PRIVILEGED AND CONFIDENTIAL ATTORNEY-CLIENT PRIVILEGE / ATTORNEY WORK PRODUCT
SCOPE OF WORK AND INVESTIGATION PLAN
Forensic Investigation of Data Security Incident Involving Palomar Data Solutions, Inc.
Prepared by: Calderwood & Harkness LLP, in coordination with Graystone Forensics LLC Date: May 7, 2023 Calderwood & Harkness Matter No.: 1025-00006
Right-click to update Table of Contents
1. PRIVILEGE DESIGNATION AND PURPOSE
This Scope of Work and Investigation Plan (this "SOW") is prepared at the direction of Calderwood & Harkness LLP ("Calderwood & Harkness" or "Counsel"), outside counsel to Quorum Insurance Holdings Corp. ("Quorum" or "QIH"), a Delaware corporation headquartered at 400 Constitution Plaza, Suite 2200, Hartford, CT 06103, and publicly traded on the Nasdaq Stock Market under the ticker symbol QIHC. Calderwood & Harkness has been engaged by Quorum to provide legal advice and representation in connection with a data security incident involving Quorum's third-party vendor, Palomar Data Solutions, Inc. ("Palomar" or "PDS"), as more fully described herein.
Graystone Forensics LLC ("Graystone") is retained pursuant to the Outside Counsel Retention Letter dated May 5, 2023 (the "Retention Letter"), under the attorney-client privilege umbrella of Calderwood & Harkness. Graystone is engaged as a consulting expert retained by outside counsel to assist Counsel in providing legal advice to the client. Graystone's engagement is made at the express direction of Counsel, and the work to be performed hereunder is integral to Counsel's ability to render informed legal advice to Quorum regarding the data security incident, including but not limited to advice regarding regulatory notification obligations, contractual remedies, litigation exposure, and risk mitigation.
All work product, reports, communications, findings, analyses, memoranda, data compilations, forensic images, and other materials produced by Graystone under this SOW (collectively, "Work Product") are privileged and confidential. Such Work Product is prepared at the direction of Counsel for the purpose of providing legal advice to Quorum and constitutes attorney work product within the meaning of Federal Rule of Civil Procedure 26(b)(3) and its state-law equivalents. The Work Product also falls within the protections of the attorney-client privilege to the extent it reflects or embodies confidential communications between Counsel and its consulting expert made for the purpose of facilitating the provision of legal advice. Graystone shall treat all Work Product as protected and shall take all reasonable steps to maintain the privileged and confidential nature of such materials.
No Graystone Work Product shall be shared with, disclosed to, or made available to any third party — including, without limitation, Quorum personnel, Palomar personnel, regulatory authorities, insurance carriers, or any other person or entity — without the prior written authorization of Calderwood & Harkness. Any request for disclosure of Work Product received by Graystone from any source shall be immediately directed to Alan Burke at Calderwood & Harkness prior to any response or production.
All deliverables prepared by Graystone under this SOW are to be directed exclusively to Calderwood & Harkness at the address set forth above or via the secure communication channels established between the parties. Graystone shall not communicate substantive findings, preliminary conclusions, or investigative results directly to Quorum personnel or any other party without Counsel's express prior approval. This restriction is essential to the maintenance of the privilege and the integrity of the investigation.
Reference is made to the Common Interest Agreement dated May 10, 2023, by and between Quorum Insurance Holdings Corp. and Atlas Mutual Insurance Company ("Atlas Mutual"), Quorum's primary cyber-liability insurer, under Policy No. CYB-2023-041587, Claim No. CYB-CLM-2023-05892 (the "Common Interest Agreement"). Pursuant to the terms of the Common Interest Agreement, certain privileged information, including Graystone Work Product, may be shared with Atlas Mutual and its authorized representatives to the extent necessary for purposes of coverage analysis and claims adjustment. However, any such sharing of privileged information with Atlas Mutual shall be conducted exclusively through Calderwood & Harkness. Graystone shall not share Work Product or communicate findings directly with Atlas Mutual, its claims adjusters, panel counsel, or any other representative of the insurer without prior written authorization from Calderwood & Harkness.
2. BACKGROUND AND CONTEXT
2.1 The Client
Quorum Insurance Holdings Corp. is a top-25 U.S. insurance holding company with operating subsidiaries licensed in all fifty states and the District of Columbia. Quorum reported annual revenue of approximately $4.82 billion for fiscal year 2022. The company employs approximately 11,400 individuals across its various operating entities and maintains a market capitalization of approximately $6.1 billion as of the date of this SOW.
Quorum offers a diversified portfolio of insurance products spanning personal lines (homeowners, auto, umbrella), commercial lines (general liability, commercial property, commercial auto, workers' compensation), and specialty insurance (professional liability, directors and officers liability, cyber liability, and surety). Quorum operates a proprietary digital underwriting platform branded "QuorumEdge," which leverages advanced analytics and machine learning to support risk assessment and policy pricing across its product lines. The QuorumEdge platform is integral to Quorum's competitive positioning and processes significant volumes of policyholder and claims data on a daily basis.
