legal-hold-notice.docx

1025-00006 · Graystone Forensics LLC · Incident Assessment & Forensic Investigation

legal-hold-notice.docx DOCUMENT Data Privacy

40 / 88 ← → ✕

PRIVILEGED AND CONFIDENTIAL ATTORNEY-CLIENT PRIVILEGED / ATTORNEY WORK PRODUCT DO NOT FORWARD OR DISCLOSE WITHOUT AUTHORIZATION FROM THE OFFICE OF THE GENERAL COUNSEL

LEGAL HOLD NOTICE

Preservation of Documents and Electronically Stored Information

FROM: Thomas R. Whitfield, General Counsel Quorum Insurance Holdings Corp. 400 Constitution Plaza, Suite 2200 Hartford, CT 06103

TO: David Naranjo, Chief Information Security Officer Robert Wentworth, Senior Vice President, Claims Operations

CC: Jennifer Liang, Chief Privacy Officer Priya Deshmukh, Vice President, Vendor Risk Management

DATE: May 6, 2023

RE: LEGAL HOLD NOTICE — Preservation of Documents and Electronic Information Relating to the Palomar Data Solutions Data Security Incident

PRIORITY: IMMEDIATE ACTION REQUIRED

— THIS NOTICE REQUIRES YOUR IMMEDIATE ATTENTION AND COMPLIANCE —

Section 1: Purpose and Legal Obligation

This memorandum constitutes a formal Legal Hold Directive issued by the Office of the General Counsel of Quorum Insurance Holdings Corp. ("Quorum" or the "Company"). It is directed to the individuals named above, as well as all directors, managers, and staff within the Information Technology Department and Claims Operations Department who may possess or have access to materials relevant to the matters described herein. The obligations imposed by this notice are mandatory, and compliance is required immediately upon receipt.

Quorum has a legal duty to preserve all documents, electronically stored information ("ESI"), and tangible materials that are potentially relevant to the data security incident originating from Quorum's third-party claims-processing vendor, Palomar Data Solutions, Inc. ("Palomar"), headquartered at 7100 Greenville Avenue, Suite 450, Dallas, TX 75231. This preservation duty arises under applicable federal and state law, including the Federal Rules of Civil Procedure, applicable state rules of civil procedure, and relevant regulatory requirements. The duty attaches upon the reasonable anticipation of litigation, regulatory investigation, or enforcement proceedings, and the Company has determined that such anticipation exists with respect to the incident described in this notice.

In connection with this incident, Quorum has retained the law firm of Calderwood & Harkness LLP, located at 1700 K Street NW, Suite 900, Washington, D.C. 20006, to serve as outside counsel and to advise on all aspects of the incident response. Calderwood & Harkness's engagement encompasses, without limitation, the forensic investigation of the incident, the evaluation and coordination of regulatory notification obligations across all affected jurisdictions, preparation for and response to potential regulatory inquiries or enforcement proceedings by state attorneys general, state departments of insurance, the U.S. Department of Health and Human Services Office for Civil Rights, or any other federal or state regulatory authority, and the evaluation and pursuit of potential contractual and tort claims against Palomar. Kevin Ostrowski serves as the responsible partner, and Alan Burke serves as the lead associate on this matter. The Calderwood & Harkness matter number for this engagement is 1025-00006.

At the direction of Calderwood & Harkness LLP, and under the protection of the attorney-client privilege and the work product doctrine, Quorum has also retained Graystone Forensics LLC, located at 1950 Old Gallows Road, Suite 600, Tysons Corner, VA 22182, to conduct a comprehensive forensic investigation of the data security incident. Graystone Forensics has been retained as a consultant to counsel, and all communications with Graystone Forensics, as well as all reports, analyses, findings, and work product generated by Graystone Forensics in connection with this engagement, are privileged and confidential.

The preservation obligation imposed by this notice is immediate and ongoing. Effective upon your receipt of this notice, no documents, data, or other materials within the scope of this legal hold may be deleted, destroyed, altered, overwritten, concealed, or otherwise disposed of, regardless of any existing retention schedules, routine document destruction policies, automated purging protocols, or any other Company policy or practice that would otherwise permit or require the disposition of such materials. This legal hold supersedes and takes precedence over all such policies and practices to the extent of any conflict.

Failure to comply with this legal hold may result in serious adverse legal consequences for Quorum, including court-imposed sanctions, adverse inference instructions, monetary penalties, and other remedial measures. In addition, individual employees who fail to comply with this notice may be subject to disciplinary action, up to and including termination of employment, in accordance with Company policy. The Company takes its preservation obligations with the utmost seriousness, and each recipient of this notice is expected to do the same.

Section 2: Background — Summary of the Incident

The following summary is provided to assist recipients in understanding the nature and scope of the incident giving rise to this legal hold. This summary is based on information available as of the date of this notice and is necessarily preliminary. The forensic investigation being conducted by Graystone Forensics LLC remains ongoing, and additional facts may emerge that expand or refine the scope of this hold. Recipients should interpret the scope of this hold broadly and err on the side of preserving materials where any doubt exists as to their relevance.

Initial Unauthorized Access. On or about March 14, 2023, an unauthorized threat actor gained access to the internal network of Palomar Data Solutions, Inc. The threat actor exploited a known vulnerability, designated as CVE-2023-0669, affecting Palomar's GoAnywhere MFT (Managed File Transfer) appliance. CVE-2023-0669 is a pre-authentication command injection vulnerability in Severin Corporation's GoAnywhere MFT product, which was publicly disclosed in early February 2023 and for which a patch was made available by the vendor. Based on information provided by Palomar to date, it appears that Palomar had not applied the available patch to its GoAnywhere MFT instance at the time of the initial intrusion.

Duration of Unauthorized Access. The unauthorized access continued for approximately 35 days, from March 14, 2023 through April 18, 2023. During this period, the threat actor maintained persistent access to Palomar's network and may have accessed, copied, exfiltrated, or otherwise compromised data stored on or transmitted through Palomar's systems. The full extent of the data exfiltration, if any, is still under active investigation.

Detection. On April 18, 2023, Palomar's security operations center ("SOC") detected anomalous outbound data transfers originating from systems within Palomar's network. This detection event marks the end of the known exfiltration window, although further investigation may reveal additional periods of unauthorized activity.

Notification to Quorum. On April 21, 2023, Palomar's General Counsel, Derek Copeland, notified Quorum's General Counsel, Thomas R. Whitfield, and Quorum's Chief Information Security Officer, David Naranjo, via email of the security incident. Notably, Palomar's notification to Quorum on April 21, 2023 was provided approximately 24 hours past the 48-hour contractual notification deadline set forth in Section 9.4 of the Master Services Agreement between Quorum and Palomar, dated November 12, 2019 (as described further below). This delay in contractual notification is a matter of significant concern and is relevant to Quorum's evaluation of potential claims against Palomar.

Contractual Relationship. Palomar processes claims data for Quorum's personal lines division pursuant to a Master Services Agreement ("MSA") dated November 12, 2019. The MSA has been amended twice: by Amendment 1, executed March 3, 2021, which expanded the scope of Palomar's services to include data processing for Quorum's QuorumEdge digital underwriting platform, and by Amendment 2, executed September 15, 2022, which, among other things, updated data security requirements and service level commitments. The MSA and its amendments, including all exhibits and schedules (with particular relevance to Exhibit D — Data Security Exhibit and Exhibit E — Insurance Requirements), are critical documents within the scope of this legal hold.

Potentially Compromised Data. Based on the nature of Palomar's services to Quorum, the incident may have exposed personally identifiable information (PII), protected health information (PHI), and financial data belonging to Quorum policyholders and claimants across multiple states. The categories of data potentially at risk include, without limitation, names, addresses, dates of birth, Social Security numbers, driver's license numbers, policy numbers, claim numbers, medical records and treatment information associated with personal injury and workers' compensation claims, bank account and financial institution information, and payment card data. The precise scope and volume of compromised data remain under investigation by Graystone Forensics.

