Contract analysis

I. SUMMARY OF QUORUM'S INDEMNIFICATION DEMAND By way of background and to ensure a complete record, we briefly restate the substance of the formal breach-of-contract and indemnification demand letter transmitted by this office to Mercer, Haight & Dunlop on June 20, 2023 (the "Demand Letter"). We incorporate the Demand Letter and all supporting materials previously transmitted therewith by reference as though fully se

II. REBUTTAL OF PALOMAR'S CAUSATION DEFENSES Your July 7, 2023 letter advances several arguments that, individually and collectively, seek to negate or diminish Palomar's responsibility for the data breach. We address each of these arguments below and demonstrate that none of them has merit. A. Palomar's "Sophisticated Attack" Argument Is Unavailing Your letter characterizes the cyberattack at issue as a "sophisticat

1. Palomar failed to apply the available critical patch to its GoAnywhere MFT appliance in violation of Section 3.4 of Exhibit D.

2. On or about March 14, 2023, a threat actor exploited the unpatched CVE-2023-0669 vulnerability to gain initial unauthorized access to Palomar's network through the GoAnywhere MFT appliance.

3. Having gained initial access, the threat actor conducted lateral movement within Palomar's network environment over an approximately thirty-five (35) day period, from March 14 through April 18, 2023.

4. During this period, the threat actor identified, staged, and ultimately exfiltrated structured data files containing the personally identifiable information ("PII"), financial information, and protected health information ("PHI") of 318,247 Quorum policyholders and claimants located across twenty-nine (29) states and the District of Columbia.

5. The exfiltration of this data triggered Quorum's obligations under applicable state breach notification statutes, the HIPAA Breach Notification Rule, and the Connecticut Insurance Data Security Law, and necessitated the comprehensive incident response effort for which Quorum now seeks indemnification. Each link in this chain is supported by the forensic evidence developed by Graystone Forensics LLC, which was reta

III. PALOMAR'S LATE NOTIFICATION COMPOUNDED THE HARM Independent of and in addition to its breach of the data security obligations under Exhibit D, Palomar also breached the incident notification obligations set forth in Section 9.4 of the MSA. This breach constitutes a separate and independent basis for Quorum's indemnification demand and further underscores the inadequacy of Palomar's response to date.

Section 9.4 of the MSA provides, in relevant part, that Palomar shall provide written notice to Quorum within forty-eight (48) hours of Palomar's discovery of any security incident that affects, or is reasonably likely to affect, the confidentiality, integrity, or availability of Quorum data. This requirement was a material term of the MSA, negotiated by the parties and included in the agreement for the express purpo

IV. REJECTION OF THE $1,500,000 GOODWILL CREDIT Palomar's July 7 letter proposes a $1,500,000 "goodwill credit" against future service fees payable by Quorum under the MSA, offered in lieu of direct indemnification. We have discussed this proposal with our client, and Quorum rejects it as wholly inadequate and unresponsive to Quorum's indemnification demand. We explain our client's position in detail below. First, th

V. REASSERTION OF FULL INDEMNIFICATION DEMAND In light of the foregoing, Quorum hereby reasserts its demand for full indemnification in the amount of $8,230,250 pursuant to Section 12.2 of the MSA. This amount represents the total incident response costs incurred by Quorum through the date of this letter as a direct result of Palomar's breaches of the Data Security Exhibit and Section 9.4 of the MSA. We note that Quo

VI. TERMINATION RIGHTS AND CONTINUED VENDOR RELATIONSHIP Palomar's breaches of the Data Security Exhibit (Exhibit D) and Section 9.4 (notification obligations) of the MSA constitute material breaches of the MSA within the meaning of Section 14.2 (Termination for Cause). Under Section 14.2, Quorum has the right to terminate the MSA upon written notice if Palomar commits a material breach and fails to cure such breach

1. Substantial financial indemnification. Palomar must provide full and adequate financial indemnification for the incident response costs incurred by Quorum, as set forth in this letter and the Demand Letter.

2. Significant enhancements to Palomar's data security program. At a minimum, Quorum will require: (a) Shortened patching timelines for critical and high-severity vulnerabilities, reduced from the current 30-day window to no more than fourteen (14) days, with emergency patches for actively exploited vulnerabilities to be deployed within seventy-two (72) hours; (b) Enhanced endpoint detection and response ("EDR") capa

3. Independent third-party security assessments at Palomar's expense. Quorum will require Palomar to engage, at Palomar's sole cost, an independent third-party security firm (to be mutually agreed upon by the parties) to conduct a comprehensive assessment of Palomar's data security program, including penetration testing and vulnerability assessment, with the results reported to Quorum. This requirement is in addition

4. Shortened incident notification timeline. The current 48-hour notification window in Section 9.4 has proven inadequate. Quorum will require that the notification timeline be reduced to no more than twenty-four (24) hours, with immediate telephonic notice required for incidents involving confirmed data exfiltration. These requirements are non-exhaustive, and Quorum reserves the right to identify additional conditio

VII. RESERVATION OF RIGHTS Quorum expressly reserves all rights and remedies available to it under the MSA, at law, and in equity, including without limitation the following: • The right to pursue claims for breach of contract arising from Palomar's breaches of the Data Security Exhibit and Section 9.4 of the MSA; • The right to pursue claims for negligence, gross negligence, and any other applicable causes of action