Kevin,
I am writing on behalf of our client, Palomar Data Solutions, Inc. ("Palomar"), in response to your demand letter dated June 20, 2023, submitted on behalf of Quorum Insurance Holdings Corp. ("Quorum"). Please find attached Palomar's formal written response, which sets forth our client's position in detail. I wanted to use this cover email, however, to preview several of the key points addressed in the enclosed letter.
**Causation.** Palomar respectfully disputes the characterization of causation set forth in Quorum's demand. As you are aware, the attack at issue exploited CVE-2023-0669, a remote code execution vulnerability in Severin Corporation's GoAnywhere MFT platform that originated as a zero-day and affected numerous organizations globally. Palomar contends that the exploitation of this vulnerability was part of a broader, highly sophisticated threat campaign and that Palomar's security posture at the time of the incident was consistent with prevailing industry standards.
**Patch Management.** While Palomar acknowledges that the vulnerability had been identified prior to the initial unauthorized access on March 14, 2023, Palomar's patch management cycle was actively in progress at that time. Palomar's position is that the 30-day patching requirement set forth in Exhibit D to the Master Services Agreement dated November 12, 2019 (as amended) (the "MSA") must be read in the context of commercially reasonable practices and the rapidly evolving threat landscape that existed during the relevant period.
**Scope of Claimed Damages.** Palomar disputes the full scope of the $8,230,250 indemnification demand asserted under Section 12.2 of the MSA. Not all of the costs identified in your demand are properly attributable to Palomar's conduct. Quorum's own discretionary decisions — including the scope and manner of individual notification, the selection of a 24-month credit monitoring term, and the choice of third-party vendors and their pricing — materially expanded costs beyond what was reasonably necessary under the circumstances.
**Notification Timing.** The attached letter also addresses your assertion that Palomar's notification to Quorum on April 21, 2023, was approximately 24 hours late relative to the 48-hour contractual requirement under Section 9.4 of the MSA. Palomar's position is that the contractual notification clock runs from "confirmation" of a security incident affecting Quorum data, not from the initial detection of anomalous activity by Palomar's SOC team on April 18, 2023. The additional time was used to conduct the preliminary assessment necessary to provide Quorum with meaningful notification rather than a speculative alert.
**Goodwill Credit.** Notwithstanding Palomar's position on causation and liability, and expressly without any admission of liability or breach, Palomar is prepared to offer a goodwill credit of $1,500,000 against future service fees under the MSA, to be applied over the remaining term (through November 11, 2024), as a gesture of its commitment to the long-standing business relationship between Palomar and Quorum.
I want to emphasize that Palomar values its relationship with Quorum — one of Palomar's most significant clients — and is committed to working collaboratively toward a resolution of this matter. Palomar has already taken substantial remedial steps to enhance its security posture following the incident and remains committed to providing Quorum with excellent service. That said, Palomar reserves all rights and defenses under the MSA and applicable law, including but not limited to the liability cap provisions set forth in Section 12.2.
Brian Soto and I remain available to discuss this matter further at your convenience, and we are open to scheduling a call or meeting to explore a mutually acceptable resolution. We would ask that all further correspondence regarding this matter be directed to me at Mercer, Haight & Dunlop, with a copy to Derek Copeland, Palomar's General Counsel.
Best regards,
Catherine Langford Partner Mercer, Haight & Dunlop LLP 2100 Ross Avenue, Suite 3600 Dallas, TX 75201 T: (214) 553-8800 E: clangford@mercerhaightdunlop.com
---
CONFIDENTIALITY NOTICE: This email and any attachments are for the exclusive and confidential use of the intended recipient. If you are not the intended recipient, please do not read, distribute, or take action based on this message. If you have received this communication in error, please notify the sender immediately by reply email and permanently delete all copies of this message and any attachments. This communication may contain information protected by the attorney-client privilege, work product doctrine, or other applicable privileges. Any inadvertent disclosure does not waive any privilege or protection.