1025-00006 · Graystone Forensics LLC · Engagement & Privilege

graystone-retention-letter.docx DOCUMENT Data Privacy

33 / 88 ← → ✕

CONFIDENTIAL — ATTORNEY-CLIENT PRIVILEGED / ATTORNEY WORK PRODUCT

CALDERWOOD & HARKNESS LLP Attorneys at Law

1700 K Street NW, Suite 900 Washington, D.C. 20006 Telephone: (202) 555-7400 Facsimile: (202) 555-7401 www.calderwoodharkness.com

May 5, 2023

VIA EMAIL AND OVERNIGHT COURIER

Dr. Nolan Briggs Managing Director, Incident Response Graystone Forensics LLC 1950 Old Gallows Road, Suite 600 Tysons Corner, VA 22182

Re: Retention of Graystone Forensics LLC — Privileged Forensic Investigation Calderwood & Harkness LLP Matter No. 1025-00006 Confidential — Attorney-Client Privileged / Attorney Work Product

Dear Dr. Briggs:

1. Introduction and Purpose of Retention

Calderwood & Harkness LLP ("C&H" or "the Firm") writes on behalf of its client, Quorum Insurance Holdings Corp. ("Quorum" or "QIH"), a Delaware corporation publicly traded on the Nasdaq Stock Market (ticker: QIHC), with its principal offices located at 400 Constitution Plaza, Suite 2200, Hartford, Connecticut 06103. C&H has been retained by Quorum to provide legal counsel in connection with a data security incident involving Quorum's third-party claims-processing vendor, Palomar Data Solutions, Inc. ("Palomar"), a Texas corporation headquartered at 7100 Greenville Avenue, Suite 450, Dallas, Texas 75231. The nature, background, and known scope of that incident are described in further detail in Section 2 below.

The purpose of this letter is to formally retain Graystone Forensics LLC ("Graystone") to provide forensic investigation, incident response, and digital forensic services at the direction and under the supervision of Calderwood & Harkness LLP in connection with the Palomar security incident (the "Incident"). Graystone is being retained by counsel — not directly by Quorum — in order to ensure that all work product, findings, reports, communications, and other materials generated by Graystone in the course of this engagement are protected under the attorney-client privilege and the work product doctrine. This structure is critical to preserve the confidentiality and legal protections that attach to the forensic investigation and its results.

This engagement shall be effective as of May 5, 2023 (the "Effective Date"). By countersigning this letter in the space provided below, Graystone confirms its acceptance of the engagement and the terms and conditions set forth herein.

2. Background of the Incident

On or about March 14, 2023, a threat actor is believed to have gained unauthorized access to the network environment of Palomar Data Solutions, Inc. by exploiting a known remote code execution vulnerability, identified in the National Vulnerability Database as CVE-2023-0669, present in Palomar's GoAnywhere MFT managed file transfer appliance. CVE-2023-0669 is a pre-authentication command injection vulnerability that, when exploited, permits an unauthenticated remote attacker to execute arbitrary code on the affected system. It is understood that Palomar had not yet applied the vendor-issued security patch for this vulnerability at the time of the initial compromise.

The unauthorized access and potential data exfiltration are believed to have continued from approximately March 14, 2023 through April 18, 2023, a period of approximately thirty-five (35) days. During this period, the threat actor is believed to have moved laterally within Palomar's internal network infrastructure, accessed claims-processing databases and file repositories, and staged and exfiltrated data to external infrastructure under the threat actor's control.

On April 18, 2023, Palomar's Security Operations Center ("SOC") detected anomalous outbound data transfers from servers within the claims-processing environment to an external IP address not previously associated with authorized business traffic. This detection prompted Palomar to initiate an internal investigation, during which Palomar's IT security team confirmed indicators of compromise consistent with the exploitation of CVE-2023-0669 and identified evidence of unauthorized access to claims data repositories.

On April 21, 2023, Derek Copeland, General Counsel of Palomar Data Solutions, Inc., notified Thomas R. Whitfield, General Counsel of Quorum Insurance Holdings Corp., and David Naranjo, Chief Information Security Officer of Quorum, of the security incident via email. That notification indicated that the compromised environment may contain data belonging to Quorum and its policyholders, but did not provide a definitive scope of exposure.

Palomar processes claims data for Quorum's personal lines insurance division under a Master Services Agreement originally dated November 12, 2019, as subsequently amended (the "MSA"). Pursuant to the MSA and its associated Data Processing Addendum, Palomar receives, processes, and stores on Quorum's behalf certain categories of sensitive personal information, including, without limitation, personally identifiable information ("PII"), protected health information ("PHI") as defined under the Health Insurance Portability and Accountability Act of 1996 ("HIPAA") and its implementing regulations, and financial data pertaining to Quorum's policyholders and claimants. As a result, the compromised environment may contain records relating to a substantial number of individuals across multiple jurisdictions, and the Incident implicates a complex web of state, federal, and potentially international notification and regulatory obligations.

Calderwood & Harkness LLP was engaged by Quorum on May 4, 2023, pursuant to a separate engagement letter, and is responsible for coordinating the comprehensive legal response to the Incident. That response encompasses, among other matters, forensic investigation oversight, state and federal breach notification compliance (including individual, regulator, and media notifications), regulatory inquiry and defense, HIPAA analysis and reporting, vendor accountability analysis, and assessment of Quorum's contractual rights and remedies under the MSA with Palomar. Kevin Ostrowski, Partner in C&H's Privacy & Data Security Practice Group, serves as the responsible partner on the matter, and Alan Burke, Associate in the same practice group, serves as lead associate.

3. Scope of Engagement

Graystone is retained to perform the following categories of services at the direction, and under the supervision, of C&H counsel. The scope of the engagement may be modified, expanded, or narrowed by C&H in writing from time to time as the investigation progresses and as additional information becomes available. Graystone shall not undertake work outside the scope described herein, or as subsequently modified, without C&H's prior written authorization.

3.1 Technical Forensic Investigation

Graystone shall conduct a comprehensive technical forensic investigation of the Incident, including, without limitation, the following:

(a) Initial Entry Vector Analysis. Determine the threat actor's initial entry vector into Palomar's network environment and confirm the exploitation of CVE-2023-0669 in the GoAnywhere MFT managed file transfer appliance as the means of initial access. This analysis shall include examination of available system logs, network logs, application logs, and other forensic artifacts associated with the GoAnywhere MFT appliance and related network infrastructure.

(b) Timeline Development. Establish a detailed, chronological timeline of the unauthorized access from initial compromise (on or about March 14, 2023) through detection and containment (on or about April 18, 2023). This timeline shall identify, to the extent ascertainable from available forensic evidence, the dates and times of the following categories of activity: initial exploitation and access; persistence mechanisms installed or established by the threat actor; credential harvesting and privilege escalation; lateral movement within Palomar's network; reconnaissance and enumeration of data repositories; staging of data for exfiltration; exfiltration of data to external infrastructure; and any additional malicious activity identified during the investigation.

(c) Data Access and Exfiltration Analysis. Identify and catalog all data sets, structured data files, databases, file shares, and other repositories accessed, copied, staged, or exfiltrated by the threat actor from Palomar's claims-processing environment. This analysis shall include, to the extent feasible, a determination of the specific data fields and record types affected and the volume of data involved.

