Contract analysis

I. Executive Summary The purpose of this memorandum is to recommend a comprehensive negotiation strategy for Quorum Insurance Holdings Corp.'s ("Quorum") indemnification claim against Palomar Data Solutions, Inc. ("Palomar") arising from the vendor-originated data breach discovered on April 18, 2023. This memorandum assesses Quorum's legal position, evaluates Palomar's likely defenses, identifies strategic considerat

II. Background — The Incident and Quorum's Indemnification Demand A. Incident Summary On or about March 14, 2023, a threat actor exploited CVE-2023-0669, a remote code execution vulnerability present in Palomar's GoAnywhere MFT file transfer appliance. The GoAnywhere MFT platform is a managed file transfer solution that Palomar uses to process, transmit, and store structured data files on behalf of its clients, inclu

III. Analysis of Quorum's Legal Position — Strengths This section provides a detailed analysis of the legal bases supporting Quorum's indemnification claim. As discussed below, Quorum's position is strong across multiple dimensions: the contractual breach is clear, the forensic evidence is compelling, and the indemnification provision is broadly drafted and well within its applicable cap. A. Breach of Data Security E

IV. Analysis of Palomar's Potential Defenses — Weaknesses in Their Position While Quorum's legal position is strong, it is important to anticipate and evaluate the defenses that Palomar is likely to assert in the course of settlement negotiations. This section assesses the principal arguments available to Palomar and evaluates their likely effectiveness. A. "Sophisticated Attack" / Causation Defense Palomar's Argumen

V. Strategic Considerations While the legal analysis supports a strong claim by Quorum, the negotiation strategy must account for a range of commercial, operational, regulatory, and insurance-related considerations. This section addresses each of these factors and their implications for the recommended approach. A. Preserving the Vendor Relationship Palomar is Quorum's second-largest claims processing vendor by reven

VI. Recommended Negotiation Strategy Based on the legal analysis and strategic considerations set forth above, we recommend the following negotiation strategy for the Palomar indemnification claim. A. Target Settlement Range The settlement parameters should be defined as follows: Opening Demand Position: Maintain the $8,230,250 full indemnification demand as the anchor. The opening position should not be reduced prio

1. Cash Payment. Seek a direct cash payment in the range of $4,000,000 to $5,000,000, payable within thirty (30) days of the execution of the settlement agreement. The cash payment component is the most important element of the deal structure and should be the primary focus of negotiation. A cash payment of this magnitude ensures that Quorum recovers a substantial portion of its out-of-pocket costs in a prompt and ce

2. Fee Reduction. Negotiate a temporary reduction in the annual contract value for a period of twelve to eighteen months, yielding an additional $1,500,000 to $2,900,000 in economic value to Quorum. The specific parameters we recommend pursuing are as follows: • At the low end of the range: an 8% reduction in the ACV ($16.3M × 8% = $1,304,000 per year) for a period of 18 months, yielding approximately $1,956,000 in t

3. Enhanced Security Commitments (Non-Monetary). In addition to the monetary components of the settlement, we recommend that Quorum require Palomar to implement the following enhanced security measures: (a) Independent Third-Party Security Assessment: Require Palomar to engage, at Palomar's sole expense, an independent third-party security assessor to conduct enhanced annual security audits of Palomar's environment,

4. MSA Amendment 3. All enhanced security commitments should be codified in a formal third amendment to the MSA ("Amendment 3"). Formalizing these commitments in a contractual amendment — rather than relying on informal assurances or side letters — ensures enforceability and provides a clear baseline against which Palomar's compliance can be measured.

