Contract analysis

I. Executive Summary Calderwood & Harkness LLP was engaged on May 4, 2023, by Quorum Insurance Holdings Corp. ("Quorum" or the "Company") to manage the legal response to a data security incident originating from Quorum's third-party claims-processing vendor, Palomar Data Solutions, Inc. ("Palomar"). This memorandum sets forth our initial assessment of the incident based on the information available to date and identi

II. Background: Quorum-Palomar Relationship A. The Master Services Agreement Quorum and Palomar entered into a Master Services Agreement (the "MSA") on November 12, 2019, pursuant to which Palomar provides claims data processing, document management, and analytics services for Quorum's personal lines division. The MSA was the product of a competitive procurement process managed by Quorum's Strategic Sourcing group an

III. Incident Timeline and Known Facts The following timeline is based on information received to date from Palomar, its counsel at Mercer, Haight & Dunlop LLP, and Quorum's internal records. All dates and facts remain subject to verification and refinement as the forensic investigation conducted by Graystone Forensics LLC progresses. Calderwood & Harkness has not independently verified the accuracy of Palomar's repr

IV. Preliminary Assessment of Compromised Data A. Categories of Potentially Affected Data Based on the nature and scope of data transmitted by Quorum to Palomar under the MSA, and in the absence of definitive forensic findings as to which specific data sets were exfiltrated, the following categories of information are potentially compromised as a result of the incident: Personally Identifiable Information (PII): Full

1. Identify the specific individuals whose personal information was compromised;

2. Determine the types of data compromised for each affected individual (e.g., name and Social Security number, name and financial account information, name and PHI, or some combination thereof);

3. Match each affected individual to their state of residence to determine which state's breach notification statute applies; and

4. Identify any individuals who may be subject to specialized notification requirements (e.g., minors, military service members, or individuals subject to state-specific protections such as those under the California Consumer Privacy Act). This data mining process is typically time-intensive and resource-intensive, particularly where the compromised data sets are large and involve multiple data formats. Calderwood &

V. Preliminary Legal Risk Assessment A. State Breach Notification Obligations If the forensic investigation confirms that PII, financial data, or PHI of Quorum policyholders and claimants was accessed or exfiltrated by the threat actor, notification obligations will be triggered under the breach notification statutes of every state in which affected individuals reside. As of the date of this memorandum, all fifty sta

VI. Contractual Considerations — Palomar MSA Calderwood & Harkness has conducted a preliminary review of the MSA and its amendments to identify the key contractual provisions relevant to the incident and Quorum's rights against Palomar. The following summarizes our initial analysis of Palomar's potential contractual breaches, Quorum's indemnification rights, and available termination remedies. A. Data Security Exhibi

Section 9.4 of the MSA requires Palomar to notify Quorum of any security incident affecting Quorum data within forty-eight (48) hours of Palomar's discovery of such incident. As set forth in the timeline above, Palomar discovered the anomalous activity on April 18, 2023, and did not provide notification to Quorum until April 21, 2023 — approximately seventy-two (72) hours after discovery, or roughly twenty-four (24)

Section 12.2 of the MSA provides that Palomar shall indemnify, defend, and hold harmless Quorum and its affiliates, officers, directors, employees, and agents from and against any and all losses, damages, liabilities, costs, and expenses (including reasonable attorneys' fees and costs of investigation and remediation) arising from or related to Palomar's breach of its data security obligations under the MSA, includin

1. Issue a formal written indemnification demand to Palomar, through its counsel at Mercer, Haight & Dunlop LLP, putting Palomar on notice of its indemnification obligations and reserving all rights under Section 12.2;

2. Begin immediately documenting all costs attributable to the incident, including internal labor costs, external counsel fees, forensic investigation costs, notification costs, credit monitoring costs, crisis communications costs, regulatory engagement costs, and any other costs arising from or related to the incident;

3. Maintain a detailed cost ledger segregating costs into categories that correspond to the indemnification and insurance coverage frameworks; and

4. Preserve all evidence relevant to Palomar's breaches of the MSA, including the failure to patch, the extended dwell time, and the late notification. D. Termination for Cause (Section 14.2)

Section 14.2 of the MSA permits either party to terminate the MSA upon material breach by the other party, provided that the non-breaching party provides written notice of the breach and the breaching party fails to cure the breach within thirty (30) days of receipt of such notice. Should the forensic investigation confirm that Palomar's failures — including the failure to timely patch a known critical vulnerability,

VII. Cyber-Insurance Coverage Quorum maintains a cyber-liability insurance tower placed by its insurance broker, Whitmore Risk Advisors Inc. (contact: Sandra Whitmore-Kim, Managing Director). The tower consists of a primary layer and a single excess layer, providing aggregate coverage of $40,000,000. The coverage structure is as follows: Primary Layer: • Carrier: Atlas Mutual Insurance Company • Policy Number: CYB-20

VIII. Immediate Next Steps and Recommendations Based on our initial assessment, Calderwood & Harkness recommends the following immediate next steps: A. Forensic Investigation Graystone Forensics LLC has been retained under the attorney-client privilege umbrella and the scope of work and investigation plan were finalized as of May 7, 2023. The forensic investigation is the single most critical workstream at this stage