(d) Evidence Collection and Preservation. Collect and forensically preserve all relevant digital evidence, including disk images, memory captures, network traffic captures, log files, and other artifacts, in accordance with industry-standard forensic best practices and applicable legal requirements.

3.2 Data Exposure Assessment

Graystone shall perform a comprehensive data exposure assessment to support C&H's analysis of Quorum's notification obligations under applicable federal and state laws, including, without limitation, the following:

(a) Data Type Identification. Identify the types and categories of personal information compromised or potentially compromised in the Incident, including but not limited to: full names; dates of birth; Social Security numbers; driver's license numbers and state identification numbers; bank account and routing numbers; payment card numbers (including credit and debit card numbers, expiration dates, and security codes); health insurance policy numbers and group numbers; health conditions, medical diagnoses, diagnosis codes (ICD-10 and CPT), treatment information, and prescription data; and any other categories of sensitive personal information identified during the investigation.

(b) Affected Individual Identification and Enumeration. Determine the number and identity (to the extent ascertainable from available data and forensic evidence) of individuals whose personal information was accessed, acquired, or exfiltrated by the threat actor. This determination shall include, to the extent feasible, a breakdown of affected individuals by state of residence, as this information is essential to C&H's analysis of state-specific notification trigger thresholds, timelines, and content requirements.

(c) Data Categorization. Categorize affected individuals by data type subsets to enable C&H to assess the applicable notification obligations and consumer protection requirements for each affected population. At a minimum, the following categories shall be identified: (i) individuals whose PII only (e.g., name plus Social Security number, name plus driver's license number) was compromised; (ii) individuals whose PII plus financial information (e.g., bank account numbers, payment card numbers) was compromised; and (iii) individuals whose PII plus protected health information (e.g., diagnosis codes, treatment records, health insurance information) was compromised. Additional sub-categorizations may be requested by C&H as the investigation progresses.

3.3 Threat Actor Assessment

Graystone shall assess the threat actor responsible for the Incident, including, without limitation, the following:

(a) Tactics, Techniques, and Procedures (TTPs). Analyze the threat actor's tactics, techniques, and procedures as observed in the forensic evidence, mapped to the MITRE ATT&CK framework where applicable, in order to support attribution analysis and inform C&H's assessment of litigation risk and regulatory exposure.

(b) Post-Exfiltration Activity. Assess whether exfiltrated data has been published on the dark web or clear web, offered for sale on underground marketplaces, used in extortion communications directed at Palomar or Quorum, or otherwise disseminated or exploited. This assessment shall include monitoring of known threat actor infrastructure, dark web forums, and paste sites for indicators of data exposure, to the extent such monitoring falls within Graystone's existing capabilities and toolsets.

(c) Threat intelligence Context. Provide threat intelligence context regarding the broader exploitation of CVE-2023-0669 by threat actors, including any known threat actor groups associated with the exploitation of this vulnerability, the scope and scale of related campaigns, and any publicly available information regarding the objectives and capabilities of the responsible threat actor or group.

3.4 Remediation Guidance

Graystone shall provide technical remediation guidance, including, without limitation, the following:

(a) Containment and Remediation Recommendations. Provide technical recommendations to Quorum and, as appropriate and as directed by C&H, to Palomar regarding containment, eradication, and remediation measures necessary to address the vulnerabilities exploited in the Incident and to prevent recurrence. Such recommendations may address patching and configuration hardening, network segmentation, access control improvements, logging and monitoring enhancements, and other technical security measures.

(b) Backdoor and Persistent Access Assessment. Assess whether the threat actor introduced additional vulnerabilities, backdoors, web shells, implants, or other persistent access mechanisms during the period of unauthorized access that may remain active or exploitable in Palomar's network environment.

4. Reporting and Deliverables

All reports, findings, analyses, communications, and work product prepared by Graystone in connection with this engagement shall be directed exclusively to Calderwood & Harkness LLP — specifically to Kevin Ostrowski, Partner, and Alan Burke, Associate — and shall not be transmitted directly to Quorum Insurance Holdings Corp., Palomar Data Solutions, Inc., or any other person or entity without the prior written authorization of C&H. This requirement applies to all forms of communication, including written reports, email correspondence, oral communications, presentations, and data transmittals.

Graystone shall provide the following deliverables in the course of this engagement:

(a) Preliminary Forensic Findings Memorandum. A written memorandum summarizing Graystone's initial findings regarding the attack vector, the timeline of unauthorized access, and the preliminary scope of data exposure. The target delivery date for this memorandum is on or before June 9, 2023. This preliminary memorandum is intended to enable C&H to begin its assessment of Quorum's notification obligations and to provide an initial briefing to Quorum's General Counsel and executive leadership.

(b) Final Forensic Investigation Report. A comprehensive written report providing Graystone's final findings on all matters within the scope of this engagement, including the complete and verified scope of compromised data, a detailed and validated timeline of the unauthorized access, the threat actor assessment, and remediation recommendations. The target delivery date for the final report is on or before July 14, 2023. C&H and Graystone acknowledge that these target dates are subject to adjustment depending on the availability and quality of forensic evidence, cooperation from Palomar, and other factors that may affect the pace of the investigation.

(c) Interim Oral Briefings. As requested by C&H counsel, Graystone shall provide oral briefings to Kevin Ostrowski, Alan Burke, and other C&H personnel as designated, to provide status updates on investigation progress, emerging findings, and any issues requiring counsel's attention or direction. Such briefings may be conducted by telephone, videoconference, or in person, as directed by C&H.

All written deliverables prepared by Graystone in connection with this engagement — including the Preliminary Forensic Findings Memorandum, the Final Forensic Investigation Report, and any interim written communications, draft analyses, data summaries, or other documents — shall bear the following legend prominently on each page:

"PRIVILEGED AND CONFIDENTIAL — PREPARED AT THE DIRECTION OF COUNSEL — ATTORNEY-CLIENT PRIVILEGE / ATTORNEY WORK PRODUCT"

Graystone shall not issue any report, summary, memorandum, communication, or other document to any person or entity other than C&H without C&H's express prior written consent. This prohibition includes, without limitation, communications to Quorum, Quorum's board of directors, Quorum's insurers, regulatory authorities, law enforcement, and any third parties.

5. Attorney-Client Privilege and Work Product Protection

The parties acknowledge that the protection of the attorney-client privilege and the work product doctrine is of paramount importance to this engagement. The following provisions are intended to establish and preserve those protections throughout the engagement and thereafter.

Graystone is retained as a consulting expert at the direction of counsel, Calderwood & Harkness LLP, to assist counsel in providing legal advice to Quorum Insurance Holdings Corp. in connection with the Incident. Graystone's work is being directed by C&H for the purpose of enabling C&H to render legal advice to Quorum regarding its obligations and rights arising from the Incident, including but not limited to breach notification obligations under applicable federal and state laws, regulatory compliance, HIPAA reporting obligations, potential litigation exposure, and contractual rights and remedies against Palomar. The retention is deliberately structured so that all communications between Graystone and C&H, and all work product generated by Graystone in the course of this engagement, are protected by the attorney-client privilege and the work product doctrine.

Graystone acknowledges and agrees to the following:

(a) Agency Relationship. Graystone is acting as an agent of Calderwood & Harkness LLP for purposes of the attorney-client privilege. In this capacity, Graystone's role is to assist C&H in understanding the technical facts relevant to the Incident so that C&H may provide informed legal advice to Quorum.

