Contract analysis

1. Executive Summary This Final Forensic Investigation Report (this "Report") presents the final findings of Graystone Forensics LLC ("Graystone") in connection with its forensic investigation conducted at the direction of Calderwood & Harkness LLP ("Calderwood & Harkness" or "Counsel"), counsel to Quorum Insurance Holdings Corp. ("Quorum" or "QIH"), relating to a data security incident involving Palomar Data Solutio

2. Engagement Background and Scope 2.1 Engagement of Graystone Forensics Graystone Forensics LLC was retained by Calderwood & Harkness LLP on May 5, 2023, pursuant to a retention letter dated May 4, 2023, establishing the terms and conditions under which Graystone would conduct a forensic investigation into the data security incident affecting Quorum data hosted by Palomar. The retention letter expressly provides tha

1. Attack Vector Identification: Determination of the initial attack vector and the specific method of unauthorized access to Palomar's network.

2. Timeline Reconstruction: Establishment of a comprehensive timeline of unauthorized activity, including the dates and methods of initial access, lateral movement, establishment of persistence, data staging, and data exfiltration.

3. Data Compromise Assessment: Identification and characterization of all data sets accessed and/or exfiltrated by the threat actor, with a specific focus on data belonging to Quorum policyholders and claimants.

4. Affected Individual Enumeration: Assessment of the categories and volume of compromised data, including PII, financial information, and PHI, and enumeration of all unique affected individuals, organized by state of residence.

5. Threat Actor Analysis: Assessment of the threat actor's tools, techniques, and procedures ("TTPs"), including attribution analysis and identification of indicators of compromise ("IOCs").

6. Security Posture Evaluation: Evaluation of aspects of Palomar's security posture relevant to the incident, including patch management practices, endpoint security coverage, network segmentation, and detection capabilities. 2.6 Methodology Graystone employed the following investigative methodologies in conducting this forensic investigation: Forensic Imaging and Analysis. Graystone conducted forensic imaging and an

3. Attack Vector Analysis 3.1 Vulnerability Identification — CVE-2023-0669 The initial point of compromise in this incident was Palomar's GoAnywhere MFT (Managed File Transfer) file transfer appliance. GoAnywhere MFT is a widely used enterprise file transfer solution that enables organizations to securely exchange data with business partners, clients, and internal systems. Palomar utilized GoAnywhere MFT as a primary

4. Post-Exploitation Activity and Lateral Movement 4.1 Establishment of Persistence Following the initial exploitation of CVE-2023-0669 and the deployment of the web shell on or about March 14, 2023, the threat actor took steps to establish multiple persistence mechanisms on the GoAnywhere MFT server to ensure continued access even in the event that one mechanism was discovered and removed. In addition to the web she

5. Data Staging and Exfiltration 5.1 Data Staging Beginning on or about March 28, 2023, following the completion of the reconnaissance phase, the threat actor began staging data for exfiltration from Palomar's network. Data staging refers to the process by which an attacker collects and consolidates targeted data into a centralized location within the compromised network, preparing it for transfer out of the network.

6. Compromised Data Analysis 6.1 Data Mining Methodology Following the forensic containment phase, Graystone conducted a comprehensive data mining effort to identify the specific data files that were staged and exfiltrated by the threat actor and to determine the precise scope of the data compromise. This data mining effort was one of the most resource-intensive components of the investigation and was completed on Au

7. Threat Actor Attribution and Characterization 7.1 Threat Actor Profile Based on the totality of the evidence gathered during the investigation, Graystone has developed a threat actor profile that characterizes the entity or entities responsible for the unauthorized access and data exfiltration. The tools, techniques, and procedures ("TTPs") observed during this investigation are consistent with a financially motiv

8. Assessment of Palomar's Security Posture (Relevant to Incident) This section provides Graystone's assessment of certain aspects of Palomar's security posture that are directly relevant to the incident described in this Report. This assessment is based on Graystone's forensic analysis, review of Palomar's security documentation, and interviews with Palomar personnel. This assessment is not intended as a comprehensi