Ongoing Investigation. Recipients should understand that the scope of compromised data, the identity and motives of the threat actor, and the full timeline of the intrusion are all still under active investigation. Because the investigation is ongoing, this legal hold must be broadly interpreted to encompass all potentially relevant materials. If at any point during the course of the investigation additional categories of relevant materials are identified, supplemental hold notices may be issued.

Section 3: Scope of the Legal Hold — Categories of Information to Be Preserved

The scope of this legal hold is intentionally broad and must be interpreted liberally. When in doubt as to whether a particular document, communication, data file, or other material falls within the scope of this hold, you must preserve it and contact the Office of the General Counsel for guidance. The categories set forth below are illustrative and not exhaustive.

3.1 Subject Matter Scope

All documents, ESI, and materials relating to any of the following subject matters must be preserved:

(a) The data security incident at Palomar Data Solutions, Inc., including without limitation the unauthorized access to Palomar's network, the exploitation of CVE-2023-0669 in the GoAnywhere MFT appliance, any data exfiltration, the discovery and detection of the incident by Palomar's security operations center, the notification of Quorum by Palomar, and any remediation, containment, or mitigation measures taken by either Palomar or Quorum in response to the incident.

(b) All communications between Quorum and Palomar Data Solutions, Inc., including without limitation communications with Derek Copeland (General Counsel, Palomar), Marcus J. Trevino (any title or capacity at Palomar), Anita Raghavan (any title or capacity at Palomar), or any other Palomar personnel, regarding the security incident, data security matters generally, vulnerability management, software patching practices, system access controls, encryption standards, or any other topic relating to the security of data processed by Palomar on behalf of Quorum.

(c) The Master Services Agreement between Quorum and Palomar dated November 12, 2019, including Amendment 1 (executed March 3, 2021), Amendment 2 (executed September 15, 2022), and all exhibits, schedules, statements of work, and ancillary agreements, with particular attention to Exhibit D — Data Security Exhibit and Exhibit E — Insurance Requirements. This includes all drafts, redlines, negotiation correspondence, and execution copies of the foregoing.

(d) Quorum's vendor risk management files, assessments, due diligence records, questionnaires, scorecards, risk ratings, and audit reports relating to Palomar, including without limitation any SOC 2 Type II reports prepared by Kessler, Park & Associates CPA, PLLC or any other auditor, any penetration testing reports, any vulnerability assessment reports, and any remediation tracking documentation.

(e) Quorum's claims operations and claims data processing workflows involving Palomar, including all data transfers, data inventories, file specifications, data dictionaries, field mapping documentation, data flow diagrams, interface specifications, and process documentation describing the flow of data between Quorum's systems and Palomar's systems.

(f) All materials relating to the QuorumEdge digital underwriting platform data processing performed by Palomar, which was added to the scope of the Palomar relationship under Amendment 1 to the MSA, including any data specifications, integration documents, testing records, and operational procedures.

(g) Any data files, databases, data extracts, data sets, flat files, or structured or unstructured data transmitted to or received from Palomar at any time during the relevant time period, or copies thereof maintained in Quorum's systems.

(h) Quorum's internal investigations, analyses, assessments, memoranda, reports, presentations, or other work product relating to the security incident, whether prepared by Quorum personnel, Calderwood & Harkness LLP, Graystone Forensics LLC, or any other advisor.

(i) All communications with Calderwood & Harkness LLP, Graystone Forensics LLC, or any other outside counsel, consultant, or advisor retained in connection with the incident. These materials are subject to attorney-client privilege and/or the work product doctrine, and their preservation is essential both for the protection of Quorum's legal interests and for the maintenance of applicable privilege protections.

(j) All communications with Quorum's cyber-insurance broker, Whitmore Risk Advisors Inc. (contact: Sandra Whitmore-Kim), and all communications with Quorum's cyber-liability insurers, Atlas Mutual Insurance Company (Policy No. CYB-2023-041587, Claim No. CYB-CLM-2023-05892) and Pinnacle Surplus Lines Insurance Corp. (Policy No. XS-CYB-2023-7812), regarding the incident, coverage, claims, reserves, or any other matter relating to Quorum's insurance recovery in connection with the incident.

(k) Quorum's information security policies, procedures, standards, guidelines, and frameworks, including without limitation the Company's incident response plan, vendor risk management policy, data protection policy, acceptable use policy, access control policy, encryption policy, and any amendments, updates, or revisions thereto at any time during the relevant time period.

(l) System logs, access logs, network traffic logs, firewall logs, intrusion detection/prevention system (IDS/IPS) logs, authentication records (including Active Directory logs, multi-factor authentication logs, and VPN authentication logs), SFTP transfer logs, SIEM (Security Information and Event Management) data, and any other technical records maintained by Quorum's IT Department relating to systems that connect with, interface with, or transmit data to or from Palomar's systems.

(m) Internal communications among Quorum personnel — including personnel in the Information Technology, Claims Operations, Privacy, Legal, Vendor Risk Management, Compliance, Internal Audit, and executive leadership functions — regarding the incident, Quorum's response to the incident, or any of the subject matters described in this Section 3.1.

(n) Board of Directors and Audit Committee materials, including board meeting minutes, committee meeting minutes, board presentations, committee presentations, board memoranda, briefing materials, and any communications with or relating to Franklin Reeves, Audit Committee Chair, concerning the incident or Quorum's response thereto.

(o) Any regulatory filings, correspondence, or notifications relating to the incident, including without limitation notifications to state attorneys general, state departments of insurance, the U.S. Department of Health and Human Services, or any other federal, state, or local regulatory authority. These materials are to be preserved as they are generated throughout the course of the incident response.

(p) Consumer notification materials, including drafts and final versions of notification letters, email notifications, website postings, FAQ documents, call center scripts, call center logs, call recordings, and credit monitoring enrollment data for affected individuals. These materials are to be preserved as they are generated throughout the course of the incident response.

3.2 Custodians. The following individuals are designated as Primary Custodians under this legal hold. All files, email accounts (including archived email), network home directories, shared drives, workspaces, mobile devices, and any other repositories under the control of the following individuals must be preserved in their entirety to the extent they contain materials within the scope of this hold:

(a) David Naranjo, Chief Information Security Officer

(b) Robert Wentworth, Senior Vice President, Claims Operations

(d) Priya Deshmukh, Vice President, Vendor Risk Management

(e) Thomas R. Whitfield, General Counsel

(f) Margaret D. Calloway, Chief Executive Officer, to the extent her files, email, or other repositories contain materials relevant to the subject matters described in Section 3.1

(g) All IT Department staff members with responsibility for Palomar-related systems, data transfers, network connectivity, or system administration of any systems through which data is transmitted to or received from Palomar

(h) All Claims Operations Department staff members with direct involvement in Palomar data processing workflows, data submissions to Palomar, data receipt from Palomar, or quality assurance or reconciliation processes involving Palomar data

(i) Any other individual identified by any of the above-named custodians as having possession, custody, or control of relevant materials. The identification of such additional custodians must be reported promptly to the Office of the General Counsel so that appropriate preservation measures can be implemented.

Each Primary Custodian is responsible for identifying subordinates and direct reports who may have relevant materials and ensuring those individuals are notified of and comply with this legal hold.

