Contract analysis

I. Executive Summary You have asked us to analyze the disclosure obligations of Quorum Insurance Holdings Corp. ("Quorum" or the "Company") (Nasdaq: QIHC) under the federal securities laws in connection with the data security incident (the "Incident") originating from Quorum's third-party claims data processing vendor, Palomar Data Solutions, Inc. ("Palomar"). This memorandum sets forth our analysis and recommendatio

II. Background — Summary of the Incident A. Incident Overview On or about March 14, 2023, a threat actor exploited a known remote code execution vulnerability in the GoAnywhere Managed File Transfer ("MFT") platform—specifically, CVE-2023-0669—to gain unauthorized access to Palomar Data Solutions' network environment. Palomar serves as a third-party claims data processing vendor for Quorum's personal lines division,

III. Applicable SEC Disclosure Framework A. New SEC Cybersecurity Disclosure Rules (Final Rule, July 2023) On March 9, 2022, the SEC proposed comprehensive new rules governing cybersecurity risk management, strategy, governance, and incident disclosure by public companies. Based on public statements by SEC Chair Gary Stonefield Advisory Group and the progression of the rulemaking process, these rules are expected to

IV. Materiality Analysis The determination of whether the Incident is "material" for purposes of the federal securities laws requires both a quantitative and qualitative analysis, consistent with the standard set forth in TSC Industries and Basic Inc., as well as the SEC staff's interpretive guidance. We address each component below. A. Quantitative Analysis

1. Estimated Financial Impact Based on the information currently available, the total estimated incident response costs are approximately $8,230,250, comprising the following categories: These figures are estimates based on current projections and vendor engagement scopes. Actual costs may vary as the response progresses, and additional cost categories may emerge depending on regulatory and litigation developments. T

2. Insurance Coverage Offset Quorum maintains a comprehensive cyber-insurance program consisting of two layers: Primary Layer: Atlas Mutual Insurance Company, Policy No. CYB-2023-041587, with a per-occurrence limit of $15,000,000 and a self-insured retention ("SIR") of $2,500,000. The policy covers first-party costs including forensic investigation, notification, credit monitoring, crisis communications, legal fees,

3. Vendor Indemnification Potential As noted above, Section 12.2 of the MSA between Quorum and Palomar provides for indemnification of Quorum by Palomar for losses arising from Palomar's breach of its data security obligations. The indemnification provision is subject to a liability cap of two times the trailing twelve-month fees paid under the agreement. Based on the trailing twelve-month fee payments of approximate

4. Comparison to Key Financial Metrics To assess the quantitative materiality of the Incident's financial impact, we compare the estimated costs and net exposure to Quorum's key financial metrics: • Total estimated incident response costs ($8,230,250) as a percentage of Quorum FY 2022 annual revenue ($4.82 billion): approximately 0.17%. • Net out-of-pocket exposure (SIR amount of $2,500,000) as a percentage of Quorum

5. Potential Additional Costs (Contingent/Uncertain) In addition to the estimated direct incident response costs analyzed above, several categories of potential additional costs exist that are currently contingent and uncertain: • Regulatory fines or penalties: Regulatory notifications to twenty-nine state attorneys general, the Connecticut Insurance Department, and HHS-OCR are in preparation. As of the date of this

1. Factors Suggesting Materiality May Be Present Several qualitative factors weigh in favor of a finding that the Incident may be material to investors: • Scale of affected individuals. The Incident affected 318,247 individuals—policyholders and claimants of Quorum's personal lines division. While this figure represents a fraction of Quorum's overall customer base, it is a significant number of affected individuals i

2. Factors Suggesting Materiality May Not Be Present Countervailing qualitative factors weigh against a finding of materiality: • Vendor-originated breach. The Incident originated in Palomar's network, not in Quorum's own systems. Quorum's information security program, network infrastructure, and the QuorumEdge platform were not compromised. The threat actor exploited a vulnerability in a third-party vendor's softwar

1. Any regulatory enforcement action is initiated by a state attorney general, the Connecticut Insurance Department, HHS-OCR, or any other regulatory authority;

2. A consumer class action lawsuit or other significant litigation is filed with the potential for substantial exposure;

3. Insurance coverage is disputed, denied, or the carrier issues a reservation of rights that materially reduces expected recovery;

4. Vendor indemnification negotiations fail, or Palomar contests its indemnification obligations in a manner that significantly reduces expected recovery;

5. Additional compromised data is identified, or the number of affected individuals increases materially beyond the current 318,247;

6. Evidence of misuse of the compromised data emerges;

7. Media coverage or investor reaction to the Incident, once publicly disclosed, indicates a market-moving impact; or

8. Total costs significantly exceed current estimates. We recommend that the General Counsel, Chief Privacy Officer (Jennifer Liang), and Chief Information Security Officer (David Naranjo) establish a periodic review cadence of at minimum every thirty days, or immediately upon any of the developments identified above, to formally reassess materiality. Each reassessment should be documented in writing to create a cont

V. Form 8-K Analysis A. Item 1.05 (Cybersecurity Incident Disclosure) Under the SEC's anticipated final rules, new Item 1.05 of Form 8-K will require a registrant to file a Current Report on Form 8-K within four business days of determining that a cybersecurity incident is material. The four-business-day clock begins to run from the date on which the registrant makes the materiality determination—not from the date of

VI. Form 10-Q Disclosure Considerations A. Timing Quorum's next quarterly report on Form 10-Q is for the fiscal quarter ended June 30, 2023, and is expected to be filed on or about mid-August 2023 (within 40 days of the quarter-end for accelerated filers). The Incident and its potential impacts should be addressed in this filing. The timing of the 10-Q filing relative to the planned consumer notification mailings (be

VII. Coordination with Public Communications The timing of the Company's SEC disclosure activities must be carefully coordinated with the broader public communications strategy for the Incident. Several concurrent workstreams will bring the Incident into the public domain in August 2023: • Consumer notification letters are planned to begin mailing on or about August 18, 2023. Once the notification mailings commence,

VIII. SEC Enforcement Risk Considerations The current SEC enforcement environment warrants careful attention to cybersecurity disclosure decisions. The Commission has made cybersecurity disclosure a priority enforcement area, and recent developments illustrate the potential risks of inadequate or untimely disclosure. The SEC has brought enforcement actions in recent years against public companies for allegedly making