(b) Privileged Communications. All communications between Graystone and C&H regarding this engagement, including oral communications, written correspondence, email communications, reports, memoranda, data transmittals, and any other forms of communication, are privileged and confidential.

(c) Work Product. All reports, memoranda, analyses, notes, drafts, data compilations, spreadsheets, charts, forensic images, and other materials produced by Graystone in connection with this engagement constitute attorney work product prepared in anticipation of litigation and/or for the purpose of rendering legal advice to Quorum. These materials would not have been prepared in substantially similar form but for the prospect of litigation and the need for legal analysis of Quorum's obligations and exposure arising from the Incident.

(d) Non-Disclosure to Third Parties. Graystone shall not disclose any information, findings, analyses, conclusions, or work product to any third party — including, without limitation, Quorum's employees, officers, directors, board members, insurers, auditors, regulators, law enforcement agencies, or any other person or entity — without the prior written authorization of Calderwood & Harkness LLP. Any such disclosure, if authorized, shall be made only in the manner and to the extent specified by C&H.

(e) Compulsory Process. If Graystone or any of its personnel receives any subpoena, court order, regulatory demand, civil investigative demand, or other compulsory process seeking information, documents, testimony, or materials related to this engagement, Graystone shall immediately — and in no event later than twenty-four (24) hours after receipt — notify Kevin Ostrowski and Alan Burke at Calderwood & Harkness LLP before producing any materials, providing any testimony, or taking any other responsive action. Graystone shall cooperate fully with C&H in asserting all applicable privileges and protections in response to any such compulsory process.

All communications regarding this engagement shall be directed through C&H counsel and shall be clearly marked as privileged and confidential in accordance with the requirements of this letter. Graystone personnel shall take care to ensure that privileged communications and work product are not inadvertently disclosed to unauthorized persons, including through the use of appropriate email distribution lists, secure file-sharing platforms, and other information security controls.

6. Engagement Team

6.1 Calderwood & Harkness LLP Contacts

The following C&H attorneys shall serve as the primary points of contact for this engagement:

Kevin Ostrowski, Partner, Privacy & Data Security — Responsible Partner Calderwood & Harkness LLP 1700 K Street NW, Suite 900 Washington, D.C. 20006 Telephone: (202) 555-7418

Email: kostrowski@calderwoodharkness.com

Alan Burke, Associate, Privacy & Data Security — Lead Associate Calderwood & Harkness LLP 1700 K Street NW, Suite 900 Washington, D.C. 20006 Telephone: (202) 555-7432

Email: aburke@calderwoodharkness.com

Sara Hendricks, Associate, Privacy & Data Security — Working Associate Calderwood & Harkness LLP 1700 K Street NW, Suite 900 Washington, D.C. 20006 Telephone: (202) 555-7445

Email: shendricks@calderwoodharkness.com

Rachel Bernstein, Partner, Privacy & Data Security — Billing Partner Calderwood & Harkness LLP 51 West 52nd Street, 34th Floor New York, NY 10019 Telephone: (212) 555-3200

Email: rbernstein@calderwoodharkness.com

All substantive communications from Graystone regarding the investigation and its findings shall be directed to Kevin Ostrowski and Alan Burke. Billing inquiries may be directed to Rachel Bernstein or Alan Burke.

6.2 Graystone Forensics LLC Engagement Team

The following Graystone personnel shall serve as the primary engagement team for this matter:

Dr. Nolan Briggs, Managing Director, Incident Response — Engagement Lead Graystone Forensics LLC 1950 Old Gallows Road, Suite 600 Tysons Corner, VA 22182

Kendra Faulkner, Senior Forensic Analyst — Analyst Lead Graystone Forensics LLC 1950 Old Gallows Road, Suite 600 Tysons Corner, VA 22182

Graystone shall notify C&H in writing in advance of any changes to the engagement team, including the departure of any team member, the substitution of any team member, or the addition of any personnel who will have access to privileged information, work product, or confidential data in connection with this engagement. C&H reserves the right to approve or reject proposed changes to the Graystone engagement team. All Graystone personnel assigned to this engagement shall be made aware of and shall comply with the confidentiality, privilege, and non-disclosure obligations set forth in this letter.

7. Coordination with Quorum Personnel

All coordination between Graystone and Quorum Insurance Holdings Corp. personnel shall be conducted through, or at the express direction of, Calderwood & Harkness LLP counsel. Graystone shall not initiate contact with any Quorum employee, officer, director, or other representative without first obtaining authorization from C&H.

C&H may, from time to time, authorize direct technical communications between Graystone analysts and specific Quorum personnel, including David Naranjo, Chief Information Security Officer of Quorum, and members of the Quorum IT security team, for purposes of evidence collection, system access, technical coordination, and other investigative activities that require direct interaction between forensic analysts and Quorum's technical staff. Any such authorization shall be provided by C&H in writing (including by email) and shall specify the scope and duration of the authorized direct communication. Such authorization does not alter the privileged nature of the engagement, and all substantive findings, analyses, and conclusions arising from such direct communications shall be reported to C&H, not to Quorum, in the first instance.

Graystone shall not communicate directly with Palomar Data Solutions, Inc., or with Palomar's outside counsel, Mercer, Haight & Dunlop LLP, without the express prior written authorization of C&H. Any interactions between Graystone and Palomar or its counsel — including requests for forensic evidence, system access, log files, or technical information — shall be coordinated through C&H.

8. Fees and Billing

Graystone shall invoice Calderwood & Harkness LLP — not Quorum Insurance Holdings Corp. directly — for all professional fees, costs, and expenses incurred in connection with this engagement, in accordance with the fee schedule attached hereto as Exhibit A or as separately agreed in writing between C&H and Graystone. In the event of any conflict between the terms of this letter and the terms of any separately negotiated fee schedule, the terms of this letter shall control with respect to privilege, confidentiality, and reporting obligations.

Invoices shall be submitted on a monthly basis and shall be sufficiently detailed to permit review and approval by C&H and, as necessary and as authorized by C&H, submission to Quorum's cyber-liability insurer, Atlas Mutual Insurance Company, under Policy No. CYB-2023-041587 (Claim No. CYB-CLM-2023-05892), for reimbursement of covered forensic investigation costs. Invoices shall include, at a minimum, a description of the services performed during the billing period, the identity of the Graystone personnel who performed the services, the hours expended by each such person, and the applicable hourly rates or fixed fees, together with an itemization of any costs or expenses incurred.

Graystone acknowledges that its fees and invoices may be submitted to Quorum's cyber-liability insurer, Atlas Mutual Insurance Company, for reimbursement under Quorum's policy, and agrees to cooperate with reasonable requests from C&H or the insurer for billing detail, clarification, or supporting documentation. Notwithstanding the foregoing, no privileged work product, substantive findings, forensic reports, or other confidential information relating to the investigation shall be disclosed to the insurer or any other party without C&H's prior written consent. C&H will coordinate any disclosures to the insurer and will provide Graystone with instructions regarding the level of detail to be included in invoices submitted for insurance reimbursement.

Payment terms shall be net thirty (30) days from C&H's receipt of each invoice. C&H shall review all invoices promptly and shall notify Graystone of any questions or discrepancies within fifteen (15) business days of receipt.

