Contract analysis

Section 1.1 — "Common Interest Materials." As used in this Agreement, "Common Interest Materials" means all documents, communications, memoranda, reports, analyses, forensic findings, legal assessments, correspondence, notes, summaries, and other materials, in any form or medium (including electronic, hard copy, oral, or any other format), that are: (a) protected by the attorney-client privilege, the work product doc

Section 1.2 — "Counsel." As used in this Agreement, "Counsel" means: (a) With respect to Quorum: Calderwood & Harkness LLP, including but not limited to the following attorneys: Kevin Ostrowski (Responsible Partner), Rachel Bernstein (Billing Partner), Alan Burke (Lead Associate), Sara Hendricks (Working Associate), and such other attorneys of Calderwood & Harkness LLP as C&H may designate from time to time in connec

Section 1.3 — "Related Proceedings." As used in this Agreement, "Related Proceedings" means any and all regulatory inquiries, investigations, examinations, enforcement actions, civil litigation, class actions, mass tort proceedings, arbitration proceedings, governmental proceedings, administrative proceedings, or other legal or administrative proceedings arising out of, relating to, or in connection with the Incident

ARTICLE II — PURPOSE AND SCOPE

Section 2.1 — Purpose. The purpose of this Agreement is to establish a framework for the sharing of Common Interest Materials between the Parties in furtherance of their shared legal interests in the investigation of, response to, and defense of the Incident and any Related Proceedings, and to ensure that such sharing does not constitute, and is not construed as constituting, a waiver of any applicable privilege, pro

Section 2.2 — Scope of Sharing. Each Party may, in its sole and absolute discretion, share Common Interest Materials with the other Party or the other Party's Counsel to the extent such sharing is reasonably necessary to advance the Parties' common legal interest as described in Recital E above. The determination of what information to share, and the timing and manner of such sharing, shall be within the sole discret

Section 2.3 — Categories of Information Anticipated to Be Shared. Without limiting the generality of the foregoing, the Parties anticipate that the following categories of information may be shared as Common Interest Materials under this Agreement: (a) Forensic Investigation Reports. Reports, findings, and analyses, whether preliminary, interim, or final, prepared by Graystone Forensics LLC under the direction and su

ARTICLE III — PRESERVATION OF PRIVILEGE

Section 3.1 — No Waiver. The sharing of Common Interest Materials pursuant to this Agreement shall not constitute a waiver of, and shall not be deemed to waive, the attorney-client privilege, the work product doctrine, or any other applicable privilege, protection, or immunity under federal or state law. The Parties expressly intend that the sharing of Common Interest Materials hereunder shall be undertaken in furthe

Section 3.2 — Ownership of Privilege. The disclosure of Common Interest Materials by one Party to the other pursuant to this Agreement shall not transfer ownership of the underlying privilege from the disclosing Party to the receiving Party. The privilege attaching to any particular communication or material shall remain the property of the Party (or its Counsel) that generated such communication or material, and sha

Section 3.3 — Consent Required for Waiver or Disclosure to Third Parties. Neither Party shall disclose, produce, transmit, or otherwise make available any Common Interest Materials received from the other Party to any third party, including without limitation any governmental authority, regulatory body, court, tribunal, arbitrator, opposing party, co-party, or any other person or entity, without the prior written con

Section 3.4 — Compelled Disclosure. In the event that either Party receives a subpoena, court order, civil investigative demand, regulatory demand, or other compulsory legal process requiring the production or disclosure of Common Interest Materials received from the other Party, the receiving Party shall: (a) promptly, and in no event later than three (3) business days after receipt of such compulsory process, notif

ARTICLE IV — CONFIDENTIALITY OBLIGATIONS

Section 4.1 — Confidential Treatment. All Common Interest Materials shared under this Agreement shall be treated as strictly confidential by the receiving Party. The receiving Party shall safeguard all Common Interest Materials with the same degree of care it employs to protect its own most sensitive privileged and confidential information, and in no event less than a reasonable degree of care. Access to Common Inter

Section 4.2 — No Use for Coverage Dispute. Neither Party shall use Common Interest Materials obtained from the other Party under this Agreement for the purpose of establishing, contesting, or litigating any coverage dispute between the Parties under the Policy, unless both Parties expressly consent in writing to such use. This restriction applies to all Common Interest Materials, regardless of the form or medium in w