The following individuals at Quorum are relevant to this engagement:
• Margaret D. Calloway, Chief Executive Officer
• Thomas R. Whitfield, General Counsel
• David Naranjo, Chief Information Security Officer ("CISO")
• Jennifer Liang, Chief Privacy Officer ("CPO")
• Robert Wentworth, Senior Vice President, Claims Operations
• Priya Deshmukh, Vice President, Vendor Risk Management
Quorum's General Counsel, Mr. Whitfield, authorized the engagement of Calderwood & Harkness to provide legal advice in connection with the data security incident described herein, and Calderwood & Harkness has in turn retained Graystone under the privilege framework set forth in Section 1 above.
2.2 The Vendor — Palomar Data Solutions, Inc.
Palomar Data Solutions, Inc. is a Texas corporation headquartered at 7100 Greenville Avenue, Suite 450, Dallas, TX 75231. Palomar provides claims data processing, document management, data analytics, and related technology services to mid-to-large insurance carriers throughout the United States. Palomar maintains data processing facilities in Dallas, Texas, and Ashburn, Virginia, and employs approximately 620 individuals.
Quorum is Palomar's second-largest client by revenue. The annual contract value of the Quorum-Palomar relationship is approximately $16.3 million as most recently amended. Under the terms of the engagement, Palomar processes significant volumes of Quorum policyholder and claimant data in connection with claims administration, document management, and analytics services across multiple Quorum operating subsidiaries.
The Quorum-Palomar relationship is governed by a Master Services Agreement originally executed on November 12, 2019 (the "MSA"), as subsequently amended by Amendment 1, dated March 3, 2021, and Amendment 2, dated September 15, 2022. The MSA and its amendments establish the contractual framework for the services provided by Palomar, including detailed provisions regarding data security, privacy, breach notification, indemnification, and vendor cooperation obligations. The specific contractual provisions relevant to this investigation are discussed in greater detail in Section 2.4 below.
The following individuals at Palomar are relevant to this engagement:
• Marcus J. Trevino, Chief Executive Officer
• Anita Raghavan, Chief Technology Officer ("CTO")
• Derek Copeland, General Counsel
Palomar is represented by outside counsel Mercer, Haight & Dunlop LLP, a Dallas-based law firm. The lead partner on the Palomar engagement at Mercer, Haight & Dunlop is Catherine Langford. All communications with Palomar regarding this incident that touch on legal matters are expected to be channeled through Ms. Langford's office.
2.3 The Incident — Summary of Known Facts
Based on information available to Calderwood & Harkness and Quorum as of the date of this SOW, the following summarizes the known facts regarding the data security incident that is the subject of this investigation.
On or about March 14, 2023, a threat actor reportedly gained unauthorized access to Palomar's network environment. Based on preliminary information provided by Palomar to Quorum, the initial intrusion was achieved by exploiting CVE-2023-0669, a known remote code execution vulnerability affecting Severin Corporation's GoAnywhere Managed File Transfer ("GoAnywhere MFT") software. GoAnywhere MFT is a widely used enterprise file transfer solution, and CVE-2023-0669 was publicly disclosed and assigned a critical severity rating in early February 2023. A vendor patch for CVE-2023-0669 was released by Severin Corporation on or about February 7, 2023. Palomar maintained one or more GoAnywhere MFT appliances as part of its infrastructure for secure file transfers with its clients, including Quorum.
Palomar's internal Security Operations Center ("SOC") detected anomalous outbound data transfers from Palomar's network environment on April 18, 2023. This detection triggered an internal investigation by Palomar's information security team, which confirmed the presence of unauthorized access and initiated containment measures. The window of unauthorized access and potential data exfiltration is currently estimated at approximately thirty-five (35) days, spanning from the believed initial compromise date of March 14, 2023, through the detection and initiation of containment on April 18, 2023. This estimate is preliminary and subject to refinement through the forensic investigation.
Palomar's General Counsel, Derek Copeland, notified Quorum's General Counsel, Thomas R. Whitfield, and Quorum's CISO, David Naranjo, of the incident via email on April 21, 2023. This notification occurred approximately three (3) business days after Palomar's internal discovery of the incident on April 18, 2023, and approximately twenty-four (24) hours past the forty-eight (48)-hour contractual notification requirement set forth in Section 9.4 of the MSA. The timeliness and adequacy of Palomar's notification to Quorum is a matter of legal significance and is among the issues that Calderwood & Harkness is analyzing in connection with Palomar's contractual obligations.
The incident potentially exposed personally identifiable information ("PII"), protected health information ("PHI"), and financial data belonging to Quorum policyholders and claimants whose data was processed by Palomar under the MSA. The specific categories, volume, and number of individuals whose data may have been compromised are not yet known with certainty and are among the primary objectives of this forensic investigation.
Following receipt of Palomar's notification, Quorum's General Counsel authorized the engagement of Calderwood & Harkness LLP as outside counsel effective May 4, 2023, under Matter No. 1025-00006. Calderwood & Harkness subsequently retained Graystone Forensics LLC under privilege on May 5, 2023, pursuant to the Retention Letter, for the purpose of conducting the forensic investigation described in this SOW.