3.3 Types of Materials

This legal hold applies to all forms of recorded information, in any medium or format, whether in electronic or physical form. The following is an illustrative, non-exhaustive list of the types of materials that must be preserved:

• Emails, including all attachments, inline images, and embedded content, regardless of the email platform or system in which they are stored (including Hollowell Systems, Strathmore Data Systems, email archival systems such as Enterprise Vault or Mimecast, personal email accounts used for Company business, and web-based email)

• Text messages, instant messages, Northgate Data Systems messages, Meridian Solutions messages, or communications from any other messaging or collaboration platform, including direct messages, group chats, and channel communications

• Voicemails, to the extent they are stored digitally or can be preserved in digital form

• Calendar entries and meeting invitations, including associated attachments and meeting notes

• Documents in all formats, including Microsoft Word, Excel, Northgate Services Inc., PDF, and all other word processing, spreadsheet, presentation, and document formats — including both draft and final versions, and including documents with tracked changes or comments

• Contracts, amendments, exhibits, schedules, statements of work, and all ancillary agreements

• Presentations, memoranda, reports, analyses, and briefing materials

• Spreadsheets, data files, databases, data extracts, CSV files, XML files, and all other forms of structured and unstructured data

• System logs, server logs, access logs, audit trails, network monitoring records, SIEM data, and all other forms of machine-generated or system-generated records

• Backup tapes, disk images, and archival media, including any backup media in offsite storage or with third-party backup service providers

• Notes (whether handwritten or electronic), notebooks, journals, and personal memoranda

• Physical documents and hard-copy files, including file folders, binders, printed correspondence, and paper records

• Photographs, screenshots, screen recordings, and video recordings

• Any other form of recorded information in any medium, including information stored on USB drives, external hard drives, optical media, or any other portable storage device

3.4 Time Period

The temporal scope of this legal hold encompasses all materials created, received, modified, or stored from January 1, 2019 through the present date and continuing until this legal hold is formally released in writing by the Office of the General Counsel. The start date of January 1, 2019 is selected to capture materials pre-dating the execution of the Master Services Agreement on November 12, 2019, including due diligence records, RFP materials, vendor evaluation documents, negotiation correspondence, and other materials generated during the vendor selection and contracting process.

The preservation obligation is ongoing and applies to materials created or received after the date of this notice that fall within the subject matter scope described in Section 3.1.

Section 4: Specific Preservation Instructions

The following specific instructions supplement the general preservation obligations described above. These instructions are directed to the named recipients and their respective departments.

4.1 Suspension of Routine Destruction

Effective immediately upon receipt of this notice, all routine document retention and destruction policies are suspended with respect to materials that fall within the scope of this legal hold. This suspension includes, without limitation:

(a) Automated email purging, mailbox size limitations, or auto-archive policies that result in the deletion or removal of email messages or attachments from custodian mailboxes or email archival systems;

(b) Backup tape recycling, overwriting, or degaussing schedules;

(c) Log rotation policies that result in the deletion or overwriting of system logs, access logs, firewall logs, SFTP logs, or any other technical records;

(d) Scheduled shredding or destruction of physical records;

(e) Any automated data lifecycle management processes that result in the deletion, archival to inaccessible media, or modification of data within the scope of this hold.

David Naranjo is directed to coordinate with IT Department staff to take immediate steps to suspend all automated deletion processes affecting email accounts, backup tapes, server logs, system logs, SIEM data, and any other electronically stored information for all custodians and systems identified in this notice. Mr. Naranjo shall confirm completion of these steps to the Office of the General Counsel in writing within 24 hours of receipt of this notice.

Robert Wentworth is directed to take immediate steps to halt any scheduled destruction of physical records within the Claims Operations Department relating to Palomar data, Palomar data processing workflows, or any other subject matter within the scope of this hold. Mr. Wentworth shall confirm completion of these steps to the Office of the General Counsel in writing within 24 hours of receipt of this notice.

4.2 ESI and Technical Data Preservation

The following specific instructions apply to the preservation of electronically stored information and technical data:

(a) David Naranjo shall coordinate with IT Department staff to ensure the immediate identification and preservation of all network logs, firewall logs, SFTP transfer logs, VPN logs, IDS/IPS logs, authentication records, SIEM data, and any other technical records relating to data flows, network connections, or system interactions between Quorum's systems and Palomar's systems. This includes logs from all perimeter devices, jump servers, file transfer systems, and any other infrastructure components involved in the Quorum-Palomar data exchange.

(b) All backup tapes, disk images, and archival media containing Palomar-related data as of and after March 14, 2023 must be identified, segregated, and preserved. No such media may be recycled, overwritten, degaussed, or otherwise altered or destroyed. If any such media are stored with a third-party vendor or offsite storage facility, Mr. Naranjo shall immediately contact the vendor to ensure preservation.

(c) All forensic images, copies, snapshots, or clones of Quorum systems taken in connection with the incident, whether by Quorum IT staff, Graystone Forensics LLC, or any other party, must be preserved in their original and unaltered state.

(d) No computing device — including workstations, laptops, servers, virtual machines, or mobile devices — used by any custodian named in this notice may be reformatted, reimaged, repurposed, recycled, donated, or disposed of without the prior written approval of the Office of the General Counsel. If any such device requires maintenance, repair, or replacement for operational reasons, contact the Office of the General Counsel before taking any action that could alter or destroy data stored on the device.

4.3 Cloud and Third-Party Systems

The preservation obligations imposed by this legal hold apply with equal force to data stored in cloud-based systems, software-as-a-service ("SaaS") platforms, platform-as-a-service ("PaaS") environments, and any other hosted or managed environments, including but not limited to:

(a) Any data in Palomar-hosted or Palomar-managed systems that Quorum personnel can access, download, or otherwise control must be preserved. To the extent that data resides exclusively on Palomar's systems and is not accessible to Quorum, preservation of such data will be addressed through separate legal channels with Palomar.

(b) All third-party systems used for claims processing, data analytics, document management, or other functions that contain Palomar-related data must be preserved. This includes, without limitation, the QuorumEdge digital underwriting platform and any third-party claims management systems, data warehouses, or analytics platforms to which Palomar data has been transmitted or from which Palomar data has been received.

(c) Cloud-based collaboration and file-sharing platforms (including Sundial Systems, Cobalt Ridge Systems, Hollowell Health IT, box, Larkspur Technologies, or any other platform) that may contain relevant documents, data, or communications must be preserved.

4.4 Physical Documents

All physical files, folders, binders, printed records, and any other tangible materials relating to the Palomar relationship, the Master Services Agreement, vendor audits, vendor risk assessments, and the security incident must be identified, secured, and preserved. Specific instructions include:

(a) Robert Wentworth shall identify and secure all Claims Operations physical files relating to Palomar data processing, including claims files, processing records, reconciliation reports, and any other physical documentation relating to the Quorum-Palomar relationship.

(b) Priya Deshmukh shall identify and secure all vendor risk management physical files relating to Palomar, including vendor assessment questionnaires, audit reports, site visit notes, correspondence, and any other physical documentation.

(c) All relevant physical documents shall be stored in a secure location and clearly labeled as subject to legal hold. No documents may be removed from the secured location without the prior authorization of the Office of the General Counsel.

Section 5: Obligations of Recipients

Each recipient of this Legal Hold Notice is personally responsible for compliance. The following specific obligations apply:

(a) Read and Understand. Each recipient must read and understand this notice in its entirety. If you have any questions about the scope or applicability of this hold, contact the Office of the General Counsel immediately. Do not assume that a particular category of materials is outside the scope of this hold without obtaining confirmation from the General Counsel's office.

(b) Immediate Identification and Preservation. Each recipient must immediately identify and preserve all materials within the scope of this hold that are in their possession, custody, or control. This includes materials stored on Company-issued devices, personal devices used for Company business, home offices, Company premises, cloud accounts, and any other location where relevant materials may be found.

(c) Cascade Notification. Each recipient must immediately notify any subordinates, direct reports, or other personnel within their departments who may possess relevant materials, and ensure that those individuals understand and comply with this legal hold. The names and titles of all individuals notified must be reported to the Office of the General Counsel within 72 hours of receipt of this notice.

(d) No Deletion, Destruction, or Modification. Each recipient must refrain from deleting, destroying, modifying, moving, or otherwise altering any materials within the scope of this hold. This prohibition applies regardless of the medium or format of the materials, and regardless of whether the materials are stored on Company systems or personal systems.

(e) Privilege Protocols. Recipients must not create any new documents — whether emails, memoranda, notes, or otherwise — that summarize, paraphrase, or comment on privileged communications with Calderwood & Harkness LLP or Graystone Forensics LLC, except in accordance with the privilege protocols established by the Office of the General Counsel. If you are uncertain whether a particular communication or document is subject to privilege protections, contact the Office of the General Counsel before disseminating it.

