Contract analysis

1. Executive Summary Graystone Forensics LLC ("Graystone") was retained on May 5, 2023 by Calderwood & Harkness LLP ("Calderwood & Harkness" or "Counsel"), outside counsel to Quorum Insurance Holdings Corp. ("Quorum" or "QIH"), to conduct a privileged forensic investigation into a security incident originating from the network environment of Palomar Data Solutions, Inc. ("Palomar"), a third-party claims-processing ve

2. Scope of Engagement and Methodology 2.1 Engagement Parameters Graystone was retained under the attorney-client privilege umbrella by Calderwood & Harkness LLP on May 5, 2023, for the purpose of conducting a forensic investigation into the security incident affecting Palomar's network environment and the Quorum data processed therein. The engagement was initiated at the express direction of Counsel, and all investi

1. Entry Vector and Timeline Determination. Determine the threat actor's initial entry vector into Palomar's network environment and reconstruct the complete timeline of unauthorized access, including initial compromise, persistence, lateral movement, and data exfiltration.

2. Data Set Identification. Identify the specific data sets accessed and/or exfiltrated by the threat actor from Palomar's network environment, with particular emphasis on data sets containing Quorum policyholder and claimant information.

3. Data Type Assessment. Assess the types and categories of data compromised, including the presence or absence of PII, financial account information, PHI, and other sensitive data elements, to support Counsel's analysis of notification obligations and regulatory exposure. The Graystone analyst team assigned to this engagement is led by Dr. Nolan Briggs, Managing Director, Incident Response, and Kendra Faulkner, Seni

3. Background — Palomar Data Solutions Environment 3.1 Palomar's Role as Quorum Vendor Palomar Data Solutions, Inc. ("Palomar"), headquartered at 7100 Greenville Avenue, Suite 450, Dallas, TX 75231, is a data services company that provides claims data processing, document management, and analytics services to insurance carriers and other financial services organizations. Palomar has served as a third-party claims-pro

4. Findings — Initial Access Vector 4.1 CVE-2023-0669 Exploitation Based on Graystone's forensic analysis, the threat actor gained initial unauthorized access to Palomar's network environment by exploiting CVE-2023-0669, a pre-authentication remote code execution ("RCE") vulnerability affecting the GoAnywhere MFT file transfer platform. CVE-2023-0669 is a critical-severity vulnerability that allows an unauthenticated

5. Findings — Lateral Movement and Persistence 5.1 Post-Exploitation Activity Following the initial exploitation of CVE-2023-0669 and the deployment of the web shell on the GoAnywhere MFT appliance, the threat actor engaged in a series of post-exploitation activities designed to establish persistent access to Palomar's network environment and to expand the scope of access beyond the initial point of compromise. These

6. Findings — Data Staging and Exfiltration 6.1 Data Staging Activity The threat actor identified and accessed structured data files and database exports within Palomar's claims processing environment that contained Quorum-specific policyholder and claimant data. The claims processing environment contained multiple data repositories, including relational databases and file share directories, organized by client and d

7. Preliminary Assessment of Compromised Data 7.1 Types of Data Confirmed Exfiltrated Graystone's analysis of the exfiltrated data sets, based on file metadata, database schema analysis, and preliminary review of the structured data files identified in the staging and exfiltration analysis, confirms that the compromised data includes Quorum policyholder and claimant records containing the following categories of sens

8. Palomar's Notification to Quorum — Timing Observation Graystone notes the following factual observations regarding the timing of Palomar's notification to Quorum of the security incident, for Counsel's consideration in assessing Palomar's compliance with its contractual obligations: • Palomar's SOC detected anomalous outbound data transfer activity on April 18, 2023, and initiated containment and investigation pro

9. Ongoing Investigation and Next Steps 9.1 Remaining Workstreams The following investigative workstreams remain active and will be completed prior to the delivery of the final forensic report:

1. Data Mining and Affected Individual Identification. Completion of data extraction, parsing, deduplication, and matching processes to produce a final, deduplicated list of affected individuals with associated data element exposure profiles. Target completion: early August 2023.

2. State-by-State Breakdown. Preparation of a state-by-state breakdown of affected individuals, categorized by data type (PII, financial information, PHI), to support Counsel's analysis of state-specific notification obligations. This breakdown will be derived from the address fields within the affected individual records.

3. Volumetric Analysis. Continued analysis of the total volume of exfiltrated data, including reconciliation of NetFlow records, proxy log entries, and staging server artifacts to produce a refined volumetric assessment.

4. Timeline Confirmation. Final confirmation of the exfiltration timeline endpoints, including the precise commencement date of outbound data transfers and the cessation of all threat actor activity.

5. Dark Web and Threat Actor Monitoring. Ongoing monitoring for any evidence of threat actor use, publication, sale, or distribution of the exfiltrated data on dark web forums, paste sites, or other channels. As of the date of this report, no confirmed exposure or publication of the exfiltrated Quorum data has been identified. Graystone will continue monitoring through the final report delivery date and will promptly

10. Limitations and Caveats This report is provided subject to the following limitations and caveats:

1. Preliminary Nature of Findings. This report reflects preliminary findings based on evidence available to and analyzed by Graystone as of June 2, 2023. The forensic investigation is ongoing, and significant workstreams — including data mining, affected individual identification, and volumetric analysis — remain in progress. Accordingly, the findings, conclusions, and estimates presented in this report may be supple

2. Scope of Access. Graystone's investigation was conducted on Palomar's systems and network environment at the direction of Calderwood & Harkness LLP. Graystone's access to Palomar's environment was facilitated through counsel-to-counsel coordination between Calderwood & Harkness LLP and Palomar's outside counsel. Graystone's findings are based on the evidence made available through this process. If additional evide

3. No Legal Advice. This report does not constitute legal advice. Graystone is a forensic investigation firm, not a law firm, and does not render legal opinions. All legal analysis of notification obligations, contractual rights and remedies, regulatory implications, and litigation strategy is deferred to Calderwood & Harkness LLP. The factual observations and forensic findings presented in this report are intended t

4. Privilege Protections. All findings, analysis, and work product generated in the course of this engagement are subject to the attorney-client privilege and work product protections applicable to this engagement. This report has been prepared at the direction of Calderwood & Harkness LLP for the purpose of rendering legal advice to Quorum Insurance Holdings Corp. and should be treated as privileged and confidential

5. No Guarantees of Completeness. While Graystone has endeavored to conduct a thorough and comprehensive forensic investigation, no forensic investigation can guarantee the identification of all threat actor activity or the complete delineation of all compromised data. Forensic findings are inherently constrained by the availability, completeness, and integrity of log data and other evidence sources. Graystone has no

11. Conclusion The forensic evidence analyzed to date confirms that a threat actor exploited CVE-2023-0669, a critical pre-authentication remote code execution vulnerability, on Palomar Data Solutions' GoAnywhere MFT appliance to gain initial unauthorized access to Palomar's network environment on or about March 14, 2023. The GoAnywhere MFT appliance was unpatched against this vulnerability at the time of exploitatio