Section 4.3 — Marking of Materials. To the extent practicable, Common Interest Materials shared under this Agreement shall be marked or labeled with the following legend, or substantially equivalent language, at the time of disclosure: "PRIVILEGED AND CONFIDENTIAL — SUBJECT TO COMMON INTEREST AGREEMENT" The failure to mark or label any particular material with the foregoing legend shall not affect the privileged or c

ARTICLE V — RESERVATION OF RIGHTS

Section 5.1 — No Admission of Liability or Coverage. This Agreement shall not be construed as an admission by Atlas of coverage or liability under the Policy for any particular loss, cost, expense, or claim, nor as a waiver of any coverage defenses, exclusions, conditions, sublimits, or limitations under the Policy. Atlas expressly reserves all of its rights under the Policy, including without limitation the right to

Section 5.2 — No Admission by Quorum. This Agreement shall not be construed as an admission by Quorum of liability, fault, negligence, or wrongdoing to any third party, regulator, governmental authority, or affected individual in connection with the Incident. Quorum expressly reserves all of its rights and defenses with respect to any claims, regulatory actions, or proceedings arising from or related to the Incident,

Section 5.3 — Independent Legal Interests. Notwithstanding their common legal interest as described in Recital E and elsewhere in this Agreement, each Party acknowledges and agrees that it may have separate and independent legal interests with respect to certain matters, including without limitation: (a) the scope, applicability, and interpretation of coverage under the Policy; (b) the amount and characterization of

ARTICLE VI — TERM AND TERMINATION

Section 6.1 — Effective Date. This Agreement shall be effective as of the date first written above, May 10, 2023.

Section 6.2 — Term. This Agreement shall remain in effect until the earliest of: (a) the date upon which both Parties execute a written agreement to terminate this Agreement; (b) the date of final resolution (including the exhaustion or expiration of all applicable appeal periods) of all Related Proceedings; or (c) the date that is thirty (30) calendar days following the date on which either Party delivers written no

Section 6.3 — Survival. The obligations set forth in Article III (Preservation of Privilege), Article IV (Confidentiality Obligations), and Article V (Reservation of Rights) shall survive the termination, expiration, or withdrawal from this Agreement in perpetuity, or for such shorter period as may be required by the final resolution of all Related Proceedings and the expiration of all applicable statutes of limitati

Section 6.4 — Return or Destruction of Materials. Upon termination of this Agreement for any reason, each Party shall, at the written request of the disclosing Party, promptly return to the disclosing Party or destroy all Common Interest Materials received from the disclosing Party, including all copies, summaries, extracts, and derivative works thereof, in whatever form or medium. Within thirty (30) calendar days of

ARTICLE VII — GENERAL PROVISIONS

Section 7.1 — Governing Law. This Agreement shall be governed by and construed in accordance with the laws of the State of Connecticut, without regard to its conflict of laws principles. The State of Connecticut has been selected as the governing jurisdiction because it is the jurisdiction of Quorum's headquarters and principal regulatory nexus, and because a substantial number of the regulatory and legal matters ari

Section 7.2 — Entire Agreement. This Agreement, including all exhibits attached hereto and incorporated herein by reference, constitutes the entire agreement between the Parties with respect to the subject matter hereof and supersedes all prior or contemporaneous oral or written agreements, understandings, representations, negotiations, or communications between the Parties relating to the sharing of privileged or co

Section 7.3 — Amendments. This Agreement may be amended, modified, or supplemented only by a written instrument signed by both Parties or their duly authorized Counsel. No oral modification or waiver of any provision of this Agreement shall be effective. Any amendment extending the scope of this Agreement to cover additional incidents, claims, or parties shall be set forth in a written amendment that specifically ide

Section 7.4 — No Third-Party Beneficiaries. This Agreement is for the sole and exclusive benefit of the Parties and their respective Counsel and shall not confer any rights, remedies, benefits, claims, or causes of action on any third party, whether by virtue of the common interest doctrine or otherwise. For the avoidance of doubt, Palomar Data Solutions, Inc., Mercer, Haight & Dunlop LLP, Graystone Forensics LLC, Br

Section 7.5 — Notices. All notices, requests, consents, demands, and other communications under this Agreement shall be in writing and shall be deemed to have been duly given when delivered by hand, when sent by nationally recognized overnight courier service, or when sent by email (with confirmation of receipt), addressed as follows: If to Quorum: Thomas R. Whitfield General Counsel Quorum Insurance Holdings Corp. 4

Section 7.6 — Counterparts. This Agreement may be executed in two or more counterparts, each of which shall be deemed an original and all of which together shall constitute one and the same instrument. Delivery of an executed counterpart by electronic mail (including PDF) or by facsimile transmission shall be equally as effective as delivery of a manually executed counterpart. Electronic or facsimile signatures shall