2.4 Relevant Contractual Context
The MSA between Quorum and Palomar contains extensive provisions governing Palomar's data security obligations in connection with its processing of Quorum data. Of particular relevance to this investigation is Exhibit D to the MSA (the "Data Security Exhibit"), as amended by Amendment 2, dated September 15, 2022. The Data Security Exhibit, as amended, imposed the following obligations on Palomar, among others:
(a) Commercially Reasonable Safeguards. Palomar was required to maintain commercially reasonable administrative, technical, and physical safeguards designed to protect the confidentiality, integrity, and availability of Quorum data processed under the MSA. Such safeguards were to be consistent with industry standards and commensurate with the sensitivity of the data processed.
(b) Vulnerability and Patch Management. Palomar was required to patch critical vulnerabilities within thirty (30) days of the release of a vendor-issued patch. This requirement was specifically added in Amendment 2 (September 15, 2022) following a vendor risk assessment conducted by Quorum's Vendor Risk Management team. The failure of Palomar to patch CVE-2023-0669 within the required thirty-day window — given that the Severin Corporation patch was released on or about February 7, 2023, and the exploit occurred on or about March 14, 2023, approximately thirty-five (35) days after patch release — is a central issue in this investigation and in Calderwood & Harkness's analysis of Palomar's contractual compliance.
(c) Annual Penetration Testing. Palomar was required to conduct annual penetration testing of its network environment, including systems used to process Quorum data, and to provide Quorum with a summary of testing results and remediation actions.
(d) SOC 2 Type II Reporting. Palomar was required to provide Quorum with a SOC 2 Type II report on an annual basis, covering the design and operating effectiveness of controls relevant to security, availability, and confidentiality. Palomar's most recent SOC 2 Type II audit was conducted by Kessler, Park & Associates CPA, PLLC, a Dallas-based accounting firm. The engagement partner for the Palomar SOC 2 audit was Vivian Park. The scope, findings, and any noted exceptions in the most recent SOC 2 report are relevant to the assessment of Palomar's security posture and are within the scope of this investigation to the extent they bear on the incident.
In addition, the MSA requires Palomar to carry minimum cyber-liability insurance coverage of $10 million, as specified in Exhibit E to the MSA. Calderwood & Harkness is separately analyzing the adequacy and applicability of Palomar's cyber-liability coverage in connection with potential indemnification claims.
Understanding the full extent and root cause of Palomar's failure to patch CVE-2023-0669 within the contractually required thirty-day window is a critical objective of this investigation. Graystone's findings on this point will directly inform Counsel's legal analysis of Palomar's liability under the MSA, including potential claims for breach of contract, indemnification, and contribution.
3. ENGAGEMENT OF GRAYSTONE FORENSICS LLC
3.1 Firm Overview
Graystone Forensics LLC is a Virginia limited liability company headquartered at 1950 Old Gallows Road, Suite 600, Tysons Corner, VA 22182. Graystone specializes in cybersecurity incident response, digital forensics, threat intelligence, and expert advisory services for large enterprises, financial institutions, and their legal counsel. Graystone has conducted forensic investigations in connection with data security incidents across a wide range of industries, including insurance, financial services, healthcare, and critical infrastructure. Graystone's professionals hold certifications including GIAC Certified Forensic Examiner (GCFE), GIAC Certified Forensic Analyst (GCFA), Certified Information Systems Security Professional (CISSP), and Penrose Technologies Certified Examiner (EnCE), among others.
The following Graystone personnel are designated as leads for this engagement:
• Engagement Lead: Dr. Nolan Briggs, Managing Director, Incident Response. Dr. Briggs will provide overall strategic direction and quality assurance for the investigation. Dr. Briggs holds a Ph.D. in Computer Science from Carnegie Mellon University and has led forensic investigations in over seventy data security incidents involving large-scale data exfiltration.
• Analyst Lead: Kendra Faulkner, Senior Forensic Analyst. Ms. Faulkner will manage the day-to-day execution of the forensic investigation, including forensic imaging, log analysis, malware analysis, and report preparation. Ms. Faulkner holds GCFA and EnCE certifications and has over twelve years of experience in digital forensics and incident response.
3.2 Reporting Relationship
The reporting and communication protocols for this engagement are designed to maintain the attorney-client privilege and attorney work product protections applicable to Graystone's work under this SOW. The following protocols shall govern the reporting relationship between Graystone and Calderwood & Harkness:
(a) Graystone reports to and takes direction exclusively from Calderwood & Harkness LLP. All substantive direction regarding the scope, priorities, and focus of the investigation shall come from Counsel.
(b) The primary point of contact at Calderwood & Harkness for all matters relating to this engagement is Alan Burke, Lead Associate, Privacy & Data Security Practice Group, Washington, D.C. office. Mr. Burke may be reached at (202) 555-0147 (direct) or aburke@calderwoodharkness.com (encrypted email preferred).
