Contract analysis

I. Executive Summary The purpose of this memorandum is to summarize the material terms of the Settlement Agreement and Mutual Release (the "Settlement Agreement") executed on October 27, 2023, between Quorum Insurance Holdings Corp. ("Quorum") and Palomar Data Solutions, Inc. ("Palomar"), which resolves all indemnification claims arising from the vendor-originated data breach discovered in April 2023. This memorandum

II. Background and Procedural History A. The Data Breach Incident On or about March 14, 2023, a threat actor exploited CVE-2023-0669, a remote code execution vulnerability in Palomar's GoAnywhere MFT (Managed File Transfer) file transfer appliance, to gain unauthorized access to Palomar Data Solutions, Inc.'s network environment. CVE-2023-0669 was publicly disclosed by Severin Corporation, the manufacturer of the GoA

III. Summary of Settlement Agreement Terms Set forth below is a summary of the material terms and provisions of the Settlement Agreement. This summary is provided for the convenience of management and does not purport to modify or supersede the terms of the executed agreement. In the event of any inconsistency between this summary and the Settlement Agreement, the terms of the executed agreement shall control. A. Cas

Section 4 of the Settlement Agreement contains a mutual release of claims. Specifically: • Quorum releases and forever discharges Palomar, its affiliates, and their respective officers, directors, employees, agents, and representatives from any and all claims, demands, actions, causes of action, obligations, damages, and liabilities of any kind, whether known or unknown, arising out of or related to the data breach i

Section 5 of the Settlement Agreement provides that the terms and conditions of the settlement are confidential and shall not be disclosed by either party to any third party, except: • As required by applicable law, regulation, or order of a court or governmental authority; • As may be required in connection with Quorum's obligations under the Securities Exchange Act of 1934 and the rules and regulations of the Secur

IV. Effective Total Recovery Analysis A. Total Recovery from Palomar The total effective recovery from Palomar under the Settlement Agreement is calculated as follows: B. Total Incident Response Costs The following table summarizes the total incident response costs incurred by Quorum in connection with the data breach: The Clearfield Notification Services LLC costs totaling $3,214,500 represent the largest single cat

V. Insurance Coverage and Net Financial Exposure A. Cyber-Insurance Tower Quorum maintains the following cyber-insurance coverage relevant to the data breach incident: A claim under the Atlas primary policy was filed on May 8, 2023, under Claim No. CYB-CLM-2023-05892. Atlas has been cooperative in the claims process to date and has not raised coverage defenses, though a formal coverage determination has not yet been

VI. Non-Monetary Benefits In addition to the financial recovery described above, the settlement and the concurrent execution of MSA Amendment 3 provide significant non-monetary benefits to Quorum. A. Enhanced Vendor Security Posture MSA Amendment 3 substantially strengthens Palomar's data security obligations for the remaining term of the MSA and any renewal period. These enhanced obligations directly address the sec

VII. Risk Assessment and Litigation Alternative In evaluating the settlement, it is important to consider the alternative — namely, pursuing the indemnification claim through breach of contract litigation. The following analysis addresses the strengths of Quorum's position, the litigation risks, and the relationship considerations that informed our recommendation to settle. A. Strengths of Quorum's Position Quorum's

VIII. Recommendations Based on our analysis of the settlement terms, the financial recovery achieved, the litigation alternative, and the non-monetary benefits secured, we respectfully submit the following recommendations for management's consideration:

1. Affirm the Settlement Agreement as Executed. The Settlement Agreement executed on October 27, 2023 represents a favorable resolution of Quorum's indemnification claims against Palomar. The approximately 74.8% recovery rate from Palomar, combined with the anticipated insurance recovery from Atlas Mutual, more than fully compensates Quorum for the total incident response costs incurred. The settlement avoids the sig

2. Monitor Palomar's Compliance with Amendment 3 Deadlines. Under Amendment 3, Palomar is required to implement enhanced patch management procedures and deploy endpoint detection and response capabilities across its network within ninety (90) days of execution — i.e., by approximately January 25, 2024. Priya Deshmukh, VP, Vendor Risk Management, should coordinate with Palomar to verify compliance with these deadlines

3. Coordinate with Insurance Broker and Carrier. Before final submission of the proof of loss to Atlas Mutual, Quorum should coordinate with Sandra Whitmore-Kim at Whitmore Risk Advisors Inc. and Paul Enriquez at Atlas Mutual regarding the interplay between the Palomar settlement recovery and the insurance claim. Specific topics to address include: (i) whether notice of the Palomar settlement should be included in or

4. Submit Proof of Loss by November 15, 2023. Quorum should finalize and submit its proof of loss and final cost summary to Atlas Mutual Insurance Company on or before November 15, 2023, to initiate recovery of the anticipated $5,730,250 in insurance proceeds above the self-insured retention. The proof of loss should include detailed documentation of all costs incurred, together with supporting invoices, the Grayston

5. Continue Engagement with the Multistate AG Coalition and Other Regulators. The supplemental submission filed with the multistate attorneys general coalition on November 3, 2023 included a summary of the settlement terms and the enhanced security measures adopted in Amendment 3. We recommend continued proactive engagement with the AG coalition, the Connecticut Insurance Department, and HHS-OCR to press for favorabl

6. Brief the Audit Committee. The settlement terms, combined recovery analysis, and net financial impact should be communicated to the Audit Committee of Quorum's Board of Directors. Franklin Reeves, Audit Committee Chair, should receive a summary briefing at the next scheduled Audit Committee meeting. The briefing should cover: (i) the terms of the Settlement Agreement and Amendment 3; (ii) the total recovery from P

7. Evaluate MSA Renewal Posture. The current MSA term expires on November 11, 2024, approximately twelve and one-half months from the date of this memorandum. Given the significance of the data breach incident, Quorum should begin evaluating its options with respect to the MSA renewal well in advance of the expiration date. The evaluation should consider: (i) Palomar's compliance with the enhanced security obligation

IX. Attachments and Enclosures The following documents are enclosed with this memorandum for your reference: • Attachment A: Executed Settlement Agreement and Mutual Release between Quorum Insurance Holdings Corp. and Palomar Data Solutions, Inc. (dated October 27, 2023) • Attachment B: Executed MSA Amendment 3 — Enhanced Data Security and Audit Provisions (dated October 27, 2023) • Attachment C: Financial Summary —