Contract analysis

I. Introduction and Purpose This Exhibit summarizes the vendor accountability actions taken by Quorum Insurance Holdings Corp. ("Quorum") against its third-party claims-processing vendor, Palomar Data Solutions, Inc. ("Palomar"), in connection with the data security incident that is the subject of the multistate inquiry initiated by the Joint Demand Letter of the Multistate Attorney General Coalition dated September

II. Background on the Quorum–Palomar Vendor Relationship A. Master Services Agreement Overview Palomar Data Solutions, Inc. is a Texas corporation headquartered at 7100 Greenville Avenue, Suite 450, Dallas, Texas 75231. Palomar provides data processing, business process outsourcing, and insurance technology services to clients in the property and casualty, life, and health insurance industries. Palomar has been a sig

Section 9.4 (Breach Notification Clause): Section 9.4 of the MSA required Palomar to notify Quorum in writing within 48 hours of discovering any security incident or data breach affecting Quorum data. This notification was required to include, to the extent known at the time, a description of the nature and scope of the incident, the categories of data involved, and the steps being taken by Palomar to investigate and

Section 12.2 (Indemnification): Section 12.2 of the MSA provides that Palomar shall indemnify, defend, and hold harmless Quorum and its affiliates, directors, officers, employees, and agents from and against any and all losses, damages, liabilities, costs, and expenses (including reasonable attorneys' fees) arising from or related to Palomar's breach of its data security obligations under the MSA and its exhibits. Pa

Section 14.2 (Termination for Cause): Section 14.2 of the MSA grants Quorum the right to terminate the MSA upon a material breach by Palomar, provided that Quorum first delivers written notice of the breach to Palomar and Palomar fails to cure the breach within 30 days of receiving such notice. As discussed in Section VI below, Quorum has expressly reserved its termination rights under Section 14.2.

III. Palomar's Contractual Breaches Quorum, with the assistance of its counsel at Calderwood & Harkness LLP and the forensic investigation conducted by Graystone Forensics LLC, has identified two specific, documented breaches of Palomar's obligations under the MSA. Each breach is discussed in detail below. A. Failure to Timely Patch Critical Vulnerability (Breach of Exhibit D) The forensic investigation conducted by

IV. Quorum's Indemnification Demand and Negotiations A. Formal Demand On June 20, 2023, Calderwood & Harkness LLP, acting on behalf of Quorum, transmitted a formal breach of contract demand letter to Catherine Langford, Partner at Mercer, Haight & Dunlop LLP, which serves as outside counsel to Palomar. The demand letter asserted Palomar's breaches of Exhibit D (failure to timely patch CVE-2023-0669) and Section 9.4 (

V. Enhanced Security Requirements — MSA Amendment 3 Concurrently with the execution of the Settlement Agreement and Mutual Release, Quorum and Palomar executed a Third Amendment to the Master Services Agreement ("Amendment 3"), dated October 27, 2023. Amendment 3 imposes enhanced, forward-looking data security and audit obligations on Palomar that are designed to substantially reduce the risk of a similar incident oc

VI. Ongoing Vendor Oversight and Monitoring In addition to the specific contractual amendments and settlement terms described above, Quorum has enhanced its internal vendor risk management practices with respect to Palomar. These enhanced practices are designed to ensure ongoing, proactive oversight of Palomar's security posture and compliance with the strengthened contractual requirements. Key ongoing vendor oversig

VII. Summary of Vendor Accountability Outcomes The following summarizes the key outcomes of Quorum's vendor accountability actions against Palomar in connection with the data security incident. Contractual Breaches Identified and Documented:

1. Failure to apply the vendor-issued patch for CVE-2023-0669 within the contractually mandated 30-day patching window, constituting a material breach of Exhibit D to the MSA.

2. Failure to notify Quorum of the security incident within the contractually mandated 48-hour notification window, with notification delivered approximately 24 hours late, constituting a breach of Section 9.4 of the MSA. Financial Recovery: Total effective recovery by Quorum: $6,156,000, comprising $4,200,000 in direct cash payment and $1,956,000 in fee reductions over an 18-month period, against total documented in

VIII. List of Referenced Documents The following documents are referenced in this Exhibit and are available upon request, subject to the privilege reservations noted below:

1. Master Services Agreement between Quorum Insurance Holdings Corp. and Palomar Data Solutions, Inc., dated November 12, 2019.

2. Amendment 1 to the Master Services Agreement, dated March 3, 2021.

3. Amendment 2 to the Master Services Agreement, dated September 15, 2022.

4. Amendment 3 to the Master Services Agreement, dated October 27, 2023.

5. Settlement Agreement and Mutual Release between Quorum Insurance Holdings Corp. and Palomar Data Solutions, Inc., dated October 27, 2023.

6. Breach of Contract Demand Letter from Calderwood & Harkness LLP to Mercer, Haight & Dunlop LLP, dated June 20, 2023.

7. Response Letter from Mercer, Haight & Dunlop LLP (on behalf of Palomar Data Solutions, Inc.), dated July 7, 2023.

8. Rebuttal Letter from Calderwood & Harkness LLP to Mercer, Haight & Dunlop LLP, dated July 25, 2023. Note: Certain documents referenced above are subject to the attorney-client privilege and/or the work product doctrine. Quorum Insurance Holdings Corp. reserves all applicable privileges and protections and does not waive any privilege or protection by this submission to the Multistate Attorney General Coalition or