(c) The supervisory attorney for this engagement is Kevin Ostrowski, Responsible Partner, Privacy & Data Security Practice Group, Washington, D.C. office.
(d) All written reports, memoranda, and substantive findings produced by Graystone are to be delivered to Alan Burke, with copies to Kevin Ostrowski. Deliverables shall be transmitted via the secure file-sharing platform designated by Calderwood & Harkness or, where appropriate, via encrypted email.
(e) Graystone may coordinate with Quorum's CISO, David Naranjo, and members of Quorum's IT security team for technical access and evidence preservation purposes as reasonably necessary to conduct the investigation. However, such coordination shall occur only with the prior authorization of Calderwood & Harkness and shall be subject to the privilege protocols established by Counsel. In particular, Graystone shall not share substantive findings, preliminary conclusions, or draft reports with Quorum personnel without Counsel's express prior approval.
(f) Graystone may coordinate with Palomar's CTO, Anita Raghavan, and members of Palomar's technical team as necessary to obtain access to systems, data, and personnel required for the investigation. All such coordination shall occur only under the direction of and with the prior approval of Calderwood & Harkness. All communications between Graystone and Palomar personnel, whether written or verbal, shall be documented by Graystone and copies of any written communications shall be provided to Counsel. To the extent practicable, a Calderwood & Harkness attorney should participate in substantive communications between Graystone and Palomar personnel.
4. SCOPE OF INVESTIGATION
4.1 Primary Objectives
The forensic investigation to be conducted by Graystone under this SOW shall address the following primary objectives. These objectives are established by Counsel to support the provision of legal advice to Quorum regarding the data security incident, including analysis of regulatory notification obligations, contractual remedies against Palomar, litigation exposure, insurance coverage, and risk mitigation. Graystone shall conduct its investigation with a view toward developing factual findings and technical conclusions sufficient to support Counsel's legal analysis across each of these areas.
4.1.1 Threat Actor Entry Vector Determination
A critical first objective of the investigation is to confirm or rule out CVE-2023-0669, the GoAnywhere MFT remote code execution vulnerability, as the initial attack vector by which the threat actor gained unauthorized access to Palomar's network environment. While Palomar has represented that the initial intrusion was achieved through exploitation of this vulnerability, independent forensic verification is essential both for the integrity of the investigation and for Counsel's ability to rely on the findings in connection with legal advice and potential litigation.
Graystone shall undertake the following activities in furtherance of this objective:
(a) Identify the specific GoAnywhere MFT appliance(s) deployed within Palomar's environment that may have been affected, including the software version number(s), patch levels as of the date of the initial compromise, and the configuration details of each appliance (including, without limitation, whether the administrative console was exposed to the public internet, whether multi-factor authentication was enabled for administrative access, and whether the appliance was deployed behind appropriate network segmentation controls).
(b) Determine whether the vendor-issued patch for CVE-2023-0669, released by Severin Corporation on or about February 7, 2023, was available to Palomar and was not applied within thirty (30) days of its release. If the patch was not applied within that timeframe, Graystone shall determine the actual date on which the patch was applied (if ever) and the duration of the period during which the vulnerability remained unpatched and exploitable.
(c) Identify any additional vulnerabilities — whether in the GoAnywhere MFT software, in other Palomar systems, or in third-party components — that were exploited by the threat actor during the course of the intrusion, either as part of the initial compromise or during subsequent stages of the attack.
(d) Assess whether any other attack vectors, including but not limited to spear-phishing, credential compromise (including credential stuffing or brute-force attacks), watering hole attacks, supply chain compromise, or insider threat activity, were used by the threat actor in conjunction with or independently of the GoAnywhere MFT exploitation to gain or maintain access to Palomar's network environment.
4.1.2 Timeline of Unauthorized Access
Graystone shall establish a comprehensive and forensically supported timeline of the threat actor's unauthorized access to Palomar's network environment. The timeline is essential for Counsel's analysis of notification obligations (which in many jurisdictions are triggered by the date of discovery of unauthorized access), contractual compliance, and the assessment of the scope and severity of the incident.
Graystone shall undertake the following activities in furtherance of this objective:
(a) Establish the precise date and time of initial unauthorized access to Palomar's network environment. Based on information currently available, the initial compromise is believed to have occurred on or about March 14, 2023, but this date requires independent forensic confirmation.
(b) Map the full chronology of the threat actor's presence in Palomar's network environment from the date and time of initial access through the date and time of detection and initiation of containment measures on April 18, 2023. This chronology should identify, to the extent forensically determinable, the key phases of the attack, including initial access, reconnaissance, privilege escalation, lateral movement, data staging, and data exfiltration.
(c) Identify the specific date range or date ranges of active data exfiltration, as distinguished from periods during which the threat actor was present in the network but engaged in reconnaissance, lateral movement, or other preparatory activity. This distinction is significant for determining the volume and nature of data potentially compromised.
(d) Confirm or refine the current estimate of an approximately thirty-five (35)-day exfiltration window (March 14, 2023, through April 18, 2023). Graystone should assess whether the actual period of active data exfiltration was shorter, longer, or coextensive with the full period of unauthorized access.
