Contract analysis

I. Purpose and Executive Summary This memorandum formally activates the Incident Response Plan ("IRP") of Quorum Insurance Holdings Corp. ("Quorum" or the "Company") in connection with a data security incident reported by Palomar Data Solutions, Inc. ("Palomar"), a third-party claims-processing vendor that provides critical services to Quorum's personal lines division. The activation of the IRP is effective as of tod

II. Background — The Palomar Security Incident A. Palomar's Role as Quorum Vendor Palomar Data Solutions, Inc. is a Texas corporation headquartered at 7100 Greenville Avenue, Suite 450, Dallas, Texas 75231. Palomar provides claims data processing, document management, and analytics services to Quorum's personal lines division pursuant to a Master Services Agreement dated November 12, 2019 (the "MSA"), as amended by A

III. Formal Activation of the Incident Response Plan Pursuant to the authority vested in the General Counsel under Quorum's Incident Response Plan (Version 3.2, last revised October 14, 2022), and upon the recommendation of outside counsel, the IRP is hereby formally activated as of May 4, 2023, in connection with the Palomar data security incident described in Section II above. All protocols, procedures, and escalat

IV. Immediate Action Items The following action items require immediate attention and execution by the designated members of the IRT. Each action item is assigned a responsible party and a target completion date. Calderwood & Harkness will track progress on these items and will report status at each IRT meeting. A. Evidence Preservation and Legal Hold The preservation of all evidence related to the Palomar security i

V. Anticipated Workstream Timeline (Preliminary) The following is a preliminary timeline for the major workstreams associated with the incident response. These timelines are subject to adjustment as the forensic investigation progresses, additional facts come to light, and circumstances evolve. Calderwood & Harkness will provide updated timeline projections at each IRT meeting. These timelines are preliminary in natu

VI. Key Contacts and Communication Protocols The following table sets forth the key contacts for the Palomar incident response. All IRT members should maintain current contact information for the individuals listed below and should ensure that communications regarding the incident are directed to the appropriate parties. Communication Protocols. The following communication protocols are effective immediately and will

1. All substantive communications regarding the Palomar data security incident — whether internal to Quorum, between Quorum and outside counsel, or between any members of the IRT — should be clearly marked with the following legend: "PRIVILEGED AND CONFIDENTIAL — ATTORNEY-CLIENT COMMUNICATION." This marking should appear in the subject line of all emails and at the top of all written documents and memoranda.

2. Outside counsel (Kevin Ostrowski, Alan Burke, or Sara Hendricks) should be included on all email communications and all written correspondence related to the incident. No substantive discussions of the incident should take place via email, telephone, or in person without the inclusion or prior coordination of outside counsel.

3. A dedicated secure communication channel will be established for the IRT to facilitate the exchange of sensitive information related to the incident. Details regarding the secure communication channel, including access credentials and usage protocols, will be provided by David Naranjo in coordination with Calderwood & Harkness. Pending the establishment of the secure channel, all communications should be transmitt

4. Hard copy documents related to the incident should be stored securely, with access limited to members of the IRT and such other individuals as may be specifically authorized by Thomas R. Whitfield or Calderwood & Harkness.

VII. Closing The Palomar data security incident presents significant legal, operational, and reputational risks to Quorum Insurance Holdings Corp. The potential scope of the compromise — involving sensitive personal information, financial data, and protected health information of Quorum policyholders and claimants across all fifty states — demands an immediate, coordinated, and disciplined response. The actions outli