1025-00006 · Graystone Forensics LLC · Incident Assessment & Forensic Investigation

graystone-preliminary-findings-memo.docx DOCUMENT Data Privacy

36 / 88 ← → ✕

PRIVILEGED AND CONFIDENTIAL ATTORNEY-CLIENT PRIVILEGE / ATTORNEY WORK PRODUCT PREPARED AT THE DIRECTION OF COUNSEL

Preliminary Forensic Findings Report

From: Dr. Nolan Briggs, Managing Director, Incident Response, Graystone Forensics LLC

To: Kevin Ostrowski, Partner, Calderwood & Harkness LLP Alan Burke, Associate, Calderwood & Harkness LLP

Date: June 2, 2023

Re: Preliminary Forensic Investigation Findings — Security Incident Involving Palomar Data Solutions, Inc. Network Environment and Quorum Insurance Holdings Corp. Policyholder/Claimant Data

Graystone Reference: Engagement initiated May 5, 2023 at the direction of Calderwood & Harkness LLP (Matter No. 1025-00006) on behalf of Quorum Insurance Holdings Corp.

Classification: Privileged and Confidential — Not for distribution outside of counsel without prior written authorization from Calderwood & Harkness LLP.

Graystone Forensics LLC 1950 Old Gallows Road, Suite 600 Tysons Corner, VA 22182 Tel: (703) 555-4200

Right-click to update Table of Contents

1. Executive Summary

Graystone Forensics LLC ("Graystone") was retained on May 5, 2023 by Calderwood & Harkness LLP ("Calderwood & Harkness" or "Counsel"), outside counsel to Quorum Insurance Holdings Corp. ("Quorum" or "QIH"), to conduct a privileged forensic investigation into a security incident originating from the network environment of Palomar Data Solutions, Inc. ("Palomar"), a third-party claims-processing vendor engaged by Quorum. This engagement was initiated at the express direction of Counsel for the purpose of providing litigation support, legal analysis assistance, and factual development under the protections of the attorney-client privilege and the work product doctrine.

This report presents Graystone's preliminary findings based on evidence acquired, preserved, and analyzed through June 2, 2023. A final comprehensive report incorporating complete data exposure analysis, affected individual identification, and state-by-state data breakdowns is anticipated for delivery by mid-July 2023, with a target delivery date of July 14, 2023.

The key preliminary conclusions of Graystone's investigation, as detailed in the sections that follow, are summarized below:

Initial Access. A threat actor exploited a known pre-authentication remote code execution vulnerability, designated CVE-2023-0669, in Palomar's GoAnywhere MFT (Managed File Transfer) file transfer appliance to gain initial unauthorized access to Palomar's network environment on or about March 14, 2023. The GoAnywhere MFT appliance was internet-facing and had not been patched against this vulnerability at the time of exploitation, despite the availability of a vendor-issued patch prior to that date.

Persistence and Lateral Movement. Following initial exploitation, the threat actor maintained persistent access to Palomar's network environment and conducted lateral movement from the demilitarized zone ("DMZ") segment into internal network segments housing the claims processing environment. This period of unauthorized access spanned approximately 35 days, from March 14, 2023 through April 18, 2023.

Data Staging and Exfiltration. During the period of unauthorized access, the threat actor identified, accessed, staged, and exfiltrated structured data files containing Quorum policyholder and claimant data from Palomar's claims processing environment. The threat actor employed encryption and compression techniques to evade detection during the exfiltration process, and conducted data transfers during off-peak hours to blend with normal network traffic.

Detection and Containment. Palomar's Security Operations Center ("SOC") detected anomalous outbound data transfer patterns on April 18, 2023, at which point containment measures were initiated and the exfiltration activity ceased. Palomar's internal investigation confirmed the involvement of Quorum data, and Palomar notified Quorum on April 21, 2023 — approximately three days after the initial internal detection.

Nature of Compromised Data. Preliminary analysis indicates that the exfiltrated data includes personally identifiable information ("PII"), including Social Security numbers and driver's license numbers; financial account information, including bank account numbers and payment card numbers; and protected health information ("PHI"), including health conditions, diagnosis codes, and treatment information, relating to Quorum policyholders and claimants across multiple U.S. states.

Estimated Scope. Full data mining and affected-individual identification remain ongoing. However, preliminary record count analysis of the exfiltrated structured data files suggests the total number of affected individuals is substantial, with current estimates indicating approximately 300,000 or more individuals may be affected. Precise individual identification, deduplication, and state-level breakdowns will be provided in the final report.

Graystone continues to advance the remaining investigative workstreams and will deliver a final comprehensive forensic report to Counsel by mid-July 2023.

2. Scope of Engagement and Methodology

2.1 Engagement Parameters

Graystone was retained under the attorney-client privilege umbrella by Calderwood & Harkness LLP on May 5, 2023, for the purpose of conducting a forensic investigation into the security incident affecting Palomar's network environment and the Quorum data processed therein. The engagement was initiated at the express direction of Counsel, and all investigation activities have been and continue to be conducted at the direction of Counsel. All findings, analysis, and work product generated in the course of this engagement have been reported exclusively to Calderwood & Harkness LLP, and this report is prepared solely for the use of Counsel in rendering legal advice to Quorum.

The scope of work was finalized between Graystone and Counsel on May 7, 2023, and defines three core investigative objectives:

1. Entry Vector and Timeline Determination. Determine the threat actor's initial entry vector into Palomar's network environment and reconstruct the complete timeline of unauthorized access, including initial compromise, persistence, lateral movement, and data exfiltration.

2. Data Set Identification. Identify the specific data sets accessed and/or exfiltrated by the threat actor from Palomar's network environment, with particular emphasis on data sets containing Quorum policyholder and claimant information.

3. Data Type Assessment. Assess the types and categories of data compromised, including the presence or absence of PII, financial account information, PHI, and other sensitive data elements, to support Counsel's analysis of notification obligations and regulatory exposure.

The Graystone analyst team assigned to this engagement is led by Dr. Nolan Briggs, Managing Director, Incident Response, and Kendra Faulkner, Senior Forensic Analyst. Additional Graystone staff members have contributed to specific workstreams, including malware analysis, network forensics, and data mining, under the supervision of Dr. Briggs and Ms. Faulkner.

2.2 Data Sources and Forensic Evidence Analyzed

In conducting this investigation, Graystone obtained, preserved, and analyzed the following categories of forensic evidence from Palomar's network environment. Access to Palomar's systems and data was facilitated through counsel-to-counsel coordination between Calderwood & Harkness LLP (counsel to Quorum) and Palomar's outside counsel. Graystone's acquisition and handling of all evidence has followed established chain-of-custody protocols and defensible forensic imaging practices.

The data sources and forensic evidence analyzed include the following:

• GoAnywhere MFT Appliance Forensic Images. Complete forensic images of Palomar's GoAnywhere MFT appliance, including server logs, application configuration files, user access records, and patch history documentation. These images were acquired on May 9, 2023.

• Network Security Device Logs. Palomar network firewall logs, intrusion detection system ("IDS") alerts, and Security Information and Event Management ("SIEM") data covering the period from February 1, 2023 through April 30, 2023. This date range was selected to provide sufficient pre-incident baseline data and to capture the full scope of post-compromise activity and containment.

• Active Directory and Authentication Records. Active Directory logs and authentication records from Palomar's domain controllers, including logon event records, account creation and modification logs, group membership changes, and Kerberos and NTLM authentication activity.

• Endpoint Forensic Images. Forensic images from compromised servers within Palomar's claims processing environment, including database servers, file servers, and staging servers identified during the investigation as having been accessed or used by the threat actor.

• SOC Incident Records. Palomar SOC incident tickets, alert records, and internal investigation notes from the April 18–21, 2023 period, documenting Palomar's initial detection, triage, and containment activities.

• File Transfer and Staging Server Logs. Application-level and operating system-level logs from file transfer and data staging servers within Palomar's environment that were involved in or proximate to the threat actor's data staging and exfiltration activities.

• Network Traffic Data. NetFlow data and proxy logs capturing outbound data transfers from Palomar's network, analyzed to identify exfiltration channels, destination IP addresses, data transfer volumes, and timing patterns.

• Vulnerability and Patch Management Records. Palomar's internal patch management records and vulnerability scanning reports, including scan results from the period preceding the compromise, to assess the patch status of the GoAnywhere MFT appliance and other relevant systems at the time of the incident.

2.3 Investigative Methodology

Graystone's investigation has been conducted in accordance with standard digital forensic methodology, encompassing four principal phases: evidence acquisition, evidence preservation, analysis, and reporting. All forensic images were acquired using write-blocking hardware and verified using cryptographic hash values (SHA-256) to ensure the integrity and admissibility of the evidence.

The analytical methodology employed by Graystone in this investigation includes the following components:

• Timeline Reconstruction. Graystone constructed a comprehensive timeline of the threat actor's activity by correlating log data, file system artifacts, and authentication records across multiple data sources. This cross-source correlation approach enables identification of the sequence and timing of the threat actor's actions with a high degree of confidence, even where individual log sources may contain gaps.

• Malware Analysis and IOC Identification. Graystone conducted static and dynamic analysis of malware samples, web shells, and backdoor tools recovered from compromised systems. This analysis yielded indicators of compromise ("IOCs"), including file hashes, command-and-control IP addresses, and behavioral signatures, which were used to identify additional affected systems and to confirm the scope of the threat actor's access.