(f) Reporting of Destruction or Alteration. Each recipient must notify the Office of the General Counsel (Thomas R. Whitfield) and Calderwood & Harkness LLP (Kevin Ostrowski or Alan Burke) immediately if they become aware of any destruction, deletion, alteration, or loss of potentially relevant materials, whether intentional or inadvertent. Prompt reporting is essential to allow the Company to assess any potential prejudice and take appropriate remedial measures.

(g) Identification of Additional Sources. Each recipient must notify the Office of the General Counsel if they become aware of additional custodians, data sources, repositories, or systems not identified in this notice that may contain relevant materials. The scope of this hold is intended to be comprehensive, but additional sources may exist that are not currently known to the Office of the General Counsel.

Section 6: Confidentiality

This Legal Hold Notice and the existence of the underlying investigation are confidential and privileged. The following confidentiality obligations apply:

(a) Recipients must not disclose the contents of this notice, or the existence or substance of the underlying investigation, to any external parties — including, without limitation, Palomar Data Solutions personnel, vendors, customers, policyholders, claimants, media representatives, or any other third party — without the prior written authorization of the Office of the General Counsel.

(b) All communications regarding this matter with Calderwood & Harkness LLP and Graystone Forensics LLC are protected by the attorney-client privilege and/or the attorney work product doctrine. Recipients must take all necessary steps to maintain and protect these privileges, including by limiting access to privileged communications to those individuals who have a need to know and by marking privileged communications as such.

(c) Any external communications regarding the incident — including inquiries from media outlets, industry analysts, business partners, regulators, or any other external parties — must be directed immediately to the Office of the General Counsel or to BrightPath Consulting Group Inc., Quorum's retained crisis communications advisor. Under no circumstances should any recipient of this notice respond to external inquiries about the incident without prior authorization from the General Counsel's office.

(d) Internal discussions regarding the incident should be limited to those individuals who have a legitimate business need to participate in the incident response, and should be conducted in a manner that preserves applicable privileges. When in doubt, consult the Office of the General Counsel.

Section 7: Compliance Acknowledgment

Each named recipient of this Legal Hold Notice must sign and return the attached Acknowledgment and Compliance Certification form to Thomas R. Whitfield, General Counsel, within 48 hours of receipt of this notice. The Acknowledgment and Compliance Certification form is attached hereto as Attachment A.

By executing the Acknowledgment, each recipient confirms that they:

(a) Have read and understood this Legal Hold Notice in its entirety;

(b) Will comply with all preservation obligations described herein;

(c) Have taken immediate steps to identify and preserve all materials within the scope of this hold that are in their possession, custody, or control; and

(d) Will cascade the hold to all relevant subordinates and direct reports within their respective departments, and will ensure that those individuals also comply with this hold.

Please be advised that the preservation obligation imposed by this legal hold is continuing. The obligation does not expire upon execution of the Acknowledgment form. Each recipient must continue to preserve relevant materials on an ongoing basis for the duration of this legal hold. The Office of the General Counsel may issue periodic reminders and may request re-confirmation of compliance from time to time. Recipients are expected to comply with all such requests promptly.

Section 8: Duration

This legal hold remains in effect until formally released in writing by the Office of the General Counsel of Quorum Insurance Holdings Corp. No oral communication, informal statement, or passage of time shall be construed as a release of this hold. Only a written release, executed by the General Counsel or an authorized designee, shall terminate the preservation obligations imposed by this notice.

The Office of the General Counsel may issue periodic reminder notices to all custodians and recipients. However, the absence of a reminder notice does not in any way diminish, modify, or suspend the obligation to preserve materials within the scope of this hold. Each recipient is expected to maintain ongoing compliance regardless of whether reminders are received.

Any questions regarding the scope, duration, applicability, or interpretation of this legal hold should be directed to Thomas R. Whitfield, General Counsel, or, at his direction, to Kevin Ostrowski or Alan Burke at Calderwood & Harkness LLP. Contact information is provided in Section 9 below.

Section 9: Contact Information

For questions regarding this Legal Hold Notice, including questions about the scope of the hold, the types of materials to be preserved, or compliance obligations, please contact any of the following individuals:

Thomas R. Whitfield General Counsel Quorum Insurance Holdings Corp. 400 Constitution Plaza, Suite 2200 Hartford, CT 06103 Telephone: (860) 555-4100

Email: t.whitfield@quoruminsurance.com

Kevin Ostrowski Partner Calderwood & Harkness LLP 1700 K Street NW, Suite 900 Washington, D.C. 20006 Telephone: (202) 555-7800

Email: kostrowski@calderwoodharkness.com

Alan Burke Associate Calderwood & Harkness LLP 1700 K Street NW, Suite 900 Washington, D.C. 20006 Telephone: (202) 555-7815

Email: aburke@calderwoodharkness.com

Please retain this notice for your records and refer to it as needed to ensure ongoing compliance.

QUORUM INSURANCE HOLDINGS CORP.

By: ________

Thomas R. Whitfield General Counsel 400 Constitution Plaza, Suite 2200 Hartford, CT 06103

Date: May 6, 2023

Prepared in coordination with Calderwood & Harkness LLP, 1700 K Street NW, Suite 900, Washington, D.C. 20006 — Matter No. 1025-00006

ATTACHMENT A

ACKNOWLEDGMENT AND COMPLIANCE CERTIFICATION

Legal Hold — Palomar Data Solutions Data Security Incident

PRIVILEGED AND CONFIDENTIAL — ATTORNEY-CLIENT PRIVILEGED / ATTORNEY WORK PRODUCT

Recipient Name: ________

Title / Department: ________

Certification:

I acknowledge receipt of the Legal Hold Notice dated May 6, 2023, issued by the Office of the General Counsel of Quorum Insurance Holdings Corp., relating to the data security incident involving Palomar Data Solutions, Inc. I certify and confirm the following:

1. I have read and understand the Legal Hold Notice in its entirety, including all sections regarding the scope of the hold, the categories of information to be preserved, the specific preservation instructions, and my individual obligations as a recipient.

2. I will comply with all preservation obligations described in the Legal Hold Notice. I understand that no documents, electronically stored information, or tangible materials within the scope of the hold may be deleted, destroyed, altered, overwritten, concealed, or otherwise disposed of, regardless of any existing retention schedules or routine document destruction policies.

3. I have taken immediate steps to identify and preserve all materials within the scope of this hold that are in my possession, custody, or control, including materials stored on Company-issued devices, personal devices used for Company business, cloud-based systems, physical files, and any other repositories.

4. I will ensure that all subordinates and direct reports within my department who may possess or have access to relevant materials are notified of and comply with this legal hold. I will report the names and titles of all individuals so notified to the Office of the General Counsel within 72 hours of my receipt of the Legal Hold Notice.

5. I understand that this preservation obligation is continuing and will remain in effect until the legal hold is formally released in writing by the Office of the General Counsel.

6. I understand that failure to comply with this legal hold may result in serious adverse legal consequences for Quorum Insurance Holdings Corp. and may also result in individual disciplinary action.

Signature: ________

Printed Name: ________

Title: ________

Department: ________

Date: ________

INSTRUCTION: Please return this completed and signed form to Thomas R. Whitfield, General Counsel, Quorum Insurance Holdings Corp., 400 Constitution Plaza, Suite 2200, Hartford, CT 06103 (or via email to t.whitfield@quoruminsurance.com) within 48 hours of receipt of the Legal Hold Notice.

