1025-00006 · Graystone Forensics LLC · Regulatory Defense/Multistate AG

ag-response-exhibit-c-vendor-accountability.docx DOCUMENT Data Privacy

62 / 88 ← → ✕

EXHIBIT C

Palomar Data Solutions, Inc. — Vendor Accountability Summary

Prepared by Calderwood & Harkness LLP Counsel to Quorum Insurance Holdings Corp.

October 13, 2023

CONFIDENTIAL — PREPARED AT THE DIRECTION OF COUNSEL

Submitted in connection with the Response of Quorum Insurance Holdings Corp. to the Joint Demand Letter of the Multistate Attorney General Coalition dated September 8, 2023. This document was prepared at the direction of counsel and contains information protected by the attorney-client privilege and the work product doctrine. Quorum Insurance Holdings Corp. reserves all applicable privileges and does not waive any privilege by this submission to the Multistate Attorney General Coalition. Any further disclosure, distribution, or reproduction of this document, in whole or in part, without the prior written consent of Calderwood & Harkness LLP is strictly prohibited.

I. Introduction and Purpose

This Exhibit summarizes the vendor accountability actions taken by Quorum Insurance Holdings Corp. ("Quorum") against its third-party claims-processing vendor, Palomar Data Solutions, Inc. ("Palomar"), in connection with the data security incident that is the subject of the multistate inquiry initiated by the Joint Demand Letter of the Multistate Attorney General Coalition dated September 8, 2023. As detailed herein, Quorum has acted promptly, decisively, and comprehensively to identify the root causes of the breach, hold its vendor accountable, recover meaningful financial compensation, and implement enhanced security safeguards designed to prevent recurrence.

Quorum has pursued accountability through multiple channels, including: (a) formal contractual indemnification demands directed to Palomar under the terms of the governing Master Services Agreement; (b) thorough identification and documentation of Palomar's specific contractual breaches, supported by independent forensic analysis; (c) negotiation of substantial monetary recovery reflecting both immediate cash compensation and ongoing fee reductions; and (d) imposition of enhanced, forward-looking data security obligations on Palomar, memorialized in a binding amendment to the Master Services Agreement.

The purpose of this Exhibit is to demonstrate to the Multistate Attorney General Coalition that Quorum has taken affirmative, comprehensive, and documented steps to hold its vendor accountable for the failures that contributed to the data security incident, and to ensure that meaningful prospective safeguards are in place to protect the personal information of Quorum's policyholders and claimants going forward. This Exhibit should be read in conjunction with the other Exhibits submitted with Quorum's Response, including the forensic investigation summary (Exhibit A) and the consumer remediation summary (Exhibit B).

II. Background on the Quorum–Palomar Vendor Relationship

A. Master Services Agreement Overview

Palomar Data Solutions, Inc. is a Texas corporation headquartered at 7100 Greenville Avenue, Suite 450, Dallas, Texas 75231. Palomar provides data processing, business process outsourcing, and insurance technology services to clients in the property and casualty, life, and health insurance industries. Palomar has been a significant vendor to Quorum since 2019, and the relationship between the two companies is governed by a comprehensive Master Services Agreement and related exhibits.

Quorum and Palomar entered into a Master Services Agreement (the "MSA") on November 12, 2019, with a five-year term expiring on November 11, 2024. The MSA was the product of extensive negotiation between the parties and their respective legal teams, and it includes detailed provisions addressing data security, privacy, confidentiality, indemnification, insurance, and termination rights—each of which is relevant to the vendor accountability analysis set forth in this Exhibit.

Under the MSA, Palomar processes claims data for Quorum's personal lines insurance division, which encompasses Quorum's homeowners, automobile, and umbrella insurance product lines. The data processed by Palomar in connection with its services includes, but is not limited to, policyholder and claimant personally identifiable information ("PII"), financial data such as bank account numbers and payment card information, and protected health information ("PHI") from workers' compensation and health-related insurance claims. The volume and sensitivity of the data entrusted to Palomar under the MSA underscore the critical importance of Palomar's data security obligations.

The original annual contract value ("ACV") under the MSA was $14,200,000 per year, yielding a five-year total contract value of approximately $71,000,000. This contract value reflected the scope of Palomar's claims processing responsibilities across Quorum's personal lines division and the substantial volume of data processed on a daily basis.

B. MSA Amendments

Since execution, the MSA has been amended twice (prior to the Amendment 3 discussed in Section V below), each amendment reflecting the evolving scope of Palomar's services and the parties' mutual commitment to enhancing data security standards.

Amendment 1 was executed on March 3, 2021. Amendment 1 expanded Palomar's scope of services to include processing of data related to Quorum's proprietary digital underwriting platform, QuorumEdge, which had been deployed in 2020 as part of Quorum's broader digital transformation initiative. The addition of QuorumEdge data processing increased the volume and complexity of data handled by Palomar, and correspondingly increased the ACV by $2,100,000, from $14,200,000 to $16,300,000 per year, effective April 1, 2021. Amendment 1 also updated certain service level metrics to account for the QuorumEdge workload.

Amendment 2 was executed on September 15, 2022. Amendment 2 was primarily focused on strengthening the data security framework governing Palomar's services. Specifically, Amendment 2 updated the Data Security Exhibit (Exhibit D to the MSA) to reflect current industry best practices and regulatory expectations. Among other changes, Amendment 2 added a requirement that Palomar obtain and provide to Quorum an annual SOC 2 Type II audit report covering the controls relevant to the processing and storage of Quorum data. Amendment 2 also updated the minimum cyber-insurance requirements applicable to Palomar under Exhibit E of the MSA, increasing the required coverage limits to reflect the expanded scope of services and the evolving cyber threat landscape.

Palomar is Quorum's second-largest vendor by contract value, with the ACV growing from approximately $14.2 million to approximately $16.3 million following the execution of Amendment 1. The size and strategic importance of the Palomar relationship are factors that Quorum considered in determining the appropriate vendor accountability measures, including the decision to maintain the relationship on enhanced terms rather than terminate and transition services mid-contract.

C. Key Data Security and Contractual Provisions

The MSA and its exhibits contain several provisions directly relevant to Quorum's vendor accountability actions. The key provisions are summarized below.

Exhibit D (Data Security Exhibit, as amended by Amendment 2): Exhibit D sets forth the data security obligations applicable to Palomar's handling of Quorum data. As amended, Exhibit D required Palomar to maintain "commercially reasonable" administrative, technical, and physical safeguards for the protection of Quorum data, consistent with applicable laws and industry standards. Exhibit D also imposed several specific, measurable security requirements, including: (i) the requirement that Palomar apply patches for critical vulnerabilities within 30 days of the date of the vendor patch release; (ii) the requirement that Palomar conduct annual penetration testing of its systems and infrastructure and provide the results to Quorum; and (iii) the requirement, added by Amendment 2, that Palomar obtain and furnish to Quorum an annual SOC 2 Type II audit report covering the security, availability, and confidentiality trust services criteria.

Section 9.4 (Breach Notification Clause): Section 9.4 of the MSA required Palomar to notify Quorum in writing within 48 hours of discovering any security incident or data breach affecting Quorum data. This notification was required to include, to the extent known at the time, a description of the nature and scope of the incident, the categories of data involved, and the steps being taken by Palomar to investigate and remediate the incident.

Section 12.2 (Indemnification): Section 12.2 of the MSA provides that Palomar shall indemnify, defend, and hold harmless Quorum and its affiliates, directors, officers, employees, and agents from and against any and all losses, damages, liabilities, costs, and expenses (including reasonable attorneys' fees) arising from or related to Palomar's breach of its data security obligations under the MSA and its exhibits. Palomar's indemnification obligations under Section 12.2 are subject to a liability cap equal to two times (2×) the trailing twelve-month fees paid by Quorum to Palomar. Based on the ACV of $16,300,000 per year in effect at the time of the incident, the applicable liability cap was $32,600,000.

Exhibit E (Insurance Requirements): Exhibit E required Palomar to maintain, at its own expense, a minimum of $10,000,000 in cyber-liability insurance coverage, with Quorum named as an additional insured. This requirement was intended to ensure that Palomar maintained adequate financial resources to satisfy its indemnification obligations in the event of a security incident.