• Data Flow Analysis. Graystone performed detailed analysis of data flows within Palomar's network and to external destinations to identify the specific data sets staged and exfiltrated by the threat actor. This analysis incorporated file system timestamps, network traffic records, and application logs to trace the path of data from its source repositories to the exfiltration endpoints.

It is important to note that the data mining process required to identify the specific individuals whose data was compromised is ongoing and has not yet been completed. Data mining involves the extraction, parsing, deduplication, and matching of records from the exfiltrated data sets to produce a deduplicated list of affected individuals with associated data elements. This process is being conducted by Graystone in coordination with Clearfield Notification Services LLC (engaged separately for notification logistics support). Preliminary analysis of the types and volume of data exfiltrated is presented in Section 7 of this report. Final affected individual identification, together with state-by-state breakdowns and data-element-level analysis, will be provided in the final forensic report anticipated by mid-July 2023.

3. Background — Palomar Data Solutions Environment

3.1 Palomar's Role as Quorum Vendor

Palomar Data Solutions, Inc. ("Palomar"), headquartered at 7100 Greenville Avenue, Suite 450, Dallas, TX 75231, is a data services company that provides claims data processing, document management, and analytics services to insurance carriers and other financial services organizations. Palomar has served as a third-party claims-processing vendor to Quorum under a Master Services Agreement ("MSA") originally executed on November 12, 2019, and subsequently amended. The MSA governs, among other things, Palomar's obligations with respect to data security, incident notification, and the handling of Quorum's confidential and protected data.

In its capacity as Quorum's claims-processing vendor, Palomar processes personal lines claims data on behalf of Quorum. This data includes policyholder and claimant records containing a range of sensitive data elements, including personally identifiable information, financial account data associated with premium payments and claims disbursements, and health-related claims information arising from workers' compensation and health insurance products underwritten or administered by Quorum.

Quorum data is processed within Palomar's claims processing environment, which is a designated and segmented portion of Palomar's broader IT infrastructure. While the claims processing environment is logically segmented from other portions of Palomar's network, it is network-connected to other segments, including the DMZ segment in which the GoAnywhere MFT appliance resided. As discussed in Section 5 below, this network connectivity facilitated the threat actor's lateral movement from the initial point of compromise to the claims processing environment.

3.2 Palomar's GoAnywhere MFT Appliance

Palomar utilizes a GoAnywhere MFT (Managed File Transfer) appliance as a centralized platform for receiving and transmitting large data files with its insurance carrier clients, including Quorum. GoAnywhere MFT is a widely used enterprise file transfer solution that supports secure file transfer protocols and provides centralized management of file transfer workflows.

Palomar's GoAnywhere MFT appliance was internet-facing and served as a primary ingress and egress point for data transfers between Palomar and its clients. The appliance was deployed within the DMZ segment of Palomar's network, a configuration that is common for internet-facing services but which requires diligent patching and monitoring to mitigate the risk of exploitation.

Graystone's review of the appliance's patch history and configuration records revealed that, at the time of the initial compromise on or about March 14, 2023, the GoAnywhere MFT appliance was running a software version that was vulnerable to CVE-2023-0669, a critical pre-authentication remote code execution vulnerability. The vendor (Severin Corporation, formerly Strathmore Industries) had released a patch addressing CVE-2023-0669 prior to the date of exploitation. Palomar's internal records confirm that this patch had not been applied to the production GoAnywhere MFT appliance as of March 14, 2023. The circumstances surrounding the delay in patch application are discussed further in Section 4.2 below.

4. Findings — Initial Access Vector

4.1 CVE-2023-0669 Exploitation

Based on Graystone's forensic analysis, the threat actor gained initial unauthorized access to Palomar's network environment by exploiting CVE-2023-0669, a pre-authentication remote code execution ("RCE") vulnerability affecting the GoAnywhere MFT file transfer platform. CVE-2023-0669 is a critical-severity vulnerability that allows an unauthenticated remote attacker to execute arbitrary code on the underlying server hosting the GoAnywhere MFT application. The vulnerability was publicly disclosed and assigned a Common Vulnerabilities and Exposures identifier in early 2023, and exploitation of this vulnerability has been associated with multiple threat actor groups conducting data theft campaigns against organizations using unpatched GoAnywhere MFT installations.

Analysis of the GoAnywhere MFT appliance logs confirms that exploitation activity targeting CVE-2023-0669 occurred on or about March 14, 2023. The forensic evidence establishing this finding includes the following:

• Web Shell Deployment. A malicious web shell was identified on the GoAnywhere MFT server's file system. File system metadata, including NTFS timestamps, indicates that the web shell was created on March 14, 2023. The web shell provided the threat actor with a persistent, browser-accessible interface for executing commands on the compromised server.

• Anomalous Process Execution. Operating system event logs and process execution records from the GoAnywhere MFT server reflect anomalous process execution activity consistent with known CVE-2023-0669 exploit payloads. Specifically, the application process spawned child processes that are not associated with normal GoAnywhere MFT operations, and the command-line arguments associated with these processes are consistent with exploitation techniques documented in public threat intelligence reporting for CVE-2023-0669.

• Application Log Anomalies. The GoAnywhere MFT application logs contain entries corresponding to the exploitation event, including error messages and exception traces consistent with the exploitation of the underlying deserialization vulnerability.

The exploit allowed the threat actor to execute arbitrary commands on the underlying operating system of the GoAnywhere MFT server without possessing valid credentials for the application or the host system. This level of access provided the threat actor with a foothold from which to conduct subsequent post-exploitation activity, including credential harvesting and lateral movement, as described in Section 5 below.

4.2 Patch Status Assessment

Graystone's review of Palomar's patch management records and vulnerability scanning reports confirms that the GoAnywhere MFT appliance was not patched against CVE-2023-0669 at the time of the March 14, 2023 exploitation. The following factual observations are relevant to this assessment:

• The vendor-issued patch for CVE-2023-0669 was released and made publicly available prior to the March 14, 2023 exploitation date. The patch addressed the specific deserialization vulnerability exploited by the threat actor.

• Palomar's internal vulnerability scanning reports from February 2023 identified the GoAnywhere MFT appliance as running a software version with known critical vulnerabilities. The scan results flagged the appliance for remediation action, consistent with the identification of CVE-2023-0669 or related vulnerabilities in the installed version.

• Despite the availability of the vendor patch and the internal identification of the vulnerability through scanning, Palomar's records do not reflect that the patch was applied to the production GoAnywhere MFT appliance prior to March 14, 2023. Graystone did not identify documentation within the available records explaining the reason for the delay in patch application.

• Following the detection of the incident on April 18, 2023, Palomar applied the vendor patch and took additional containment steps, as described in Section 6.3 below.

Graystone notes these factual findings regarding the patch status of the GoAnywhere MFT appliance for Counsel's consideration. The assessment of whether the patching delay violated contractual obligations under the Palomar-Quorum MSA, including any applicable security requirements, service level commitments, or duty-to-patch provisions, is outside the scope of this forensic investigation and is deferred to Calderwood & Harkness LLP for legal analysis.

5. Findings — Lateral Movement and Persistence

5.1 Post-Exploitation Activity

Following the initial exploitation of CVE-2023-0669 and the deployment of the web shell on the GoAnywhere MFT appliance, the threat actor engaged in a series of post-exploitation activities designed to establish persistent access to Palomar's network environment and to expand the scope of access beyond the initial point of compromise. These activities are consistent with the tradecraft of financially motivated threat actors engaged in data theft operations and reflect a methodical approach to network enumeration, credential acquisition, and lateral movement.

The key post-exploitation activities identified through Graystone's forensic analysis include:

Persistent Access Establishment. The threat actor established multiple persistence mechanisms within Palomar's environment. In addition to the web shell deployed on the GoAnywhere MFT server on March 14, 2023, Graystone identified additional backdoor tools installed on intermediate systems during the lateral movement phase. These persistence mechanisms provided the threat actor with redundant pathways for re-accessing the environment, reducing the risk that the loss of any single access point would terminate the intrusion.

Credential Harvesting. Active Directory log analysis reveals that the threat actor harvested credentials from the GoAnywhere MFT server. The compromised credentials included service account credentials with elevated privileges that were stored or cached on the GoAnywhere MFT appliance. These credentials were subsequently used by the threat actor to authenticate to other systems within Palomar's network, enabling lateral movement beyond the DMZ segment.

Lateral Movement. Using the harvested credentials, the threat actor moved laterally from the DMZ segment, where the GoAnywhere MFT appliance resided, into Palomar's internal network segments. Of particular significance, the threat actor successfully accessed systems within the claims processing environment, the segmented portion of Palomar's infrastructure that housed Quorum policyholder and claimant data. The lateral movement path traversed network boundaries that, while logically segmented, permitted authenticated connections using the compromised service account credentials.

5.2 Timeline of Lateral Movement

Based on the correlation of log data, file system artifacts, authentication records, and network traffic data across multiple sources, Graystone has reconstructed the following timeline of the threat actor's activity within Palomar's network environment:

March 14, 2023 — Initial Compromise. The threat actor exploited CVE-2023-0669 on the GoAnywhere MFT appliance, achieving remote code execution. A web shell was deployed on the server, providing persistent remote access. Credential harvesting activity began on the compromised server, targeting cached and stored credentials, including service account credentials.

March 15–19, 2023 — Lateral Movement and Network Enumeration. The threat actor used the harvested credentials to initiate lateral movement from the DMZ segment into Palomar's internal network segments. During this phase, the threat actor conducted network enumeration activities, including the discovery and mapping of file shares, database servers, and other resources within the claims processing environment. Active Directory queries and network scanning activity attributable to the threat actor are reflected in the log data during this period.