PRIVILEGED AND CONFIDENTIAL — DO NOT FORWARD OR DISCLOSE WITHOUT AUTHORIZATION FROM THE OFFICE OF THE GENERAL COUNSEL Calderwood & Harkness LLP — Matter No. 1025-00006

PRIVILEGED AND CONFIDENTIAL ATTORNEY-CLIENT PRIVILEGED / ATTORNEY WORK PRODUCT DO NOT FORWARD OR DISCLOSE WITHOUT AUTHORIZATION FROM THE OFFICE OF THE GENERAL COUNSEL
LEGAL HOLD NOTICE
Preservation of Documents and Electronically Stored Information
FROM: Thomas R. Whitfield, General Counsel Quorum Insurance Holdings Corp. 400 Constitution Plaza, Suite 2200 Hartford, CT 06103
TO: David Naranjo, Chief Information Security Officer Robert Wentworth, Senior Vice President, Claims Operations
CC: Jennifer Liang, Chief Privacy Officer Priya Deshmukh, Vice President, Vendor Risk Management
DATE: May 6, 2023
RE: LEGAL HOLD NOTICE — Preservation of Documents and Electronic Information Relating to the Palomar Data Solutions Data Security Incident
PRIORITY: IMMEDIATE ACTION REQUIRED
— THIS NOTICE REQUIRES YOUR IMMEDIATE ATTENTION AND COMPLIANCE —
Section 1: Purpose and Legal Obligation
This memorandum constitutes a formal Legal Hold Directive issued by the Office of the General Counsel of Quorum Insurance Holdings Corp. ("Quorum" or the "Company"). It is directed to the individuals named above, as well as all directors, managers, and staff within the Information Technology Department and Claims Operations Department who may possess or have access to materials relevant to the matters described herein. The obligations imposed by this notice are mandatory, and compliance is required immediately upon receipt.
Quorum has a legal duty to preserve all documents, electronically stored information ("ESI"), and tangible materials that are potentially relevant to the data security incident originating from Quorum's third-party claims-processing vendor, Palomar Data Solutions, Inc. ("Palomar"), headquartered at 7100 Greenville Avenue, Suite 450, Dallas, TX 75231. This preservation duty arises under applicable federal and state law, including the Federal Rules of Civil Procedure, applicable state rules of civil procedure, and relevant regulatory requirements. The duty attaches upon the reasonable anticipation of litigation, regulatory investigation, or enforcement proceedings, and the Company has determined that such anticipation exists with respect to the incident described in this notice.
In connection with this incident, Quorum has retained the law firm of Calderwood & Harkness LLP, located at 1700 K Street NW, Suite 900, Washington, D.C. 20006, to serve as outside counsel and to advise on all aspects of the incident response. Calderwood & Harkness's engagement encompasses, without limitation, the forensic investigation of the incident, the evaluation and coordination of regulatory notification obligations across all affected jurisdictions, preparation for and response to potential regulatory inquiries or enforcement proceedings by state attorneys general, state departments of insurance, the U.S. Department of Health and Human Services Office for Civil Rights, or any other federal or state regulatory authority, and the evaluation and pursuit of potential contractual and tort claims against Palomar. Kevin Ostrowski serves as the responsible partner, and Alan Burke serves as the lead associate on this matter. The Calderwood & Harkness matter number for this engagement is 1025-00006.
At the direction of Calderwood & Harkness LLP, and under the protection of the attorney-client privilege and the work product doctrine, Quorum has also retained Graystone Forensics LLC, located at 1950 Old Gallows Road, Suite 600, Tysons Corner, VA 22182, to conduct a comprehensive forensic investigation of the data security incident. Graystone Forensics has been retained as a consultant to counsel, and all communications with Graystone Forensics, as well as all reports, analyses, findings, and work product generated by Graystone Forensics in connection with this engagement, are privileged and confidential.
The preservation obligation imposed by this notice is immediate and ongoing. Effective upon your receipt of this notice, no documents, data, or other materials within the scope of this legal hold may be deleted, destroyed, altered, overwritten, concealed, or otherwise disposed of, regardless of any existing retention schedules, routine document destruction policies, automated purging protocols, or any other Company policy or practice that would otherwise permit or require the disposition of such materials. This legal hold supersedes and takes precedence over all such policies and practices to the extent of any conflict.
Failure to comply with this legal hold may result in serious adverse legal consequences for Quorum, including court-imposed sanctions, adverse inference instructions, monetary penalties, and other remedial measures. In addition, individual employees who fail to comply with this notice may be subject to disciplinary action, up to and including termination of employment, in accordance with Company policy. The Company takes its preservation obligations with the utmost seriousness, and each recipient of this notice is expected to do the same.
Section 2: Background — Summary of the Incident
The following summary is provided to assist recipients in understanding the nature and scope of the incident giving rise to this legal hold. This summary is based on information available as of the date of this notice and is necessarily preliminary. The forensic investigation being conducted by Graystone Forensics LLC remains ongoing, and additional facts may emerge that expand or refine the scope of this hold. Recipients should interpret the scope of this hold broadly and err on the side of preserving materials where any doubt exists as to their relevance.
Initial Unauthorized Access. On or about March 14, 2023, an unauthorized threat actor gained access to the internal network of Palomar Data Solutions, Inc. The threat actor exploited a known vulnerability, designated as CVE-2023-0669, affecting Palomar's GoAnywhere MFT (Managed File Transfer) appliance. CVE-2023-0669 is a pre-authentication command injection vulnerability in Severin Corporation's GoAnywhere MFT product, which was publicly disclosed in early February 2023 and for which a patch was made available by the vendor. Based on information provided by Palomar to date, it appears that Palomar had not applied the available patch to its GoAnywhere MFT instance at the time of the initial intrusion.
Duration of Unauthorized Access. The unauthorized access continued for approximately 35 days, from March 14, 2023 through April 18, 2023. During this period, the threat actor maintained persistent access to Palomar's network and may have accessed, copied, exfiltrated, or otherwise compromised data stored on or transmitted through Palomar's systems. The full extent of the data exfiltration, if any, is still under active investigation.
Detection. On April 18, 2023, Palomar's security operations center ("SOC") detected anomalous outbound data transfers originating from systems within Palomar's network. This detection event marks the end of the known exfiltration window, although further investigation may reveal additional periods of unauthorized activity.
Notification to Quorum. On April 21, 2023, Palomar's General Counsel, Derek Copeland, notified Quorum's General Counsel, Thomas R. Whitfield, and Quorum's Chief Information Security Officer, David Naranjo, via email of the security incident. Notably, Palomar's notification to Quorum on April 21, 2023 was provided approximately 24 hours past the 48-hour contractual notification deadline set forth in Section 9.4 of the Master Services Agreement between Quorum and Palomar, dated November 12, 2019 (as described further below). This delay in contractual notification is a matter of significant concern and is relevant to Quorum's evaluation of potential claims against Palomar.
Contractual Relationship. Palomar processes claims data for Quorum's personal lines division pursuant to a Master Services Agreement ("MSA") dated November 12, 2019. The MSA has been amended twice: by Amendment 1, executed March 3, 2021, which expanded the scope of Palomar's services to include data processing for Quorum's QuorumEdge digital underwriting platform, and by Amendment 2, executed September 15, 2022, which, among other things, updated data security requirements and service level commitments. The MSA and its amendments, including all exhibits and schedules (with particular relevance to Exhibit D — Data Security Exhibit and Exhibit E — Insurance Requirements), are critical documents within the scope of this legal hold.
Potentially Compromised Data. Based on the nature of Palomar's services to Quorum, the incident may have exposed personally identifiable information (PII), protected health information (PHI), and financial data belonging to Quorum policyholders and claimants across multiple states. The categories of data potentially at risk include, without limitation, names, addresses, dates of birth, Social Security numbers, driver's license numbers, policy numbers, claim numbers, medical records and treatment information associated with personal injury and workers' compensation claims, bank account and financial institution information, and payment card data. The precise scope and volume of compromised data remain under investigation by Graystone Forensics.
Ongoing Investigation. Recipients should understand that the scope of compromised data, the identity and motives of the threat actor, and the full timeline of the intrusion are all still under active investigation. Because the investigation is ongoing, this legal hold must be broadly interpreted to encompass all potentially relevant materials. If at any point during the course of the investigation additional categories of relevant materials are identified, supplemental hold notices may be issued.
