Contract analysis

I. EXECUTIVE SUMMARY This memorandum analyzes key provisions of the Master Services Agreement dated November 12, 2019 (the "MSA") between Quorum Insurance Holdings Corp. ("Quorum" or the "Company") and Palomar Data Solutions, Inc. ("Palomar"), as amended by Amendment No. 1 (executed March 3, 2021) and Amendment No. 2 (executed September 15, 2022), in light of the data security incident disclosed by Palomar to Quorum

II. BACKGROUND A. The Master Services Agreement The MSA, titled "Master Services Agreement between Quorum Insurance Holdings Corp. and Palomar Data Solutions, Inc.," was executed on November 12, 2019, and governs Palomar's provision of claims data processing, document management, and analytics services for Quorum's personal lines insurance division. Under the MSA, Palomar receives, processes, stores, and manages subs

III. DATA SECURITY OBLIGATIONS — EXHIBIT D (AS AMENDED) A. Overview of Exhibit D Requirements Exhibit D to the MSA, titled "Data Security Requirements," sets forth the specific data security obligations applicable to Palomar in connection with its receipt, processing, storage, and management of Quorum data. Exhibit D was included in the original MSA executed on November 12, 2019 and was materially updated and strengt

IV. BREACH NOTIFICATION OBLIGATION — SECTION 9.4 A. Contractual Requirement

Section 9.4 of the MSA, titled "Security Incident Notification," establishes Palomar's obligation to notify Quorum promptly upon discovery of a security incident affecting Quorum data. Section 9.4 provides in relevant part: "Service Provider shall notify Client in writing within forty-eight (48) hours of Service Provider's discovery of any Security Incident that affects or is reasonably likely to affect Client Data."

V. INDEMNIFICATION PROVISIONS — SECTION 12.2 A. Scope of Indemnification

Section 12.2 of the MSA, titled "Data Security Indemnification," establishes a broad indemnification obligation running from Palomar to Quorum in connection with data security breaches. Section 12.2 provides in relevant part: "Service Provider shall indemnify, defend, and hold harmless Client, its affiliates, and their respective officers, directors, employees, and agents from and against any and all losses, damages,

Section 12.4 of the MSA, titled "Indemnification Procedure," establishes the process that the indemnified party (Quorum) must follow to assert its right to indemnification and that the indemnifying party (Palomar) must follow to satisfy its indemnification obligation. The key procedural requirements are as follows: (a) Prompt Written Notice. The indemnified party must provide "prompt written notice" to the indemnifyi

VI. INSURANCE REQUIREMENTS — EXHIBIT E A. Palomar's Insurance Obligations Exhibit E to the MSA, titled "Insurance Requirements," sets forth the minimum insurance coverages that Palomar is required to maintain throughout the term of the agreement. Exhibit E was updated by Amendment No. 2 (September 15, 2022) to increase the minimum cyber liability insurance requirement. The current minimum insurance requirements, as a

VII. TERMINATION FOR CAUSE — SECTION 14.2 A. Termination Provisions

Section 14.2 of the MSA, titled "Termination for Cause," provides either party with the right to terminate the agreement upon the occurrence of a material breach by the other party, subject to a notice and cure period. Section 14.2 provides in relevant part: "Either party may terminate this Agreement upon written notice if the other party commits a material breach of this Agreement and fails to cure such breach withi

VIII. SUMMARY OF PALOMAR'S IDENTIFIED BREACHES Based on our analysis of the MSA and the information available to date, Palomar has committed the following identified breaches of the MSA in connection with the Incident: A. Breach 1: Failure to Timely Patch Critical Vulnerability (Exhibit D, Section 3(f)) Palomar failed to apply the available patch for CVE-2023-0669 — a critical remote code execution vulnerability in S