March 20–28, 2023 — Data Access and Staging. The threat actor accessed claims processing database servers and file repositories containing Quorum policyholder and claimant data. During this phase, the threat actor identified target data sets and began staging data for exfiltration. Staging activity involved copying, aggregating, compressing, and encrypting data files on intermediate servers within Palomar's network. File system artifacts and database query logs confirm access to structured data files and database exports containing Quorum-specific records.

March 29 – April 18, 2023 — Continued Staging and Exfiltration. The threat actor continued data staging and exfiltration activities over a period of approximately three weeks. Exfiltrated data was transferred outbound via encrypted channels to external infrastructure controlled by the threat actor. Throughout this period, the threat actor maintained intermittent access to Palomar's environment through the previously deployed web shell and additional persistence mechanisms. The exfiltration activity ceased on or about April 18, 2023, coinciding with Palomar SOC's detection of anomalous outbound data transfers and the initiation of containment measures.

5.3 Threat Actor Tradecraft

The threat actor employed several techniques that are characteristic of sophisticated, financially motivated threat groups and that are designed to evade detection by network security monitoring tools and security operations personnel. The tradecraft observations relevant to this investigation include the following:

Living-off-the-Land Techniques. The threat actor made extensive use of legitimate system administration tools and utilities already present within Palomar's environment to conduct post-exploitation activities, including network enumeration, credential harvesting, and lateral movement. This technique, commonly referred to as "living off the land," reduces the threat actor's reliance on custom malware and makes malicious activity more difficult to distinguish from legitimate administrative operations in log data and behavioral monitoring systems.

Pre-Exfiltration Data Processing. Prior to exfiltration, the threat actor compressed and encrypted the staged data files. This processing step served a dual purpose: it reduced the volume of data to be transferred, thereby decreasing the time and bandwidth required for exfiltration, and it rendered the outbound data transfers opaque to data loss prevention ("DLP") tools and intrusion detection systems ("IDS") that rely on content inspection to identify sensitive data leaving the network.

Off-Peak Timing. The exfiltration sessions were conducted predominantly during off-peak hours, including evenings, overnight periods, and weekends. This timing pattern was designed to blend the exfiltration traffic with lower-volume network activity periods, reducing the likelihood of detection through volumetric anomaly alerts.

Anonymization Infrastructure. The external IP addresses used by the threat actor for command-and-control communications and data exfiltration have been traced to commercial VPN services and proxy infrastructure. This use of anonymization services obscures the threat actor's true geographic location and identity. Attribution analysis is ongoing but is outside the core scope of this engagement, and Graystone has not reached a conclusion regarding the identity of the threat actor as of this report date.

6. Findings — Data Staging and Exfiltration

6.1 Data Staging Activity

The threat actor identified and accessed structured data files and database exports within Palomar's claims processing environment that contained Quorum-specific policyholder and claimant data. The claims processing environment contained multiple data repositories, including relational databases and file share directories, organized by client and data type. The threat actor's activity within these repositories was targeted rather than indiscriminate; file access and database query logs indicate that the threat actor focused on data sets associated with Quorum's personal lines claims operations.

Staging activity was observed on intermediate servers within Palomar's internal network. These staging servers were not the primary data repositories; rather, they were systems to which the threat actor copied and aggregated target data in preparation for exfiltration. On these staging servers, the data was aggregated from multiple source locations, compressed using standard compression utilities, and encrypted prior to outbound transfer. Forensic analysis of the staging server file system artifacts — including temporary files, directory creation timestamps, and file modification records — confirms that staging activity occurred between approximately March 20 and April 18, 2023, consistent with the broader timeline of lateral movement and exfiltration activity.

The use of intermediate staging servers is a common technique employed by threat actors to consolidate data prior to exfiltration, enabling the transfer process to proceed more efficiently and reducing the number of direct connections between the source data repositories and external exfiltration endpoints.

6.2 Exfiltration Methodology

Following staging and pre-processing, the exfiltrated data was transferred outbound from Palomar's network via encrypted channels to external infrastructure controlled by the threat actor. The exfiltration channels utilized encrypted protocols that rendered the content of the outbound transfers opaque to inline content inspection tools deployed within Palomar's network.

NetFlow data and proxy log analysis confirms multiple outbound data transfer sessions during the period from March 22 through April 18, 2023. These sessions were directed to external IP addresses associated with the threat actor's infrastructure, consistent with the anonymization infrastructure described in Section 5.3 above. The transfer sessions exhibited characteristics consistent with bulk data exfiltration, including sustained high-volume outbound transfers during the off-peak periods previously noted.

The estimated total volume of data exfiltrated from Palomar's network is in the range of several hundred gigabytes. Precise volumetric analysis is ongoing, as the calculation requires reconciliation of NetFlow records, proxy log entries, and staging server artifacts. The final volumetric assessment will be included in the final forensic report. However, the preliminary volume estimate is consistent with the types and quantities of structured data files identified in the staging analysis and the preliminary record counts discussed in Section 7 below.

Exfiltration activity ceased on or about April 18, 2023. This cessation coincided with Palomar SOC's detection of anomalous outbound transfer patterns and the subsequent initiation of containment actions, as described in Section 6.3 below. Graystone has not identified evidence of additional exfiltration activity after April 18, 2023.

6.3 Palomar SOC Detection and Containment

On April 18, 2023, Palomar's Security Operations Center detected unusual outbound data transfer patterns through its network monitoring tools. According to Palomar's SOC incident tickets and internal investigation notes, the alert was triggered by volumetric anomaly detection rules that identified outbound data transfer volumes exceeding established baseline thresholds during off-peak hours. The SOC initiated triage and investigation procedures upon receipt of the alert.

Palomar's internal records indicate that the SOC initiated containment measures promptly upon confirming the anomalous activity, including the following actions:

• Isolation of the compromised GoAnywhere MFT appliance from the network to terminate the threat actor's primary access pathway.

• blocking of identified external threat actor IP addresses at the network perimeter firewall.

• Initiation of an internal investigation to determine the scope and nature of the incident.

• Engagement of Palomar's internal incident response team and escalation to Palomar's executive leadership and General Counsel.

Palomar's internal investigation between April 18 and April 21, 2023 confirmed that the incident affected data belonging to Quorum, among potentially other Palomar clients. The investigation identified the GoAnywhere MFT appliance as the initial point of compromise and determined that the threat actor had accessed internal systems within the claims processing environment.

On April 21, 2023, Palomar's General Counsel, Derek Copeland, notified Quorum's General Counsel, Thomas R. Whitfield, and Quorum's Chief Information Security Officer, David Naranjo, via email regarding the security incident. The notification communicated that Palomar had experienced a security incident affecting data belonging to Quorum and provided preliminary information regarding the nature of the incident. The timing of this notification relative to Palomar's contractual obligations is addressed in Section 8 below.

7. Preliminary Assessment of Compromised Data

7.1 Types of Data Confirmed Exfiltrated

Graystone's analysis of the exfiltrated data sets, based on file metadata, database schema analysis, and preliminary review of the structured data files identified in the staging and exfiltration analysis, confirms that the compromised data includes Quorum policyholder and claimant records containing the following categories of sensitive information:

Personally Identifiable Information (PII). The exfiltrated structured data files contain records that include full names, dates of birth, Social Security numbers, and driver's license numbers of Quorum policyholders and claimants. These data elements are present across the majority of the exfiltrated record sets and constitute the broadest category of compromised data.

Financial Information. A subset of the exfiltrated records contains financial account information, including bank account numbers associated with claims disbursement payments and payment card numbers associated with premium payment transactions. Preliminary analysis indicates that the financial data subset affects a smaller but still significant portion of the total affected population. The precise number of individuals with compromised financial data will be determined through the ongoing data mining process.

Protected Health Information (PHI). A subset of the exfiltrated records contains protected health information within the meaning of the Health Insurance Portability and Accountability Act of 1996 ("HIPAA") and applicable state laws. The PHI identified within the exfiltrated data sets includes health conditions, diagnosis codes (International Classification of Diseases, or ICD, codes), and treatment information associated with workers' compensation claims and health-related insurance claims processed by Palomar on behalf of Quorum. As with the financial data subset, the PHI subset appears to affect a smaller but still significant portion of the total affected population.

File metadata analysis and database schema review confirm that these data types were present within the structured data files and database exports that were staged and exfiltrated by the threat actor. The presence of these data elements within the exfiltrated data sets has been confirmed through sampling and preliminary parsing of the recovered file contents.

7.2 Preliminary Scope Estimate

Preliminary record count analysis of the exfiltrated structured data files suggests that the total number of affected individuals is in the range of approximately 300,000 or more. This preliminary estimate is based on an analysis of the record volumes within the identified exfiltrated data files, adjusted for known duplicate records within individual files. However, the estimate has not yet been refined through the full deduplication and matching processes necessary to produce a final affected individual count.

The precise identification of affected individuals requires the completion of data mining processes that include extraction of individual records from the exfiltrated data files, parsing and normalization of data fields, deduplication across multiple files and data sets, and matching to produce a single, consolidated list of unique affected individuals with associated data element exposure profiles. These processes are currently in progress, as described in Section 7.3 below.

Geographic scope analysis, based on the address fields present within the exfiltrated records, indicates that the affected individuals span multiple U.S. states. A state-by-state breakdown of affected individuals is necessary to support Counsel's analysis of state-specific notification obligations and regulatory requirements. This state-level breakdown will be provided in the final forensic report.

