Contract analysis

I. Introduction and Purpose This firm represents Quorum Insurance Holdings Corp. ("Quorum" or "QIH"), a Delaware corporation publicly traded on the Nasdaq Stock Market (ticker: QIHC) and headquartered at 400 Constitution Plaza, Suite 2200, Hartford, Connecticut 06103 (EIN: 06-4832197). We submit this letter, together with the enclosed supporting documentation, on behalf of Quorum for the purpose of presenting to Atla

II. Summary of the Covered Incident 2.1 Nature of the Incident The covered cybersecurity incident arose from a vendor-originated data breach at Palomar Data Solutions, Inc. ("Palomar"), a Texas corporation headquartered at 7100 Greenville Avenue, Suite 450, Dallas, Texas 75231 (EIN: 75-3291048). Palomar serves as Quorum's third-party claims-processing vendor pursuant to a Master Services Agreement originally dated No

III. Policy Coverage Summary The relevant terms of the Policy applicable to this claim are summarized below for ease of reference: The following covered cost categories under the Policy are applicable to this claim: (a) First-Party Forensic Investigation Costs — costs and expenses incurred for the engagement of forensic investigators to determine the cause, scope, and extent of a covered cybersecurity incident, inclu

IV. Final Cost Summary / Itemized Schedule of Loss 4.1 Overview. The total incident response costs incurred by Quorum in connection with the covered cybersecurity incident are $8,230,250. After application of the $2,500,000 SIR, the net amount claimed under the Atlas primary policy is $5,730,250. A detailed breakdown of costs by category is set forth below. Summary of Claimed Amounts Each cost category is described i

V. Application of Self-Insured Retention The Policy provides for a self-insured retention of $2,500,000 per covered occurrence. Quorum confirms that it has fully satisfied its SIR obligation through the payment of the first $2,500,000 in incident response costs incurred in connection with this cybersecurity incident. These costs were paid by Quorum in the ordinary course of the incident response from Quorum's own fun

VI. Palomar Indemnification Recovery and Subrogation Considerations We wish to advise Atlas of a related development that is material to the administration of this claim. Quorum has reached a settlement with Palomar Data Solutions, Inc. regarding Palomar's contractual indemnification obligations arising from the security incident. The key terms of the settlement are as follows: On October 27, 2023, Quorum and Palomar

VII. Supporting Documentation / Exhibits The following exhibits are enclosed with this submission and are incorporated herein by reference: Exhibit 1: Graystone Forensics LLC — Engagement letter dated May 5, 2023; invoices; and scope of work summary. Exhibit 2: Clearfield Notification Services LLC — Statement of Work executed August 6, 2023; invoices; and enrollment statistics summary. Exhibit 3: BrightPath Consultin

VIII. Certification and Reservation of Rights Quorum Insurance Holdings Corp. hereby certifies, through its undersigned counsel, as follows:

1. The amounts set forth in this Proof of Loss and Final Cost Summary represent the actual, reasonable, and necessary costs incurred by Quorum in connection with the response to the covered cybersecurity incident described herein.

2. All costs were incurred in good faith and in accordance with the terms and conditions of the Policy, including the requirement to obtain Atlas's prior consent for the engagement of forensic investigators, notification vendors, crisis communications firms, and outside counsel, which consent was obtained at or prior to each such engagement.

3. The supporting documentation enclosed herewith accurately reflects the costs incurred and the services rendered.

4. Quorum has not received, and is not aware of, any indemnification, reimbursement, or other recovery from any source that would reduce the amounts claimed herein, other than the Palomar recovery described in Section VI, of which Atlas has been advised. Notwithstanding the foregoing certification, Quorum expressly reserves all rights under the Policy, including without limitation: (a) The right to submit additional

IX. Request for Reimbursement Based on the foregoing, Quorum Insurance Holdings Corp. hereby formally requests that Atlas Mutual Insurance Company reimburse Quorum in the amount of $5,730,250, representing the total incident response costs of $8,230,250 less the $2,500,000 self-insured retention, in accordance with the terms and conditions of the Policy. Quorum requests that payment be directed to Quorum's designated