4.1.3 Lateral Movement and Persistence Mechanisms
Graystone shall trace the threat actor's lateral movement through Palomar's network environment to determine the scope and breadth of the compromise. Understanding the full extent of the threat actor's access is necessary both for identifying the data at risk and for assessing Palomar's network security architecture and its effectiveness (or lack thereof) in limiting the impact of the breach.
Graystone shall undertake the following activities in furtherance of this objective:
(a) Trace the threat actor's lateral movement from the initial point of compromise (believed to be the GoAnywhere MFT appliance) to other systems, servers, databases, and file repositories within Palomar's network environment, with particular focus on systems containing or processing Quorum data.
(b) Identify any persistence mechanisms deployed by the threat actor to maintain access to Palomar's environment, including but not limited to web shells, scheduled tasks, registry modifications, implanted backdoors, compromised credentials, remote access tools, or modifications to legitimate remote access infrastructure.
(c) Identify any additional tools, scripts, or software deployed by the threat actor within Palomar's environment, including tools used for credential harvesting, privilege escalation, network scanning, data staging, data compression, or data exfiltration.
(d) Determine which specific Palomar systems, servers, databases, file servers, and file repositories were accessed by the threat actor, including whether the threat actor accessed administrative consoles, domain controllers, backup systems, or other sensitive infrastructure components.
(e) Assess whether the threat actor gained access to Palomar's claims processing environment specifically used for Quorum data, as distinguished from environments used to process data for other Palomar clients. This distinction is important for determining the scope of the Quorum-specific impact and for limiting, if possible, the population of potentially affected individuals to Quorum-related data subjects.
4.1.4 Identification of Exfiltrated Data Sets
The identification of the specific data that was exfiltrated from Palomar's environment, or to which the threat actor had access, is among the most critical objectives of this investigation. Counsel's analysis of notification obligations, affected-individual counts, and the overall severity of the incident depends directly on this determination.
Graystone shall undertake the following activities in furtherance of this objective:
(a) Identify with as much specificity as forensically possible the data files, databases, structured data sets, and/or unstructured data that were actually exfiltrated from Palomar's network environment by the threat actor. Where actual exfiltration can be confirmed through network traffic analysis, log review, or other forensic evidence, Graystone shall document the specific data sets involved.
(b) Where actual exfiltration cannot be confirmed for specific data sets but the threat actor had access to systems containing such data, Graystone shall identify those data sets and characterize the nature of the access (e.g., read access, directory listing, file access timestamps, query execution logs).
(c) Determine the volume of data exfiltrated, measured both in total file size (gigabytes/terabytes) and, to the extent determinable, in the number of records or files involved.
(d) Identify whether the exfiltrated data included Quorum policyholder and claimant data specifically, or whether the exfiltration involved a broader data set that may include data belonging to other Palomar clients. If multi-client data was compromised, Graystone shall attempt to isolate the Quorum-specific portion to the extent feasible.
(e) Recover or reconstruct, to the extent forensically possible, a representative sample or a complete manifest of the files and data sets exfiltrated by the threat actor. This may include analysis of staging directories, compressed archives, and exfiltration tool logs, as well as correlation with backup data and known file inventories.
4.1.5 Assessment of Compromised Data Types
For data determined to be Quorum-related (whether exfiltrated or accessed by the threat actor), Graystone shall assess the specific categories and types of data elements compromised. This assessment is essential for Counsel's state-by-state analysis of notification obligations, as different jurisdictions define "personal information" and trigger notification requirements based on specific combinations of data elements.
Graystone shall determine whether the compromised data includes any of the following categories:
(a) Personally Identifiable Information (PII): Including but not limited to full names, dates of birth, Social Security numbers, driver's license numbers, state identification numbers, passport numbers, and other government-issued identification numbers.
(b) Financial Information: Including but not limited to bank account numbers, bank routing numbers, payment card numbers (credit and debit), card verification values (CVVs), PINs, and financial account credentials.
(c) Protected Health Information (PHI): Including but not limited to health conditions, medical diagnoses, diagnosis codes (ICD-10), treatment information, provider information, health plan identifiers, and other information that constitutes individually identifiable health information as defined under the Health Insurance Portability and Accountability Act of 1996 ("HIPAA"), 45 C.F.R. § 160.103. PHI exposure is particularly relevant given that Palomar processes claims data for Quorum's workers' compensation and health-related insurance lines.
In addition to the foregoing, Graystone shall:
(d) Identify the number of unique individuals whose data was compromised, broken down by data type and data element category. This analysis should distinguish between individuals for whom only basic contact information (e.g., name and address) was compromised versus individuals for whom sensitive data elements (e.g., Social Security numbers, financial account numbers, PHI) were compromised.
(e) To the extent possible using available data fields and records, identify or facilitate the identification of the specific affected individuals by state of residence. State-of-residence classification is critical for Calderwood & Harkness's analysis of notification obligations under the patchwork of state data breach notification laws, which vary in their definitions of triggering data elements, notification timing requirements, and regulatory reporting obligations.