The financial data subset and the PHI subset each appear to represent a smaller but still significant portion of the total affected population. Preliminary analysis suggests that these subsets are concentrated in certain claims categories (e.g., workers' compensation claims for PHI, claims involving bank account disbursements for financial data), but the precise contours of these subsets will be defined through the data mining process.

7.3 Data Mining Status

Data mining and affected individual identification is being conducted by Graystone in coordination with Clearfield Notification Services LLC ("Clearfield"), which has been engaged separately to provide notification logistics support, including address verification, notification letter preparation, and call center services. Graystone's role in the data mining process is the extraction, parsing, deduplication, and analysis of the compromised data to produce a final affected individual list and associated data element exposure profiles. Clearfield's role commences upon receipt of the finalized affected individual list.

The current status of the data mining process is as follows:

• Data extraction from the identified exfiltrated file sets is substantially complete.

• Parsing and normalization of individual records is in progress.

• Deduplication and matching processes have commenced but are not yet complete.

• Preliminary results from the data mining process are expected within four to six weeks from the date of this report.

• Final identification of all affected individuals, together with state-by-state breakdowns and data-element-level exposure profiles, is anticipated by early August 2023.

Final affected individual counts, state-by-state breakdowns, and data-element-level analysis will be included in the final forensic report, targeted for delivery by July 14, 2023, with supplemental data mining results to follow as necessary through early August 2023.

8. Palomar's Notification to Quorum — Timing Observation

Graystone notes the following factual observations regarding the timing of Palomar's notification to Quorum of the security incident, for Counsel's consideration in assessing Palomar's compliance with its contractual obligations:

• Palomar's SOC detected anomalous outbound data transfer activity on April 18, 2023, and initiated containment and investigation procedures on that date.

• Palomar's internal investigation between April 18 and April 21, 2023 confirmed that the incident affected data belonging to Quorum.

• Palomar's General Counsel, Derek Copeland, notified Quorum's General Counsel, Thomas R. Whitfield, and Quorum's CISO, David Naranjo, of the incident via email on April 21, 2023 — approximately three calendar days after Palomar's initial internal detection of the anomalous activity.

• Section 9.4 of the Master Services Agreement between Quorum and Palomar requires Palomar to notify Quorum within 48 hours of discovering a security incident affecting Quorum data.

• Based on the available records, the April 21, 2023 notification was made approximately 24 hours beyond the contractual 48-hour notification deadline, measured from the April 18, 2023 detection date.

Graystone presents these factual observations for Counsel's use in evaluating the contractual and legal implications of the notification timing. Legal analysis of whether the notification delay constitutes a breach of the MSA, and of any resulting consequences or remedies, is outside the scope of this forensic investigation and is deferred to Calderwood & Harkness LLP.

9. Ongoing Investigation and Next Steps

9.1 Remaining Workstreams

The following investigative workstreams remain active and will be completed prior to the delivery of the final forensic report:

1. Data Mining and Affected Individual Identification. Completion of data extraction, parsing, deduplication, and matching processes to produce a final, deduplicated list of affected individuals with associated data element exposure profiles. Target completion: early August 2023.

2. State-by-State Breakdown. Preparation of a state-by-state breakdown of affected individuals, categorized by data type (PII, financial information, PHI), to support Counsel's analysis of state-specific notification obligations. This breakdown will be derived from the address fields within the affected individual records.

3. Volumetric Analysis. Continued analysis of the total volume of exfiltrated data, including reconciliation of NetFlow records, proxy log entries, and staging server artifacts to produce a refined volumetric assessment.

4. Timeline Confirmation. Final confirmation of the exfiltration timeline endpoints, including the precise commencement date of outbound data transfers and the cessation of all threat actor activity.

5. Dark Web and Threat Actor Monitoring. Ongoing monitoring for any evidence of threat actor use, publication, sale, or distribution of the exfiltrated data on dark web forums, paste sites, or other channels. As of the date of this report, no confirmed exposure or publication of the exfiltrated Quorum data has been identified. Graystone will continue monitoring through the final report delivery date and will promptly notify Counsel of any positive findings.

9.2 Final Report Timeline

Graystone anticipates delivering the Final Forensic Report to Calderwood & Harkness LLP by mid-July 2023, with a target delivery date of July 14, 2023. The final report will include the following:

• Comprehensive and finalized timeline of the security incident, from initial access through containment.

• Complete affected individual identification, including final deduplicated individual counts.

• State-by-state breakdown of affected individuals by data type.

• Full technical findings, including detailed malware analysis results, IOC listings, and network forensic analysis.

• Remediation observations, including factual findings relevant to the security posture of Palomar's environment at the time of the incident.

In the event that the data mining process extends beyond the final report delivery date, Graystone will deliver the final report with the most current data mining results available and will provide supplemental data mining deliverables upon completion, anticipated by early August 2023.

10. Limitations and Caveats

This report is provided subject to the following limitations and caveats:

1. Preliminary Nature of Findings. This report reflects preliminary findings based on evidence available to and analyzed by Graystone as of June 2, 2023. The forensic investigation is ongoing, and significant workstreams — including data mining, affected individual identification, and volumetric analysis — remain in progress. Accordingly, the findings, conclusions, and estimates presented in this report may be supplemented, modified, or revised in the final forensic report or in subsequent supplemental deliverables as additional analysis is completed.

2. Scope of Access. Graystone's investigation was conducted on Palomar's systems and network environment at the direction of Calderwood & Harkness LLP. Graystone's access to Palomar's environment was facilitated through counsel-to-counsel coordination between Calderwood & Harkness LLP and Palomar's outside counsel. Graystone's findings are based on the evidence made available through this process. If additional evidence sources are identified or made available subsequent to this report, Graystone's findings may be updated accordingly.

3. No Legal Advice. This report does not constitute legal advice. Graystone is a forensic investigation firm, not a law firm, and does not render legal opinions. All legal analysis of notification obligations, contractual rights and remedies, regulatory implications, and litigation strategy is deferred to Calderwood & Harkness LLP. The factual observations and forensic findings presented in this report are intended to support Counsel's legal analysis and decision-making.

4. Privilege Protections. All findings, analysis, and work product generated in the course of this engagement are subject to the attorney-client privilege and work product protections applicable to this engagement. This report has been prepared at the direction of Calderwood & Harkness LLP for the purpose of rendering legal advice to Quorum Insurance Holdings Corp. and should be treated as privileged and confidential. Distribution of this report or its contents outside of Counsel should not occur without the prior written authorization of Calderwood & Harkness LLP.

5. No Guarantees of Completeness. While Graystone has endeavored to conduct a thorough and comprehensive forensic investigation, no forensic investigation can guarantee the identification of all threat actor activity or the complete delineation of all compromised data. Forensic findings are inherently constrained by the availability, completeness, and integrity of log data and other evidence sources. Graystone has noted any significant gaps in available evidence where identified and has drawn conclusions based on the preponderance of available evidence.

11. Conclusion

The forensic evidence analyzed to date confirms that a threat actor exploited CVE-2023-0669, a critical pre-authentication remote code execution vulnerability, on Palomar Data Solutions' GoAnywhere MFT appliance to gain initial unauthorized access to Palomar's network environment on or about March 14, 2023. The GoAnywhere MFT appliance was unpatched against this vulnerability at the time of exploitation, despite the prior availability of a vendor-issued patch and the identification of the vulnerability through Palomar's own internal scanning processes.

Following the initial compromise, the threat actor established persistent access, harvested credentials, and conducted lateral movement from the DMZ segment into Palomar's internal claims processing environment. Over an approximately 35-day period from March 14 through April 18, 2023, the threat actor identified, staged, and exfiltrated structured data files containing Quorum policyholder and claimant records.

The exfiltrated data includes personally identifiable information (including Social Security numbers and driver's license numbers), financial account information (including bank account numbers and payment card numbers), and protected health information (including health conditions, diagnosis codes, and treatment information). The scale of the compromise is substantial, with preliminary estimates indicating that approximately 300,000 or more individuals may be affected across multiple U.S. states.

Palomar's SOC detected the anomalous exfiltration activity on April 18, 2023, and containment measures were initiated. Palomar notified Quorum on April 21, 2023, approximately 24 hours beyond the 48-hour contractual notification deadline established in the MSA.

Graystone will continue the investigation, complete the remaining workstreams — including data mining, affected individual identification, and state-by-state analysis — and provide a final comprehensive forensic report to Counsel by mid-July 2023, with a target delivery date of July 14, 2023. Graystone will promptly notify Counsel of any material developments arising from ongoing dark web monitoring or other investigative activities prior to the delivery of the final report.

Dr. Nolan Briggs Managing Director, Incident Response Graystone Forensics LLC 1950 Old Gallows Road, Suite 600 Tysons Corner, VA 22182

Signature: ________

Date: June 2, 2023

Kendra Faulkner Senior Forensic Analyst Graystone Forensics LLC

Signature: ________

Date: June 2, 2023

DISTRIBUTION LEGEND

Privileged and Confidential — Prepared at the Direction of Counsel

Distribution of this report is limited to the following individuals:

• Kevin Ostrowski, Partner, Calderwood & Harkness LLP

• Alan Burke, Associate, Calderwood & Harkness LLP

Calderwood & Harkness LLP — Matter No. 1025-00006

This report and its contents may not be copied, forwarded, distributed, or disclosed to any person or entity without prior written authorization from Calderwood & Harkness LLP. Unauthorized distribution may result in waiver of applicable privilege protections.