Section 3: Scope of the Legal Hold — Categories of Information to Be Preserved
The scope of this legal hold is intentionally broad and must be interpreted liberally. When in doubt as to whether a particular document, communication, data file, or other material falls within the scope of this hold, you must preserve it and contact the Office of the General Counsel for guidance. The categories set forth below are illustrative and not exhaustive.
3.1 Subject Matter Scope
All documents, ESI, and materials relating to any of the following subject matters must be preserved:
(a) The data security incident at Palomar Data Solutions, Inc., including without limitation the unauthorized access to Palomar's network, the exploitation of CVE-2023-0669 in the GoAnywhere MFT appliance, any data exfiltration, the discovery and detection of the incident by Palomar's security operations center, the notification of Quorum by Palomar, and any remediation, containment, or mitigation measures taken by either Palomar or Quorum in response to the incident.
(b) All communications between Quorum and Palomar Data Solutions, Inc., including without limitation communications with Derek Copeland (General Counsel, Palomar), Marcus J. Trevino (any title or capacity at Palomar), Anita Raghavan (any title or capacity at Palomar), or any other Palomar personnel, regarding the security incident, data security matters generally, vulnerability management, software patching practices, system access controls, encryption standards, or any other topic relating to the security of data processed by Palomar on behalf of Quorum.
(c) The Master Services Agreement between Quorum and Palomar dated November 12, 2019, including Amendment 1 (executed March 3, 2021), Amendment 2 (executed September 15, 2022), and all exhibits, schedules, statements of work, and ancillary agreements, with particular attention to Exhibit D — Data Security Exhibit and Exhibit E — Insurance Requirements. This includes all drafts, redlines, negotiation correspondence, and execution copies of the foregoing.
(d) Quorum's vendor risk management files, assessments, due diligence records, questionnaires, scorecards, risk ratings, and audit reports relating to Palomar, including without limitation any SOC 2 Type II reports prepared by Kessler, Park & Associates CPA, PLLC or any other auditor, any penetration testing reports, any vulnerability assessment reports, and any remediation tracking documentation.
(e) Quorum's claims operations and claims data processing workflows involving Palomar, including all data transfers, data inventories, file specifications, data dictionaries, field mapping documentation, data flow diagrams, interface specifications, and process documentation describing the flow of data between Quorum's systems and Palomar's systems.
(f) All materials relating to the QuorumEdge digital underwriting platform data processing performed by Palomar, which was added to the scope of the Palomar relationship under Amendment 1 to the MSA, including any data specifications, integration documents, testing records, and operational procedures.
(g) Any data files, databases, data extracts, data sets, flat files, or structured or unstructured data transmitted to or received from Palomar at any time during the relevant time period, or copies thereof maintained in Quorum's systems.
(h) Quorum's internal investigations, analyses, assessments, memoranda, reports, presentations, or other work product relating to the security incident, whether prepared by Quorum personnel, Calderwood & Harkness LLP, Graystone Forensics LLC, or any other advisor.
(i) All communications with Calderwood & Harkness LLP, Graystone Forensics LLC, or any other outside counsel, consultant, or advisor retained in connection with the incident. These materials are subject to attorney-client privilege and/or the work product doctrine, and their preservation is essential both for the protection of Quorum's legal interests and for the maintenance of applicable privilege protections.
(j) All communications with Quorum's cyber-insurance broker, Whitmore Risk Advisors Inc. (contact: Sandra Whitmore-Kim), and all communications with Quorum's cyber-liability insurers, Atlas Mutual Insurance Company (Policy No. CYB-2023-041587, Claim No. CYB-CLM-2023-05892) and Pinnacle Surplus Lines Insurance Corp. (Policy No. XS-CYB-2023-7812), regarding the incident, coverage, claims, reserves, or any other matter relating to Quorum's insurance recovery in connection with the incident.
(k) Quorum's information security policies, procedures, standards, guidelines, and frameworks, including without limitation the Company's incident response plan, vendor risk management policy, data protection policy, acceptable use policy, access control policy, encryption policy, and any amendments, updates, or revisions thereto at any time during the relevant time period.
(l) System logs, access logs, network traffic logs, firewall logs, intrusion detection/prevention system (IDS/IPS) logs, authentication records (including Active Directory logs, multi-factor authentication logs, and VPN authentication logs), SFTP transfer logs, SIEM (Security Information and Event Management) data, and any other technical records maintained by Quorum's IT Department relating to systems that connect with, interface with, or transmit data to or from Palomar's systems.
(m) Internal communications among Quorum personnel — including personnel in the Information Technology, Claims Operations, Privacy, Legal, Vendor Risk Management, Compliance, Internal Audit, and executive leadership functions — regarding the incident, Quorum's response to the incident, or any of the subject matters described in this Section 3.1.
(n) Board of Directors and Audit Committee materials, including board meeting minutes, committee meeting minutes, board presentations, committee presentations, board memoranda, briefing materials, and any communications with or relating to Franklin Reeves, Audit Committee Chair, concerning the incident or Quorum's response thereto.
(o) Any regulatory filings, correspondence, or notifications relating to the incident, including without limitation notifications to state attorneys general, state departments of insurance, the U.S. Department of Health and Human Services, or any other federal, state, or local regulatory authority. These materials are to be preserved as they are generated throughout the course of the incident response.
(p) Consumer notification materials, including drafts and final versions of notification letters, email notifications, website postings, FAQ documents, call center scripts, call center logs, call recordings, and credit monitoring enrollment data for affected individuals. These materials are to be preserved as they are generated throughout the course of the incident response.
3.2 Custodians.  The following individuals are designated as Primary Custodians under this legal hold. All files, email accounts (including archived email), network home directories, shared drives, workspaces, mobile devices, and any other repositories under the control of the following individuals must be preserved in their entirety to the extent they contain materials within the scope of this hold:
(a) David Naranjo, Chief Information Security Officer
(b) Robert Wentworth, Senior Vice President, Claims Operations
(c) Jennifer Liang, Chief Privacy Officer
(d) Priya Deshmukh, Vice President, Vendor Risk Management
(e) Thomas R. Whitfield, General Counsel
(f) Margaret D. Calloway, Chief Executive Officer, to the extent her files, email, or other repositories contain materials relevant to the subject matters described in Section 3.1
(g) All IT Department staff members with responsibility for Palomar-related systems, data transfers, network connectivity, or system administration of any systems through which data is transmitted to or received from Palomar
(h) All Claims Operations Department staff members with direct involvement in Palomar data processing workflows, data submissions to Palomar, data receipt from Palomar, or quality assurance or reconciliation processes involving Palomar data
(i) Any other individual identified by any of the above-named custodians as having possession, custody, or control of relevant materials. The identification of such additional custodians must be reported promptly to the Office of the General Counsel so that appropriate preservation measures can be implemented.
Each Primary Custodian is responsible for identifying subordinates and direct reports who may have relevant materials and ensuring those individuals are notified of and comply with this legal hold.
3.3 Types of Materials
This legal hold applies to all forms of recorded information, in any medium or format, whether in electronic or physical form. The following is an illustrative, non-exhaustive list of the types of materials that must be preserved:
•  Emails, including all attachments, inline images, and embedded content, regardless of the email platform or system in which they are stored (including Hollowell Systems, Strathmore Data Systems, email archival systems such as Enterprise Vault or Mimecast, personal email accounts used for Company business, and web-based email)
•  Text messages, instant messages, Northgate Data Systems messages, Meridian Solutions messages, or communications from any other messaging or collaboration platform, including direct messages, group chats, and channel communications
•  Voicemails, to the extent they are stored digitally or can be preserved in digital form
•  Calendar entries and meeting invitations, including associated attachments and meeting notes