(f) The detailed data mining and affected individual identification required to support the notification process is addressed as a distinct workstream in Section 4.2 below.
4.1.6 Threat Actor Attribution
Graystone shall assess the available evidence to determine or narrow the identity or group affiliation of the threat actor responsible for the intrusion. While definitive attribution is not always possible in cybersecurity investigations, even partial attribution can inform the assessment of ongoing risk, the likelihood of data monetization or public exposure, and the appropriate incident response strategy.
Graystone shall undertake the following activities in furtherance of this objective:
(a) Analyze available indicators of compromise ("IOCs"), including IP addresses, domain names, file hashes, malware signatures, and command-and-control infrastructure, and correlate these indicators with known threat intelligence databases, including open-source intelligence (OSINT) repositories, commercial threat intelligence feeds, and government advisories.
(b) Assess the threat actor's tactics, techniques, and procedures ("TTPs") as observed during the investigation and map them against the MITRE ATT&CK framework to identify patterns consistent with known threat groups or ransomware operations.
(c) Determine whether the attack is attributable to a known threat group, advanced persistent threat (APT) actor, or ransomware/extortion operation. Given the exploitation of CVE-2023-0669 as the initial vector, Graystone should specifically assess whether the attack is linked to the Strathmore & Co. ransomware group or other threat groups known to have exploited this vulnerability.
(d) Assess whether the threat actor has communicated any ransom demands to Palomar, published or threatened to publish exfiltrated data on dark web leak sites, offered data for sale on underground marketplaces, or otherwise attempted to monetize the stolen data.
(e) Assess the ongoing risk of data exposure or misuse, including the likelihood that exfiltrated data will be published, sold, or used for identity theft, fraud, or other harmful purposes.
4.1.7 Assessment of Palomar's Security Posture
Graystone shall conduct an assessment of Palomar's cybersecurity practices and security posture as they relate to the incident and its root causes. This assessment is undertaken at the direction of Counsel to support Calderwood & Harkness's legal analysis of Palomar's compliance with its contractual obligations under the MSA, including the Data Security Exhibit, and to inform Counsel's evaluation of potential claims against Palomar for breach of contract, negligence, and indemnification. The findings of this assessment constitute privileged attorney work product.
Graystone shall address the following elements in its assessment:
(a) Patch Management Practices. Evaluate Palomar's patch management policies, procedures, and actual practices, with specific focus on the circumstances surrounding the failure to patch CVE-2023-0669 in a timely manner. This evaluation should address whether Palomar had a documented vulnerability management program, whether the CVE-2023-0669 advisory was identified and triaged in a timely manner, the reason(s) for the delay in patching, and whether the failure was an isolated incident or indicative of a systemic deficiency in Palomar's patch management practices.
(b) Endpoint Detection and Response (EDR). Review Palomar's EDR capabilities, including the specific EDR tools deployed, the coverage of those tools across Palomar's environment, and the effectiveness of EDR in detecting the threat actor's activities during the approximately thirty-five-day period of unauthorized access.
(c) Network Segmentation. Assess the degree to which Palomar's network environment was segmented, including whether client data environments were isolated from one another and from general-purpose network segments, and whether the threat actor's lateral movement was facilitated by inadequate segmentation.
(d) Logging and Monitoring. Assess the adequacy of Palomar's logging and monitoring practices, including the types of logs maintained, log retention periods, the configuration and staffing of Palomar's SOC, and the effectiveness of automated alerting and anomaly detection mechanisms.
(e) Timeliness of Detection. Assess whether Palomar's detection of the incident on April 18, 2023 — approximately thirty-five days after the initial compromise — was timely given the indicators and forensic artifacts that were available during the period of unauthorized access, or whether earlier detection was feasible with reasonable logging, monitoring, and detection capabilities. This assessment should identify specific indicators or anomalies that were present but not detected or investigated by Palomar's security team during the intrusion window.
Note: The assessment of Palomar's security posture set forth in this Section 4.1.7 is to support Counsel's privileged legal analysis and is not intended as a general cybersecurity audit. The scope and depth of the assessment shall be directed by Counsel in coordination with Graystone as the investigation progresses.
4.2 Data Mining and Affected Individual Identification
Upon confirmation of the exfiltrated data sets and the data types compromised (as addressed in Sections 4.1.4 and 4.1.5 above), Graystone shall conduct or coordinate a data mining workstream to identify the specific individuals whose data was compromised. This workstream is essential for determining the population of individuals to whom notification may be required and for supporting the consumer notification process.
The data mining workstream shall produce a deduplicated master list of affected individuals containing the following data fields, to the extent such information is available in the compromised data sets:
• Full legal name (first name, middle name or initial, last name, suffix)
• Last known mailing address (street address, city, state, zip code)
• State of residence
• Data elements compromised for each individual (classified by category: PII, financial information, PHI)
• Specific data elements compromised (e.g., Social Security number, date of birth, driver's license number, bank account number, diagnosis code)
Graystone shall coordinate with Quorum's SVP, Claims Operations, Robert Wentworth, and VP, Vendor Risk Management, Priya Deshmukh, as necessary for purposes of record matching, deduplication, and validation against Quorum's internal policyholder and claimant databases. All such coordination shall be subject to the privilege protocols established by Counsel and shall be conducted with the prior authorization of Calderwood & Harkness.