PRIVILEGED AND CONFIDENTIAL ATTORNEY-CLIENT PRIVILEGE / ATTORNEY WORK PRODUCT PREPARED AT THE DIRECTION OF COUNSEL
Preliminary Forensic Findings Report
From: Dr. Nolan Briggs, Managing Director, Incident Response, Graystone Forensics LLC
To: Kevin Ostrowski, Partner, Calderwood & Harkness LLP Alan Burke, Associate, Calderwood & Harkness LLP
Date: June 2, 2023
Re: Preliminary Forensic Investigation Findings — Security Incident Involving Palomar Data Solutions, Inc. Network Environment and Quorum Insurance Holdings Corp. Policyholder/Claimant Data
Graystone Reference: Engagement initiated May 5, 2023 at the direction of Calderwood & Harkness LLP (Matter No. 1025-00006) on behalf of Quorum Insurance Holdings Corp.
Classification: Privileged and Confidential — Not for distribution outside of counsel without prior written authorization from Calderwood & Harkness LLP.
Graystone Forensics LLC 1950 Old Gallows Road, Suite 600 Tysons Corner, VA 22182 Tel: (703) 555-4200 | Fax: (703) 555-4201 www.graystoneforensics.com
Right-click to update Table of Contents
1. Executive Summary
Graystone Forensics LLC ("Graystone") was retained on May 5, 2023 by Calderwood & Harkness LLP ("Calderwood & Harkness" or "Counsel"), outside counsel to Quorum Insurance Holdings Corp. ("Quorum" or "QIH"), to conduct a privileged forensic investigation into a security incident originating from the network environment of Palomar Data Solutions, Inc. ("Palomar"), a third-party claims-processing vendor engaged by Quorum. This engagement was initiated at the express direction of Counsel for the purpose of providing litigation support, legal analysis assistance, and factual development under the protections of the attorney-client privilege and the work product doctrine.
This report presents Graystone's preliminary findings based on evidence acquired, preserved, and analyzed through June 2, 2023. A final comprehensive report incorporating complete data exposure analysis, affected individual identification, and state-by-state data breakdowns is anticipated for delivery by mid-July 2023, with a target delivery date of July 14, 2023.
The key preliminary conclusions of Graystone's investigation, as detailed in the sections that follow, are summarized below:
Initial Access. A threat actor exploited a known pre-authentication remote code execution vulnerability, designated CVE-2023-0669, in Palomar's GoAnywhere MFT (Managed File Transfer) file transfer appliance to gain initial unauthorized access to Palomar's network environment on or about March 14, 2023. The GoAnywhere MFT appliance was internet-facing and had not been patched against this vulnerability at the time of exploitation, despite the availability of a vendor-issued patch prior to that date.
Persistence and Lateral Movement. Following initial exploitation, the threat actor maintained persistent access to Palomar's network environment and conducted lateral movement from the demilitarized zone ("DMZ") segment into internal network segments housing the claims processing environment. This period of unauthorized access spanned approximately 35 days, from March 14, 2023 through April 18, 2023.
Data Staging and Exfiltration. During the period of unauthorized access, the threat actor identified, accessed, staged, and exfiltrated structured data files containing Quorum policyholder and claimant data from Palomar's claims processing environment. The threat actor employed encryption and compression techniques to evade detection during the exfiltration process, and conducted data transfers during off-peak hours to blend with normal network traffic.
Detection and Containment. Palomar's Security Operations Center ("SOC") detected anomalous outbound data transfer patterns on April 18, 2023, at which point containment measures were initiated and the exfiltration activity ceased. Palomar's internal investigation confirmed the involvement of Quorum data, and Palomar notified Quorum on April 21, 2023 — approximately three days after the initial internal detection.
Nature of Compromised Data. Preliminary analysis indicates that the exfiltrated data includes personally identifiable information ("PII"), including Social Security numbers and driver's license numbers; financial account information, including bank account numbers and payment card numbers; and protected health information ("PHI"), including health conditions, diagnosis codes, and treatment information, relating to Quorum policyholders and claimants across multiple U.S. states.
Estimated Scope. Full data mining and affected-individual identification remain ongoing. However, preliminary record count analysis of the exfiltrated structured data files suggests the total number of affected individuals is substantial, with current estimates indicating approximately 300,000 or more individuals may be affected. Precise individual identification, deduplication, and state-level breakdowns will be provided in the final report.
Graystone continues to advance the remaining investigative workstreams and will deliver a final comprehensive forensic report to Counsel by mid-July 2023.
2. Scope of Engagement and Methodology
2.1 Engagement Parameters
Graystone was retained under the attorney-client privilege umbrella by Calderwood & Harkness LLP on May 5, 2023, for the purpose of conducting a forensic investigation into the security incident affecting Palomar's network environment and the Quorum data processed therein. The engagement was initiated at the express direction of Counsel, and all investigation activities have been and continue to be conducted at the direction of Counsel. All findings, analysis, and work product generated in the course of this engagement have been reported exclusively to Calderwood & Harkness LLP, and this report is prepared solely for the use of Counsel in rendering legal advice to Quorum.
The scope of work was finalized between Graystone and Counsel on May 7, 2023, and defines three core investigative objectives:
1.  Entry Vector and Timeline Determination. Determine the threat actor's initial entry vector into Palomar's network environment and reconstruct the complete timeline of unauthorized access, including initial compromise, persistence, lateral movement, and data exfiltration.
2.  Data Set Identification. Identify the specific data sets accessed and/or exfiltrated by the threat actor from Palomar's network environment, with particular emphasis on data sets containing Quorum policyholder and claimant information.
3.  Data Type Assessment. Assess the types and categories of data compromised, including the presence or absence of PII, financial account information, PHI, and other sensitive data elements, to support Counsel's analysis of notification obligations and regulatory exposure.
The Graystone analyst team assigned to this engagement is led by Dr. Nolan Briggs, Managing Director, Incident Response, and Kendra Faulkner, Senior Forensic Analyst. Additional Graystone staff members have contributed to specific workstreams, including malware analysis, network forensics, and data mining, under the supervision of Dr. Briggs and Ms. Faulkner.
2.2 Data Sources and Forensic Evidence Analyzed
In conducting this investigation, Graystone obtained, preserved, and analyzed the following categories of forensic evidence from Palomar's network environment. Access to Palomar's systems and data was facilitated through counsel-to-counsel coordination between Calderwood & Harkness LLP (counsel to Quorum) and Palomar's outside counsel. Graystone's acquisition and handling of all evidence has followed established chain-of-custody protocols and defensible forensic imaging practices.
The data sources and forensic evidence analyzed include the following:
•  GoAnywhere MFT Appliance Forensic Images. Complete forensic images of Palomar's GoAnywhere MFT appliance, including server logs, application configuration files, user access records, and patch history documentation. These images were acquired on May 9, 2023.
•  Network Security Device Logs. Palomar network firewall logs, intrusion detection system ("IDS") alerts, and Security Information and Event Management ("SIEM") data covering the period from February 1, 2023 through April 30, 2023. This date range was selected to provide sufficient pre-incident baseline data and to capture the full scope of post-compromise activity and containment.
•  Active Directory and Authentication Records. Active Directory logs and authentication records from Palomar's domain controllers, including logon event records, account creation and modification logs, group membership changes, and Kerberos and NTLM authentication activity.
•  Endpoint Forensic Images. Forensic images from compromised servers within Palomar's claims processing environment, including database servers, file servers, and staging servers identified during the investigation as having been accessed or used by the threat actor.
•  SOC Incident Records. Palomar SOC incident tickets, alert records, and internal investigation notes from the April 18–21, 2023 period, documenting Palomar's initial detection, triage, and containment activities.
•  File Transfer and Staging Server Logs. Application-level and operating system-level logs from file transfer and data staging servers within Palomar's environment that were involved in or proximate to the threat actor's data staging and exfiltration activities.
•  Network Traffic Data. NetFlow data and proxy logs capturing outbound data transfers from Palomar's network, analyzed to identify exfiltration channels, destination IP addresses, data transfer volumes, and timing patterns.
•  Vulnerability and Patch Management Records. Palomar's internal patch management records and vulnerability scanning reports, including scan results from the period preceding the compromise, to assess the patch status of the GoAnywhere MFT appliance and other relevant systems at the time of the incident.
2.3 Investigative Methodology
Graystone's investigation has been conducted in accordance with standard digital forensic methodology, encompassing four principal phases: evidence acquisition, evidence preservation, analysis, and reporting. All forensic images were acquired using write-blocking hardware and verified using cryptographic hash values (SHA-256) to ensure the integrity and admissibility of the evidence.
The analytical methodology employed by Graystone in this investigation includes the following components:
•  Timeline Reconstruction. Graystone constructed a comprehensive timeline of the threat actor's activity by correlating log data, file system artifacts, and authentication records across multiple data sources. This cross-source correlation approach enables identification of the sequence and timing of the threat actor's actions with a high degree of confidence, even where individual log sources may contain gaps.
•  Malware Analysis and IOC Identification. Graystone conducted static and dynamic analysis of malware samples, web shells, and backdoor tools recovered from compromised systems. This analysis yielded indicators of compromise ("IOCs"), including file hashes, command-and-control IP addresses, and behavioral signatures, which were used to identify additional affected systems and to confirm the scope of the threat actor's access.
•  Data Flow Analysis. Graystone performed detailed analysis of data flows within Palomar's network and to external destinations to identify the specific data sets staged and exfiltrated by the threat actor. This analysis incorporated file system timestamps, network traffic records, and application logs to trace the path of data from its source repositories to the exfiltration endpoints.
It is important to note that the data mining process required to identify the specific individuals whose data was compromised is ongoing and has not yet been completed. Data mining involves the extraction, parsing, deduplication, and matching of records from the exfiltrated data sets to produce a deduplicated list of affected individuals with associated data elements. This process is being conducted by Graystone in coordination with Clearfield Notification Services LLC (engaged separately for notification logistics support). Preliminary analysis of the types and volume of data exfiltrated is presented in Section 7 of this report. Final affected individual identification, together with state-by-state breakdowns and data-element-level analysis, will be provided in the final forensic report anticipated by mid-July 2023.
