Contract analysis

From: "Alan Burke" To: "Dr.Nolan Briggs" Cc: "Kevin Ostrowski" Date: Sun, 07 May 2023 10:42:00 -0000 Subject: Quorum Insurance Holdings Corp. — Finalized Scope of Work & Investigation Plan [PRIVILEGED & CONFIDENTIAL — ATTORNEY-CLIENT COMMUNICATION / WORK PRODUCT]

**PRIVILEGED AND CONFIDENTIAL — ATTORNEY-CLIENT COMMUNICATION AND ATTORNEY WORK PRODUCT. This communication and its attachments are protected by the attorney-client privilege and/or the work product doctrine. Do not forward, copy, or distribute without prior authorization from Calderwood & Harkness LLP.**

Thank you for the productive kickoff call on Friday. I appreciate the time you and Kendra took to walk through Graystone's preliminary approach and resource plan — it was a very helpful discussion and gave us confidence that we are well-aligned on priorities.

Attached to this email, please find the finalized Scope of Work and Investigation Plan, which incorporates the revisions we discussed on the call. As you know, Graystone Forensics LLC has been retained at the direction of counsel — Calderwood & Harkness LLP — to provide forensic investigation services in connection with the data security incident affecting our client, Quorum Insurance Holdings Corp. (C&H Matter No. 1

By way of brief summary for the record and for those copied: the incident originates from Quorum's third-party claims-processing vendor, Palomar Data Solutions, Inc., headquartered in Dallas, Texas. Palomar's network was compromised through exploitation of CVE-2023-0669, a remote code execution vulnerability in Palomar's GoAnywhere MFT file transfer appliance. Based on available information, initial unauthorized acce

There is reason to believe that structured data files containing personally identifiable information (PII), financial data, and potentially protected health information (PHI) of Quorum policyholders and claimants may have been exfiltrated during this period.

**Scope of Work — Summary of Workstreams**

The finalized scope of work, detailed in the attachment, covers four primary workstreams:

1. **Entry Vector Confirmation.** Confirm and document the threat actor's method of initial access, including analysis of the exploited CVE-2023-0669 vulnerability, Palomar's patch status at the time of compromise, and the network entry point.

2. **Timeline Reconstruction.** Reconstruct the full timeline of unauthorized access from initial compromise (on or about March 14, 2023) through Palomar's detection on April 18, 2023, including lateral movement within Palomar's network and any persistence mechanisms deployed by the threat actor.

3. **Data Exfiltration Analysis.** Identify and document the specific data sets accessed and/or exfiltrated, including the staging and transfer methodology used by the threat actor. Determine the volumes and types of data involved.

4. **Compromised Data Classification.** Classify the types of data compromised — including PII (names, dates of birth, Social Security numbers, driver's license numbers), financial information (bank account numbers, payment card numbers), and PHI (health conditions, diagnosis codes, treatment information from workers' compensation and health-related claims). Identify the total number of affected individuals and provi

**Privilege Framework and Communication Protocols**

I want to reiterate several points regarding privilege that are critical to the integrity of this engagement:

All work performed by Graystone under this engagement is at the direction of, and for the benefit of, legal counsel in connection with providing legal advice to Quorum. All reports, findings, analyses, and communications constitute attorney work product and are protected by the attorney-client privilege.

All deliverables — including preliminary findings, interim updates, and the final forensic report — must be directed exclusively to Calderwood & Harkness LLP. Graystone should not communicate findings directly to Quorum personnel, Palomar, or any other party without prior written authorization from Calderwood & Harkness. All documents and communications should be marked: "PRIVILEGED AND CONFIDENTIAL — PREPARED AT THE

On a practical level, day-to-day communications should be directed to me and Sara Hendricks, with Kevin Ostrowski copied on significant developments and all formal deliverables. Email is acceptable for routine coordination; however, substantive findings or sensitive forensic details should be discussed via secure call or transmitted via encrypted file transfer. Graystone's secure portal is acceptable for this purpose

Additionally, Graystone should not retain or produce any documents to third parties without Calderwood & Harkness's express written consent.

We have established the following reporting cadence, which is also reflected in the attached scope of work:

- **Weekly Status Updates:** Beginning the week of May 15, Graystone should provide brief written status updates each Friday to me and Sara, summarizing investigative progress, any preliminary observations, and anticipated next steps. These need not be formal reports but should be marked as privileged. Email is sufficient.

- **Preliminary Findings Report:** Target delivery by early June 2023 (approximately four weeks from commencement). This report should provide initial conclusions on the entry vector, timeline, and a preliminary assessment of the data sets likely compromised.

- **Final Forensic Report:** Target delivery by mid-July 2023 (approximately ten weeks from commencement). This report should provide definitive findings on all four workstreams, including confirmed scope of compromised data, total affected individuals, state-by-state breakdown, and data-type categorization (PII, financial, PHI).

I recognize that these timelines may need to be adjusted based on the complexity of the forensic analysis and the availability of data from Palomar. If you anticipate any material delays, please communicate those to us promptly so we can manage downstream obligations accordingly.

Calderwood & Harkness is coordinating access to Palomar's systems and logs. On Quorum's side, David Naranjo (CISO) and Priya Deshmukh (VP, Vendor Risk Management) are liaising with Palomar's CTO, Anita Raghavan, to facilitate Graystone's access to relevant network logs, system images, and file transfer records. We expect to have initial access arrangements confirmed within the next few days and will keep you posted.

Please note that Palomar is represented by outside counsel — Mercer, Haight & Dunlop LLP (Catherine Langford, Partner). Any communications with Palomar's legal team should be routed through Calderwood & Harkness. Graystone personnel may interact with Palomar's technical staff for data collection purposes, but should not discuss legal conclusions, liability assessments, or privileged analysis with Palomar personnel.

This email confirms that Kendra Faulkner will serve as Senior Forensic Analyst and primary day-to-day point of contact on the Graystone side, reporting to you. On our end, Sara Hendricks and I will serve as the primary Calderwood & Harkness contacts.

Please confirm that Graystone's billing will be submitted to Calderwood & Harkness in accordance with the retention letter executed on May 5, 2023. All invoices should reference C&H Matter No. 1025-00006 and the client name "Quorum Insurance Holdings Corp."

Nolan, could you please confirm receipt of this email and the attached scope of work at your earliest convenience, and flag any questions or concerns? We are eager to get this moving and I appreciate Graystone's rapid mobilization on this matter. I look forward to working closely with you and Kendra over the coming weeks.

**Alan Burke** Lead Associate, Privacy & Data Security Calderwood & Harkness LLP 1700 K Street NW, Suite 900 Washington, D.C. 20006 T: (202) 555-4138 E: aburke@calderwoodharkness.com

**Attachment:** Graystone Forensics — Scope of Work & Investigation Plan (May 7, 2023) — PRIVILEGED AND CONFIDENTIAL.pdf

*CONFIDENTIALITY NOTICE: This email and any attachments are for the exclusive and confidential use of the intended recipient(s). If you are not the intended recipient, please do not read, distribute, or take action based on this message. This communication may contain information that is privileged, confidential, and exempt from disclosure under applicable law, including attorney-client privileged communications and