACT A. Total Incident Response Costs The following table summarizes the total incident response costs incurred in connection with the Palomar data security incident: For transparency and in accordance with our standard billing disclosure practices for Board-level engagements, we provide the following summary of Calderwood & Harkness's fees: Calderwoo

VII. SEC DISCLOSURE STATUS As analyzed in the separate SEC Disclosure Analysis Memorandum prepared by Calderwood & Harkness and dated July 19, 2023, the Firm evaluated Quorum's disclosure obligations arising from the incident under the Securities and Exchange Commission's cybersecurity disclosure rules, including Item 1.05 of Form 8-K (requiring disclosure of material cybersecurity incidents) and periodic reporting o

VIII. POST-INCIDENT REMEDIATION AND LESSONS LEARNED Calderwood & Harkness has prepared a separate Post-Incident Lessons Learned & Remediation Recommendations Memorandum, dated November 30, 2023, which will be provided to the Audit Committee and Board under separate cover. That memorandum contains a detailed analysis of the incident response process, identifies areas for improvement, and sets forth specific recommenda

IX. ENGAGEMENT CLOSURE Calderwood & Harkness recommends that the engagement in connection with the Palomar data security incident (Matter No. 1025-00006) be formally closed effective December 1, 2023. All substantive workstreams have been concluded, as summarized below: Document Retention and Privilege Log Protocol. A separate Document Retention & Privilege Log Protocol Memorandum will be issued by Calderwood & Harkn

X. CONCLUSION AND RECOMMENDATION The Palomar data security incident has been resolved with what Calderwood & Harkness considers to be the most favorable outcome achievable under the circumstances. The key outcomes are: • No enforcement action from any regulator — the multistate AG coalition (29 states), the Connecticut Insurance Department, and HHS-OCR have all closed their respective inquiries without imposing any f

1. Approve formal closure of the matter, Matter No. 1025-00006, effective December 1, 2023, and direct that Calderwood & Harkness issue the Document Retention & Privilege Log Protocol Memorandum to ensure the preservation and organization of all matter-related documents.

2. Review and adopt the post-incident remediation recommendations set forth in the Post-Incident Lessons Learned & Remediation Recommendations Memorandum (to be provided under separate cover), and direct management to develop an implementation timeline and report back to the Audit Committee on progress.

3. Consider the adequacy of Quorum's cyber-insurance program in light of the incident, including whether the current tower limits, SIR levels, and coverage terms remain appropriate for the Company's evolving risk profile. Calderwood & Harkness recommends that management, in consultation with Whitmore Risk Advisors, conduct a comprehensive coverage review in connection with the next policy renewal cycle. Calderwood &