3. Background — Palomar Data Solutions Environment
3.1 Palomar's Role as Quorum Vendor
Palomar Data Solutions, Inc. ("Palomar"), headquartered at 7100 Greenville Avenue, Suite 450, Dallas, TX 75231, is a data services company that provides claims data processing, document management, and analytics services to insurance carriers and other financial services organizations. Palomar has served as a third-party claims-processing vendor to Quorum under a Master Services Agreement ("MSA") originally executed on November 12, 2019, and subsequently amended. The MSA governs, among other things, Palomar's obligations with respect to data security, incident notification, and the handling of Quorum's confidential and protected data.
In its capacity as Quorum's claims-processing vendor, Palomar processes personal lines claims data on behalf of Quorum. This data includes policyholder and claimant records containing a range of sensitive data elements, including personally identifiable information, financial account data associated with premium payments and claims disbursements, and health-related claims information arising from workers' compensation and health insurance products underwritten or administered by Quorum.
Quorum data is processed within Palomar's claims processing environment, which is a designated and segmented portion of Palomar's broader IT infrastructure. While the claims processing environment is logically segmented from other portions of Palomar's network, it is network-connected to other segments, including the DMZ segment in which the GoAnywhere MFT appliance resided. As discussed in Section 5 below, this network connectivity facilitated the threat actor's lateral movement from the initial point of compromise to the claims processing environment.
3.2 Palomar's GoAnywhere MFT Appliance
Palomar utilizes a GoAnywhere MFT (Managed File Transfer) appliance as a centralized platform for receiving and transmitting large data files with its insurance carrier clients, including Quorum. GoAnywhere MFT is a widely used enterprise file transfer solution that supports secure file transfer protocols and provides centralized management of file transfer workflows.
Palomar's GoAnywhere MFT appliance was internet-facing and served as a primary ingress and egress point for data transfers between Palomar and its clients. The appliance was deployed within the DMZ segment of Palomar's network, a configuration that is common for internet-facing services but which requires diligent patching and monitoring to mitigate the risk of exploitation.
Graystone's review of the appliance's patch history and configuration records revealed that, at the time of the initial compromise on or about March 14, 2023, the GoAnywhere MFT appliance was running a software version that was vulnerable to CVE-2023-0669, a critical pre-authentication remote code execution vulnerability. The vendor (Severin Corporation, formerly Strathmore Industries) had released a patch addressing CVE-2023-0669 prior to the date of exploitation. Palomar's internal records confirm that this patch had not been applied to the production GoAnywhere MFT appliance as of March 14, 2023. The circumstances surrounding the delay in patch application are discussed further in Section 4.2 below.
4. Findings — Initial Access Vector
4.1 CVE-2023-0669 Exploitation
Based on Graystone's forensic analysis, the threat actor gained initial unauthorized access to Palomar's network environment by exploiting CVE-2023-0669, a pre-authentication remote code execution ("RCE") vulnerability affecting the GoAnywhere MFT file transfer platform. CVE-2023-0669 is a critical-severity vulnerability that allows an unauthenticated remote attacker to execute arbitrary code on the underlying server hosting the GoAnywhere MFT application. The vulnerability was publicly disclosed and assigned a Common Vulnerabilities and Exposures identifier in early 2023, and exploitation of this vulnerability has been associated with multiple threat actor groups conducting data theft campaigns against organizations using unpatched GoAnywhere MFT installations.
Analysis of the GoAnywhere MFT appliance logs confirms that exploitation activity targeting CVE-2023-0669 occurred on or about March 14, 2023. The forensic evidence establishing this finding includes the following:
•  Web Shell Deployment. A malicious web shell was identified on the GoAnywhere MFT server's file system. File system metadata, including NTFS timestamps, indicates that the web shell was created on March 14, 2023. The web shell provided the threat actor with a persistent, browser-accessible interface for executing commands on the compromised server.
•  Anomalous Process Execution. Operating system event logs and process execution records from the GoAnywhere MFT server reflect anomalous process execution activity consistent with known CVE-2023-0669 exploit payloads. Specifically, the application process spawned child processes that are not associated with normal GoAnywhere MFT operations, and the command-line arguments associated with these processes are consistent with exploitation techniques documented in public threat intelligence reporting for CVE-2023-0669.
•  Application Log Anomalies. The GoAnywhere MFT application logs contain entries corresponding to the exploitation event, including error messages and exception traces consistent with the exploitation of the underlying deserialization vulnerability.
The exploit allowed the threat actor to execute arbitrary commands on the underlying operating system of the GoAnywhere MFT server without possessing valid credentials for the application or the host system. This level of access provided the threat actor with a foothold from which to conduct subsequent post-exploitation activity, including credential harvesting and lateral movement, as described in Section 5 below.
4.2 Patch Status Assessment
Graystone's review of Palomar's patch management records and vulnerability scanning reports confirms that the GoAnywhere MFT appliance was not patched against CVE-2023-0669 at the time of the March 14, 2023 exploitation. The following factual observations are relevant to this assessment:
•  The vendor-issued patch for CVE-2023-0669 was released and made publicly available prior to the March 14, 2023 exploitation date. The patch addressed the specific deserialization vulnerability exploited by the threat actor.
•  Palomar's internal vulnerability scanning reports from February 2023 identified the GoAnywhere MFT appliance as running a software version with known critical vulnerabilities. The scan results flagged the appliance for remediation action, consistent with the identification of CVE-2023-0669 or related vulnerabilities in the installed version.
•  Despite the availability of the vendor patch and the internal identification of the vulnerability through scanning, Palomar's records do not reflect that the patch was applied to the production GoAnywhere MFT appliance prior to March 14, 2023. Graystone did not identify documentation within the available records explaining the reason for the delay in patch application.
•  Following the detection of the incident on April 18, 2023, Palomar applied the vendor patch and took additional containment steps, as described in Section 6.3 below.
Graystone notes these factual findings regarding the patch status of the GoAnywhere MFT appliance for Counsel's consideration. The assessment of whether the patching delay violated contractual obligations under the Palomar-Quorum MSA, including any applicable security requirements, service level commitments, or duty-to-patch provisions, is outside the scope of this forensic investigation and is deferred to Calderwood & Harkness LLP for legal analysis.
5. Findings — Lateral Movement and Persistence
5.1 Post-Exploitation Activity
Following the initial exploitation of CVE-2023-0669 and the deployment of the web shell on the GoAnywhere MFT appliance, the threat actor engaged in a series of post-exploitation activities designed to establish persistent access to Palomar's network environment and to expand the scope of access beyond the initial point of compromise. These activities are consistent with the tradecraft of financially motivated threat actors engaged in data theft operations and reflect a methodical approach to network enumeration, credential acquisition, and lateral movement.
The key post-exploitation activities identified through Graystone's forensic analysis include:
Persistent Access Establishment. The threat actor established multiple persistence mechanisms within Palomar's environment. In addition to the web shell deployed on the GoAnywhere MFT server on March 14, 2023, Graystone identified additional backdoor tools installed on intermediate systems during the lateral movement phase. These persistence mechanisms provided the threat actor with redundant pathways for re-accessing the environment, reducing the risk that the loss of any single access point would terminate the intrusion.
Credential Harvesting. Active Directory log analysis reveals that the threat actor harvested credentials from the GoAnywhere MFT server. The compromised credentials included service account credentials with elevated privileges that were stored or cached on the GoAnywhere MFT appliance. These credentials were subsequently used by the threat actor to authenticate to other systems within Palomar's network, enabling lateral movement beyond the DMZ segment.
Lateral Movement. Using the harvested credentials, the threat actor moved laterally from the DMZ segment, where the GoAnywhere MFT appliance resided, into Palomar's internal network segments. Of particular significance, the threat actor successfully accessed systems within the claims processing environment, the segmented portion of Palomar's infrastructure that housed Quorum policyholder and claimant data. The lateral movement path traversed network boundaries that, while logically segmented, permitted authenticated connections using the compromised service account credentials.
5.2 Timeline of Lateral Movement
Based on the correlation of log data, file system artifacts, authentication records, and network traffic data across multiple sources, Graystone has reconstructed the following timeline of the threat actor's activity within Palomar's network environment:
March 14, 2023 — Initial Compromise. The threat actor exploited CVE-2023-0669 on the GoAnywhere MFT appliance, achieving remote code execution. A web shell was deployed on the server, providing persistent remote access. Credential harvesting activity began on the compromised server, targeting cached and stored credentials, including service account credentials.
March 15–19, 2023 — Lateral Movement and Network Enumeration. The threat actor used the harvested credentials to initiate lateral movement from the DMZ segment into Palomar's internal network segments. During this phase, the threat actor conducted network enumeration activities, including the discovery and mapping of file shares, database servers, and other resources within the claims processing environment. Active Directory queries and network scanning activity attributable to the threat actor are reflected in the log data during this period.
March 20–28, 2023 — Data Access and Staging. The threat actor accessed claims processing database servers and file repositories containing Quorum policyholder and claimant data. During this phase, the threat actor identified target data sets and began staging data for exfiltration. Staging activity involved copying, aggregating, compressing, and encrypting data files on intermediate servers within Palomar's network. File system artifacts and database query logs confirm access to structured data files and database exports containing Quorum-specific records.