9. Confidentiality

Graystone shall maintain the strict confidentiality of all information received, developed, or generated in connection with this engagement. This obligation of confidentiality applies to all information concerning the Incident, Quorum Insurance Holdings Corp., Palomar Data Solutions, Inc., the investigation, the findings and conclusions of the investigation, and any other matter related to this engagement, regardless of the form in which such information is received or maintained.

Graystone shall not disclose any information concerning the Incident, Quorum, Palomar, or the investigation to any third party — including media organizations, industry groups, government agencies, law enforcement, regulatory authorities, business partners, or any other person or entity — without C&H's prior written consent. This obligation applies to all Graystone personnel who have access to information related to this engagement.

Graystone shall implement appropriate administrative, technical, and physical safeguards to protect all data and information received or generated in connection with this engagement from unauthorized access, use, disclosure, alteration, or destruction. Such safeguards shall be no less protective than those Graystone maintains for its own confidential and proprietary information and shall be consistent with industry best practices for the protection of sensitive forensic data and evidence.

Upon completion of the engagement, or upon earlier termination, Graystone shall retain all materials related to the engagement in accordance with C&H's written instructions. Upon C&H's request, Graystone shall return all such materials to C&H or, at C&H's direction, securely destroy such materials using methods appropriate for the type and sensitivity of the data involved, and shall certify such destruction in writing.

10. Document and Evidence Preservation

Graystone shall preserve all evidence, data, notes, analyses, logs, forensic images, memory captures, network packet captures, correspondence, and other materials collected or generated during the investigation in accordance with forensic best practices, including but not limited to the standards and guidelines published by the National Institute of Standards and Technology (NIST) and the Scientific Working Group on Digital Evidence (SWGDE), and in accordance with all applicable legal hold obligations.

Graystone shall maintain a comprehensive chain-of-custody log for all digital evidence collected, acquired, or created during the investigation. The chain-of-custody log shall document, at a minimum, the identity of each item of evidence, the date and time of collection or acquisition, the identity of the person who collected or acquired the item, the method of collection and preservation, hash values (MD5 and SHA-256) for all forensic images and evidentiary files, and a complete record of all subsequent transfers, accesses, and handling of each item.

No materials collected, created, or generated in connection with this engagement shall be destroyed, deleted, discarded, overwritten, or otherwise disposed of without C&H's prior written authorization. This prohibition applies to all categories of materials, including original evidence, forensic copies, working copies, draft analyses, notes, internal communications, and any other materials related to the engagement.

11. No Testimony or Public Statements

Graystone shall not provide testimony — whether by deposition, declaration, affidavit, hearing, trial, regulatory proceeding, or otherwise — regarding this engagement or any findings, analyses, or conclusions developed in connection with this engagement, without the prior written consent of Calderwood & Harkness LLP. In the event that C&H authorizes any such testimony, C&H and Graystone shall confer regarding the scope, preparation, and logistics of such testimony in advance.

Graystone shall not make any public statements, press releases, media communications, blog posts, social media posts, conference presentations, white papers, case studies, or other public or semi-public communications regarding this engagement, the Incident, Quorum, Palomar, or any findings or work product developed in connection with this engagement, without the prior written consent of C&H. This prohibition applies indefinitely and survives the termination of the engagement.

If Graystone or any of its personnel are contacted by media, regulators, law enforcement, government agencies, or any other third party regarding this matter, Graystone shall decline to comment and shall immediately refer such contact to Kevin Ostrowski at Calderwood & Harkness LLP at the contact information provided in Section 6.1 above. Graystone shall notify C&H of any such contact within twenty-four (24) hours.

12. Term and Termination

This engagement shall commence on the Effective Date and shall continue until terminated by C&H in writing. The engagement is project-based in nature and is expected to conclude upon the delivery of the Final Forensic Investigation Report and the completion of any additional tasks requested by C&H.

Either party may terminate this engagement upon thirty (30) days' prior written notice to the other party. In the event of termination by either party, Graystone shall complete any work in progress to a reasonable stopping point, as determined in consultation with C&H, and shall deliver all work product, materials, evidence, data, and other items in Graystone's possession or control related to the engagement to C&H promptly upon termination. C&H shall compensate Graystone for all services performed and expenses incurred through the effective date of termination, in accordance with the fee schedule and the terms of this letter.

Graystone's obligations regarding the attorney-client privilege, confidentiality, document and evidence preservation, non-disclosure, and restrictions on testimony and public statements, as set forth in Sections 5, 9, 10, and 11 of this letter, shall survive the termination or expiration of the engagement and shall remain in full force and effect indefinitely.

13. Limitation of Liability and Indemnification

Each party's aggregate liability to the other party for any claims, damages, losses, costs, or expenses arising out of or relating to this engagement shall not exceed the total fees paid by C&H to Graystone under this engagement, except that this limitation shall not apply to claims arising from a party's willful misconduct, gross negligence, or breach of its confidentiality or privilege obligations under this letter.

Each party (the "Indemnifying Party") shall indemnify, defend, and hold harmless the other party and its partners, members, officers, directors, employees, and agents (the "Indemnified Party") from and against any and all third-party claims, demands, actions, damages, losses, liabilities, costs, and expenses (including reasonable attorneys' fees) arising out of or resulting from the Indemnifying Party's breach of this letter, negligent acts or omissions, or willful misconduct in connection with this engagement.

The limitations and indemnification obligations set forth in this Section 13 are subject to and shall be interpreted consistently with the privilege and confidentiality protections established elsewhere in this letter.

14. Governing Law

This retention letter and all matters arising out of or relating to this engagement, including any disputes between C&H and Graystone regarding the terms, performance, or termination of the engagement, shall be governed by and construed in accordance with the laws of the Commonwealth of Virginia, without regard to its conflict-of-laws principles.

15. Acceptance

We ask that Dr. Briggs countersign this letter in the space provided below and return one fully executed copy to Kevin Ostrowski at Calderwood & Harkness LLP to confirm Graystone's acceptance of the engagement and the terms and conditions set forth herein. This letter, together with any attachments and exhibits referenced herein, constitutes the entire agreement between Calderwood & Harkness LLP and Graystone Forensics LLC with respect to the subject matter hereof and supersedes all prior or contemporaneous oral or written communications, proposals, or agreements relating to this engagement.

We look forward to working with you and the Graystone team on this important matter. Please do not hesitate to contact me or Alan Burke with any questions.

Very truly yours,

CALDERWOOD & HARKNESS LLP

By: ________

Name: Kevin Ostrowski

Title: Partner, Privacy & Data Security

Date: May 5, 2023

ACKNOWLEDGED AND AGREED

The undersigned, on behalf of Graystone Forensics LLC, acknowledges receipt of this retention letter, confirms acceptance of the engagement described herein, and agrees to the terms and conditions set forth above.

GRAYSTONE FORENSICS LLC

By: ________

Name: Dr. Nolan Briggs

Title: Managing Director, Incident Response

Date: ________

Enclosure: Fee Schedule (Exhibit A) (attached hereto or as separately agreed)

cc: Alan Burke, Calderwood & Harkness LLP (internal copy only)

CONFIDENTIAL — ATTORNEY-CLIENT PRIVILEGED / ATTORNEY WORK PRODUCT This letter and all attachments contain information that is privileged, confidential, and/or protected as attorney work product. Any unauthorized review, use, disclosure, or distribution is prohibited. If you have received this communication in error, please notify the sender immediately and destroy all copies.

