Contract analysis

From: Catherine Langford <clangford@mercerhaightdunlop.com> To: Kevin Ostrowski <kostrowski@calderwoodharkness.com> Cc: Brian Soto <bsoto@mercerhaightdunlop.com> Date: Fri, 07 Jul 2023 04:47:00 -0000 Subject: Re: Quorum Insurance Holdings Corp. — Indemnification Demand Under Master Services Agreement — Palomar Data Solutions, Inc. Response

I am writing on behalf of our client, Palomar Data Solutions, Inc. ("Palomar"), in response to your demand letter dated June 20, 2023, submitted on behalf of Quorum Insurance Holdings Corp. ("Quorum"). Please find attached Palomar's formal written response, which sets forth our client's position in detail. I wanted to use this cover email, however, to preview several of the key points addressed in the enclosed letter

**Causation.** Palomar respectfully disputes the characterization of causation set forth in Quorum's demand. As you are aware, the attack at issue exploited CVE-2023-0669, a remote code execution vulnerability in Severin Corporation's GoAnywhere MFT platform that originated as a zero-day and affected numerous organizations globally. Palomar contends that the exploitation of this vulnerability was part of a broader, h

**Patch Management.** While Palomar acknowledges that the vulnerability had been identified prior to the initial unauthorized access on March 14, 2023, Palomar's patch management cycle was actively in progress at that time. Palomar's position is that the 30-day patching requirement set forth in Exhibit D to the Master Services Agreement dated November 12, 2019 (as amended) (the "MSA") must be read in the context of c

**Scope of Claimed Damages.** Palomar disputes the full scope of the $8,230,250 indemnification demand asserted under Section 12.2 of the MSA. Not all of the costs identified in your demand are properly attributable to Palomar's conduct. Quorum's own discretionary decisions — including the scope and manner of individual notification, the selection of a 24-month credit monitoring term, and the choice of third-party ve

**Notification Timing.** The attached letter also addresses your assertion that Palomar's notification to Quorum on April 21, 2023, was approximately 24 hours late relative to the 48-hour contractual requirement under Section 9.4 of the MSA. Palomar's position is that the contractual notification clock runs from "confirmation" of a security incident affecting Quorum data, not from the initial detection of anomalous a

**Goodwill Credit.** Notwithstanding Palomar's position on causation and liability, and expressly without any admission of liability or breach, Palomar is prepared to offer a goodwill credit of $1,500,000 against future service fees under the MSA, to be applied over the remaining term (through November 11, 2024), as a gesture of its commitment to the long-standing business relationship between Palomar and Quorum.

I want to emphasize that Palomar values its relationship with Quorum — one of Palomar's most significant clients — and is committed to working collaboratively toward a resolution of this matter. Palomar has already taken substantial remedial steps to enhance its security posture following the incident and remains committed to providing Quorum with excellent service. That said, Palomar reserves all rights and defenses

Brian Soto and I remain available to discuss this matter further at your convenience, and we are open to scheduling a call or meeting to explore a mutually acceptable resolution. We would ask that all further correspondence regarding this matter be directed to me at Mercer, Haight & Dunlop, with a copy to Derek Copeland, Palomar's General Counsel.

Catherine Langford Partner Mercer, Haight & Dunlop LLP 2100 Ross Avenue, Suite 3600 Dallas, TX 75201 T: (214) 553-8800 E: clangford@mercerhaightdunlop.com

CONFIDENTIALITY NOTICE: This email and any attachments are for the exclusive and confidential use of the intended recipient. If you are not the intended recipient, please do not read, distribute, or take action based on this message. If you have received this communication in error, please notify the sender immediately by reply email and permanently delete all copies of this message and any attachments. This communic