March 29 – April 18, 2023 — Continued Staging and Exfiltration. The threat actor continued data staging and exfiltration activities over a period of approximately three weeks. Exfiltrated data was transferred outbound via encrypted channels to external infrastructure controlled by the threat actor. Throughout this period, the threat actor maintained intermittent access to Palomar's environment through the previously deployed web shell and additional persistence mechanisms. The exfiltration activity ceased on or about April 18, 2023, coinciding with Palomar SOC's detection of anomalous outbound data transfers and the initiation of containment measures.
5.3 Threat Actor Tradecraft
The threat actor employed several techniques that are characteristic of sophisticated, financially motivated threat groups and that are designed to evade detection by network security monitoring tools and security operations personnel. The tradecraft observations relevant to this investigation include the following:
Living-off-the-Land Techniques. The threat actor made extensive use of legitimate system administration tools and utilities already present within Palomar's environment to conduct post-exploitation activities, including network enumeration, credential harvesting, and lateral movement. This technique, commonly referred to as "living off the land," reduces the threat actor's reliance on custom malware and makes malicious activity more difficult to distinguish from legitimate administrative operations in log data and behavioral monitoring systems.
Pre-Exfiltration Data Processing. Prior to exfiltration, the threat actor compressed and encrypted the staged data files. This processing step served a dual purpose: it reduced the volume of data to be transferred, thereby decreasing the time and bandwidth required for exfiltration, and it rendered the outbound data transfers opaque to data loss prevention ("DLP") tools and intrusion detection systems ("IDS") that rely on content inspection to identify sensitive data leaving the network.
Off-Peak Timing. The exfiltration sessions were conducted predominantly during off-peak hours, including evenings, overnight periods, and weekends. This timing pattern was designed to blend the exfiltration traffic with lower-volume network activity periods, reducing the likelihood of detection through volumetric anomaly alerts.
Anonymization Infrastructure. The external IP addresses used by the threat actor for command-and-control communications and data exfiltration have been traced to commercial VPN services and proxy infrastructure. This use of anonymization services obscures the threat actor's true geographic location and identity. Attribution analysis is ongoing but is outside the core scope of this engagement, and Graystone has not reached a conclusion regarding the identity of the threat actor as of this report date.
6. Findings — Data Staging and Exfiltration
6.1 Data Staging Activity
The threat actor identified and accessed structured data files and database exports within Palomar's claims processing environment that contained Quorum-specific policyholder and claimant data. The claims processing environment contained multiple data repositories, including relational databases and file share directories, organized by client and data type. The threat actor's activity within these repositories was targeted rather than indiscriminate; file access and database query logs indicate that the threat actor focused on data sets associated with Quorum's personal lines claims operations.
Staging activity was observed on intermediate servers within Palomar's internal network. These staging servers were not the primary data repositories; rather, they were systems to which the threat actor copied and aggregated target data in preparation for exfiltration. On these staging servers, the data was aggregated from multiple source locations, compressed using standard compression utilities, and encrypted prior to outbound transfer. Forensic analysis of the staging server file system artifacts — including temporary files, directory creation timestamps, and file modification records — confirms that staging activity occurred between approximately March 20 and April 18, 2023, consistent with the broader timeline of lateral movement and exfiltration activity.
The use of intermediate staging servers is a common technique employed by threat actors to consolidate data prior to exfiltration, enabling the transfer process to proceed more efficiently and reducing the number of direct connections between the source data repositories and external exfiltration endpoints.
6.2 Exfiltration Methodology
Following staging and pre-processing, the exfiltrated data was transferred outbound from Palomar's network via encrypted channels to external infrastructure controlled by the threat actor. The exfiltration channels utilized encrypted protocols that rendered the content of the outbound transfers opaque to inline content inspection tools deployed within Palomar's network.
NetFlow data and proxy log analysis confirms multiple outbound data transfer sessions during the period from March 22 through April 18, 2023. These sessions were directed to external IP addresses associated with the threat actor's infrastructure, consistent with the anonymization infrastructure described in Section 5.3 above. The transfer sessions exhibited characteristics consistent with bulk data exfiltration, including sustained high-volume outbound transfers during the off-peak periods previously noted.
The estimated total volume of data exfiltrated from Palomar's network is in the range of several hundred gigabytes. Precise volumetric analysis is ongoing, as the calculation requires reconciliation of NetFlow records, proxy log entries, and staging server artifacts. The final volumetric assessment will be included in the final forensic report. However, the preliminary volume estimate is consistent with the types and quantities of structured data files identified in the staging analysis and the preliminary record counts discussed in Section 7 below.
Exfiltration activity ceased on or about April 18, 2023. This cessation coincided with Palomar SOC's detection of anomalous outbound transfer patterns and the subsequent initiation of containment actions, as described in Section 6.3 below. Graystone has not identified evidence of additional exfiltration activity after April 18, 2023.
6.3 Palomar SOC Detection and Containment
On April 18, 2023, Palomar's Security Operations Center detected unusual outbound data transfer patterns through its network monitoring tools. According to Palomar's SOC incident tickets and internal investigation notes, the alert was triggered by volumetric anomaly detection rules that identified outbound data transfer volumes exceeding established baseline thresholds during off-peak hours. The SOC initiated triage and investigation procedures upon receipt of the alert.
Palomar's internal records indicate that the SOC initiated containment measures promptly upon confirming the anomalous activity, including the following actions:
•  Isolation of the compromised GoAnywhere MFT appliance from the network to terminate the threat actor's primary access pathway.
•  blocking of identified external threat actor IP addresses at the network perimeter firewall.
•  Initiation of an internal investigation to determine the scope and nature of the incident.
•  Engagement of Palomar's internal incident response team and escalation to Palomar's executive leadership and General Counsel.
Palomar's internal investigation between April 18 and April 21, 2023 confirmed that the incident affected data belonging to Quorum, among potentially other Palomar clients. The investigation identified the GoAnywhere MFT appliance as the initial point of compromise and determined that the threat actor had accessed internal systems within the claims processing environment.
On April 21, 2023, Palomar's General Counsel, Derek Copeland, notified Quorum's General Counsel, Thomas R. Whitfield, and Quorum's Chief Information Security Officer, David Naranjo, via email regarding the security incident. The notification communicated that Palomar had experienced a security incident affecting data belonging to Quorum and provided preliminary information regarding the nature of the incident. The timing of this notification relative to Palomar's contractual obligations is addressed in Section 8 below.
7. Preliminary Assessment of Compromised Data
7.1 Types of Data Confirmed Exfiltrated
Graystone's analysis of the exfiltrated data sets, based on file metadata, database schema analysis, and preliminary review of the structured data files identified in the staging and exfiltration analysis, confirms that the compromised data includes Quorum policyholder and claimant records containing the following categories of sensitive information:
Personally Identifiable Information (PII). The exfiltrated structured data files contain records that include full names, dates of birth, Social Security numbers, and driver's license numbers of Quorum policyholders and claimants. These data elements are present across the majority of the exfiltrated record sets and constitute the broadest category of compromised data.
Financial Information. A subset of the exfiltrated records contains financial account information, including bank account numbers associated with claims disbursement payments and payment card numbers associated with premium payment transactions. Preliminary analysis indicates that the financial data subset affects a smaller but still significant portion of the total affected population. The precise number of individuals with compromised financial data will be determined through the ongoing data mining process.
Protected Health Information (PHI). A subset of the exfiltrated records contains protected health information within the meaning of the Health Insurance Portability and Accountability Act of 1996 ("HIPAA") and applicable state laws. The PHI identified within the exfiltrated data sets includes health conditions, diagnosis codes (International Classification of Diseases, or ICD, codes), and treatment information associated with workers' compensation claims and health-related insurance claims processed by Palomar on behalf of Quorum. As with the financial data subset, the PHI subset appears to affect a smaller but still significant portion of the total affected population.
File metadata analysis and database schema review confirm that these data types were present within the structured data files and database exports that were staged and exfiltrated by the threat actor. The presence of these data elements within the exfiltrated data sets has been confirmed through sampling and preliminary parsing of the recovered file contents.
7.2 Preliminary Scope Estimate
Preliminary record count analysis of the exfiltrated structured data files suggests that the total number of affected individuals is in the range of approximately 300,000 or more. This preliminary estimate is based on an analysis of the record volumes within the identified exfiltrated data files, adjusted for known duplicate records within individual files. However, the estimate has not yet been refined through the full deduplication and matching processes necessary to produce a final affected individual count.
The precise identification of affected individuals requires the completion of data mining processes that include extraction of individual records from the exfiltrated data files, parsing and normalization of data fields, deduplication across multiple files and data sets, and matching to produce a single, consolidated list of unique affected individuals with associated data element exposure profiles. These processes are currently in progress, as described in Section 7.3 below.
Geographic scope analysis, based on the address fields present within the exfiltrated records, indicates that the affected individuals span multiple U.S. states. A state-by-state breakdown of affected individuals is necessary to support Counsel's analysis of state-specific notification obligations and regulatory requirements. This state-level breakdown will be provided in the final forensic report.