CONFIDENTIAL — ATTORNEY-CLIENT PRIVILEGED / ATTORNEY WORK PRODUCT
CALDERWOOD & HARKNESS LLP Attorneys at Law
1700 K Street NW, Suite 900 Washington, D.C. 20006 Telephone: (202) 555-7400 Facsimile: (202) 555-7401 www.calderwoodharkness.com
May 5, 2023
VIA EMAIL AND OVERNIGHT COURIER
Dr. Nolan Briggs Managing Director, Incident Response Graystone Forensics LLC 1950 Old Gallows Road, Suite 600 Tysons Corner, VA 22182
Re: Retention of Graystone Forensics LLC — Privileged Forensic Investigation Calderwood & Harkness LLP Matter No. 1025-00006 Confidential — Attorney-Client Privileged / Attorney Work Product
Dear Dr. Briggs:
1. Introduction and Purpose of Retention
Calderwood & Harkness LLP ("C&H" or "the Firm") writes on behalf of its client, Quorum Insurance Holdings Corp. ("Quorum" or "QIH"), a Delaware corporation publicly traded on the Nasdaq Stock Market (ticker: QIHC), with its principal offices located at 400 Constitution Plaza, Suite 2200, Hartford, Connecticut 06103. C&H has been retained by Quorum to provide legal counsel in connection with a data security incident involving Quorum's third-party claims-processing vendor, Palomar Data Solutions, Inc. ("Palomar"), a Texas corporation headquartered at 7100 Greenville Avenue, Suite 450, Dallas, Texas 75231. The nature, background, and known scope of that incident are described in further detail in Section 2 below.
The purpose of this letter is to formally retain Graystone Forensics LLC ("Graystone") to provide forensic investigation, incident response, and digital forensic services at the direction and under the supervision of Calderwood & Harkness LLP in connection with the Palomar security incident (the "Incident"). Graystone is being retained by counsel — not directly by Quorum — in order to ensure that all work product, findings, reports, communications, and other materials generated by Graystone in the course of this engagement are protected under the attorney-client privilege and the work product doctrine. This structure is critical to preserve the confidentiality and legal protections that attach to the forensic investigation and its results.
This engagement shall be effective as of May 5, 2023 (the "Effective Date"). By countersigning this letter in the space provided below, Graystone confirms its acceptance of the engagement and the terms and conditions set forth herein.
2. Background of the Incident
On or about March 14, 2023, a threat actor is believed to have gained unauthorized access to the network environment of Palomar Data Solutions, Inc. by exploiting a known remote code execution vulnerability, identified in the National Vulnerability Database as CVE-2023-0669, present in Palomar's GoAnywhere MFT managed file transfer appliance. CVE-2023-0669 is a pre-authentication command injection vulnerability that, when exploited, permits an unauthenticated remote attacker to execute arbitrary code on the affected system. It is understood that Palomar had not yet applied the vendor-issued security patch for this vulnerability at the time of the initial compromise.
The unauthorized access and potential data exfiltration are believed to have continued from approximately March 14, 2023 through April 18, 2023, a period of approximately thirty-five (35) days. During this period, the threat actor is believed to have moved laterally within Palomar's internal network infrastructure, accessed claims-processing databases and file repositories, and staged and exfiltrated data to external infrastructure under the threat actor's control.
On April 18, 2023, Palomar's Security Operations Center ("SOC") detected anomalous outbound data transfers from servers within the claims-processing environment to an external IP address not previously associated with authorized business traffic. This detection prompted Palomar to initiate an internal investigation, during which Palomar's IT security team confirmed indicators of compromise consistent with the exploitation of CVE-2023-0669 and identified evidence of unauthorized access to claims data repositories.
On April 21, 2023, Derek Copeland, General Counsel of Palomar Data Solutions, Inc., notified Thomas R. Whitfield, General Counsel of Quorum Insurance Holdings Corp., and David Naranjo, Chief Information Security Officer of Quorum, of the security incident via email. That notification indicated that the compromised environment may contain data belonging to Quorum and its policyholders, but did not provide a definitive scope of exposure.
Palomar processes claims data for Quorum's personal lines insurance division under a Master Services Agreement originally dated November 12, 2019, as subsequently amended (the "MSA"). Pursuant to the MSA and its associated Data Processing Addendum, Palomar receives, processes, and stores on Quorum's behalf certain categories of sensitive personal information, including, without limitation, personally identifiable information ("PII"), protected health information ("PHI") as defined under the Health Insurance Portability and Accountability Act of 1996 ("HIPAA") and its implementing regulations, and financial data pertaining to Quorum's policyholders and claimants. As a result, the compromised environment may contain records relating to a substantial number of individuals across multiple jurisdictions, and the Incident implicates a complex web of state, federal, and potentially international notification and regulatory obligations.
Calderwood & Harkness LLP was engaged by Quorum on May 4, 2023, pursuant to a separate engagement letter, and is responsible for coordinating the comprehensive legal response to the Incident. That response encompasses, among other matters, forensic investigation oversight, state and federal breach notification compliance (including individual, regulator, and media notifications), regulatory inquiry and defense, HIPAA analysis and reporting, vendor accountability analysis, and assessment of Quorum's contractual rights and remedies under the MSA with Palomar. Kevin Ostrowski, Partner in C&H's Privacy & Data Security Practice Group, serves as the responsible partner on the matter, and Alan Burke, Associate in the same practice group, serves as lead associate.
3. Scope of Engagement
Graystone is retained to perform the following categories of services at the direction, and under the supervision, of C&H counsel. The scope of the engagement may be modified, expanded, or narrowed by C&H in writing from time to time as the investigation progresses and as additional information becomes available. Graystone shall not undertake work outside the scope described herein, or as subsequently modified, without C&H's prior written authorization.
3.1 Technical Forensic Investigation
Graystone shall conduct a comprehensive technical forensic investigation of the Incident, including, without limitation, the following:
(a) Initial Entry Vector Analysis. Determine the threat actor's initial entry vector into Palomar's network environment and confirm the exploitation of CVE-2023-0669 in the GoAnywhere MFT managed file transfer appliance as the means of initial access. This analysis shall include examination of available system logs, network logs, application logs, and other forensic artifacts associated with the GoAnywhere MFT appliance and related network infrastructure.
(b) Timeline Development. Establish a detailed, chronological timeline of the unauthorized access from initial compromise (on or about March 14, 2023) through detection and containment (on or about April 18, 2023). This timeline shall identify, to the extent ascertainable from available forensic evidence, the dates and times of the following categories of activity: initial exploitation and access; persistence mechanisms installed or established by the threat actor; credential harvesting and privilege escalation; lateral movement within Palomar's network; reconnaissance and enumeration of data repositories; staging of data for exfiltration; exfiltration of data to external infrastructure; and any additional malicious activity identified during the investigation.
(c) Data Access and Exfiltration Analysis. Identify and catalog all data sets, structured data files, databases, file shares, and other repositories accessed, copied, staged, or exfiltrated by the threat actor from Palomar's claims-processing environment. This analysis shall include, to the extent feasible, a determination of the specific data fields and record types affected and the volume of data involved.
(d) Evidence Collection and Preservation. Collect and forensically preserve all relevant digital evidence, including disk images, memory captures, network traffic captures, log files, and other artifacts, in accordance with industry-standard forensic best practices and applicable legal requirements.
3.2 Data Exposure Assessment
Graystone shall perform a comprehensive data exposure assessment to support C&H's analysis of Quorum's notification obligations under applicable federal and state laws, including, without limitation, the following:
