Contract analysis

From: Kevin Ostrowski <kostrowski@calderwoodharkness.com> To: Catherine Langford <clangford@mercerhaight.com> Cc: Alan Burke <aburke@calderwoodharkness.com> Date: Tue, 20 Jun 2023 02:47:00 -0000 Subject: Quorum Insurance Holdings Corp. — Demand for Indemnification Under Master Services Agreement / Palomar Data Solutions, Inc. Security Incident

I write as counsel to Quorum Insurance Holdings Corp. ("Quorum") in connection with the data security incident originating from the network environment of Palomar Data Solutions, Inc. ("Palomar"). This matter is being handled by Calderwood & Harkness LLP under Matter No. 1025-00006. I understand that you and your colleagues at Mercer, Haight & Dunlop LLP serve as outside counsel to Palomar in connection with this mat

Please find attached hereto a formal Breach of Contract and Indemnification Demand Letter dated June 20, 2023, addressed to Palomar through your firm (the "Demand Letter"). The Demand Letter constitutes Quorum's formal demand for contractual indemnification under Section 12.2 of the Master Services Agreement dated November 12, 2019, between Quorum and Palomar (the "MSA"), as amended by Amendment 1, dated March 3, 202

While the attached Demand Letter addresses these matters comprehensively, I will briefly summarize the principal bases for Quorum's claim for your reference.

First, Palomar failed to timely remediate a critical remote code execution vulnerability (CVE-2023-0669) in its GoAnywhere MFT file transfer appliance within the thirty (30)-day patching window required by the Data Security Exhibit (Exhibit D, as amended). This failure created the attack vector through which unauthorized access to Quorum policyholder data was achieved.

Second, Palomar failed to comply with the forty-eight (48)-hour security incident notification requirement set forth in Section 9.4 of the MSA. Although Palomar discovered anomalous activity on or about April 18, 2023, Palomar did not notify Quorum until April 21, 2023 — a delay of approximately twenty-four (24) hours beyond the contractual deadline. This delay materially impaired Quorum's ability to initiate its own

As a result of these failures, unauthorized actors accessed and exfiltrated data from Palomar's environment over an approximately thirty-five (35)-day window, from on or about March 14, 2023 through April 18, 2023. Based on preliminary findings from Graystone Digital Forensics dated June 2, 2023, which confirmed the exfiltration of structured data files, the incident compromised the personally identifiable informatio

Quorum is incurring and will continue to incur significant costs in connection with forensic investigation, consumer notification and call center operations, credit monitoring and identity protection services, regulatory compliance across multiple jurisdictions, crisis communications, and legal fees. All such costs constitute indemnifiable losses under Section 12.2 of the MSA.

We acknowledge that the contractual indemnification obligation under Section 12.2 is subject to a liability cap equal to two times the trailing twelve-month fees paid under the MSA, which amounts to $32,600,000 (2 × $16,300,000 annual contract value following Amendment 1). Quorum's demand is for full indemnification of all incident response costs, which are expected to be well within the applicable cap. Quorum reserv

Quorum requests that Palomar, through counsel, provide a substantive written response to the attached Demand Letter within thirty (30) days — that is, no later than July 20, 2023. Quorum expects to engage constructively with Palomar to resolve this indemnification claim. However, should a reasonable resolution not be achievable, Quorum will not hesitate to pursue all available contractual and legal remedies.

Quorum expressly reserves all rights and remedies available to it under the MSA and applicable law, including but not limited to its right to terminate the MSA for cause under Section 14.2 (material breach with thirty (30)-day cure period). Nothing in the attached Demand Letter or in this correspondence shall constitute or be construed as a waiver of any right, claim, or remedy, whether or not specifically referenced

I would appreciate it if you could confirm receipt of this email and the attached Demand Letter at your earliest convenience. Should you have any questions regarding the demand, or if you would like to discuss logistics for Palomar's response, please do not hesitate to contact me directly at the number below. I am also happy to arrange a telephone call to discuss the matter if that would be useful.

Thank you for your attention to this matter.

**Kevin Ostrowski** Partner, Privacy & Data Security Calderwood & Harkness LLP 1700 K Street NW, Suite 900 Washington, D.C. 20006 Tel: (202) 654-3100 Email: kostrowski@calderwoodharkness.com

**Attachment:** Quorum Insurance Holdings Corp. — Breach of Contract and Indemnification Demand Letter (June 20, 2023).pdf

*CONFIDENTIALITY NOTICE: This email message and any attachments are confidential, may be subject to the attorney-client privilege and/or work product doctrine, and are intended solely for the use of the individual(s) to whom they are addressed. If you are not the intended recipient, or if you have received this communication in error, please notify the sender immediately by reply email and permanently delete the orig