5. Mutual Release. The settlement should include an exchange of mutual releases of all claims related to the April 2023 data breach incident, subject to the following carve-outs: (a) Obligations arising under the settlement agreement itself, including the cash payment and fee reduction obligations; (b) Obligations arising under MSA Amendment 3, including all enhanced security commitments; (c) All ongoing obligations

1. Commercial and Operational Coordination: Coordinate with Thomas R. Whitfield (General Counsel) and Priya Deshmukh (VP, Vendor Risk Management) on the commercial terms and operational implications of the proposed settlement, including the fee reduction parameters and the enhanced security requirements. Ms. Deshmukh's team should assess the operational feasibility of the proposed enhanced security commitments and id

2. Technical Security Coordination: Coordinate with David Naranjo (Chief Information Security Officer) on the technical adequacy of the proposed enhanced security commitments, including the shortened patching window, EDR deployment, and quarterly vulnerability scanning requirements. Mr. Naranjo's input will ensure that the enhanced security commitments are technically sound and will meaningfully reduce Quorum's prosp

3. Insurance Coordination: Coordinate with Sandra Whitmore-Kim (Whitmore Risk Advisors) and Paul Enriquez (Atlas Mutual Insurance Company) regarding insurance subrogation rights and recovery allocation. As discussed in Section V.C, the settlement must be structured to preserve Atlas's subrogation rights, and any necessary consent from Atlas must be obtained before the settlement is finalized.

4. Executive Authorization: Obtain sign-off from Margaret D. Calloway (CEO) or her designee for any settlement above $3,000,000, or as otherwise required by Quorum's internal authorization matrix. Given the magnitude of the settlement parameters described in this memorandum, executive-level authorization will be required before Quorum can commit to final terms.

5. Board Briefing: Brief Franklin Reeves (Board Chair, Audit Committee) on settlement parameters, consistent with Quorum's Board reporting obligations. The Board Audit Committee should be apprised of the negotiation strategy, the target settlement range, and the key risk factors identified in this memorandum.

VII. Risk Assessment Summary The following table summarizes the key risk factors that inform the recommended negotiation strategy, together with our assessment of each factor and its likely impact on the outcome.

VIII. Recommended Next Steps Based on the analysis and recommendations set forth in this memorandum, we recommend the following next steps, organized by target timing:

1. Week of September 4, 2023: Schedule a call with Thomas R. Whitfield and Priya Deshmukh to confirm commercial parameters, internal authorization thresholds, and any operational constraints that should be factored into the negotiation. This call should also address Ms. Deshmukh's assessment of the feasibility of the proposed enhanced security commitments from a vendor management perspective.

2. Week of September 4–8, 2023: Coordinate with Sandra Whitmore-Kim (Whitmore Risk Advisors) and Paul Enriquez (Atlas Mutual Insurance Company) regarding Atlas's subrogation position and any settlement consent requirements under the cyber insurance policy. This coordination should be completed before the first substantive negotiation session with Palomar's counsel.

3. Week of September 11–15, 2023: Schedule the initial settlement negotiation session with Catherine Langford at Mercer, Haight & Dunlop LLP. The session should be structured as a face-to-face or video meeting between Kevin Ostrowski and Catherine Langford, with Alan Burke attending in a supporting role. The agenda for the initial session should include: (i) reiteration of Quorum's demand; (ii) presentation of key fo

4. Concurrent with Step 3: Prepare detailed negotiation materials, including a damages summary with supporting documentation for each cost category, a timeline of key events and Palomar's contractual obligations, and a draft term sheet for use once substantive agreement in principle is reached.

5. Week of September 11–15, 2023: Brief David Naranjo (CISO) on the proposed enhanced security commitments — including the fourteen-day patching window, EDR deployment, quarterly vulnerability scanning, and twenty-four-hour notification requirement — to confirm their technical adequacy and identify any refinements that should be made before the commitments are proposed to Palomar.

6. Target: Mid-to-Late October 2023: Conclude the Palomar negotiation and reach agreement in principle, timed to support the multistate AG response narrative. If a final agreement cannot be reached by this date, Quorum should at minimum be in a position to report substantive progress in the AG response.

7. Upon Reaching Agreement in Principle: Prepare the following documents for review and execution: (a) Settlement Agreement and Mutual Release, incorporating the cash payment, fee reduction, and mutual release provisions; (b) MSA Amendment 3, codifying all enhanced security commitments; (c) Summary memorandum to Thomas R. Whitfield and Margaret D. Calloway confirming the terms of the settlement and requesting final e

IX. Conclusion Quorum Insurance Holdings Corp. holds a strong legal position in its indemnification claim against Palomar Data Solutions, Inc. The claim rests on documented breaches of the MSA — specifically, Palomar's failure to patch CVE-2023-0669 within the thirt