(a) Data Type Identification. Identify the types and categories of personal information compromised or potentially compromised in the Incident, including but not limited to: full names; dates of birth; Social Security numbers; driver's license numbers and state identification numbers; bank account and routing numbers; payment card numbers (including credit and debit card numbers, expiration dates, and security codes); health insurance policy numbers and group numbers; health conditions, medical diagnoses, diagnosis codes (ICD-10 and CPT), treatment information, and prescription data; and any other categories of sensitive personal information identified during the investigation.
(b) Affected Individual Identification and Enumeration. Determine the number and identity (to the extent ascertainable from available data and forensic evidence) of individuals whose personal information was accessed, acquired, or exfiltrated by the threat actor. This determination shall include, to the extent feasible, a breakdown of affected individuals by state of residence, as this information is essential to C&H's analysis of state-specific notification trigger thresholds, timelines, and content requirements.
(c) Data Categorization. Categorize affected individuals by data type subsets to enable C&H to assess the applicable notification obligations and consumer protection requirements for each affected population. At a minimum, the following categories shall be identified: (i) individuals whose PII only (e.g., name plus Social Security number, name plus driver's license number) was compromised; (ii) individuals whose PII plus financial information (e.g., bank account numbers, payment card numbers) was compromised; and (iii) individuals whose PII plus protected health information (e.g., diagnosis codes, treatment records, health insurance information) was compromised. Additional sub-categorizations may be requested by C&H as the investigation progresses.
3.3 Threat Actor Assessment
Graystone shall assess the threat actor responsible for the Incident, including, without limitation, the following:
(a) Tactics, Techniques, and Procedures (TTPs). Analyze the threat actor's tactics, techniques, and procedures as observed in the forensic evidence, mapped to the MITRE ATT&CK framework where applicable, in order to support attribution analysis and inform C&H's assessment of litigation risk and regulatory exposure.
(b) Post-Exfiltration Activity. Assess whether exfiltrated data has been published on the dark web or clear web, offered for sale on underground marketplaces, used in extortion communications directed at Palomar or Quorum, or otherwise disseminated or exploited. This assessment shall include monitoring of known threat actor infrastructure, dark web forums, and paste sites for indicators of data exposure, to the extent such monitoring falls within Graystone's existing capabilities and toolsets.
(c) Threat intelligence Context. Provide threat intelligence context regarding the broader exploitation of CVE-2023-0669 by threat actors, including any known threat actor groups associated with the exploitation of this vulnerability, the scope and scale of related campaigns, and any publicly available information regarding the objectives and capabilities of the responsible threat actor or group.
3.4 Remediation Guidance
Graystone shall provide technical remediation guidance, including, without limitation, the following:
(a) Containment and Remediation Recommendations. Provide technical recommendations to Quorum and, as appropriate and as directed by C&H, to Palomar regarding containment, eradication, and remediation measures necessary to address the vulnerabilities exploited in the Incident and to prevent recurrence. Such recommendations may address patching and configuration hardening, network segmentation, access control improvements, logging and monitoring enhancements, and other technical security measures.
(b) Backdoor and Persistent Access Assessment. Assess whether the threat actor introduced additional vulnerabilities, backdoors, web shells, implants, or other persistent access mechanisms during the period of unauthorized access that may remain active or exploitable in Palomar's network environment.
4. Reporting and Deliverables
All reports, findings, analyses, communications, and work product prepared by Graystone in connection with this engagement shall be directed exclusively to Calderwood & Harkness LLP — specifically to Kevin Ostrowski, Partner, and Alan Burke, Associate — and shall not be transmitted directly to Quorum Insurance Holdings Corp., Palomar Data Solutions, Inc., or any other person or entity without the prior written authorization of C&H. This requirement applies to all forms of communication, including written reports, email correspondence, oral communications, presentations, and data transmittals.
Graystone shall provide the following deliverables in the course of this engagement:
(a) Preliminary Forensic Findings Memorandum. A written memorandum summarizing Graystone's initial findings regarding the attack vector, the timeline of unauthorized access, and the preliminary scope of data exposure. The target delivery date for this memorandum is on or before June 9, 2023. This preliminary memorandum is intended to enable C&H to begin its assessment of Quorum's notification obligations and to provide an initial briefing to Quorum's General Counsel and executive leadership.
(b) Final Forensic Investigation Report. A comprehensive written report providing Graystone's final findings on all matters within the scope of this engagement, including the complete and verified scope of compromised data, a detailed and validated timeline of the unauthorized access, the threat actor assessment, and remediation recommendations. The target delivery date for the final report is on or before July 14, 2023. C&H and Graystone acknowledge that these target dates are subject to adjustment depending on the availability and quality of forensic evidence, cooperation from Palomar, and other factors that may affect the pace of the investigation.
(c) Interim Oral Briefings. As requested by C&H counsel, Graystone shall provide oral briefings to Kevin Ostrowski, Alan Burke, and other C&H personnel as designated, to provide status updates on investigation progress, emerging findings, and any issues requiring counsel's attention or direction. Such briefings may be conducted by telephone, videoconference, or in person, as directed by C&H.
All written deliverables prepared by Graystone in connection with this engagement — including the Preliminary Forensic Findings Memorandum, the Final Forensic Investigation Report, and any interim written communications, draft analyses, data summaries, or other documents — shall bear the following legend prominently on each page:
"PRIVILEGED AND CONFIDENTIAL — PREPARED AT THE DIRECTION OF COUNSEL — ATTORNEY-CLIENT PRIVILEGE / ATTORNEY WORK PRODUCT"
Graystone shall not issue any report, summary, memorandum, communication, or other document to any person or entity other than C&H without C&H's express prior written consent. This prohibition includes, without limitation, communications to Quorum, Quorum's board of directors, Quorum's insurers, regulatory authorities, law enforcement, and any third parties.
5. Attorney-Client Privilege and Work Product Protection
The parties acknowledge that the protection of the attorney-client privilege and the work product doctrine is of paramount importance to this engagement. The following provisions are intended to establish and preserve those protections throughout the engagement and thereafter.
Graystone is retained as a consulting expert at the direction of counsel, Calderwood & Harkness LLP, to assist counsel in providing legal advice to Quorum Insurance Holdings Corp. in connection with the Incident. Graystone's work is being directed by C&H for the purpose of enabling C&H to render legal advice to Quorum regarding its obligations and rights arising from the Incident, including but not limited to breach notification obligations under applicable federal and state laws, regulatory compliance, HIPAA reporting obligations, potential litigation exposure, and contractual rights and remedies against Palomar. The retention is deliberately structured so that all communications between Graystone and C&H, and all work product generated by Graystone in the course of this engagement, are protected by the attorney-client privilege and the work product doctrine.
Graystone acknowledges and agrees to the following:
(a) Agency Relationship. Graystone is acting as an agent of Calderwood & Harkness LLP for purposes of the attorney-client privilege. In this capacity, Graystone's role is to assist C&H in understanding the technical facts relevant to the Incident so that C&H may provide informed legal advice to Quorum.
(b) Privileged Communications. All communications between Graystone and C&H regarding this engagement, including oral communications, written correspondence, email communications, reports, memoranda, data transmittals, and any other forms of communication, are privileged and confidential.
(c) Work Product. All reports, memoranda, analyses, notes, drafts, data compilations, spreadsheets, charts, forensic images, and other materials produced by Graystone in connection with this engagement constitute attorney work product prepared in anticipation of litigation and/or for the purpose of rendering legal advice to Quorum. These materials would not have been prepared in substantially similar form but for the prospect of litigation and the need for legal analysis of Quorum's obligations and exposure arising from the Incident.
(d) Non-Disclosure to Third Parties. Graystone shall not disclose any information, findings, analyses, conclusions, or work product to any third party — including, without limitation, Quorum's employees, officers, directors, board members, insurers, auditors, regulators, law enforcement agencies, or any other person or entity — without the prior written authorization of Calderwood & Harkness LLP. Any such disclosure, if authorized, shall be made only in the manner and to the extent specified by C&H.
(e) Compulsory Process. If Graystone or any of its personnel receives any subpoena, court order, regulatory demand, civil investigative demand, or other compulsory process seeking information, documents, testimony, or materials related to this engagement, Graystone shall immediately — and in no event later than twenty-four (24) hours after receipt — notify Kevin Ostrowski and Alan Burke at Calderwood & Harkness LLP before producing any materials, providing any testimony, or taking any other responsive action. Graystone shall cooperate fully with C&H in asserting all applicable privileges and protections in response to any such compulsory process.
All communications regarding this engagement shall be directed through C&H counsel and shall be clearly marked as privileged and confidential in accordance with the requirements of this letter. Graystone personnel shall take care to ensure that privileged communications and work product are not inadvertently disclosed to unauthorized persons, including through the use of appropriate email distribution lists, secure file-sharing platforms, and other information security controls.
6. Engagement Team
6.1 Calderwood & Harkness LLP Contacts
The following C&H attorneys shall serve as the primary points of contact for this engagement:
Kevin Ostrowski, Partner, Privacy & Data Security — Responsible Partner Calderwood & Harkness LLP 1700 K Street NW, Suite 900 Washington, D.C. 20006 Telephone: (202) 555-7418
Email: kostrowski@calderwoodharkness.com
Alan Burke, Associate, Privacy & Data Security — Lead Associate Calderwood & Harkness LLP 1700 K Street NW, Suite 900 Washington, D.C. 20006 Telephone: (202) 555-7432
Email: aburke@calderwoodharkness.com
Sara Hendricks, Associate, Privacy & Data Security — Working Associate Calderwood & Harkness LLP 1700 K Street NW, Suite 900 Washington, D.C. 20006 Telephone: (202) 555-7445
Email: shendricks@calderwoodharkness.com
Rachel Bernstein, Partner, Privacy & Data Security — Billing Partner Calderwood & Harkness LLP 51 West 52nd Street, 34th Floor New York, NY 10019 Telephone: (212) 555-3200
Email: rbernstein@calderwoodharkness.com
All substantive communications from Graystone regarding the investigation and its findings shall be directed to Kevin Ostrowski and Alan Burke. Billing inquiries may be directed to Rachel Bernstein or Alan Burke.
6.2 Graystone Forensics LLC Engagement Team
The following Graystone personnel shall serve as the primary engagement team for this matter:
Dr. Nolan Briggs, Managing Director, Incident Response — Engagement Lead Graystone Forensics LLC 1950 Old Gallows Road, Suite 600 Tysons Corner, VA 22182
Kendra Faulkner, Senior Forensic Analyst — Analyst Lead Graystone Forensics LLC 1950 Old Gallows Road, Suite 600 Tysons Corner, VA 22182
Graystone shall notify C&H in writing in advance of any changes to the engagement team, including the departure of any team member, the substitution of any team member, or the addition of any personnel who will have access to privileged information, work product, or confidential data in connection with this engagement. C&H reserves the right to approve or reject proposed changes to the Graystone engagement team. All Graystone personnel assigned to this engagement shall be made aware of and shall comply with the confidentiality, privilege, and non-disclosure obligations set forth in this letter.
7. Coordination with Quorum Personnel
All coordination between Graystone and Quorum Insurance Holdings Corp. personnel shall be conducted through, or at the express direction of, Calderwood & Harkness LLP counsel. Graystone shall not initiate contact with any Quorum employee, officer, director, or other representative without first obtaining authorization from C&H.
C&H may, from time to time, authorize direct technical communications between Graystone analysts and specific Quorum personnel, including David Naranjo, Chief Information Security Officer of Quorum, and members of the Quorum IT security team, for purposes of evidence collection, system access, technical coordination, and other investigative activities that require direct interaction between forensic analysts and Quorum's technical staff. Any such authorization shall be provided by C&H in writing (including by email) and shall specify the scope and duration of the authorized direct communication. Such authorization does not alter the privileged nature of the engagement, and all substantive findings, analyses, and conclusions arising from such direct communications shall be reported to C&H, not to Quorum, in the first instance.
Graystone shall not communicate directly with Palomar Data Solutions, Inc., or with Palomar's outside counsel, Mercer, Haight & Dunlop LLP, without the express prior written authorization of C&H. Any interactions between Graystone and Palomar or its counsel — including requests for forensic evidence, system access, log files, or technical information — shall be coordinated through C&H.
8. Fees and Billing
Graystone shall invoice Calderwood & Harkness LLP — not Quorum Insurance Holdings Corp. directly — for all professional fees, costs, and expenses incurred in connection with this engagement, in accordance with the fee schedule attached hereto as Exhibit A or as separately agreed in writing between C&H and Graystone. In the event of any conflict between the terms of this letter and the terms of any separately negotiated fee schedule, the terms of this letter shall control with respect to privilege, confidentiality, and reporting obligations.
Invoices shall be submitted on a monthly basis and shall be sufficiently detailed to permit review and approval by C&H and, as necessary and as authorized by C&H, submission to Quorum's cyber-liability insurer, Atlas Mutual Insurance Company, under Policy No. CYB-2023-041587 (Claim No. CYB-CLM-2023-05892), for reimbursement of covered forensic investigation costs. Invoices shall include, at a minimum, a description of the services performed during the billing period, the identity of the Graystone personnel who performed the services, the hours expended by each such person, and the applicable hourly rates or fixed fees, together with an itemization of any costs or expenses incurred.
Graystone acknowledges that its fees and invoices may be submitted to Quorum's cyber-liability insurer, Atlas Mutual Insurance Company, for reimbursement under Quorum's policy, and agrees to cooperate with reasonable requests from C&H or the insurer for billing detail, clarification, or supporting documentation. Notwithstanding the foregoing, no privileged work product, substantive findings, forensic reports, or other confidential information relating to the investigation shall be disclosed to the insurer or any other party without C&H's prior written consent. C&H will coordinate any disclosures to the insurer and will provide Graystone with instructions regarding the level of detail to be included in invoices submitted for insurance reimbursement.
Payment terms shall be net thirty (30) days from C&H's receipt of each invoice. C&H shall review all invoices promptly and shall notify Graystone of any questions or discrepancies within fifteen (15) business days of receipt.
9. Confidentiality
Graystone shall maintain the strict confidentiality of all information received, developed, or generated in connection with this engagement. This obligation of confidentiality applies to all information concerning the Incident, Quorum Insurance Holdings Corp., Palomar Data Solutions, Inc., the investigation, the findings and conclusions of the investigation, and any other matter related to this engagement, regardless of the form in which such information is received or maintained.