Section 7.7 — Severability. If any provision of this Agreement is held by a court of competent jurisdiction or other tribunal to be invalid, illegal, or unenforceable for any reason, such invalidity, illegality, or unenforceability shall not affect any other provision of this Agreement, and the remaining provisions shall continue in full force and effect. The Parties shall negotiate in good faith to replace any inval

Section 7.8 — Relationship to Policy. This Agreement is supplemental to, and does not modify, amend, alter, or supersede, the terms and conditions of Policy No. CYB-2023-041587, including without limitation any cooperation obligations, consent provisions, notification provisions, voluntary payment clauses, or other conditions precedent to coverage set forth in the Policy. In the event of any conflict or inconsistency

Section 7.9 — Excess Carrier. The Parties acknowledge that Pinnacle Surplus Lines Insurance Corp. ("Pinnacle") has issued an excess cyber-liability insurance policy bearing Policy No. XS-CYB-2023-7812, which provides Twenty-Five Million Dollars ($25,000,000) in excess cyber-liability coverage above the Atlas primary layer, for a total insurance tower of Forty Million Dollars ($40,000,000). Pinnacle is not a party to

I. Counsel for Quorum Insurance Holdings Corp. Firm: Calderwood & Harkness LLP Office Addresses: 1700 K Street NW, Suite 900 Washington, D.C. 20006 Telephone: (202) 555-8400 Facsimile: (202) 555-8401 51 West 52nd Street, 34th Floor New York, New York 10019 Telephone: (212) 555-7300 Facsimile: (212) 555-7301 Designated Attorneys: C&H Matter No.: 1025-00006 Calderwood & Harkness LLP may designate additional attorneys t

II. Counsel for Atlas Mutual Insurance Company Atlas Mutual Insurance Company shall designate its internal and/or external legal counsel by completing the information below and providing written notice thereof to Calderwood & Harkness LLP in accordance with Section 7.5 of the Agreement. Atlas shall provide such written notice prior to sharing any Common Interest Materials with any designated counsel. Internal Counsel

I. Summary Description of the Incident On or about March 14, 2023, a threat actor exploited a known remote code execution vulnerability designated as CVE-2023-0669 in a GoAnywhere MFT (Managed File Transfer) file transfer appliance operated by Palomar Data Solutions, Inc. ("Palomar"), a third-party claims-processing vendor retained by Quorum Insurance Holdings Corp. ("Quorum") pursuant to a Master Services Agreement

II. Palomar's Notification to Quorum On April 21, 2023, Palomar Data Solutions, Inc. notified Quorum of the security incident. Palomar's notification indicated that it had become aware of anomalous activity on its GoAnywhere MFT appliance on or about April 18, 2023, that it had engaged a third-party forensic investigation firm to assess the scope of the compromise, and that preliminary findings indicated that data fi

III. Engagement of Counsel and Forensic Investigators On May 4, 2023, Quorum engaged Calderwood & Harkness LLP ("C&H") as outside counsel to coordinate the incident response, forensic investigation, regulatory notification compliance, regulatory defense, and vendor accountability negotiations arising from the Incident. The engagement was assigned C&H Matter No. 1025-00006. On May 5, 2023, Calderwood & Harkness LLP, a

IV. Filing of Claim with Atlas On May 8, 2023, Quorum, through its Outside Counsel, submitted a formal notice of claim to Atlas Mutual Insurance Company under Policy No. CYB-2023-041587. Atlas assigned Claim No. CYB-CLM-2023-05892 to the notice of claim.

V. Anticipated Cost Categories Based on preliminary assessments as of the date of this Agreement, the following categories of costs and expenses are anticipated to be incurred in connection with the Incident, subject to further investigation, analysis, and adjustment: The foregoing cost categories are provided for illustrative purposes and do not represent an exhaustive list of all costs and expenses that may be incu

VI. Policy Terms Applicable to the Claim • Policy Number: CYB-2023-041587 • Coverage Period: January 1, 2023 through January 1, 2024 • Per-Occurrence Limit: $15,000,000 • Aggregate Limit: $15,000,000 • Self-Insured Retention (SIR): $2,500,000 • Excess Coverage: Pinnacle Surplus Lines Insurance Corp., Policy No. XS-CYB-2023-7812, providing $25,000,000 excess of the Atlas primary layer • Total Insurance Tower: $40,000,