The financial data subset and the PHI subset each appear to represent a smaller but still significant portion of the total affected population. Preliminary analysis suggests that these subsets are concentrated in certain claims categories (e.g., workers' compensation claims for PHI, claims involving bank account disbursements for financial data), but the precise contours of these subsets will be defined through the data mining process.
7.3 Data Mining Status
Data mining and affected individual identification is being conducted by Graystone in coordination with Clearfield Notification Services LLC ("Clearfield"), which has been engaged separately to provide notification logistics support, including address verification, notification letter preparation, and call center services. Graystone's role in the data mining process is the extraction, parsing, deduplication, and analysis of the compromised data to produce a final affected individual list and associated data element exposure profiles. Clearfield's role commences upon receipt of the finalized affected individual list.
The current status of the data mining process is as follows:
•  Data extraction from the identified exfiltrated file sets is substantially complete.
•  Parsing and normalization of individual records is in progress.
•  Deduplication and matching processes have commenced but are not yet complete.
•  Preliminary results from the data mining process are expected within four to six weeks from the date of this report.
•  Final identification of all affected individuals, together with state-by-state breakdowns and data-element-level exposure profiles, is anticipated by early August 2023.
Final affected individual counts, state-by-state breakdowns, and data-element-level analysis will be included in the final forensic report, targeted for delivery by July 14, 2023, with supplemental data mining results to follow as necessary through early August 2023.
8. Palomar's Notification to Quorum — Timing Observation
Graystone notes the following factual observations regarding the timing of Palomar's notification to Quorum of the security incident, for Counsel's consideration in assessing Palomar's compliance with its contractual obligations:
•  Palomar's SOC detected anomalous outbound data transfer activity on April 18, 2023, and initiated containment and investigation procedures on that date.
•  Palomar's internal investigation between April 18 and April 21, 2023 confirmed that the incident affected data belonging to Quorum.
•  Palomar's General Counsel, Derek Copeland, notified Quorum's General Counsel, Thomas R. Whitfield, and Quorum's CISO, David Naranjo, of the incident via email on April 21, 2023 — approximately three calendar days after Palomar's initial internal detection of the anomalous activity.
•  Section 9.4 of the Master Services Agreement between Quorum and Palomar requires Palomar to notify Quorum within 48 hours of discovering a security incident affecting Quorum data.
•  Based on the available records, the April 21, 2023 notification was made approximately 24 hours beyond the contractual 48-hour notification deadline, measured from the April 18, 2023 detection date.
Graystone presents these factual observations for Counsel's use in evaluating the contractual and legal implications of the notification timing. Legal analysis of whether the notification delay constitutes a breach of the MSA, and of any resulting consequences or remedies, is outside the scope of this forensic investigation and is deferred to Calderwood & Harkness LLP.
9. Ongoing Investigation and Next Steps
9.1 Remaining Workstreams
The following investigative workstreams remain active and will be completed prior to the delivery of the final forensic report:
1.  Data Mining and Affected Individual Identification. Completion of data extraction, parsing, deduplication, and matching processes to produce a final, deduplicated list of affected individuals with associated data element exposure profiles. Target completion: early August 2023.
2.  State-by-State Breakdown. Preparation of a state-by-state breakdown of affected individuals, categorized by data type (PII, financial information, PHI), to support Counsel's analysis of state-specific notification obligations. This breakdown will be derived from the address fields within the affected individual records.
3.  Volumetric Analysis. Continued analysis of the total volume of exfiltrated data, including reconciliation of NetFlow records, proxy log entries, and staging server artifacts to produce a refined volumetric assessment.
4.  Timeline Confirmation. Final confirmation of the exfiltration timeline endpoints, including the precise commencement date of outbound data transfers and the cessation of all threat actor activity.
5.  Dark Web and Threat Actor Monitoring. Ongoing monitoring for any evidence of threat actor use, publication, sale, or distribution of the exfiltrated data on dark web forums, paste sites, or other channels. As of the date of this report, no confirmed exposure or publication of the exfiltrated Quorum data has been identified. Graystone will continue monitoring through the final report delivery date and will promptly notify Counsel of any positive findings.
9.2 Final Report Timeline
Graystone anticipates delivering the Final Forensic Report to Calderwood & Harkness LLP by mid-July 2023, with a target delivery date of July 14, 2023. The final report will include the following:
•  Comprehensive and finalized timeline of the security incident, from initial access through containment.
•  Complete affected individual identification, including final deduplicated individual counts.
•  State-by-state breakdown of affected individuals by data type.
•  Full technical findings, including detailed malware analysis results, IOC listings, and network forensic analysis.
•  Remediation observations, including factual findings relevant to the security posture of Palomar's environment at the time of the incident.
In the event that the data mining process extends beyond the final report delivery date, Graystone will deliver the final report with the most current data mining results available and will provide supplemental data mining deliverables upon completion, anticipated by early August 2023.
10. Limitations and Caveats
This report is provided subject to the following limitations and caveats:
1.  Preliminary Nature of Findings. This report reflects preliminary findings based on evidence available to and analyzed by Graystone as of June 2, 2023. The forensic investigation is ongoing, and significant workstreams — including data mining, affected individual identification, and volumetric analysis — remain in progress. Accordingly, the findings, conclusions, and estimates presented in this report may be supplemented, modified, or revised in the final forensic report or in subsequent supplemental deliverables as additional analysis is completed.
2.  Scope of Access. Graystone's investigation was conducted on Palomar's systems and network environment at the direction of Calderwood & Harkness LLP. Graystone's access to Palomar's environment was facilitated through counsel-to-counsel coordination between Calderwood & Harkness LLP and Palomar's outside counsel. Graystone's findings are based on the evidence made available through this process. If additional evidence sources are identified or made available subsequent to this report, Graystone's findings may be updated accordingly.
3.  No Legal Advice. This report does not constitute legal advice. Graystone is a forensic investigation firm, not a law firm, and does not render legal opinions. All legal analysis of notification obligations, contractual rights and remedies, regulatory implications, and litigation strategy is deferred to Calderwood & Harkness LLP. The factual observations and forensic findings presented in this report are intended to support Counsel's legal analysis and decision-making.
4.  Privilege Protections. All findings, analysis, and work product generated in the course of this engagement are subject to the attorney-client privilege and work product protections applicable to this engagement. This report has been prepared at the direction of Calderwood & Harkness LLP for the purpose of rendering legal advice to Quorum Insurance Holdings Corp. and should be treated as privileged and confidential. Distribution of this report or its contents outside of Counsel should not occur without the prior written authorization of Calderwood & Harkness LLP.
5.  No Guarantees of Completeness. While Graystone has endeavored to conduct a thorough and comprehensive forensic investigation, no forensic investigation can guarantee the identification of all threat actor activity or the complete delineation of all compromised data. Forensic findings are inherently constrained by the availability, completeness, and integrity of log data and other evidence sources. Graystone has noted any significant gaps in available evidence where identified and has drawn conclusions based on the preponderance of available evidence.
11. Conclusion
The forensic evidence analyzed to date confirms that a threat actor exploited CVE-2023-0669, a critical pre-authentication remote code execution vulnerability, on Palomar Data Solutions' GoAnywhere MFT appliance to gain initial unauthorized access to Palomar's network environment on or about March 14, 2023. The GoAnywhere MFT appliance was unpatched against this vulnerability at the time of exploitation, despite the prior availability of a vendor-issued patch and the identification of the vulnerability through Palomar's own internal scanning processes.
Following the initial compromise, the threat actor established persistent access, harvested credentials, and conducted lateral movement from the DMZ segment into Palomar's internal claims processing environment. Over an approximately 35-day period from March 14 through April 18, 2023, the threat actor identified, staged, and exfiltrated structured data files containing Quorum policyholder and claimant records.
The exfiltrated data includes personally identifiable information (including Social Security numbers and driver's license numbers), financial account information (including bank account numbers and payment card numbers), and protected health information (including health conditions, diagnosis codes, and treatment information). The scale of the compromise is substantial, with preliminary estimates indicating that approximately 300,000 or more individuals may be affected across multiple U.S. states.
Palomar's SOC detected the anomalous exfiltration activity on April 18, 2023, and containment measures were initiated. Palomar notified Quorum on April 21, 2023, approximately 24 hours beyond the 48-hour contractual notification deadline established in the MSA.
Graystone will continue the investigation, complete the remaining workstreams — including data mining, affected individual identification, and state-by-state analysis — and provide a final comprehensive forensic report to Counsel by mid-July 2023, with a target delivery date of July 14, 2023. Graystone will promptly notify Counsel of any material developments arising from ongoing dark web monitoring or other investigative activities prior to the delivery of the final report.
Dr. Nolan Briggs Managing Director, Incident Response Graystone Forensics LLC 1950 Old Gallows Road, Suite 600 Tysons Corner, VA 22182
Signature: ________
Date: June 2, 2023
Kendra Faulkner Senior Forensic Analyst Graystone Forensics LLC
Signature: ________
Date: June 2, 2023
DISTRIBUTION LEGEND
Privileged and Confidential — Prepared at the Direction of Counsel
Distribution of this report is limited to the following individuals:
•  Kevin Ostrowski, Partner, Calderwood & Harkness LLP
•  Alan Burke, Associate, Calderwood & Harkness LLP
Calderwood & Harkness LLP — Matter No. 1025-00006
This report and its contents may not be copied, forwarded, distributed, or disclosed to any person or entity without prior written authorization from Calderwood & Harkness LLP. Unauthorized distribution may result in waiver of applicable privilege protections.

PRIVILEGED AND CONFIDENTIAL ATTORNEY-CLIENT PRIVILEGE / ATTORNEY WORK PRODUCT PREPARED AT THE DIRECTION OF COUNSEL

DISTRIBUTION LEGEND

Record

Parties

Dates

Amounts