Contract analysis

I. Introduction and Purpose This Exhibit provides a comprehensive chronological account of the data security incident affecting policyholders and claimants of Quorum Insurance Holdings Corp. ("Quorum" or "QIH"), a Delaware corporation publicly traded on the Nasdaq Stock Market under the ticker symbol QIHC and headquartered in Hartford, Connecticut. This Exhibit is submitted in connection with Quorum's response to the

1. Narrative Chronological Timeline of the Incident. A detailed, phase-by-phase recounting of the events from the initial unauthorized access through the conclusion of all regulatory engagements, including the forensic investigation, notification activities, and vendor accountability process.

2. Summary of Remedial Measures Taken by Quorum. A comprehensive description of the immediate response measures, notification and consumer protection measures, vendor accountability measures, and enhancements to Quorum's information security and vendor risk management program that Quorum has undertaken in connection with the incident.

3. Summary of Vendor Accountability Measures Imposed on Palomar. A detailed account of the contractual analysis, indemnification demand, negotiation, and ultimate settlement with Palomar, including the enhanced security requirements imposed on Palomar through the execution of Amendment 3 to the MSA. In total, the incident affected 318,247 individuals across 29 states and the District of Columbia. As set forth in deta

II. Background — Quorum and the Palomar Vendor Relationship A. Overview of Quorum Insurance Holdings Corp. Quorum Insurance Holdings Corp. is a top-25 United States insurance holding company, with operating subsidiaries licensed and conducting business in all 50 states, the District of Columbia, and several U.S. territories. Quorum offers a diversified portfolio of insurance products across its personal lines divisio

III. Detailed Chronological Timeline of the Incident The following narrative timeline sets forth, in chronological order, the key events associated with the data security incident, from the initial unauthorized access through the conclusion of all regulatory engagements. The timeline is organized into eleven phases for clarity of presentation. Phase 1: Unauthorized Access and Data Exfiltration (March 14 – April 18, 2

IV. Summary of Remedial Measures Taken by Quorum The following is a consolidated summary of the remedial measures taken by Quorum in connection with the incident, organized by category. A. Immediate Response Measures Quorum took the following immediate response measures upon learning of the incident:

1. Activation of Incident Response Plan and Internal Team. Quorum activated its enterprise incident response plan and convened its internal incident response team, comprised of senior leadership from the Legal, Information Security, Privacy, Vendor Risk Management, and Claims Operations functions, effective May 4, 2023.

2. Engagement of Experienced Outside Counsel. Quorum promptly engaged Calderwood & Harkness LLP, a nationally recognized law firm with deep expertise in privacy, data security, and incident response, to serve as outside counsel for all aspects of the incident response, including forensic investigation oversight, notification compliance analysis, regulatory defense, and vendor accountability.

3. Retention of Privileged Forensic Investigator. Through outside counsel, Quorum retained Graystone Forensics LLC, a leading digital forensics and incident response firm, to conduct the technical forensic investigation under the protection of the attorney-client privilege and work product doctrine.

4. Issuance of Legal Hold. Calderwood & Harkness issued a comprehensive legal hold notice to all relevant Quorum departments, directing the preservation of all documents, communications, and electronic records related to the incident, the Palomar vendor relationship, and Quorum's response activities.

5. Filing of Cyber-Insurance Claim. Quorum promptly filed a cyber-insurance claim with Atlas Mutual Insurance Company under its primary cyber-insurance policy and provided precautionary notice to its excess carrier, Pinnacle Surplus Lines Insurance Corp.

6. Engagement of Crisis Communications Firm. Quorum retained BrightPath Consulting Group Inc. to develop and execute an external and internal communications strategy, ensuring that policyholders, employees, media, and investors received accurate and timely information. B. Notification and Consumer Protection Measures Quorum implemented the following notification and consumer protection measures:

1. Timely Regulatory Notifications. Quorum filed regulatory notifications with the attorneys general and/or other designated regulatory authorities in all 29 affected states and the District of Columbia, with the Connecticut Insurance Department, and with the HHS Office for Civil Rights. All filings met applicable statutory deadlines.

2. Individual Written Notification. Quorum sent individual written notification letters to all 318,247 affected individuals, with tailored notification letter versions based on the types of data compromised and the state-specific notification requirements applicable to each individual recipient.

3. Complimentary Credit Monitoring and Identity Theft Protection. Quorum offered all 318,247 affected individuals twenty-four (24) months of complimentary credit monitoring and identity theft protection services through a nationally recognized provider. Enrollment instructions and activation codes were included in each notification letter.

4. Dedicated Toll-Free Call Center. Quorum established a dedicated toll-free call center, operated by Clearfield Notification Services LLC and staffed by trained representatives, for a twelve (12)-week period to assist affected individuals with questions, concerns, and enrollment in credit monitoring services.

5. Substitute Notice. Substitute notice was posted on Quorum's corporate website, providing a description of the incident, the steps being taken by Quorum, and instructions for affected individuals. C. Vendor Accountability Measures Quorum pursued the following vendor accountability measures against Palomar:

1. Formal Contractual Demand for Indemnification. Through Calderwood & Harkness, Quorum issued a formal breach of contract and indemnification demand to Palomar's outside counsel, demanding reimbursement of the full $8,230,250 in incident response costs under Section 12.2 of the MSA.

2. Negotiated Settlement. Following extensive negotiations, Quorum secured a settlement agreement providing for total effective recovery of $6,156,000, comprised of a $4,200,000 cash payment from Palomar and $1,956,000 in fee reductions over an 18-month period.

3. Enhanced Contractual Security Requirements. Quorum required, as a condition of continuing the vendor relationship, the execution of Amendment 3 to the MSA, which imposed significantly enhanced security requirements on Palomar. These enhanced requirements include: • Reduction of the critical vulnerability patching timeline from 30 days to 14 days; • Mandatory deployment and maintenance of endpoint detection and res

1. Enhancement of Vendor Risk Management Program. Under the leadership of Priya Deshmukh, Vice President, Vendor Risk Management, Quorum has reviewed and enhanced its vendor risk management program, including the implementation of enhanced due diligence requirements for all vendors that process sensitive personal information, increased frequency of vendor security assessments (moving from annual to semi-annual assess

2. Update of Enterprise Incident Response Plan. Quorum has reviewed and updated its enterprise incident response plan to incorporate lessons learned from this incident, including refined escalation procedures, updated communications protocols, and enhanced vendor-incident coordination procedures.

3. Enhanced Monitoring of Third-Party Data Processing. Quorum has implemented enhanced monitoring and oversight of third-party data processing activities, including expanded logging and alerting capabilities and more frequent review of vendor security reports and certifications.

4. Internal Training and Awareness. Quorum has enhanced its internal training and awareness programs for relevant personnel, including members of the IT Security, Claims Operations, Privacy, and Vendor Risk Management teams, focusing on vendor security oversight, incident identification and escalation, and evolving cybersecurity threats.

V. Summary of Total Incident Response Costs The following table summarizes the total incident response costs incurred by Quorum in connection with the incident: Cyber-Insurance Recovery. Quorum's primary cyber-insurance policy with Atlas Mutual Insurance Company (Policy No. CYB-2023-041587) carried a $2,500,000 self-insured retention, which was borne by Quorum. The remaining $5,730,250 of the total incident response

VI. Conclusion Quorum Insurance Holdings Corp. took immediate, comprehensive, and good-faith steps at every stage of its response to this vendor-originated data security incident. From the moment Quorum was notified of the incident by Palomar, Quorum acted with urgency and diligence to investigate the scope of the compromise, engage experienced advisors, identify and protect affected individuals, comply with all appl