•  Documents in all formats, including Microsoft Word, Excel, Northgate Services Inc., PDF, and all other word processing, spreadsheet, presentation, and document formats — including both draft and final versions, and including documents with tracked changes or comments
•  Contracts, amendments, exhibits, schedules, statements of work, and all ancillary agreements
•  Presentations, memoranda, reports, analyses, and briefing materials
•  Spreadsheets, data files, databases, data extracts, CSV files, XML files, and all other forms of structured and unstructured data
•  System logs, server logs, access logs, audit trails, network monitoring records, SIEM data, and all other forms of machine-generated or system-generated records
•  Backup tapes, disk images, and archival media, including any backup media in offsite storage or with third-party backup service providers
•  Notes (whether handwritten or electronic), notebooks, journals, and personal memoranda
•  Physical documents and hard-copy files, including file folders, binders, printed correspondence, and paper records
•  Photographs, screenshots, screen recordings, and video recordings
•  Any other form of recorded information in any medium, including information stored on USB drives, external hard drives, optical media, or any other portable storage device
3.4 Time Period
The temporal scope of this legal hold encompasses all materials created, received, modified, or stored from January 1, 2019 through the present date and continuing until this legal hold is formally released in writing by the Office of the General Counsel. The start date of January 1, 2019 is selected to capture materials pre-dating the execution of the Master Services Agreement on November 12, 2019, including due diligence records, RFP materials, vendor evaluation documents, negotiation correspondence, and other materials generated during the vendor selection and contracting process.
The preservation obligation is ongoing and applies to materials created or received after the date of this notice that fall within the subject matter scope described in Section 3.1.
Section 4: Specific Preservation Instructions
The following specific instructions supplement the general preservation obligations described above. These instructions are directed to the named recipients and their respective departments.
4.1 Suspension of Routine Destruction
Effective immediately upon receipt of this notice, all routine document retention and destruction policies are suspended with respect to materials that fall within the scope of this legal hold. This suspension includes, without limitation:
(a) Automated email purging, mailbox size limitations, or auto-archive policies that result in the deletion or removal of email messages or attachments from custodian mailboxes or email archival systems;
(b) Backup tape recycling, overwriting, or degaussing schedules;
(c) Log rotation policies that result in the deletion or overwriting of system logs, access logs, firewall logs, SFTP logs, or any other technical records;
(d) Scheduled shredding or destruction of physical records;
(e) Any automated data lifecycle management processes that result in the deletion, archival to inaccessible media, or modification of data within the scope of this hold.
David Naranjo is directed to coordinate with IT Department staff to take immediate steps to suspend all automated deletion processes affecting email accounts, backup tapes, server logs, system logs, SIEM data, and any other electronically stored information for all custodians and systems identified in this notice. Mr. Naranjo shall confirm completion of these steps to the Office of the General Counsel in writing within 24 hours of receipt of this notice.
Robert Wentworth is directed to take immediate steps to halt any scheduled destruction of physical records within the Claims Operations Department relating to Palomar data, Palomar data processing workflows, or any other subject matter within the scope of this hold. Mr. Wentworth shall confirm completion of these steps to the Office of the General Counsel in writing within 24 hours of receipt of this notice.
4.2 ESI and Technical Data Preservation
The following specific instructions apply to the preservation of electronically stored information and technical data:
(a) David Naranjo shall coordinate with IT Department staff to ensure the immediate identification and preservation of all network logs, firewall logs, SFTP transfer logs, VPN logs, IDS/IPS logs, authentication records, SIEM data, and any other technical records relating to data flows, network connections, or system interactions between Quorum's systems and Palomar's systems. This includes logs from all perimeter devices, jump servers, file transfer systems, and any other infrastructure components involved in the Quorum-Palomar data exchange.
(b) All backup tapes, disk images, and archival media containing Palomar-related data as of and after March 14, 2023 must be identified, segregated, and preserved. No such media may be recycled, overwritten, degaussed, or otherwise altered or destroyed. If any such media are stored with a third-party vendor or offsite storage facility, Mr. Naranjo shall immediately contact the vendor to ensure preservation.
(c) All forensic images, copies, snapshots, or clones of Quorum systems taken in connection with the incident, whether by Quorum IT staff, Graystone Forensics LLC, or any other party, must be preserved in their original and unaltered state.
(d) No computing device — including workstations, laptops, servers, virtual machines, or mobile devices — used by any custodian named in this notice may be reformatted, reimaged, repurposed, recycled, donated, or disposed of without the prior written approval of the Office of the General Counsel. If any such device requires maintenance, repair, or replacement for operational reasons, contact the Office of the General Counsel before taking any action that could alter or destroy data stored on the device.
4.3 Cloud and Third-Party Systems
The preservation obligations imposed by this legal hold apply with equal force to data stored in cloud-based systems, software-as-a-service ("SaaS") platforms, platform-as-a-service ("PaaS") environments, and any other hosted or managed environments, including but not limited to:
(a) Any data in Palomar-hosted or Palomar-managed systems that Quorum personnel can access, download, or otherwise control must be preserved. To the extent that data resides exclusively on Palomar's systems and is not accessible to Quorum, preservation of such data will be addressed through separate legal channels with Palomar.
(b) All third-party systems used for claims processing, data analytics, document management, or other functions that contain Palomar-related data must be preserved. This includes, without limitation, the QuorumEdge digital underwriting platform and any third-party claims management systems, data warehouses, or analytics platforms to which Palomar data has been transmitted or from which Palomar data has been received.
(c) Cloud-based collaboration and file-sharing platforms (including Sundial Systems, Cobalt Ridge Systems, Hollowell Health IT, box, Larkspur Technologies, or any other platform) that may contain relevant documents, data, or communications must be preserved.
4.4 Physical Documents
All physical files, folders, binders, printed records, and any other tangible materials relating to the Palomar relationship, the Master Services Agreement, vendor audits, vendor risk assessments, and the security incident must be identified, secured, and preserved. Specific instructions include:
(a) Robert Wentworth shall identify and secure all Claims Operations physical files relating to Palomar data processing, including claims files, processing records, reconciliation reports, and any other physical documentation relating to the Quorum-Palomar relationship.
(b) Priya Deshmukh shall identify and secure all vendor risk management physical files relating to Palomar, including vendor assessment questionnaires, audit reports, site visit notes, correspondence, and any other physical documentation.
(c) All relevant physical documents shall be stored in a secure location and clearly labeled as subject to legal hold. No documents may be removed from the secured location without the prior authorization of the Office of the General Counsel.
Section 5: Obligations of Recipients
Each recipient of this Legal Hold Notice is personally responsible for compliance. The following specific obligations apply:
(a) Read and Understand. Each recipient must read and understand this notice in its entirety. If you have any questions about the scope or applicability of this hold, contact the Office of the General Counsel immediately. Do not assume that a particular category of materials is outside the scope of this hold without obtaining confirmation from the General Counsel's office.
(b) Immediate Identification and Preservation. Each recipient must immediately identify and preserve all materials within the scope of this hold that are in their possession, custody, or control. This includes materials stored on Company-issued devices, personal devices used for Company business, home offices, Company premises, cloud accounts, and any other location where relevant materials may be found.
(c) Cascade Notification. Each recipient must immediately notify any subordinates, direct reports, or other personnel within their departments who may possess relevant materials, and ensure that those individuals understand and comply with this legal hold. The names and titles of all individuals notified must be reported to the Office of the General Counsel within 72 hours of receipt of this notice.
(d) No Deletion, Destruction, or Modification. Each recipient must refrain from deleting, destroying, modifying, moving, or otherwise altering any materials within the scope of this hold. This prohibition applies regardless of the medium or format of the materials, and regardless of whether the materials are stored on Company systems or personal systems.
