Contract analysis

I. OPENING / INTRODUCTION This firm represents Palomar Data Solutions, Inc. ("Palomar") in connection with the above-referenced matter. We write in response to your letter dated June 20, 2023, submitted on behalf of your client, Quorum Insurance Holdings Corp. ("Quorum"), regarding the data security incident that was first identified in April 2023 (the "Incident"). At the outset, Palomar expressly reserves all of its

II. FACTUAL BACKGROUND A. Nature of the Attack The Incident resulted from a sophisticated, state-of-the-art cyber-attack perpetrated by a highly capable and well-resourced threat actor. Based on the information developed through both Palomar's internal investigation and the forensic investigation conducted by Graystone Forensics LLC ("Graystone"), the threat actor exploited a critical remote code execution vulnerabil

1. Patching of the GoAnywhere MFT Vulnerability. Palomar immediately applied the vendor patch for CVE-2023-0669 across all GoAnywhere MFT instances in Palomar's production, staging, and development environments. The patch was fully deployed within twenty-four (24) hours of the SOC's initial detection of the anomalous activity.

2. Network Segmentation Enhancements. Palomar implemented enhanced network segmentation controls to isolate its managed file transfer environment from other segments of its internal network, reducing the potential blast radius of any future security incident affecting file transfer systems.

3. Deployment of Additional Endpoint Detection and Response (EDR) Tools. Palomar deployed additional EDR capabilities across its server infrastructure, including enhanced behavioral analysis and real-time threat detection on all systems involved in the processing, storage, or transmission of client data.

4. Independent Security Assessment. Palomar engaged an independent cybersecurity firm to conduct a comprehensive security assessment of Palomar's infrastructure, controls, and processes, including a focused review of the managed file transfer environment and related data handling workflows.

5. Enhanced Monitoring and Logging. Palomar implemented enhanced monitoring and logging for all file transfer activities, including real-time alerting on anomalous data transfer volumes, unusual destination endpoints, and encrypted outbound connections to unrecognized external addresses.

6. Patch Management Program Review. Palomar initiated a comprehensive review and update of its enterprise-wide patch management program, including the development of accelerated patching procedures for critical and high-severity vulnerabilities in internet-facing and data-handling systems. Palomar wishes to emphasize the extent of its cooperation with Quorum and with Graystone Forensics LLC, the forensic investigatio

III. LEGAL DEFENSES A. Causation Palomar respectfully submits that the proximate cause of the data exfiltration was the criminal conduct of the threat actor, not any act or omission by Palomar. The threat actor deliberately targeted Palomar's GoAnywhere MFT environment using a sophisticated exploit that was specifically designed to bypass security controls. The criminal and intentional nature of the attack was the pr

IV. SETTLEMENT PROPOSAL In the spirit of the parties' longstanding and valued commercial relationship — which spans nearly four years and has generated significant mutual value — Palomar is prepared to offer Quorum a goodwill credit in the amount of One Million Five Hundred Thousand Dollars ($1,500,000.00), to be applied as a reduction against Quorum's monthly service fee invoices under the MSA over the remaining ter

V. CLOSING Palomar values its relationship with Quorum and remains committed to providing Quorum with the high-quality data processing and claims administration services that have characterized the parties' commercial relationship since the inception of the MSA in November 2019. Palomar is Quorum's second-largest claims processing vendor by volume, handling approximately 34% of Quorum's total claims data processing w

2. Causation Defense. The causation defense is Palomar's weakest argument. The Graystone forensic investigation confirms that CVE-2023-0669 was the sole initial access vector exploited by the threat actor. If the vulnerability had been patched within the contractual window, the specific exploit would not have been available. The "alternative attack vector" argument is speculative and unsupported by any forensic evide

3. Late Notification. The notification delay — approximately 72 hours from discovery versus the 48-hour contractual requirement in Section 9.4 — is an additional, independent breach. Palomar does not dispute the factual dates (Discovery on April 18; notification on April 21); it only recharacterizes the delay as "prompt" and "commercially reasonable." The MSA language is clear and does not permit extension of the not

4. Contributory Negligence / Shared Responsibility. These arguments lack contractual support and are factually weak. The MSA places data security obligations on Palomar as the service provider. The MSA does not contain comparative fault provisions. Quorum's reliance on contractual audit mechanisms (including the SOC 2 Type II requirement) is reasonable and appropriate. The data format / encryption argument is affirma

5. Scope of Damages. Palomar's arguments regarding the recoverability of legal fees, crisis communications costs, and internal costs are contradicted by the express language of Section 12.2, which covers "all losses, damages, costs, and expenses (including reasonable attorneys' fees and costs of investigation)." Each disputed cost category falls within this language.

6. Insurance Offset. The double recovery / insurance offset argument has no basis in the MSA, which contains no offset provision. Quorum's cyber-insurance coverage is a separate entitlement obtained at Quorum's own expense, and Palomar has no claim to the benefit of that coverage. Palomar's Leverage Points (to be addressed in strategy) Notwithstanding the weakness of Palomar's legal defenses, Palomar does possess cer