Graystone shall not disclose any information concerning the Incident, Quorum, Palomar, or the investigation to any third party — including media organizations, industry groups, government agencies, law enforcement, regulatory authorities, business partners, or any other person or entity — without C&H's prior written consent. This obligation applies to all Graystone personnel who have access to information related to this engagement.
Graystone shall implement appropriate administrative, technical, and physical safeguards to protect all data and information received or generated in connection with this engagement from unauthorized access, use, disclosure, alteration, or destruction. Such safeguards shall be no less protective than those Graystone maintains for its own confidential and proprietary information and shall be consistent with industry best practices for the protection of sensitive forensic data and evidence.
Upon completion of the engagement, or upon earlier termination, Graystone shall retain all materials related to the engagement in accordance with C&H's written instructions. Upon C&H's request, Graystone shall return all such materials to C&H or, at C&H's direction, securely destroy such materials using methods appropriate for the type and sensitivity of the data involved, and shall certify such destruction in writing.
10. Document and Evidence Preservation
Graystone shall preserve all evidence, data, notes, analyses, logs, forensic images, memory captures, network packet captures, correspondence, and other materials collected or generated during the investigation in accordance with forensic best practices, including but not limited to the standards and guidelines published by the National Institute of Standards and Technology (NIST) and the Scientific Working Group on Digital Evidence (SWGDE), and in accordance with all applicable legal hold obligations.
Graystone shall maintain a comprehensive chain-of-custody log for all digital evidence collected, acquired, or created during the investigation. The chain-of-custody log shall document, at a minimum, the identity of each item of evidence, the date and time of collection or acquisition, the identity of the person who collected or acquired the item, the method of collection and preservation, hash values (MD5 and SHA-256) for all forensic images and evidentiary files, and a complete record of all subsequent transfers, accesses, and handling of each item.
No materials collected, created, or generated in connection with this engagement shall be destroyed, deleted, discarded, overwritten, or otherwise disposed of without C&H's prior written authorization. This prohibition applies to all categories of materials, including original evidence, forensic copies, working copies, draft analyses, notes, internal communications, and any other materials related to the engagement.
11. No Testimony or Public Statements
Graystone shall not provide testimony — whether by deposition, declaration, affidavit, hearing, trial, regulatory proceeding, or otherwise — regarding this engagement or any findings, analyses, or conclusions developed in connection with this engagement, without the prior written consent of Calderwood & Harkness LLP. In the event that C&H authorizes any such testimony, C&H and Graystone shall confer regarding the scope, preparation, and logistics of such testimony in advance.
Graystone shall not make any public statements, press releases, media communications, blog posts, social media posts, conference presentations, white papers, case studies, or other public or semi-public communications regarding this engagement, the Incident, Quorum, Palomar, or any findings or work product developed in connection with this engagement, without the prior written consent of C&H. This prohibition applies indefinitely and survives the termination of the engagement.
If Graystone or any of its personnel are contacted by media, regulators, law enforcement, government agencies, or any other third party regarding this matter, Graystone shall decline to comment and shall immediately refer such contact to Kevin Ostrowski at Calderwood & Harkness LLP at the contact information provided in Section 6.1 above. Graystone shall notify C&H of any such contact within twenty-four (24) hours.
12. Term and Termination
This engagement shall commence on the Effective Date and shall continue until terminated by C&H in writing. The engagement is project-based in nature and is expected to conclude upon the delivery of the Final Forensic Investigation Report and the completion of any additional tasks requested by C&H.
Either party may terminate this engagement upon thirty (30) days' prior written notice to the other party. In the event of termination by either party, Graystone shall complete any work in progress to a reasonable stopping point, as determined in consultation with C&H, and shall deliver all work product, materials, evidence, data, and other items in Graystone's possession or control related to the engagement to C&H promptly upon termination. C&H shall compensate Graystone for all services performed and expenses incurred through the effective date of termination, in accordance with the fee schedule and the terms of this letter.
Graystone's obligations regarding the attorney-client privilege, confidentiality, document and evidence preservation, non-disclosure, and restrictions on testimony and public statements, as set forth in Sections 5, 9, 10, and 11 of this letter, shall survive the termination or expiration of the engagement and shall remain in full force and effect indefinitely.
13. Limitation of Liability and Indemnification
Each party's aggregate liability to the other party for any claims, damages, losses, costs, or expenses arising out of or relating to this engagement shall not exceed the total fees paid by C&H to Graystone under this engagement, except that this limitation shall not apply to claims arising from a party's willful misconduct, gross negligence, or breach of its confidentiality or privilege obligations under this letter.
Each party (the "Indemnifying Party") shall indemnify, defend, and hold harmless the other party and its partners, members, officers, directors, employees, and agents (the "Indemnified Party") from and against any and all third-party claims, demands, actions, damages, losses, liabilities, costs, and expenses (including reasonable attorneys' fees) arising out of or resulting from the Indemnifying Party's breach of this letter, negligent acts or omissions, or willful misconduct in connection with this engagement.
The limitations and indemnification obligations set forth in this Section 13 are subject to and shall be interpreted consistently with the privilege and confidentiality protections established elsewhere in this letter.
14. Governing Law
This retention letter and all matters arising out of or relating to this engagement, including any disputes between C&H and Graystone regarding the terms, performance, or termination of the engagement, shall be governed by and construed in accordance with the laws of the Commonwealth of Virginia, without regard to its conflict-of-laws principles.
15. Acceptance
We ask that Dr. Briggs countersign this letter in the space provided below and return one fully executed copy to Kevin Ostrowski at Calderwood & Harkness LLP to confirm Graystone's acceptance of the engagement and the terms and conditions set forth herein. This letter, together with any attachments and exhibits referenced herein, constitutes the entire agreement between Calderwood & Harkness LLP and Graystone Forensics LLC with respect to the subject matter hereof and supersedes all prior or contemporaneous oral or written communications, proposals, or agreements relating to this engagement.
We look forward to working with you and the Graystone team on this important matter. Please do not hesitate to contact me or Alan Burke with any questions.
Very truly yours,
CALDERWOOD & HARKNESS LLP
By: ________
Name: Kevin Ostrowski
Title: Partner, Privacy & Data Security
Date: May 5, 2023
ACKNOWLEDGED AND AGREED
The undersigned, on behalf of Graystone Forensics LLC, acknowledges receipt of this retention letter, confirms acceptance of the engagement described herein, and agrees to the terms and conditions set forth above.
GRAYSTONE FORENSICS LLC
By: ________
Name: Dr. Nolan Briggs
Title: Managing Director, Incident Response
Date: ________
Enclosure: Fee Schedule (Exhibit A) (attached hereto or as separately agreed)
cc: Alan Burke, Calderwood & Harkness LLP (internal copy only)
CONFIDENTIAL — ATTORNEY-CLIENT PRIVILEGED / ATTORNEY WORK PRODUCT This letter and all attachments contain information that is privileged, confidential, and/or protected as attorney work product. Any unauthorized review, use, disclosure, or distribution is prohibited. If you have received this communication in error, please notify the sender immediately and destroy all copies.

CONFIDENTIAL — ATTORNEY-CLIENT PRIVILEGED / ATTORNEY WORK PRODUCT

VIA EMAIL AND OVERNIGHT COURIER

CALDERWOOD & HARKNESS LLP

ACKNOWLEDGED AND AGREED

GRAYSTONE FORENSICS LLC

Record

Parties

Dates

Amounts