(e) Privilege Protocols. Recipients must not create any new documents — whether emails, memoranda, notes, or otherwise — that summarize, paraphrase, or comment on privileged communications with Calderwood & Harkness LLP or Graystone Forensics LLC, except in accordance with the privilege protocols established by the Office of the General Counsel. If you are uncertain whether a particular communication or document is subject to privilege protections, contact the Office of the General Counsel before disseminating it.
(f) Reporting of Destruction or Alteration. Each recipient must notify the Office of the General Counsel (Thomas R. Whitfield) and Calderwood & Harkness LLP (Kevin Ostrowski or Alan Burke) immediately if they become aware of any destruction, deletion, alteration, or loss of potentially relevant materials, whether intentional or inadvertent. Prompt reporting is essential to allow the Company to assess any potential prejudice and take appropriate remedial measures.
(g) Identification of Additional Sources. Each recipient must notify the Office of the General Counsel if they become aware of additional custodians, data sources, repositories, or systems not identified in this notice that may contain relevant materials. The scope of this hold is intended to be comprehensive, but additional sources may exist that are not currently known to the Office of the General Counsel.
Section 6: Confidentiality
This Legal Hold Notice and the existence of the underlying investigation are confidential and privileged. The following confidentiality obligations apply:
(a) Recipients must not disclose the contents of this notice, or the existence or substance of the underlying investigation, to any external parties — including, without limitation, Palomar Data Solutions personnel, vendors, customers, policyholders, claimants, media representatives, or any other third party — without the prior written authorization of the Office of the General Counsel.
(b) All communications regarding this matter with Calderwood & Harkness LLP and Graystone Forensics LLC are protected by the attorney-client privilege and/or the attorney work product doctrine. Recipients must take all necessary steps to maintain and protect these privileges, including by limiting access to privileged communications to those individuals who have a need to know and by marking privileged communications as such.
(c) Any external communications regarding the incident — including inquiries from media outlets, industry analysts, business partners, regulators, or any other external parties — must be directed immediately to the Office of the General Counsel or to BrightPath Consulting Group Inc., Quorum's retained crisis communications advisor. Under no circumstances should any recipient of this notice respond to external inquiries about the incident without prior authorization from the General Counsel's office.
(d) Internal discussions regarding the incident should be limited to those individuals who have a legitimate business need to participate in the incident response, and should be conducted in a manner that preserves applicable privileges. When in doubt, consult the Office of the General Counsel.
Section 7: Compliance Acknowledgment
Each named recipient of this Legal Hold Notice must sign and return the attached Acknowledgment and Compliance Certification form to Thomas R. Whitfield, General Counsel, within 48 hours of receipt of this notice. The Acknowledgment and Compliance Certification form is attached hereto as Attachment A.
By executing the Acknowledgment, each recipient confirms that they:
(a) Have read and understood this Legal Hold Notice in its entirety;
(b) Will comply with all preservation obligations described herein;
(c) Have taken immediate steps to identify and preserve all materials within the scope of this hold that are in their possession, custody, or control; and
(d) Will cascade the hold to all relevant subordinates and direct reports within their respective departments, and will ensure that those individuals also comply with this hold.
Please be advised that the preservation obligation imposed by this legal hold is continuing. The obligation does not expire upon execution of the Acknowledgment form. Each recipient must continue to preserve relevant materials on an ongoing basis for the duration of this legal hold. The Office of the General Counsel may issue periodic reminders and may request re-confirmation of compliance from time to time. Recipients are expected to comply with all such requests promptly.
Section 8: Duration
This legal hold remains in effect until formally released in writing by the Office of the General Counsel of Quorum Insurance Holdings Corp. No oral communication, informal statement, or passage of time shall be construed as a release of this hold. Only a written release, executed by the General Counsel or an authorized designee, shall terminate the preservation obligations imposed by this notice.
The Office of the General Counsel may issue periodic reminder notices to all custodians and recipients. However, the absence of a reminder notice does not in any way diminish, modify, or suspend the obligation to preserve materials within the scope of this hold. Each recipient is expected to maintain ongoing compliance regardless of whether reminders are received.
Any questions regarding the scope, duration, applicability, or interpretation of this legal hold should be directed to Thomas R. Whitfield, General Counsel, or, at his direction, to Kevin Ostrowski or Alan Burke at Calderwood & Harkness LLP. Contact information is provided in Section 9 below.
Section 9: Contact Information
For questions regarding this Legal Hold Notice, including questions about the scope of the hold, the types of materials to be preserved, or compliance obligations, please contact any of the following individuals:
Thomas R. Whitfield General Counsel Quorum Insurance Holdings Corp. 400 Constitution Plaza, Suite 2200 Hartford, CT 06103 Telephone: (860) 555-4100
Email: t.whitfield@quoruminsurance.com
Kevin Ostrowski Partner Calderwood & Harkness LLP 1700 K Street NW, Suite 900 Washington, D.C. 20006 Telephone: (202) 555-7800
Email: kostrowski@calderwoodharkness.com
Alan Burke Associate Calderwood & Harkness LLP 1700 K Street NW, Suite 900 Washington, D.C. 20006 Telephone: (202) 555-7815
Email: aburke@calderwoodharkness.com
Please retain this notice for your records and refer to it as needed to ensure ongoing compliance.
QUORUM INSURANCE HOLDINGS CORP.
By: ________
Thomas R. Whitfield General Counsel 400 Constitution Plaza, Suite 2200 Hartford, CT 06103
Date: May 6, 2023
Prepared in coordination with Calderwood & Harkness LLP, 1700 K Street NW, Suite 900, Washington, D.C. 20006 — Matter No. 1025-00006
ATTACHMENT A
ACKNOWLEDGMENT AND COMPLIANCE CERTIFICATION
Legal Hold — Palomar Data Solutions Data Security Incident
PRIVILEGED AND CONFIDENTIAL — ATTORNEY-CLIENT PRIVILEGED / ATTORNEY WORK PRODUCT
Recipient Name: ________
Title / Department: ________
Certification:
I acknowledge receipt of the Legal Hold Notice dated May 6, 2023, issued by the Office of the General Counsel of Quorum Insurance Holdings Corp., relating to the data security incident involving Palomar Data Solutions, Inc. I certify and confirm the following:
1.  I have read and understand the Legal Hold Notice in its entirety, including all sections regarding the scope of the hold, the categories of information to be preserved, the specific preservation instructions, and my individual obligations as a recipient.
2.  I will comply with all preservation obligations described in the Legal Hold Notice. I understand that no documents, electronically stored information, or tangible materials within the scope of the hold may be deleted, destroyed, altered, overwritten, concealed, or otherwise disposed of, regardless of any existing retention schedules or routine document destruction policies.
3.  I have taken immediate steps to identify and preserve all materials within the scope of this hold that are in my possession, custody, or control, including materials stored on Company-issued devices, personal devices used for Company business, cloud-based systems, physical files, and any other repositories.
4.  I will ensure that all subordinates and direct reports within my department who may possess or have access to relevant materials are notified of and comply with this legal hold. I will report the names and titles of all individuals so notified to the Office of the General Counsel within 72 hours of my receipt of the Legal Hold Notice.
5.  I understand that this preservation obligation is continuing and will remain in effect until the legal hold is formally released in writing by the Office of the General Counsel.
6.  I understand that failure to comply with this legal hold may result in serious adverse legal consequences for Quorum Insurance Holdings Corp. and may also result in individual disciplinary action.
Signature: ________
Printed Name: ________
Title: ________
Department: ________
Date: ________
INSTRUCTION: Please return this completed and signed form to Thomas R. Whitfield, General Counsel, Quorum Insurance Holdings Corp., 400 Constitution Plaza, Suite 2200, Hartford, CT 06103 (or via email to t.whitfield@quoruminsurance.com) within 48 hours of receipt of the Legal Hold Notice.
PRIVILEGED AND CONFIDENTIAL — DO NOT FORWARD OR DISCLOSE WITHOUT AUTHORIZATION FROM THE OFFICE OF THE GENERAL COUNSEL Calderwood & Harkness LLP — Matter No. 1025-00006

LEGAL HOLD NOTICE

PRIORITY: IMMEDIATE ACTION REQUIRED

QUORUM INSURANCE HOLDINGS CORP.

ATTACHMENT A

ACKNOWLEDGMENT AND COMPLIANCE CERTIFICATION

Record

Parties

Dates

Amounts