The target completion date for the data mining and affected individual identification workstream is on or before early August 2023 (target: August 4, 2023). This timeline is driven by the need to complete state-by-state notification analysis and to initiate the consumer notification process within applicable statutory deadlines.
5. ACCESS AND COOPERATION REQUIREMENTS
5.1 Access to Palomar Systems and Data
The successful completion of this forensic investigation requires Graystone to have timely and adequate access to Palomar's network environment, systems, and data. Specifically, Graystone will require access to the following Palomar resources, at a minimum:
(a) Forensic images of the GoAnywhere MFT appliance(s) affected by the intrusion, including the file system, application logs, configuration files, and any associated databases.
(b) Forensic images of other affected servers, endpoints, and systems, including file servers, database servers, domain controllers, and any systems identified as having been accessed by the threat actor during the investigation.
(c) Network traffic logs, firewall logs, intrusion detection/prevention system (IDS/IPS) logs, VPN logs, proxy logs, DNS logs, and any SIEM or SOC platform logs maintained by Palomar for the period from at least January 1, 2023, through the date of containment and remediation.
(d) EDR telemetry data from Palomar's endpoint detection and response platform for the relevant time period.
(e) Palomar's security policies, procedures, and documentation, including vulnerability management policies, patch management logs, penetration testing reports, risk assessments, and the most recent SOC 2 Type II report issued by Kessler, Park & Associates CPA, PLLC.
(f) Access to Palomar's technical personnel, including the CTO, IT security team members, SOC analysts, and system administrators, for interviews and technical consultations as needed.
Calderwood & Harkness will coordinate access to Palomar systems and personnel with Palomar's General Counsel, Derek Copeland, and Palomar's outside counsel, Catherine Langford at Mercer, Haight & Dunlop LLP. Calderwood & Harkness will work with Palomar's counsel to establish an access protocol that facilitates the investigation while respecting applicable legal constraints and the interests of both parties.
Palomar is required under Section 9.5 of the MSA to cooperate fully with Quorum's investigation of security incidents affecting Quorum data, including providing access to relevant systems, logs, and personnel. Calderwood & Harkness will invoke the applicable MSA provisions as necessary to ensure that Graystone receives adequate and timely access. Any limitations on access, whether imposed by Palomar or its counsel, may be relevant to Counsel's analysis of Palomar's contractual compliance and will be documented as described below.
Graystone shall maintain a detailed log of all access requests submitted to Palomar, the date and manner of each request, the date and extent of access granted, and any limitations, conditions, restrictions, or refusals of access encountered. This log shall be provided to Calderwood & Harkness as part of each weekly status report and shall be included as an appendix to the Final Forensic Report.
5.2 Access to Quorum Systems and Data
In certain circumstances, Graystone may require access to Quorum's internal systems and data to the extent that Quorum data was transmitted to or from Palomar, for purposes of data mapping, record matching, deduplication, and validation of affected individual lists. Such access may include access to Quorum's policyholder and claimant databases, file transfer logs, and related systems.
Access to Quorum systems shall be coordinated through Quorum's CISO, David Naranjo, with Calderwood & Harkness's prior approval. Graystone shall submit access requests to Alan Burke at Calderwood & Harkness, who will coordinate with Mr. Naranjo and authorize access as appropriate. All access to Quorum systems shall be conducted in a manner consistent with Quorum's information security policies and the privilege protocols governing this engagement.
5.3 Evidence Preservation
Graystone shall ensure that forensic best practices are followed throughout the investigation for evidence preservation, chain of custody, and forensic imaging. Specifically:
(a) All forensic images shall be created using industry-standard forensic imaging tools and methodologies, with write-blockers employed where appropriate, and hash values (MD5 and SHA-256) calculated and recorded for each image at the time of creation to ensure integrity.
(b) Graystone shall maintain a comprehensive chain of custody log for all forensic images, physical and electronic evidence, artifacts, and other materials collected during the investigation. The chain of custody log shall document the identity of each item collected, the date, time, and manner of collection, the identity of the collecting analyst, and all subsequent transfers or access to the item.
(c) All evidence collected by Graystone in connection with this investigation is subject to the legal hold notice issued by Calderwood & Harkness on May 6, 2023 (the "Legal Hold Notice"). Graystone shall preserve all evidence in accordance with the Legal Hold Notice and shall not destroy, modify, or dispose of any evidence without prior written authorization from Calderwood & Harkness.
(d) Graystone shall store all forensic images and evidence in a secure, access-controlled environment consistent with the confidentiality and information security requirements set forth in Section 11 of this SOW.
6. DELIVERABLES AND REPORTING MILESTONES
6.1 Weekly Status Reports
Graystone shall provide weekly written status reports to Alan Burke, with a copy to Kevin Ostrowski, summarizing the progress of the investigation, key findings to date, outstanding items, upcoming activities, and any access or cooperation issues encountered. The weekly status reports are intended to keep Counsel informed of the investigation's progress on a real-time basis and to enable Counsel to provide timely direction and legal guidance.