Section 14.2 (Termination for Cause): Section 14.2 of the MSA grants Quorum the right to terminate the MSA upon a material breach by Palomar, provided that Quorum first delivers written notice of the breach to Palomar and Palomar fails to cure the breach within 30 days of receiving such notice. As discussed in Section VI below, Quorum has expressly reserved its termination rights under Section 14.2.

III. Palomar's Contractual Breaches

Quorum, with the assistance of its counsel at Calderwood & Harkness LLP and the forensic investigation conducted by Graystone Forensics LLC, has identified two specific, documented breaches of Palomar's obligations under the MSA. Each breach is discussed in detail below.

A. Failure to Timely Patch Critical Vulnerability (Breach of Exhibit D)

The forensic investigation conducted by Graystone Forensics LLC—which was retained under the direction of Calderwood & Harkness LLP pursuant to a Kovel engagement for the purpose of providing privileged forensic analysis—confirmed that the threat actor responsible for the data security incident gained initial unauthorized access to Palomar's network on or about March 14, 2023. The threat actor accomplished this initial access by exploiting CVE-2023-0669, a known remote code execution vulnerability in Palomar's GoAnywhere MFT file transfer appliance. The GoAnywhere MFT appliance was a component of Palomar's infrastructure used to facilitate the secure transfer of data files between Palomar and its clients, including Quorum.

CVE-2023-0669 was a critical-severity vulnerability that had been publicly disclosed prior to the date of exploitation. A vendor-issued patch for CVE-2023-0669 was publicly available prior to the date of the threat actor's exploitation of the vulnerability on or about March 14, 2023. The availability of this patch was widely publicized within the information security community, including through advisories issued by the Cybersecurity and Infrastructure Security Agency (CISA), which added CVE-2023-0669 to its Known Exploited Vulnerabilities Catalog.

Exhibit D of the MSA, as amended by Amendment 2, contained a clear and unambiguous requirement that Palomar apply patches for critical vulnerabilities within 30 days of the vendor patch release date. Palomar failed to apply the vendor-issued patch for CVE-2023-0669 within the contractual 30-day window. At the time of the threat actor's exploitation on or about March 14, 2023, the vulnerability remained unpatched on Palomar's GoAnywhere MFT appliance. Graystone Forensics' analysis confirmed that the unpatched GoAnywhere MFT appliance was the initial point of compromise and the attack vector through which the threat actor gained access to Palomar's internal network.

This failure to apply the critical patch within the contractually required timeframe constitutes a material breach of Palomar's data security obligations under Exhibit D of the MSA. The breach was not the result of a zero-day exploit or a previously unknown vulnerability; rather, it was the direct consequence of Palomar's failure to adhere to the patch management obligations it had expressly assumed under the MSA.

B. Failure to Timely Notify Quorum (Breach of Section 9.4)

In addition to the patching failure, Palomar also breached its contractual breach notification obligations under Section 9.4 of the MSA. Palomar's Security Operations Center ("SOC") first detected anomalous outbound data transfers from Palomar's network on April 18, 2023. This detection constituted the discovery of a security incident affecting Quorum data for purposes of Section 9.4 of the MSA, triggering Palomar's obligation to notify Quorum within 48 hours—i.e., by approximately April 20, 2023, at 11:59 p.m. Central Time.

Palomar did not notify Quorum of the security incident until April 21, 2023. The notification was transmitted by email from Derek Copeland, Palomar's General Counsel, to Thomas R. Whitfield, Quorum's General Counsel, and David Naranjo, Quorum's Chief Information Security Officer ("CISO"). This notification was delivered approximately 24 hours after the expiration of the contractual 48-hour notification window, in breach of Section 9.4 of the MSA.

While Palomar has offered various explanations for the delay—including the need to conduct preliminary internal investigation before notifying Quorum—the contractual obligation under Section 9.4 was clear and not conditioned on the completion of any internal investigation by Palomar. The 48-hour notification window was a material term of the MSA that was specifically negotiated to ensure that Quorum could commence its own incident response and forensic analysis promptly upon learning of a security incident affecting its data.

The delay in notification compromised Quorum's ability to begin its own incident response and forensic analysis on a timely basis, including the preservation of evidence, engagement of forensic consultants, and initial assessment of the scope and nature of the compromise. Every hour of delay in the notification of a data security incident of this magnitude has tangible consequences for the affected organization's ability to contain the incident, assess the impact, and protect the individuals whose data may have been compromised.

C. Impact of Palomar's Breaches

The combined impact of Palomar's two contractual breaches was severe and far-reaching. The unpatched vulnerability in the GoAnywhere MFT appliance enabled the threat actor to maintain persistent unauthorized access to Palomar's network for an approximately 35-day period from March 14 through April 18, 2023. During this 35-day exfiltration window, the threat actor conducted extensive lateral movement through Palomar's network, escalated privileges, and ultimately staged and exfiltrated structured data files containing Quorum policyholder and claimant data.

The forensic investigation conducted by Graystone Forensics confirmed that a total of 318,247 individuals across 29 states and the District of Columbia were affected by the data security incident. The compromised data included the following categories of sensitive personal information:

• Personally Identifiable Information (PII): Names, dates of birth, Social Security numbers, and driver's license numbers for all 318,247 affected individuals.

• Financial Information: Bank account numbers, payment card numbers, and related financial data for 84,619 of the affected individuals, representing approximately 26.6% of the total affected population.

• Protected Health Information (PHI): Health conditions, diagnosis codes, treatment information, and related medical data for 41,203 of the affected individuals, representing approximately 12.9% of the total affected population. These individuals were primarily claimants under Quorum's workers' compensation and health-related insurance product lines.

The scope and severity of the data compromise underscore the seriousness of Palomar's contractual failures. Had Palomar applied the critical patch within the contractually mandated 30-day window, the threat actor would not have been able to exploit CVE-2023-0669 as the initial access vector. Moreover, had Palomar provided timely notification within the contractual 48-hour window, Quorum could have initiated containment and remediation efforts sooner, potentially limiting the scope of the exfiltration.

IV. Quorum's Indemnification Demand and Negotiations

A. Formal Demand

On June 20, 2023, Calderwood & Harkness LLP, acting on behalf of Quorum, transmitted a formal breach of contract demand letter to Catherine Langford, Partner at Mercer, Haight & Dunlop LLP, which serves as outside counsel to Palomar. The demand letter asserted Palomar's breaches of Exhibit D (failure to timely patch CVE-2023-0669) and Section 9.4 (failure to provide timely breach notification) of the MSA, and invoked Quorum's rights under Section 12.2 (Indemnification) of the MSA.

Quorum demanded full indemnification under Section 12.2 for all incident response costs incurred as a direct result of Palomar's breaches, totaling $8,230,250. This demand was supported by detailed documentation of each cost category and was accompanied by relevant invoices and supporting materials. The component costs were as follows:

(i) Forensic investigation costs (Graystone Forensics LLC): $1,847,000. These costs reflect the fees and expenses incurred in connection with the comprehensive forensic investigation of the data security incident, including network forensics, malware analysis, data exfiltration analysis, and preparation of the forensic report.

(ii) Consumer notification, call center, and credit monitoring services (Clearfield Notification Services LLC): $3,214,500. These costs reflect the expenses of providing individual written notification to all 318,247 affected individuals in compliance with applicable state breach notification laws, establishing and operating a dedicated call center to respond to consumer inquiries, and providing complimentary credit monitoring and identity theft protection services to all affected individuals.

(iii) Crisis communications (BrightPath Consulting Group Inc.): $385,000. These costs reflect the fees incurred for crisis communications consulting, including preparation of public statements, media response strategy, and stakeholder communications.

(iv) Legal fees (Calderwood & Harkness LLP): $2,163,750. These costs reflect the legal fees incurred in connection with incident response, regulatory compliance, multistate notification coordination, forensic engagement oversight, and preparation of the vendor accountability demand.

(v) Quorum internal costs (IT remediation, employee overtime): $620,000 (estimated). These costs reflect the internal resources deployed by Quorum's IT department and other business units in connection with incident containment, remediation of Quorum's own systems, assessment of Quorum's data environment, and coordination with Palomar and external vendors.

The total demand amount of $8,230,250 was well within the contractual indemnification cap of $32,600,000 under Section 12.2 of the MSA, and Quorum's demand letter expressly reserved Quorum's right to seek additional indemnification for any future costs arising from the incident, including any regulatory penalties, litigation costs, or additional consumer remediation expenses, up to the contractual cap.

B. Palomar's Initial Response

On July 7, 2023, Mercer, Haight & Dunlop LLP, acting on behalf of Palomar, transmitted a written response to Calderwood & Harkness's demand letter. In its response, Palomar disputed both causation and the scope of its liability under the MSA. Specifically, Palomar contended that the exploitation of CVE-2023-0669 constituted a "sophisticated attack" by a highly skilled threat actor and that the mere existence of an unpatched vulnerability did not establish that the incident would not have occurred absent the patching delay. Palomar further contended that certain of the costs claimed by Quorum were not directly attributable to Palomar's alleged breaches and were instead ordinary costs of incident response that Quorum would have incurred regardless of any contractual non-compliance by Palomar.

As an alternative to full indemnification, Palomar offered a $1,500,000 goodwill credit to be applied against future service fees payable by Quorum under the MSA. Palomar characterized this offer as a demonstration of its commitment to the Quorum relationship and its recognition that the incident had caused disruption to Quorum's business.

Quorum rejected the $1,500,000 offer as wholly inadequate. The offer represented less than 19% of Quorum's documented incident costs and failed to acknowledge or address Palomar's clear contractual breaches. Quorum communicated its rejection of the offer through Calderwood & Harkness on July 14, 2023, and indicated its intention to pursue the full indemnification demand.

C. Quorum's Rebuttal

On July 25, 2023, Calderwood & Harkness LLP transmitted a detailed rebuttal letter to Catherine Langford at Mercer, Haight & Dunlop LLP, reasserting Quorum's indemnification claim and responding point-by-point to Palomar's defenses. The rebuttal letter highlighted the following key points:

(i) The vendor-issued patch for CVE-2023-0669 was publicly available prior to the date of exploitation, and the vulnerability had been the subject of widespread public advisories, including a CISA Known Exploited Vulnerabilities Catalog listing. There was nothing "novel" or "sophisticated" about the exploitation of a known, publicly disclosed vulnerability for which a patch was readily available.

(ii) Palomar's failure to apply the patch within the contractual 30-day window set forth in Exhibit D was a clear, unambiguous violation of a specific, measurable, and negotiated contractual obligation. The "commercially reasonable" standard was a floor, not a ceiling, and the specific 30-day patching requirement was an express covenant that superseded any general reasonableness analysis.

(iii) The late breach notification—approximately 24 hours beyond the contractual 48-hour window—compounded the harm to Quorum and its policyholders by delaying Quorum's ability to initiate its own incident response, engage forensic analysts, and begin the process of assessing the scope of the compromise.

(iv) The forensic evidence developed by Graystone Forensics LLC conclusively established that the unpatched CVE-2023-0669 vulnerability in Palomar's GoAnywhere MFT appliance was the initial attack vector through which the threat actor gained unauthorized access to Palomar's network. The causal chain from Palomar's patching failure to the data exfiltration was direct and well-documented.

The rebuttal letter concluded by reiterating Quorum's demand for full indemnification and reserving Quorum's right to pursue termination of the MSA for cause under Section 14.2 if a satisfactory resolution could not be reached.

D. Negotiated Settlement

Following the transmission of the rebuttal letter, the parties engaged in extended good-faith negotiations through their respective counsel over the course of approximately three months. During this period, Calderwood & Harkness and Mercer, Haight & Dunlop exchanged multiple rounds of correspondence, participated in several telephonic negotiation sessions, and shared relevant documentation in support of their respective positions. Quorum's negotiation strategy was informed by a careful assessment of the strength of its legal position, the total costs incurred, the potential for additional future costs, the availability of insurance recovery from Quorum's own cyber-liability carrier (Atlas Mutual Insurance Company), and the business interest in maintaining operational continuity during the remaining MSA term.

The parties ultimately reached a settlement on October 27, 2023, which was memorialized in a Settlement Agreement and Mutual Release executed by authorized representatives of both Quorum and Palomar on that date. The material terms of the settlement are as follows:

(a) Cash Payment: Palomar agreed to pay Quorum the sum of $4,200,000, payable within 30 calendar days of the execution date of the Settlement Agreement. This payment represents direct monetary recovery for a substantial portion of Quorum's documented incident response costs.

(b) Fee Reduction: Palomar agreed to an 18-month reduction of 8% on the annual contract value, effective November 1, 2023. Based on the current ACV of $16,300,000, the 8% reduction yields annual savings of $1,304,000, and the total savings over the 18-month reduction period equal $1,956,000 ($16,300,000 × 8% × 1.5 years). This fee reduction provides Quorum with ongoing economic benefit and reflects Palomar's acknowledgment of its responsibility for the incident.

(c) Independent Security Assessment: Palomar agreed to engage, at Palomar's sole cost and expense, an independent third-party security assessor to conduct enhanced annual security audits of Palomar's systems and controls, with the scope of such audits to be mutually agreed upon by the parties and the results to be shared with Quorum. This requirement is in addition to the annual SOC 2 Type II audit requirement already in effect under Amendment 2.

(d) Enhanced Security Measures: Palomar committed to implement enhanced patch management protocols, including automated patch deployment and verification processes, and to deploy enterprise-grade endpoint detection and response ("EDR") capabilities across all systems that process, store, or transmit Quorum data. These implementations were required to be completed within 90 calendar days of the settlement date.

(e) Mutual Release: The parties exchanged mutual releases of all claims, demands, causes of action, and liabilities related to or arising from the data security incident, subject to customary carve-outs for fraud, willful misconduct, and obligations arising under the Settlement Agreement itself and Amendment 3 to the MSA.

Effective Total Recovery by Quorum: The combined value of the cash payment and the fee reduction yields a total effective recovery of $6,156,000 ($4,200,000 in cash plus $1,956,000 in fee reductions). This recovery represents approximately 74.8% of Quorum's total documented incident costs of $8,230,250.

Quorum's Board of Directors and senior management team carefully evaluated the settlement terms and determined the settlement to be commercially reasonable in light of the totality of the circumstances, including: the total documented incident costs of $8,230,250; the insurance recovery obtained by Quorum from its own cyber-liability carrier, Atlas Mutual Insurance Company; the litigation risk and costs that would be associated with pursuing the full indemnification claim through litigation; the interest in preserving the ongoing vendor relationship through the remaining MSA term and avoiding the significant operational disruption and expense that would accompany a mid-contract vendor transition; and the substantial forward-looking security enhancements obtained through Amendment 3 (discussed in Section V below).

V. Enhanced Security Requirements — MSA Amendment 3

Concurrently with the execution of the Settlement Agreement and Mutual Release, Quorum and Palomar executed a Third Amendment to the Master Services Agreement ("Amendment 3"), dated October 27, 2023. Amendment 3 imposes enhanced, forward-looking data security and audit obligations on Palomar that are designed to substantially reduce the risk of a similar incident occurring in the future. The key provisions of Amendment 3 are summarized below.

Accelerated Patch Management: Amendment 3 reduces the maximum permissible timeframe for applying critical vulnerability patches from 30 days to 14 days following the vendor patch release date. This accelerated patching requirement applies to all critical and high-severity vulnerabilities affecting systems that process, store, or transmit Quorum data. The reduction from a 30-day to a 14-day patching window reflects current industry best practices and significantly narrows the window of exposure to known vulnerabilities. Palomar is further required to maintain and provide to Quorum, upon request, documentation evidencing compliance with this accelerated patching requirement.

Mandatory Endpoint Detection and Response (EDR): Amendment 3 requires Palomar to deploy enterprise-grade endpoint detection and response technology across all systems that process, store, or transmit Quorum data. The EDR solution must provide real-time monitoring, automated threat detection, and incident response capabilities. This requirement ensures that Palomar's security infrastructure includes modern, active monitoring capabilities that go beyond traditional signature-based antivirus solutions and that enable rapid detection of, and response to, anomalous activity on Palomar's endpoints and servers.

Quarterly Vulnerability Scanning: Amendment 3 requires Palomar to conduct comprehensive vulnerability scans of all systems in scope for Quorum data processing on a quarterly basis. Following each quarterly scan, Palomar is required to provide a detailed vulnerability scan report to Quorum's CISO, David Naranjo, and VP, Vendor Risk Management, Priya Deshmukh. The reports must include a complete inventory of identified vulnerabilities, severity ratings, and planned remediation timelines. This quarterly cadence replaces the prior annual-only assessment framework and provides Quorum with regular, ongoing visibility into the security posture of Palomar's systems.

Annual Independent Security Assessment: Amendment 3 requires Palomar to engage an independent third-party security assessor, selected with the consent of Quorum and at Palomar's sole expense, to conduct a comprehensive annual security assessment of Palomar's systems, controls, and processes relevant to the processing of Quorum data. The scope of the annual assessment must include, at a minimum, network security architecture review, access control evaluation, data protection and encryption assessment, incident response preparedness evaluation, and review of Palomar's compliance with Amendment 3's enhanced security requirements. The results of each annual assessment, including any findings and recommended remediation actions, must be shared with Quorum within 30 days of completion.

Enhanced Incident Notification: Amendment 3 shortens the contractual notification window for security incidents from 48 hours to 24 hours from the time of discovery of any security incident affecting or reasonably believed to affect Quorum data. This revised notification window replaces the prior 48-hour requirement set forth in Section 9.4 of the MSA and ensures that Quorum receives earlier notice of potential security incidents, enabling a more rapid and effective incident response. The notification must include, to the extent known at the time, the nature and scope of the incident, the categories of Quorum data potentially affected, and the immediate steps being taken by Palomar to contain and investigate the incident.

Fee Reduction: Amendment 3 incorporates and memorializes the negotiated 18-month, 8% fee reduction into the economic terms of the MSA, as agreed in the Settlement Agreement. Specifically, the ACV is reduced from $16,300,000 to $14,996,000 for the 18-month period from November 1, 2023, through April 30, 2025, after which the ACV reverts to $16,300,000 for the remainder of the MSA term (if any).

Taken together, the provisions of Amendment 3 represent a substantial strengthening of Palomar's security obligations under the MSA and reflect Quorum's insistence on meaningful, enforceable prospective safeguards as a condition of continuing the vendor relationship.

VI. Ongoing Vendor Oversight and Monitoring

In addition to the specific contractual amendments and settlement terms described above, Quorum has enhanced its internal vendor risk management practices with respect to Palomar. These enhanced practices are designed to ensure ongoing, proactive oversight of Palomar's security posture and compliance with the strengthened contractual requirements.

Key ongoing vendor oversight measures include the following:

• Enhanced Oversight Cadence: Quorum's VP, Vendor Risk Management, Priya Deshmukh, has implemented an enhanced oversight cadence for the Palomar relationship, including monthly security posture reviews conducted in collaboration with Quorum's Information Security team. These monthly reviews cover Palomar's patching status, vulnerability scan results, incident response readiness, and compliance with the requirements of Amendment 3. Prior to the incident, vendor security reviews were conducted on a quarterly basis; the shift to a monthly cadence reflects the heightened risk profile assigned to the Palomar relationship.

• Direct Security Communication Channels: Quorum's CISO, David Naranjo, has established direct, ongoing communication channels with Palomar's Chief Technology Officer, Anita Raghavan, for the purpose of real-time security issue escalation. This direct line of communication ensures that any emerging security concerns can be raised and addressed promptly, without the delays inherent in formal contractual notification processes.

• SOC 2 Type II Report Review: Quorum required and obtained Palomar's most recent SOC 2 Type II audit report, which was audited by Kessler, Park & Associates CPA, PLLC, an independent public accounting firm. Quorum's Information Security team has reviewed the report and is monitoring Palomar's remediation of any findings identified therein. Quorum will continue to require and review annual SOC 2 Type II reports from Palomar for the duration of the MSA.

• Reservation of Termination Rights: Quorum has expressly reserved its right to terminate the MSA for cause under Section 14.2 should any future material security breach, contractual non-compliance, or failure to satisfy the enhanced obligations under Amendment 3 occur. Quorum has communicated this reservation of rights directly to Palomar's senior management and outside counsel, and Palomar has acknowledged that its continued performance under the MSA is subject to strict compliance with all applicable security obligations.

These ongoing oversight measures complement the contractual enhancements set forth in Amendment 3 and reflect Quorum's commitment to maintaining a rigorous, proactive vendor risk management posture.

VII. Summary of Vendor Accountability Outcomes

The following summarizes the key outcomes of Quorum's vendor accountability actions against Palomar in connection with the data security incident.

Contractual Breaches Identified and Documented:

1. Failure to apply the vendor-issued patch for CVE-2023-0669 within the contractually mandated 30-day patching window, constituting a material breach of Exhibit D to the MSA.

2. Failure to notify Quorum of the security incident within the contractually mandated 48-hour notification window, with notification delivered approximately 24 hours late, constituting a breach of Section 9.4 of the MSA.

Financial Recovery:

Total effective recovery by Quorum: $6,156,000, comprising $4,200,000 in direct cash payment and $1,956,000 in fee reductions over an 18-month period, against total documented incident costs of $8,230,250. This recovery represents approximately 74.8% of Quorum's total documented costs.

Forward-Looking Security Enhancements:

Amendment 3 to the MSA substantially strengthened Palomar's security obligations, including:

• Accelerated critical patching requirement (reduced from 30 days to 14 days);

• Mandatory deployment of enterprise-grade endpoint detection and response (EDR) technology;

• Quarterly vulnerability scanning with reporting to Quorum;

• Annual independent third-party security assessment at Palomar's expense;

• Shortened security incident notification window (reduced from 48 hours to 24 hours).

Vendor Relationship:

Quorum elected to maintain the vendor relationship with Palomar through the remaining term of the MSA, subject to the enhanced security obligations imposed by Amendment 3 and Quorum's expressly reserved termination rights under Section 14.2. This decision was made in the interest of operational continuity—reflecting the critical nature of Palomar's claims processing services and the significant cost and disruption associated with a mid-contract vendor transition—while ensuring rigorous, ongoing accountability through the contractual, financial, and oversight mechanisms described in this Exhibit.

Quorum's vendor accountability actions, taken as a whole, reflect its firm commitment to protecting the personal information of its policyholders and claimants, holding responsible parties accountable for security failures, recovering meaningful financial compensation, and implementing prospective safeguards designed to materially reduce the risk of recurrence. Quorum believes that the actions documented in this Exhibit demonstrate the type of responsible, proactive vendor management that the Multistate Attorney General Coalition expects of entities entrusted with consumers' sensitive personal information.

VIII. List of Referenced Documents

The following documents are referenced in this Exhibit and are available upon request, subject to the privilege reservations noted below:

1. Master Services Agreement between Quorum Insurance Holdings Corp. and Palomar Data Solutions, Inc., dated November 12, 2019.

2. Amendment 1 to the Master Services Agreement, dated March 3, 2021.

3. Amendment 2 to the Master Services Agreement, dated September 15, 2022.

4. Amendment 3 to the Master Services Agreement, dated October 27, 2023.

5. Settlement Agreement and Mutual Release between Quorum Insurance Holdings Corp. and Palomar Data Solutions, Inc., dated October 27, 2023.

6. Breach of Contract Demand Letter from Calderwood & Harkness LLP to Mercer, Haight & Dunlop LLP, dated June 20, 2023.

7. Response Letter from Mercer, Haight & Dunlop LLP (on behalf of Palomar Data Solutions, Inc.), dated July 7, 2023.

8. Rebuttal Letter from Calderwood & Harkness LLP to Mercer, Haight & Dunlop LLP, dated July 25, 2023.

Note: Certain documents referenced above are subject to the attorney-client privilege and/or the work product doctrine. Quorum Insurance Holdings Corp. reserves all applicable privileges and protections and does not waive any privilege or protection by this submission to the Multistate Attorney General Coalition or by the identification of such documents herein. Production of any such documents, if agreed to, will be subject to appropriate confidentiality protections and non-waiver agreements.

— END OF EXHIBIT C —

EXHIBIT C
Palomar Data Solutions, Inc. — Vendor Accountability Summary
Prepared by Calderwood & Harkness LLP Counsel to Quorum Insurance Holdings Corp.
October 13, 2023
CONFIDENTIAL — PREPARED AT THE DIRECTION OF COUNSEL
Submitted in connection with the Response of Quorum Insurance Holdings Corp. to the Joint Demand Letter of the Multistate Attorney General Coalition dated September 8, 2023. This document was prepared at the direction of counsel and contains information protected by the attorney-client privilege and the work product doctrine. Quorum Insurance Holdings Corp. reserves all applicable privileges and does not waive any privilege by this submission to the Multistate Attorney General Coalition. Any further disclosure, distribution, or reproduction of this document, in whole or in part, without the prior written consent of Calderwood & Harkness LLP is strictly prohibited.
I. Introduction and Purpose
This Exhibit summarizes the vendor accountability actions taken by Quorum Insurance Holdings Corp. ("Quorum") against its third-party claims-processing vendor, Palomar Data Solutions, Inc. ("Palomar"), in connection with the data security incident that is the subject of the multistate inquiry initiated by the Joint Demand Letter of the Multistate Attorney General Coalition dated September 8, 2023. As detailed herein, Quorum has acted promptly, decisively, and comprehensively to identify the root causes of the breach, hold its vendor accountable, recover meaningful financial compensation, and implement enhanced security safeguards designed to prevent recurrence.
Quorum has pursued accountability through multiple channels, including: (a) formal contractual indemnification demands directed to Palomar under the terms of the governing Master Services Agreement; (b) thorough identification and documentation of Palomar's specific contractual breaches, supported by independent forensic analysis; (c) negotiation of substantial monetary recovery reflecting both immediate cash compensation and ongoing fee reductions; and (d) imposition of enhanced, forward-looking data security obligations on Palomar, memorialized in a binding amendment to the Master Services Agreement.
The purpose of this Exhibit is to demonstrate to the Multistate Attorney General Coalition that Quorum has taken affirmative, comprehensive, and documented steps to hold its vendor accountable for the failures that contributed to the data security incident, and to ensure that meaningful prospective safeguards are in place to protect the personal information of Quorum's policyholders and claimants going forward. This Exhibit should be read in conjunction with the other Exhibits submitted with Quorum's Response, including the forensic investigation summary (Exhibit A) and the consumer remediation summary (Exhibit B).
II. Background on the Quorum–Palomar Vendor Relationship
A. Master Services Agreement Overview
Palomar Data Solutions, Inc. is a Texas corporation headquartered at 7100 Greenville Avenue, Suite 450, Dallas, Texas 75231. Palomar provides data processing, business process outsourcing, and insurance technology services to clients in the property and casualty, life, and health insurance industries. Palomar has been a significant vendor to Quorum since 2019, and the relationship between the two companies is governed by a comprehensive Master Services Agreement and related exhibits.
Quorum and Palomar entered into a Master Services Agreement (the "MSA") on November 12, 2019, with a five-year term expiring on November 11, 2024. The MSA was the product of extensive negotiation between the parties and their respective legal teams, and it includes detailed provisions addressing data security, privacy, confidentiality, indemnification, insurance, and termination rights—each of which is relevant to the vendor accountability analysis set forth in this Exhibit.
Under the MSA, Palomar processes claims data for Quorum's personal lines insurance division, which encompasses Quorum's homeowners, automobile, and umbrella insurance product lines. The data processed by Palomar in connection with its services includes, but is not limited to, policyholder and claimant personally identifiable information ("PII"), financial data such as bank account numbers and payment card information, and protected health information ("PHI") from workers' compensation and health-related insurance claims. The volume and sensitivity of the data entrusted to Palomar under the MSA underscore the critical importance of Palomar's data security obligations.
The original annual contract value ("ACV") under the MSA was $14,200,000 per year, yielding a five-year total contract value of approximately $71,000,000. This contract value reflected the scope of Palomar's claims processing responsibilities across Quorum's personal lines division and the substantial volume of data processed on a daily basis.
B. MSA Amendments
Since execution, the MSA has been amended twice (prior to the Amendment 3 discussed in Section V below), each amendment reflecting the evolving scope of Palomar's services and the parties' mutual commitment to enhancing data security standards.
Amendment 1 was executed on March 3, 2021. Amendment 1 expanded Palomar's scope of services to include processing of data related to Quorum's proprietary digital underwriting platform, QuorumEdge, which had been deployed in 2020 as part of Quorum's broader digital transformation initiative. The addition of QuorumEdge data processing increased the volume and complexity of data handled by Palomar, and correspondingly increased the ACV by $2,100,000, from $14,200,000 to $16,300,000 per year, effective April 1, 2021. Amendment 1 also updated certain service level metrics to account for the QuorumEdge workload.
Amendment 2 was executed on September 15, 2022. Amendment 2 was primarily focused on strengthening the data security framework governing Palomar's services. Specifically, Amendment 2 updated the Data Security Exhibit (Exhibit D to the MSA) to reflect current industry best practices and regulatory expectations. Among other changes, Amendment 2 added a requirement that Palomar obtain and provide to Quorum an annual SOC 2 Type II audit report covering the controls relevant to the processing and storage of Quorum data. Amendment 2 also updated the minimum cyber-insurance requirements applicable to Palomar under Exhibit E of the MSA, increasing the required coverage limits to reflect the expanded scope of services and the evolving cyber threat landscape.
Palomar is Quorum's second-largest vendor by contract value, with the ACV growing from approximately $14.2 million to approximately $16.3 million following the execution of Amendment 1. The size and strategic importance of the Palomar relationship are factors that Quorum considered in determining the appropriate vendor accountability measures, including the decision to maintain the relationship on enhanced terms rather than terminate and transition services mid-contract.
C. Key Data Security and Contractual Provisions
The MSA and its exhibits contain several provisions directly relevant to Quorum's vendor accountability actions. The key provisions are summarized below.
Exhibit D (Data Security Exhibit, as amended by Amendment 2): Exhibit D sets forth the data security obligations applicable to Palomar's handling of Quorum data. As amended, Exhibit D required Palomar to maintain "commercially reasonable" administrative, technical, and physical safeguards for the protection of Quorum data, consistent with applicable laws and industry standards. Exhibit D also imposed several specific, measurable security requirements, including: (i) the requirement that Palomar apply patches for critical vulnerabilities within 30 days of the date of the vendor patch release; (ii) the requirement that Palomar conduct annual penetration testing of its systems and infrastructure and provide the results to Quorum; and (iii) the requirement, added by Amendment 2, that Palomar obtain and furnish to Quorum an annual SOC 2 Type II audit report covering the security, availability, and confidentiality trust services criteria.
Section 9.4 (Breach Notification Clause): Section 9.4 of the MSA required Palomar to notify Quorum in writing within 48 hours of discovering any security incident or data breach affecting Quorum data. This notification was required to include, to the extent known at the time, a description of the nature and scope of the incident, the categories of data involved, and the steps being taken by Palomar to investigate and remediate the incident.
Section 12.2 (Indemnification): Section 12.2 of the MSA provides that Palomar shall indemnify, defend, and hold harmless Quorum and its affiliates, directors, officers, employees, and agents from and against any and all losses, damages, liabilities, costs, and expenses (including reasonable attorneys' fees) arising from or related to Palomar's breach of its data security obligations under the MSA and its exhibits. Palomar's indemnification obligations under Section 12.2 are subject to a liability cap equal to two times (2×) the trailing twelve-month fees paid by Quorum to Palomar. Based on the ACV of $16,300,000 per year in effect at the time of the incident, the applicable liability cap was $32,600,000.
Exhibit E (Insurance Requirements): Exhibit E required Palomar to maintain, at its own expense, a minimum of $10,000,000 in cyber-liability insurance coverage, with Quorum named as an additional insured. This requirement was intended to ensure that Palomar maintained adequate financial resources to satisfy its indemnification obligations in the event of a security incident.
Section 14.2 (Termination for Cause): Section 14.2 of the MSA grants Quorum the right to terminate the MSA upon a material breach by Palomar, provided that Quorum first delivers written notice of the breach to Palomar and Palomar fails to cure the breach within 30 days of receiving such notice. As discussed in Section VI below, Quorum has expressly reserved its termination rights under Section 14.2.
III. Palomar's Contractual Breaches
Quorum, with the assistance of its counsel at Calderwood & Harkness LLP and the forensic investigation conducted by Graystone Forensics LLC, has identified two specific, documented breaches of Palomar's obligations under the MSA. Each breach is discussed in detail below.
A. Failure to Timely Patch Critical Vulnerability (Breach of Exhibit D)
The forensic investigation conducted by Graystone Forensics LLC—which was retained under the direction of Calderwood & Harkness LLP pursuant to a Kovel engagement for the purpose of providing privileged forensic analysis—confirmed that the threat actor responsible for the data security incident gained initial unauthorized access to Palomar's network on or about March 14, 2023. The threat actor accomplished this initial access by exploiting CVE-2023-0669, a known remote code execution vulnerability in Palomar's GoAnywhere MFT file transfer appliance. The GoAnywhere MFT appliance was a component of Palomar's infrastructure used to facilitate the secure transfer of data files between Palomar and its clients, including Quorum.
CVE-2023-0669 was a critical-severity vulnerability that had been publicly disclosed prior to the date of exploitation. A vendor-issued patch for CVE-2023-0669 was publicly available prior to the date of the threat actor's exploitation of the vulnerability on or about March 14, 2023. The availability of this patch was widely publicized within the information security community, including through advisories issued by the Cybersecurity and Infrastructure Security Agency (CISA), which added CVE-2023-0669 to its Known Exploited Vulnerabilities Catalog.
Exhibit D of the MSA, as amended by Amendment 2, contained a clear and unambiguous requirement that Palomar apply patches for critical vulnerabilities within 30 days of the vendor patch release date. Palomar failed to apply the vendor-issued patch for CVE-2023-0669 within the contractual 30-day window. At the time of the threat actor's exploitation on or about March 14, 2023, the vulnerability remained unpatched on Palomar's GoAnywhere MFT appliance. Graystone Forensics' analysis confirmed that the unpatched GoAnywhere MFT appliance was the initial point of compromise and the attack vector through which the threat actor gained access to Palomar's internal network.
This failure to apply the critical patch within the contractually required timeframe constitutes a material breach of Palomar's data security obligations under Exhibit D of the MSA. The breach was not the result of a zero-day exploit or a previously unknown vulnerability; rather, it was the direct consequence of Palomar's failure to adhere to the patch management obligations it had expressly assumed under the MSA.
B. Failure to Timely Notify Quorum (Breach of Section 9.4)
In addition to the patching failure, Palomar also breached its contractual breach notification obligations under Section 9.4 of the MSA. Palomar's Security Operations Center ("SOC") first detected anomalous outbound data transfers from Palomar's network on April 18, 2023. This detection constituted the discovery of a security incident affecting Quorum data for purposes of Section 9.4 of the MSA, triggering Palomar's obligation to notify Quorum within 48 hours—i.e., by approximately April 20, 2023, at 11:59 p.m. Central Time.
Palomar did not notify Quorum of the security incident until April 21, 2023. The notification was transmitted by email from Derek Copeland, Palomar's General Counsel, to Thomas R. Whitfield, Quorum's General Counsel, and David Naranjo, Quorum's Chief Information Security Officer ("CISO"). This notification was delivered approximately 24 hours after the expiration of the contractual 48-hour notification window, in breach of Section 9.4 of the MSA.
While Palomar has offered various explanations for the delay—including the need to conduct preliminary internal investigation before notifying Quorum—the contractual obligation under Section 9.4 was clear and not conditioned on the completion of any internal investigation by Palomar. The 48-hour notification window was a material term of the MSA that was specifically negotiated to ensure that Quorum could commence its own incident response and forensic analysis promptly upon learning of a security incident affecting its data.
The delay in notification compromised Quorum's ability to begin its own incident response and forensic analysis on a timely basis, including the preservation of evidence, engagement of forensic consultants, and initial assessment of the scope and nature of the compromise. Every hour of delay in the notification of a data security incident of this magnitude has tangible consequences for the affected organization's ability to contain the incident, assess the impact, and protect the individuals whose data may have been compromised.
C. Impact of Palomar's Breaches
The combined impact of Palomar's two contractual breaches was severe and far-reaching. The unpatched vulnerability in the GoAnywhere MFT appliance enabled the threat actor to maintain persistent unauthorized access to Palomar's network for an approximately 35-day period from March 14 through April 18, 2023. During this 35-day exfiltration window, the threat actor conducted extensive lateral movement through Palomar's network, escalated privileges, and ultimately staged and exfiltrated structured data files containing Quorum policyholder and claimant data.
The forensic investigation conducted by Graystone Forensics confirmed that a total of 318,247 individuals across 29 states and the District of Columbia were affected by the data security incident. The compromised data included the following categories of sensitive personal information:
• Personally Identifiable Information (PII): Names, dates of birth, Social Security numbers, and driver's license numbers for all 318,247 affected individuals.
• Financial Information: Bank account numbers, payment card numbers, and related financial data for 84,619 of the affected individuals, representing approximately 26.6% of the total affected population.
• Protected Health Information (PHI): Health conditions, diagnosis codes, treatment information, and related medical data for 41,203 of the affected individuals, representing approximately 12.9% of the total affected population. These individuals were primarily claimants under Quorum's workers' compensation and health-related insurance product lines.
The scope and severity of the data compromise underscore the seriousness of Palomar's contractual failures. Had Palomar applied the critical patch within the contractually mandated 30-day window, the threat actor would not have been able to exploit CVE-2023-0669 as the initial access vector. Moreover, had Palomar provided timely notification within the contractual 48-hour window, Quorum could have initiated containment and remediation efforts sooner, potentially limiting the scope of the exfiltration.
IV. Quorum's Indemnification Demand and Negotiations
A. Formal Demand
On June 20, 2023, Calderwood & Harkness LLP, acting on behalf of Quorum, transmitted a formal breach of contract demand letter to Catherine Langford, Partner at Mercer, Haight & Dunlop LLP, which serves as outside counsel to Palomar. The demand letter asserted Palomar's breaches of Exhibit D (failure to timely patch CVE-2023-0669) and Section 9.4 (failure to provide timely breach notification) of the MSA, and invoked Quorum's rights under Section 12.2 (Indemnification) of the MSA.
Quorum demanded full indemnification under Section 12.2 for all incident response costs incurred as a direct result of Palomar's breaches, totaling $8,230,250. This demand was supported by detailed documentation of each cost category and was accompanied by relevant invoices and supporting materials. The component costs were as follows:
(i) Forensic investigation costs (Graystone Forensics LLC): $1,847,000. These costs reflect the fees and expenses incurred in connection with the comprehensive forensic investigation of the data security incident, including network forensics, malware analysis, data exfiltration analysis, and preparation of the forensic report.
(ii) Consumer notification, call center, and credit monitoring services (Clearfield Notification Services LLC): $3,214,500. These costs reflect the expenses of providing individual written notification to all 318,247 affected individuals in compliance with applicable state breach notification laws, establishing and operating a dedicated call center to respond to consumer inquiries, and providing complimentary credit monitoring and identity theft protection services to all affected individuals.
(iii) Crisis communications (BrightPath Consulting Group Inc.): $385,000. These costs reflect the fees incurred for crisis communications consulting, including preparation of public statements, media response strategy, and stakeholder communications.
(iv) Legal fees (Calderwood & Harkness LLP): $2,163,750. These costs reflect the legal fees incurred in connection with incident response, regulatory compliance, multistate notification coordination, forensic engagement oversight, and preparation of the vendor accountability demand.
(v) Quorum internal costs (IT remediation, employee overtime): $620,000 (estimated). These costs reflect the internal resources deployed by Quorum's IT department and other business units in connection with incident containment, remediation of Quorum's own systems, assessment of Quorum's data environment, and coordination with Palomar and external vendors.
The total demand amount of $8,230,250 was well within the contractual indemnification cap of $32,600,000 under Section 12.2 of the MSA, and Quorum's demand letter expressly reserved Quorum's right to seek additional indemnification for any future costs arising from the incident, including any regulatory penalties, litigation costs, or additional consumer remediation expenses, up to the contractual cap.
B. Palomar's Initial Response
On July 7, 2023, Mercer, Haight & Dunlop LLP, acting on behalf of Palomar, transmitted a written response to Calderwood & Harkness's demand letter. In its response, Palomar disputed both causation and the scope of its liability under the MSA. Specifically, Palomar contended that the exploitation of CVE-2023-0669 constituted a "sophisticated attack" by a highly skilled threat actor and that the mere existence of an unpatched vulnerability did not establish that the incident would not have occurred absent the patching delay. Palomar further contended that certain of the costs claimed by Quorum were not directly attributable to Palomar's alleged breaches and were instead ordinary costs of incident response that Quorum would have incurred regardless of any contractual non-compliance by Palomar.
As an alternative to full indemnification, Palomar offered a $1,500,000 goodwill credit to be applied against future service fees payable by Quorum under the MSA. Palomar characterized this offer as a demonstration of its commitment to the Quorum relationship and its recognition that the incident had caused disruption to Quorum's business.
Quorum rejected the $1,500,000 offer as wholly inadequate. The offer represented less than 19% of Quorum's documented incident costs and failed to acknowledge or address Palomar's clear contractual breaches. Quorum communicated its rejection of the offer through Calderwood & Harkness on July 14, 2023, and indicated its intention to pursue the full indemnification demand.
C. Quorum's Rebuttal
On July 25, 2023, Calderwood & Harkness LLP transmitted a detailed rebuttal letter to Catherine Langford at Mercer, Haight & Dunlop LLP, reasserting Quorum's indemnification claim and responding point-by-point to Palomar's defenses. The rebuttal letter highlighted the following key points:
(i) The vendor-issued patch for CVE-2023-0669 was publicly available prior to the date of exploitation, and the vulnerability had been the subject of widespread public advisories, including a CISA Known Exploited Vulnerabilities Catalog listing. There was nothing "novel" or "sophisticated" about the exploitation of a known, publicly disclosed vulnerability for which a patch was readily available.
(ii) Palomar's failure to apply the patch within the contractual 30-day window set forth in Exhibit D was a clear, unambiguous violation of a specific, measurable, and negotiated contractual obligation. The "commercially reasonable" standard was a floor, not a ceiling, and the specific 30-day patching requirement was an express covenant that superseded any general reasonableness analysis.
(iii) The late breach notification—approximately 24 hours beyond the contractual 48-hour window—compounded the harm to Quorum and its policyholders by delaying Quorum's ability to initiate its own incident response, engage forensic analysts, and begin the process of assessing the scope of the compromise.
(iv) The forensic evidence developed by Graystone Forensics LLC conclusively established that the unpatched CVE-2023-0669 vulnerability in Palomar's GoAnywhere MFT appliance was the initial attack vector through which the threat actor gained unauthorized access to Palomar's network. The causal chain from Palomar's patching failure to the data exfiltration was direct and well-documented.
The rebuttal letter concluded by reiterating Quorum's demand for full indemnification and reserving Quorum's right to pursue termination of the MSA for cause under Section 14.2 if a satisfactory resolution could not be reached.
D. Negotiated Settlement
Following the transmission of the rebuttal letter, the parties engaged in extended good-faith negotiations through their respective counsel over the course of approximately three months. During this period, Calderwood & Harkness and Mercer, Haight & Dunlop exchanged multiple rounds of correspondence, participated in several telephonic negotiation sessions, and shared relevant documentation in support of their respective positions. Quorum's negotiation strategy was informed by a careful assessment of the strength of its legal position, the total costs incurred, the potential for additional future costs, the availability of insurance recovery from Quorum's own cyber-liability carrier (Atlas Mutual Insurance Company), and the business interest in maintaining operational continuity during the remaining MSA term.
The parties ultimately reached a settlement on October 27, 2023, which was memorialized in a Settlement Agreement and Mutual Release executed by authorized representatives of both Quorum and Palomar on that date. The material terms of the settlement are as follows:
(a) Cash Payment: Palomar agreed to pay Quorum the sum of $4,200,000, payable within 30 calendar days of the execution date of the Settlement Agreement. This payment represents direct monetary recovery for a substantial portion of Quorum's documented incident response costs.
(b) Fee Reduction: Palomar agreed to an 18-month reduction of 8% on the annual contract value, effective November 1, 2023. Based on the current ACV of $16,300,000, the 8% reduction yields annual savings of $1,304,000, and the total savings over the 18-month reduction period equal $1,956,000 ($16,300,000 × 8% × 1.5 years). This fee reduction provides Quorum with ongoing economic benefit and reflects Palomar's acknowledgment of its responsibility for the incident.
(c) Independent Security Assessment: Palomar agreed to engage, at Palomar's sole cost and expense, an independent third-party security assessor to conduct enhanced annual security audits of Palomar's systems and controls, with the scope of such audits to be mutually agreed upon by the parties and the results to be shared with Quorum. This requirement is in addition to the annual SOC 2 Type II audit requirement already in effect under Amendment 2.
(d) Enhanced Security Measures: Palomar committed to implement enhanced patch management protocols, including automated patch deployment and verification processes, and to deploy enterprise-grade endpoint detection and response ("EDR") capabilities across all systems that process, store, or transmit Quorum data. These implementations were required to be completed within 90 calendar days of the settlement date.
(e) Mutual Release: The parties exchanged mutual releases of all claims, demands, causes of action, and liabilities related to or arising from the data security incident, subject to customary carve-outs for fraud, willful misconduct, and obligations arising under the Settlement Agreement itself and Amendment 3 to the MSA.
Effective Total Recovery by Quorum: The combined value of the cash payment and the fee reduction yields a total effective recovery of $6,156,000 ($4,200,000 in cash plus $1,956,000 in fee reductions). This recovery represents approximately 74.8% of Quorum's total documented incident costs of $8,230,250.
Quorum's Board of Directors and senior management team carefully evaluated the settlement terms and determined the settlement to be commercially reasonable in light of the totality of the circumstances, including: the total documented incident costs of $8,230,250; the insurance recovery obtained by Quorum from its own cyber-liability carrier, Atlas Mutual Insurance Company; the litigation risk and costs that would be associated with pursuing the full indemnification claim through litigation; the interest in preserving the ongoing vendor relationship through the remaining MSA term and avoiding the significant operational disruption and expense that would accompany a mid-contract vendor transition; and the substantial forward-looking security enhancements obtained through Amendment 3 (discussed in Section V below).
V. Enhanced Security Requirements — MSA Amendment 3
Concurrently with the execution of the Settlement Agreement and Mutual Release, Quorum and Palomar executed a Third Amendment to the Master Services Agreement ("Amendment 3"), dated October 27, 2023. Amendment 3 imposes enhanced, forward-looking data security and audit obligations on Palomar that are designed to substantially reduce the risk of a similar incident occurring in the future. The key provisions of Amendment 3 are summarized below.
Accelerated Patch Management: Amendment 3 reduces the maximum permissible timeframe for applying critical vulnerability patches from 30 days to 14 days following the vendor patch release date. This accelerated patching requirement applies to all critical and high-severity vulnerabilities affecting systems that process, store, or transmit Quorum data. The reduction from a 30-day to a 14-day patching window reflects current industry best practices and significantly narrows the window of exposure to known vulnerabilities. Palomar is further required to maintain and provide to Quorum, upon request, documentation evidencing compliance with this accelerated patching requirement.
Mandatory Endpoint Detection and Response (EDR): Amendment 3 requires Palomar to deploy enterprise-grade endpoint detection and response technology across all systems that process, store, or transmit Quorum data. The EDR solution must provide real-time monitoring, automated threat detection, and incident response capabilities. This requirement ensures that Palomar's security infrastructure includes modern, active monitoring capabilities that go beyond traditional signature-based antivirus solutions and that enable rapid detection of, and response to, anomalous activity on Palomar's endpoints and servers.
Quarterly Vulnerability Scanning: Amendment 3 requires Palomar to conduct comprehensive vulnerability scans of all systems in scope for Quorum data processing on a quarterly basis. Following each quarterly scan, Palomar is required to provide a detailed vulnerability scan report to Quorum's CISO, David Naranjo, and VP, Vendor Risk Management, Priya Deshmukh. The reports must include a complete inventory of identified vulnerabilities, severity ratings, and planned remediation timelines. This quarterly cadence replaces the prior annual-only assessment framework and provides Quorum with regular, ongoing visibility into the security posture of Palomar's systems.
Annual Independent Security Assessment: Amendment 3 requires Palomar to engage an independent third-party security assessor, selected with the consent of Quorum and at Palomar's sole expense, to conduct a comprehensive annual security assessment of Palomar's systems, controls, and processes relevant to the processing of Quorum data. The scope of the annual assessment must include, at a minimum, network security architecture review, access control evaluation, data protection and encryption assessment, incident response preparedness evaluation, and review of Palomar's compliance with Amendment 3's enhanced security requirements. The results of each annual assessment, including any findings and recommended remediation actions, must be shared with Quorum within 30 days of completion.
Enhanced Incident Notification: Amendment 3 shortens the contractual notification window for security incidents from 48 hours to 24 hours from the time of discovery of any security incident affecting or reasonably believed to affect Quorum data. This revised notification window replaces the prior 48-hour requirement set forth in Section 9.4 of the MSA and ensures that Quorum receives earlier notice of potential security incidents, enabling a more rapid and effective incident response. The notification must include, to the extent known at the time, the nature and scope of the incident, the categories of Quorum data potentially affected, and the immediate steps being taken by Palomar to contain and investigate the incident.
Fee Reduction: Amendment 3 incorporates and memorializes the negotiated 18-month, 8% fee reduction into the economic terms of the MSA, as agreed in the Settlement Agreement. Specifically, the ACV is reduced from $16,300,000 to $14,996,000 for the 18-month period from November 1, 2023, through April 30, 2025, after which the ACV reverts to $16,300,000 for the remainder of the MSA term (if any).
Taken together, the provisions of Amendment 3 represent a substantial strengthening of Palomar's security obligations under the MSA and reflect Quorum's insistence on meaningful, enforceable prospective safeguards as a condition of continuing the vendor relationship.
VI. Ongoing Vendor Oversight and Monitoring
In addition to the specific contractual amendments and settlement terms described above, Quorum has enhanced its internal vendor risk management practices with respect to Palomar. These enhanced practices are designed to ensure ongoing, proactive oversight of Palomar's security posture and compliance with the strengthened contractual requirements.
Key ongoing vendor oversight measures include the following:
• Enhanced Oversight Cadence: Quorum's VP, Vendor Risk Management, Priya Deshmukh, has implemented an enhanced oversight cadence for the Palomar relationship, including monthly security posture reviews conducted in collaboration with Quorum's Information Security team. These monthly reviews cover Palomar's patching status, vulnerability scan results, incident response readiness, and compliance with the requirements of Amendment 3. Prior to the incident, vendor security reviews were conducted on a quarterly basis; the shift to a monthly cadence reflects the heightened risk profile assigned to the Palomar relationship.
• Direct Security Communication Channels: Quorum's CISO, David Naranjo, has established direct, ongoing communication channels with Palomar's Chief Technology Officer, Anita Raghavan, for the purpose of real-time security issue escalation. This direct line of communication ensures that any emerging security concerns can be raised and addressed promptly, without the delays inherent in formal contractual notification processes.
• SOC 2 Type II Report Review: Quorum required and obtained Palomar's most recent SOC 2 Type II audit report, which was audited by Kessler, Park & Associates CPA, PLLC, an independent public accounting firm. Quorum's Information Security team has reviewed the report and is monitoring Palomar's remediation of any findings identified therein. Quorum will continue to require and review annual SOC 2 Type II reports from Palomar for the duration of the MSA.
• Reservation of Termination Rights: Quorum has expressly reserved its right to terminate the MSA for cause under Section 14.2 should any future material security breach, contractual non-compliance, or failure to satisfy the enhanced obligations under Amendment 3 occur. Quorum has communicated this reservation of rights directly to Palomar's senior management and outside counsel, and Palomar has acknowledged that its continued performance under the MSA is subject to strict compliance with all applicable security obligations.
These ongoing oversight measures complement the contractual enhancements set forth in Amendment 3 and reflect Quorum's commitment to maintaining a rigorous, proactive vendor risk management posture.
VII. Summary of Vendor Accountability Outcomes
The following summarizes the key outcomes of Quorum's vendor accountability actions against Palomar in connection with the data security incident.
Contractual Breaches Identified and Documented:
1. Failure to apply the vendor-issued patch for CVE-2023-0669 within the contractually mandated 30-day patching window, constituting a material breach of Exhibit D to the MSA.
2. Failure to notify Quorum of the security incident within the contractually mandated 48-hour notification window, with notification delivered approximately 24 hours late, constituting a breach of Section 9.4 of the MSA.
Financial Recovery:
Total effective recovery by Quorum: $6,156,000, comprising $4,200,000 in direct cash payment and $1,956,000 in fee reductions over an 18-month period, against total documented incident costs of $8,230,250. This recovery represents approximately 74.8% of Quorum's total documented costs.
Forward-Looking Security Enhancements:
Amendment 3 to the MSA substantially strengthened Palomar's security obligations, including:
• Accelerated critical patching requirement (reduced from 30 days to 14 days);
• Mandatory deployment of enterprise-grade endpoint detection and response (EDR) technology;
• Quarterly vulnerability scanning with reporting to Quorum;
• Annual independent third-party security assessment at Palomar's expense;
• Shortened security incident notification window (reduced from 48 hours to 24 hours).
Vendor Relationship:
Quorum elected to maintain the vendor relationship with Palomar through the remaining term of the MSA, subject to the enhanced security obligations imposed by Amendment 3 and Quorum's expressly reserved termination rights under Section 14.2. This decision was made in the interest of operational continuity—reflecting the critical nature of Palomar's claims processing services and the significant cost and disruption associated with a mid-contract vendor transition—while ensuring rigorous, ongoing accountability through the contractual, financial, and oversight mechanisms described in this Exhibit.
Quorum's vendor accountability actions, taken as a whole, reflect its firm commitment to protecting the personal information of its policyholders and claimants, holding responsible parties accountable for security failures, recovering meaningful financial compensation, and implementing prospective safeguards designed to materially reduce the risk of recurrence. Quorum believes that the actions documented in this Exhibit demonstrate the type of responsible, proactive vendor management that the Multistate Attorney General Coalition expects of entities entrusted with consumers' sensitive personal information.
VIII. List of Referenced Documents
The following documents are referenced in this Exhibit and are available upon request, subject to the privilege reservations noted below:
1. Master Services Agreement between Quorum Insurance Holdings Corp. and Palomar Data Solutions, Inc., dated November 12, 2019.
2. Amendment 1 to the Master Services Agreement, dated March 3, 2021.
3. Amendment 2 to the Master Services Agreement, dated September 15, 2022.
4. Amendment 3 to the Master Services Agreement, dated October 27, 2023.
5. Settlement Agreement and Mutual Release between Quorum Insurance Holdings Corp. and Palomar Data Solutions, Inc., dated October 27, 2023.
6. Breach of Contract Demand Letter from Calderwood & Harkness LLP to Mercer, Haight & Dunlop LLP, dated June 20, 2023.
7. Response Letter from Mercer, Haight & Dunlop LLP (on behalf of Palomar Data Solutions, Inc.), dated July 7, 2023.
8. Rebuttal Letter from Calderwood & Harkness LLP to Mercer, Haight & Dunlop LLP, dated July 25, 2023.
Note: Certain documents referenced above are subject to the attorney-client privilege and/or the work product doctrine. Quorum Insurance Holdings Corp. reserves all applicable privileges and protections and does not waive any privilege or protection by this submission to the Multistate Attorney General Coalition or by the identification of such documents herein. Production of any such documents, if agreed to, will be subject to appropriate confidentiality protections and non-waiver agreements.
— END OF EXHIBIT C —

EXHIBIT C

Record

Parties

Dates

Amounts