Each weekly status report shall include, at a minimum, the following elements:
(a) A summary of investigation activities conducted during the reporting period.
(b) A summary of key findings or developments since the prior report, including any preliminary conclusions reached.
(c) A list of outstanding items, open questions, and areas requiring further investigation.
(d) A summary of any access requests submitted to Palomar, access granted, and any access issues or refusals encountered.
(e) Identification of any issues requiring Counsel's attention or direction.
(f) Anticipated activities for the following week.
Format: Email memorandum, clearly marked "PRIVILEGED AND CONFIDENTIAL — ATTORNEY-CLIENT PRIVILEGE / ATTORNEY WORK PRODUCT" in the subject line and at the top of the document body. Weekly status reports shall be transmitted via the secure communication channels designated by Calderwood & Harkness.
Due: Every Friday by 5:00 PM Eastern Time, commencing May 12, 2023.
6.2 Preliminary Forensic Findings Report
Target Delivery Date: On or before June 2, 2023 (approximately four weeks from investigation commencement).
Content: The Preliminary Forensic Findings Report shall set forth Graystone's preliminary conclusions and findings as of the report date regarding the following subjects:
(a) Entry vector confirmation or preliminary assessment (CVE-2023-0669 and any additional vectors identified).
(b) Preliminary timeline of unauthorized access, including best estimates for initial compromise date, lateral movement phases, and data exfiltration period.
(c) Preliminary assessment of the scope of compromise, including systems accessed by the threat actor and the data environments at risk.
(d) Initial assessment of exfiltrated data types and estimated volume.
(e) Preliminary threat actor attribution analysis, if sufficient indicators are available.
(f) Any critical or time-sensitive findings that bear on Counsel's notification analysis or other legal advice.
Purpose: The Preliminary Forensic Findings Report is intended to enable Calderwood & Harkness to begin its preliminary analysis of Quorum's notification obligations under applicable state and federal law, to advise Quorum on the anticipated scope and severity of the incident, and to inform early decision-making regarding incident response strategy, including whether early or expedited notification may be warranted.
Format: Formal written memorandum addressed to Calderwood & Harkness LLP, marked "PRIVILEGED AND CONFIDENTIAL — ATTORNEY-CLIENT PRIVILEGE / ATTORNEY WORK PRODUCT." The report shall be transmitted via the secure file-sharing platform designated by Calderwood & Harkness.
6.3 Final Forensic Report
Target Delivery Date: On or before mid-July 2023 (target: July 14, 2023, approximately ten weeks from investigation commencement).
Content: The Final Forensic Report shall set forth Graystone's comprehensive findings and conclusions addressing all primary objectives set forth in Section 4.1 of this SOW, including:
(a) Confirmed entry vector and detailed technical analysis of the initial compromise.
(b) Full timeline of unauthorized access, from initial compromise through detection and containment, with dates, times, and descriptions of key events.
(c) Detailed lateral movement analysis, including identification of all systems accessed by the threat actor and persistence mechanisms deployed.
(d) Complete identification and characterization of exfiltrated data sets, including volume and file/record counts.
(e) Assessment of compromised data types, including the categories of data elements compromised and the estimated number of affected individuals, broken down by data type.
(f) Threat actor attribution assessment, including IOCs, TTPs, and correlation with known threat groups.
(g) Assessment of Palomar's security posture, including patch management practices, EDR capabilities, network segmentation, logging and monitoring, and timeliness of detection.
(h) Any additional findings or observations material to Counsel's legal analysis.
Format: Formal written report addressed to Calderwood & Harkness LLP, marked "PRIVILEGED AND CONFIDENTIAL — ATTORNEY-CLIENT PRIVILEGE / ATTORNEY WORK PRODUCT."
The Final Forensic Report shall include supporting exhibits, appendices, and technical documentation, including but not limited to the following:
• Timeline charts depicting the chronology of the intrusion.
• Network diagrams illustrating the threat actor's path through Palomar's environment.
• Indicators of compromise (IOC) lists.
• Data classification summaries and exfiltration volume tables.
• Chain of custody log.
• Access request log.
6.4 Data Mining Deliverable
Target Delivery Date: On or before early August 2023 (target: August 4, 2023).
Content: The data mining deliverable shall consist of a deduplicated master list of affected individuals whose data was compromised in the incident, together with the associated data fields described in Section 4.2 of this SOW (full name, last known mailing address, state of residence, data elements compromised by category and specific element).
Format: Encrypted electronic file(s) in a format suitable for ingestion by the consumer notification vendor (e.g., delimited flat file, encrypted Excel workbook). The deliverable shall be transmitted securely to Calderwood & Harkness via the designated secure file-sharing platform or encrypted transfer mechanism. Under no circumstances shall the data mining deliverable be transmitted via unencrypted email or other unsecured channels.
Significance: The data mining deliverable is critical for several downstream workstreams, including: