PRIVILEGED AND CONFIDENTIAL — ATTORNEY-CLIENT PRIVILEGED / ATTORNEY WORK PRODUCT
MEMORANDUM
FROM: Alan Burke, Lead Associate, Privacy & Data Security, Calderwood & Harkness LLP
TO: Kevin Ostrowski, Responsible Partner, Privacy & Data Security, Calderwood & Harkness LLP Thomas R. Whitfield, General Counsel, Quorum Insurance Holdings Corp.
DATE: May 12, 2023
RE: Contractual Analysis — Master Services Agreement Between Quorum Insurance Holdings Corp. and Palomar Data Solutions, Inc. (dated November 12, 2019, as amended) — Indemnification, Data Security, and Related Provisions
MATTER NO.: 1025-00006
CLIENT: Quorum Insurance Holdings Corp.
I. EXECUTIVE SUMMARY
This memorandum analyzes key provisions of the Master Services Agreement dated November 12, 2019 (the "MSA") between Quorum Insurance Holdings Corp. ("Quorum" or the "Company") and Palomar Data Solutions, Inc. ("Palomar"), as amended by Amendment No. 1 (executed March 3, 2021) and Amendment No. 2 (executed September 15, 2022), in light of the data security incident disclosed by Palomar to Quorum on April 21, 2023 (the "Incident"). Our analysis focuses on Palomar's data security obligations, the breach notification requirements, the indemnification and liability limitation framework, and the termination rights available to Quorum.
Based on our review of the MSA and the information available to date, we conclude that Palomar appears to have materially breached at least two provisions of the MSA in connection with the Incident:
First, Palomar failed to comply with the vulnerability patching requirements set forth in Exhibit D (Data Security Requirements), Section 3(f) (as amended by Amendment No. 2). That provision requires Palomar to apply security patches classified as "critical" or "high" within thirty (30) calendar days of the date such patch is made generally available by the software vendor. The Incident was caused by exploitation of CVE-2023-0669, a critical remote code execution vulnerability in Severin Corporation's GoAnywhere MFT file transfer appliance, for which a vendor patch had been released prior to the date of exploitation. Preliminary information strongly indicates that Palomar failed to apply this patch in the required timeframe.
Second, Palomar breached the breach notification requirement set forth in MSA Section 9.4 (Security Incident Notification), which requires Palomar to notify Quorum in writing within forty-eight (48) hours of Palomar's discovery of any Security Incident affecting or reasonably likely to affect Client Data. Palomar's Security Operations Center detected the Incident on April 18, 2023, but Palomar did not notify Quorum until April 21, 2023 — approximately twenty-four (24) hours past the contractual deadline.
Under Section 12.2 of the MSA (Data Security Indemnification), Palomar is obligated to indemnify, defend, and hold harmless Quorum for all losses arising from Palomar's breach of its data security obligations under Exhibit D or Section 9 (Confidentiality and Security Incident Notification). This indemnification obligation is broad and covers forensic investigation costs, consumer notification costs, credit monitoring and identity theft protection, crisis communications, legal fees, regulatory defense costs, fines and penalties, and Quorum's internal remediation costs.
The MSA contains a general liability cap of two times (2×) the trailing twelve-month fees paid or payable by Quorum to Palomar (MSA Section 13.1). Based on Quorum's current annual contract value of $16,300,000 (as adjusted by Amendment No. 1, effective April 1, 2021), the Liability Cap under the conservative reading is 2 × $16,300,000 = $32,600,000. However, Section 13.2 of the MSA contains a carve-out that expressly excludes data security indemnification obligations under Section 12.2 from the Liability Cap, which may render Palomar's indemnification obligation effectively uncapped. We discuss this interpretive question in detail in Section V below.
It is important to note that the forensic investigation being conducted by Graystone Forensics LLC under the privilege umbrella established by this firm is ongoing. Preliminary findings are expected by early June 2023. Total incident response costs are not yet determinable, and the full scope of affected data — including the number of individuals whose personally identifiable information ("PII"), financial information, and protected health information ("PHI") may have been compromised — remains under investigation. Accordingly, this memorandum addresses the contractual framework, identifies Palomar's apparent breaches, and sets forth our recommended course of action. We will update this analysis as additional facts become available.
Recommendation. Quorum has strong contractual grounds to pursue full indemnification from Palomar for all incident response costs and related losses arising from the Incident. We recommend that Quorum promptly (i) issue a formal written notice to Palomar asserting its right to indemnification under Section 12.2, (ii) issue a formal notice of material breach under Section 14.2 (Termination for Cause) to preserve Quorum's termination rights, and (iii) take the additional steps outlined in Section X of this memorandum to position Quorum for maximum recovery while maintaining operational flexibility regarding the ongoing vendor relationship.
II. BACKGROUND
A. The Master Services Agreement
The MSA, titled "Master Services Agreement between Quorum Insurance Holdings Corp. and Palomar Data Solutions, Inc.," was executed on November 12, 2019, and governs Palomar's provision of claims data processing, document management, and analytics services for Quorum's personal lines insurance division. Under the MSA, Palomar receives, processes, stores, and manages substantial volumes of sensitive data belonging to Quorum and its policyholders and claimants, including PII, financial information, claims records, and — in connection with certain workers' compensation and disability claims — protected health information subject to the Health Insurance Portability and Accountability Act of 1996 ("HIPAA") and its implementing regulations.
The original term of the MSA is five (5) years, commencing on November 12, 2019 and expiring on November 11, 2024, unless earlier terminated in accordance with the terms of the agreement. The MSA provides for automatic renewal for successive one-year periods unless either party provides written notice of non-renewal at least one hundred eighty (180) days prior to the expiration of the then-current term.
The original annual contract value ("ACV") under the MSA was $14,200,000 per year, resulting in a total contract value over the initial five-year term of approximately $71,000,000. As discussed below, the ACV was subsequently increased by Amendment No. 1. Palomar has represented in prior correspondence that Quorum is Palomar's second-largest client by revenue, reflecting the significance of this commercial relationship to both parties.
The MSA is governed by the laws of the State of Delaware, without regard to its conflict-of-laws principles (MSA Section 17.5), and the parties have consented to the exclusive jurisdiction of the federal and state courts located in Wilmington, Delaware for the resolution of any disputes arising under the agreement (MSA Section 17.6). The MSA also includes a mandatory pre-suit mediation requirement (Section 17.7), requiring the parties to engage in good-faith mediation before commencing any litigation.
B. Amendment History
The MSA has been amended twice since its original execution:
Amendment No. 1 (executed March 3, 2021). Amendment No. 1 expanded the scope of Palomar's services to include the processing of data generated by Quorum's proprietary digital underwriting platform, known internally as "QuorumEdge." QuorumEdge is a cloud-based platform that automates portions of Quorum's personal lines underwriting workflow and generates substantial volumes of applicant data, risk scoring outputs, and policy issuance records. The addition of QuorumEdge data processing to Palomar's scope of services increased the volume and sensitivity of data entrusted to Palomar's custody and control. To account for the expanded scope, Amendment No. 1 increased the ACV by $2,100,000, bringing the total ACV from $14,200,000 to $16,300,000 per year, effective April 1, 2021. All other terms and conditions of the MSA remained unchanged by Amendment No. 1.
Amendment No. 2 (executed September 15, 2022). Amendment No. 2 was negotiated in the context of a broader vendor risk management review conducted by Quorum's information security and legal teams during the first half of 2022. The primary purpose of Amendment No. 2 was to update and strengthen the data security requirements applicable to Palomar under Exhibit D (Data Security Requirements). Key changes effected by Amendment No. 2 include: (i) enhanced specificity in the vulnerability management and patching requirements, including the 30-day patching obligation discussed in detail in Section III.B below; (ii) the addition of a requirement that Palomar obtain and deliver to Quorum an annual SOC 2 Type II audit report, prepared by an independent CPA firm, covering the design and operating effectiveness of Palomar's security controls relevant to the processing of Quorum data (the initial audit was to be performed by Kessler, Park & Associates CPA, PLLC, of Dallas, Texas, with Vivian Park as the engagement partner); and (iii) updates to the cyber insurance minimum requirements set forth in Exhibit E (Insurance Requirements), including an increase in the minimum cyber liability insurance coverage from $5,000,000 to $10,000,000 per occurrence. All other terms and conditions of the MSA, as previously amended, remained unchanged by Amendment No. 2.
C. The Security Incident
The following summary of the Incident is based on information provided by Palomar to date, publicly available threat intelligence regarding CVE-2023-0669, and the preliminary work undertaken by Graystone Forensics LLC since its engagement on May 5, 2023. The facts remain subject to confirmation and refinement as the forensic investigation progresses.
On or about March 14, 2023, a threat actor exploited CVE-2023-0669, a known remote code execution vulnerability affecting Severin Corporation's GoAnywhere MFT (Managed File Transfer) file transfer appliance, to gain unauthorized access to Palomar's network environment. CVE-2023-0669 is a pre-authentication command injection vulnerability that permits an unauthenticated remote attacker to execute arbitrary code on the affected server. The vulnerability was widely publicized in the cybersecurity community in early 2023, and Severin Corporation released a patch to remediate the flaw prior to the date of exploitation. Multiple cybersecurity agencies, including the Cybersecurity and Infrastructure Security Agency ("CISA"), issued advisories urging organizations to apply the patch immediately. Exploitation of CVE-2023-0669 has been attributed by multiple cybersecurity firms to the Strathmore & Co. ransomware group and affiliated threat actors, who have conducted a broad campaign targeting organizations using unpatched GoAnywhere MFT appliances.
Following the initial compromise of Palomar's GoAnywhere MFT appliance, the threat actor engaged in lateral movement within Palomar's network over an approximately thirty-five (35) day window, from on or about March 14, 2023 through April 18, 2023. During this period, the threat actor accessed portions of Palomar's internal network infrastructure and exfiltrated data. The scope and volume of the exfiltrated data are under active investigation by Graystone Forensics.
On April 18, 2023, Palomar's Security Operations Center ("SOC") detected anomalous outbound data transfers from Palomar's network environment. Upon detection, Palomar initiated its internal incident response procedures, including containment and eradication activities. Palomar retained its own outside forensic firm (we understand this to be CipherTrace Solutions, Inc., although this has not been formally confirmed) to assist with investigation and remediation.
On April 21, 2023, Palomar notified Quorum of the Incident via email from Derek Copeland, Palomar's General Counsel, to Thomas R. Whitfield, Quorum's General Counsel, and David Naranjo, Quorum's Chief Information Security Officer ("CISO"). The notification email provided a high-level description of the Incident, indicated that Palomar was conducting an investigation, and stated that Palomar would provide additional information as it became available. As discussed in Section IV below, this notification was provided approximately twenty-four (24) hours after the expiration of the forty-eight (48) hour notification window required by Section 9.4 of the MSA.
Calderwood & Harkness LLP was engaged by Quorum on May 4, 2023 to provide legal advice and representation in connection with the Incident. On May 5, 2023, at the direction of this firm and under the protection of the attorney-client privilege and attorney work product doctrine, Quorum retained Graystone Forensics LLC ("Graystone") to conduct a forensic investigation of the Incident. Graystone's investigation is being conducted under a written engagement letter with this firm, and all communications with Graystone are being channeled through Calderwood & Harkness to preserve applicable privilege protections.
Preliminary indications from Graystone's work to date suggest that the Incident resulted in the exposure of PII (including names, addresses, dates of birth, Social Security numbers, and driver's license numbers), financial information (including bank account and payment card information), and PHI (including medical records and health insurance information) of Quorum policyholders and claimants across multiple states. The total number of affected individuals has not yet been determined, but based on the volume and types of data processed by Palomar on behalf of Quorum, the affected population could be substantial. We expect Graystone to deliver its preliminary findings report by early June 2023, which will provide greater clarity on the scope of affected data and the number of potentially impacted individuals.
III. DATA SECURITY OBLIGATIONS — EXHIBIT D (AS AMENDED)
A. Overview of Exhibit D Requirements
Exhibit D to the MSA, titled "Data Security Requirements," sets forth the specific data security obligations applicable to Palomar in connection with its receipt, processing, storage, and management of Quorum data. Exhibit D was included in the original MSA executed on November 12, 2019 and was materially updated and strengthened by Amendment No. 2, executed on September 15, 2022. References to Exhibit D in this memorandum refer to the version as amended by Amendment No. 2 unless otherwise indicated.
The overarching data security standard established by Exhibit D requires Palomar to "implement and maintain commercially reasonable administrative, technical, and physical safeguards designed to protect the confidentiality, integrity, and availability of Client Data in Service Provider's custody or control, consistent with industry standards and applicable law." This general standard is supplemented by a series of specific, enumerated security obligations, which include but are not limited to the following:
(a) Encryption. Palomar is required to encrypt all Quorum data at rest using AES-256 or equivalent encryption, and to encrypt all Quorum data in transit using TLS 1.2 or higher.
(b) Access Controls. Palomar is required to implement and maintain role-based access controls, ensuring that access to Quorum data is limited to Palomar personnel who require such access to perform their assigned duties in connection with the services. Palomar must conduct access reviews no less frequently than quarterly and must promptly revoke access upon personnel termination or role change.
(c) Network Segmentation. Palomar is required to maintain logical and, where feasible, physical segmentation of the network environments used to process Quorum data from Palomar's general corporate network and from environments used to process data of other Palomar clients.
(d) Logging and Monitoring. Palomar is required to maintain comprehensive logging of all access to, and activity involving, Quorum data, and to monitor such logs using automated security information and event management ("SIEM") tools for indicators of compromise and anomalous activity. Logs must be retained for a minimum of one (1) year.
(e) Vulnerability Management Program. Palomar is required to maintain a documented vulnerability management program that includes regular vulnerability scanning of all systems that process Quorum data, risk-based prioritization of identified vulnerabilities, and timely remediation activities.
(f) Vulnerability Patching — 30-Day Requirement. Palomar is required to apply security patches and updates classified as "critical" or "high" by the applicable software vendor or by the Common Vulnerability Scoring System ("CVSS") within thirty (30) calendar days of the date such patch or update is made generally available by the vendor. This provision is discussed in detail in Section III.B below.
(g) Annual Penetration Testing. Palomar is required to conduct annual penetration testing of its network and systems that process Quorum data, performed by a qualified third-party firm. A summary report of the penetration test results must be provided to Quorum within thirty (30) days of completion of the test.
(h) SOC 2 Type II Audit Report. Palomar is required to obtain and deliver to Quorum an annual SOC 2 Type II audit report, covering the design and operating effectiveness of security controls relevant to the processing of Quorum data. This requirement was added by Amendment No. 2 and is discussed in Section III.D below.
These obligations are cumulative and are in addition to the general "commercially reasonable safeguards" standard. Palomar's compliance with the specific enumerated requirements does not excuse any failure to maintain commercially reasonable safeguards overall, and conversely, a failure to comply with any specific enumerated requirement constitutes a breach of Exhibit D regardless of whether Palomar's overall security posture might otherwise be deemed "commercially reasonable."
B. Vulnerability Patching Obligation — 30-Day Requirement
The vulnerability patching requirement is the most significant contractual provision at issue in connection with the Incident. Exhibit D, Section 3(f), as amended by Amendment No. 2, provides in relevant part:
"Service Provider shall apply security patches and updates classified as 'critical' or 'high' by the applicable software vendor or by the Common Vulnerability Scoring System (CVSS) within thirty (30) calendar days of the date such patch or update is made generally available by the vendor."
This provision establishes a clear, objective, and time-bound obligation: Palomar must apply critical or high-severity patches within thirty calendar days of vendor release. The obligation is not qualified by reasonableness or feasibility exceptions; it is a mandatory compliance requirement.
CVE-2023-0669. The vulnerability exploited in the Incident is designated CVE-2023-0669. This is a pre-authentication remote code execution vulnerability affecting Severin Corporation's GoAnywhere MFT file transfer appliance, a widely used enterprise managed file transfer solution. The vulnerability permits an unauthenticated attacker to execute arbitrary code on the affected system by exploiting a flaw in the administrative console. CVE-2023-0669 was assigned a CVSS base score of 7.2 (classified as "high") by the National Vulnerability Database, and Severin Corporation itself classified the vulnerability as critical in its security advisory. The vulnerability was publicly disclosed, and a patch (version 7.1.2) was made available by Severin Corporation prior to March 14, 2023, the date on which the threat actor exploited the vulnerability on Palomar's system.
The precise date on which Severin Corporation made the patch generally available is a critical factual question that Graystone Forensics has been specifically tasked with confirming. Publicly available information indicates that Severin Corporation issued an emergency patch for CVE-2023-0669 on or about February 7, 2023, and issued a security advisory urging all customers to apply the patch immediately. CISA added CVE-2023-0669 to its Known Exploited Vulnerabilities ("KEV") catalog on February 10, 2023, with a remediation deadline of March 3, 2023 for federal agencies. Widespread exploitation by the Strathmore & Co. ransomware group was reported throughout February and March 2023.
Palomar's Apparent Failure. Based on the information available to date, the threat actor exploited CVE-2023-0669 on Palomar's GoAnywhere MFT appliance on or about March 14, 2023. If the patch was made available by Severin Corporation on or about February 7, 2023, then the 30-day contractual patching window under Exhibit D, Section 3(f) would have expired on or about March 9, 2023 — five days before the exploitation occurred. If Palomar had not applied the patch by March 14, 2023, then Palomar was already in breach of the 30-day patching requirement at the time of exploitation.
Even if there is some ambiguity regarding the exact date the patch became "generally available" within the meaning of Section 3(f), the facts overwhelmingly support a finding of breach. The patch was released more than five weeks before the exploitation, CISA had issued an emergency directive, and the vulnerability was being actively exploited in the wild. Any reasonable interpretation of the 30-day patching obligation would require Palomar to have applied this patch well before March 14, 2023.
We have directed Graystone Forensics to include in its investigation specific findings regarding: (i) the date on which Severin Corporation made the patch for CVE-2023-0669 generally available; (ii) whether Palomar applied the patch to its GoAnywhere MFT appliance prior to the March 14 exploitation, and if so, on what date; (iii) whether Palomar's vulnerability management program identified CVE-2023-0669 as a critical or high-severity vulnerability requiring remediation; and (iv) Palomar's internal communications and decision-making regarding the patching of CVE-2023-0669. These findings will be critical to Quorum's indemnification demand and any subsequent enforcement action.
C. Annual Penetration Testing Requirement
Exhibit D, Section 3(h) (as designated following the Amendment No. 2 restructuring of the Exhibit) requires Palomar to "conduct annual penetration testing of its network and systems that process Client Data, performed by a qualified third-party firm, with a summary report of the results provided to Client within thirty (30) days of completion of the test."
The relevance of this requirement to the Incident is twofold. First, a properly scoped penetration test should have identified the GoAnywhere MFT appliance as a component of Palomar's network infrastructure processing or handling Quorum data, and should have assessed whether the appliance was running a vulnerable software version. If Palomar's most recent penetration test failed to identify the GoAnywhere MFT vulnerability — either because the test was not properly scoped to include the appliance, or because the test was conducted before the vulnerability was disclosed — this may not constitute a breach in itself, but it would raise questions about the adequacy of Palomar's overall vulnerability management posture.
Second, if the most recent penetration test did identify vulnerabilities in the GoAnywhere MFT appliance or in Palomar's patch management practices, and Palomar failed to remediate those findings in a timely manner, this would constitute an additional breach of Exhibit D's requirement to maintain a vulnerability management program and to remediate identified vulnerabilities.
Action Item. We recommend that Quorum's VP, Vendor Risk Management, Priya Deshmukh, be consulted to confirm: (i) when Palomar last delivered a penetration testing summary report to Quorum; (ii) what firm conducted the penetration test; (iii) whether the scope of the test included the GoAnywhere MFT appliance; and (iv) whether any findings related to patch management or file transfer systems were identified and, if so, whether remediation was confirmed. This information will inform our assessment of whether the penetration testing requirement was breached and will support the broader narrative of Palomar's deficient security practices.
D. SOC 2 Type II Audit Requirement
Amendment No. 2, executed on September 15, 2022, added a new requirement for Palomar to obtain and deliver to Quorum an annual SOC 2 Type II audit report. SOC 2 Type II reports, issued in accordance with the American Institute of Certified Public Accountants ("AICPA") Trust Services Criteria, evaluate both the design and operating effectiveness of an organization's controls over a defined review period (typically six to twelve months). The SOC 2 Type II audit for Palomar was to be performed by Kessler, Park & Associates CPA, PLLC, an independent CPA firm based in Dallas, Texas, with Vivian Park as the engagement partner.
The SOC 2 Type II report is relevant to the Incident analysis in several respects. If the report covers a review period that includes the months leading up to the March 2023 exploitation, it may contain findings, exceptions, or qualifications related to Palomar's vulnerability management and patching controls. Specifically, the SOC 2 Trust Services Criteria for the "Security" principle include criteria related to the identification and management of vulnerabilities, the timely application of security patches, and the monitoring of systems for indicators of compromise. If the SOC 2 Type II report identifies control deficiencies in these areas, it would corroborate Quorum's position that Palomar's security practices were inadequate and would further support the indemnification claim.
Conversely, if the SOC 2 Type II report contains a clean opinion with no exceptions related to patch management, this would raise questions about the scope and rigor of the audit itself, but would not diminish Palomar's contractual obligation to actually apply patches within the 30-day window.
Action Item. We recommend that Quorum obtain the most recent SOC 2 Type II report from Palomar (or from Kessler, Park & Associates directly, if Palomar has authorized such delivery) and provide it to this firm for review. We will assess whether any exceptions or qualifications were noted in connection with patch management, vulnerability management, or related security controls, and will incorporate those findings into our analysis.
IV. BREACH NOTIFICATION OBLIGATION — SECTION 9.4
A. Contractual Requirement
Section 9.4 of the MSA, titled "Security Incident Notification," establishes Palomar's obligation to notify Quorum promptly upon discovery of a security incident affecting Quorum data. Section 9.4 provides in relevant part:
"Service Provider shall notify Client in writing within forty-eight (48) hours of Service Provider's discovery of any Security Incident that affects or is reasonably likely to affect Client Data."
The term "Security Incident" is defined in Section 1.15 of the MSA as follows:
"'Security Incident' means any unauthorized access to, acquisition of, use of, or disclosure of Client Data, or any event that compromises the security, confidentiality, or integrity of Client Data."
This definition is intentionally broad. It encompasses not only confirmed data breaches involving actual unauthorized access to or acquisition of data, but also any "event" that "compromises the security, confidentiality, or integrity" of Quorum data. The detection of anomalous outbound data transfers from Palomar's network on April 18, 2023 — which indicated that data was being exfiltrated from Palomar's systems — clearly falls within this definition. Indeed, even prior to confirming the nature and scope of the exfiltrated data, the anomalous transfers were "reasonably likely to affect Client Data," given that Palomar processes substantial volumes of Quorum data on the affected systems.
The notification must be provided "in writing," which the MSA defines in Section 1.22 to include email. Accordingly, Palomar's email notification to Thomas R. Whitfield and David Naranjo on April 21, 2023 satisfied the form requirement. The issue is one of timeliness.
B. Palomar's Notification Timeline
The relevant timeline for assessing Palomar's compliance with Section 9.4 is as follows:
The 48-hour notification clock under Section 9.4 began to run on April 18, 2023, when Palomar's SOC discovered the anomalous outbound data transfers. This detection constitutes "Discovery" of a Security Incident within the meaning of Section 9.4, as the anomalous transfers were, at minimum, an "event that compromises the security, confidentiality, or integrity of Client Data" and were "reasonably likely to affect Client Data."
The 48-hour contractual deadline therefore expired on or about April 20, 2023, by the end of business. Palomar did not provide written notification to Quorum until April 21, 2023 — approximately twenty-four (24) hours after the contractual deadline had passed.
C. Significance of the Late Notification
While the delay in notification was approximately one day — a relatively brief period in absolute terms — the late notification is legally significant for several reasons that Quorum should consider:
Independent Breach. The late notification constitutes a separate, independent breach of the MSA, distinct from the patching failure discussed in Section III.B. Even if Palomar were able to dispute its liability for the patching failure (which we do not believe is likely based on the available facts), the late notification stands as an additional contractual violation that independently triggers Palomar's indemnification obligations under Section 12.2.
Reduced Response Time. Every additional day of delay in vendor-to-client notification reduced Quorum's ability to begin its own investigation, containment planning, and notification assessment. The 48-hour notification window was specifically negotiated to ensure that Quorum would have prompt notice of any security incident so that it could take immediate steps to protect its interests, including engaging counsel and forensic experts, assessing its own notification obligations under applicable data breach notification statutes, and communicating with regulators and affected individuals as appropriate. The 24-hour delay meant that Quorum's response activities were correspondingly delayed by at least one day, and potentially longer given that the notification was received late on a Friday afternoon.
Pattern of Non-Compliance. When considered together with the patching failure, the late notification demonstrates a broader pattern of non-compliance by Palomar with its data security and incident response obligations under the MSA. This pattern is relevant both to the strength of Quorum's indemnification position and to the assessment of whether Palomar's conduct rises to the level of "gross negligence" or approaches "willful misconduct" for purposes of the Section 13.2 liability cap carve-out discussed in Section V.B below.
Regulatory Implications. Quorum is subject to data breach notification requirements under the laws of numerous states in which its policyholders and claimants reside. Many of these statutes impose specific timelines for notification to affected individuals and to state attorneys general or other regulators, often measured from the date the data owner (Quorum) discovers or is notified of the breach. State regulators and attorneys general may inquire about the timeliness of vendor-to-client notification as part of their review of Quorum's compliance with applicable notification requirements. The documented 24-hour delay in Palomar's notification to Quorum will need to be addressed in any regulatory filings or communications, and the delay may complicate Quorum's ability to demonstrate timely compliance with its own notification obligations.
Adequacy of Notification Content. We also note that Palomar's April 21 email notification was not a comprehensive incident report. The notification provided only a high-level summary of the incident, indicated that an investigation was underway, and stated that additional information would be provided as it became available. While Section 9.4 requires only "written notice" (as opposed to a detailed incident report), the adequacy and completeness of Palomar's subsequent communications — including the timeliness with which Palomar provides updates, forensic findings, and the information necessary for Quorum to assess its own regulatory obligations — should be closely monitored and documented. Any further delays or deficiencies in Palomar's cooperation could constitute additional breaches of the MSA or exacerbate Quorum's damages.
V. INDEMNIFICATION PROVISIONS — SECTION 12.2
A. Scope of Indemnification
Section 12.2 of the MSA, titled "Data Security Indemnification," establishes a broad indemnification obligation running from Palomar to Quorum in connection with data security breaches. Section 12.2 provides in relevant part:
"Service Provider shall indemnify, defend, and hold harmless Client, its affiliates, and their respective officers, directors, employees, and agents from and against any and all losses, damages, liabilities, costs, and expenses (including reasonable attorneys' fees and expenses) arising out of or relating to any breach by Service Provider of its obligations under [Exhibit D — Data Security Requirements] or under Section 9 [Confidentiality and Security Incident Notification]."
Several features of this indemnification provision are noteworthy:
Breadth of Covered Parties. The indemnification extends not only to Quorum itself, but also to its affiliates and their respective officers, directors, employees, and agents. This broad scope of covered parties ensures that indemnification is available to cover claims or losses incurred by any Quorum entity or individual, regardless of which specific entity or individual bears the cost.
Breadth of Covered Losses. The phrase "any and all losses, damages, liabilities, costs, and expenses (including reasonable attorneys' fees and expenses)" is deliberately expansive. Based on the language of Section 12.2 and customary interpretations of similarly worded indemnification clauses, the following categories of losses should be covered by Palomar's indemnification obligation:
• Forensic investigation costs (including fees payable to Graystone Forensics LLC and any other forensic firms retained in connection with the Incident);
• Consumer notification costs (including printing, mailing, and call center costs associated with providing notice to affected individuals under applicable data breach notification statutes);
• Credit monitoring and identity theft protection costs (including the cost of offering and providing credit monitoring, identity theft protection, and related services to affected individuals);
• Regulatory defense costs (including legal fees and expenses incurred in responding to inquiries, investigations, or enforcement actions by state attorneys general, the Federal Trade Commission, the Department of Health and Human Services Office for Civil Rights, state insurance regulators, or other regulatory bodies);
• Regulatory fines and penalties (to the extent such fines or penalties are imposed on Quorum as a result of the Incident and are covered under the indemnification clause);
• Crisis communications costs (including fees payable to BrightPath Consulting Group Inc. or other communications consultants retained to manage public communications and media inquiries related to the Incident);
• Litigation defense and settlement costs (including legal fees and expenses incurred in defending against class action lawsuits, individual claims, or other litigation brought by affected individuals, business partners, or other third parties);
• Quorum's internal remediation costs (including costs associated with IT remediation, security enhancements, employee overtime, vendor management activities, and other internal resources deployed in response to the Incident).
Triggering Events. The indemnification obligation is triggered by "any breach by Service Provider of its obligations under [Exhibit D] or under Section 9." As discussed in Sections III and IV above, Palomar has committed at least two breaches that trigger the indemnification obligation: the failure to timely patch the CVE-2023-0669 vulnerability (Exhibit D, Section 3(f)) and the late breach notification (Section 9.4). Each breach independently triggers the indemnification obligation, and the losses arising from both breaches are cumulatively covered.
Causal Nexus. The indemnification covers losses "arising out of or relating to" the identified breaches. The phrase "arising out of or relating to" is broader than "caused by" or "resulting from," and encompasses losses that have a sufficient nexus to the covered breach, even if the breach is not the sole or proximate cause of every individual cost element. Palomar's failure to patch the CVE-2023-0669 vulnerability is the direct and proximate cause of the Incident and all resulting losses. Palomar's late notification, while not the cause of the initial intrusion, contributed to the delay in Quorum's response and may have exacerbated Quorum's damages. Both breaches have a clear nexus to the categories of losses enumerated above.
B. Indemnification Cap — Liability Limitation
The MSA contains a limitation of liability provision that is directly relevant to the scope of Palomar's financial exposure. The interplay between the general liability cap and the carve-out for data security indemnification is a critical interpretive question that Palomar's counsel will almost certainly contest.
General Liability Cap. Section 13.1 of the MSA, titled "Limitation of Liability," provides in relevant part:
"Except as set forth in Section 13.2 [Carve-Outs], each party's total aggregate liability under this Agreement shall not exceed an amount equal to two times (2×) the fees paid or payable by Client to Service Provider during the twelve (12) months immediately preceding the event giving rise to the claim (the 'Liability Cap')."
Based on the current ACV of $16,300,000 (as adjusted by Amendment No. 1, effective April 1, 2021), the trailing twelve-month fees paid or payable by Quorum to Palomar are $16,300,000. The Liability Cap under Section 13.1 is therefore:
2 × $16,300,000 = $32,600,000
Carve-Outs from Liability Cap. Section 13.2 of the MSA, titled "Carve-Outs from Liability Cap," provides in relevant part:
"The Liability Cap set forth in Section 13.1 shall not apply to (a) Service Provider's indemnification obligations under Section 12.2, and (b) losses arising from Service Provider's gross negligence or willful misconduct."
Analysis of the Carve-Out. Section 13.2(a) expressly states that the Liability Cap "shall not apply to" Palomar's data security indemnification obligations under Section 12.2. Read according to its plain language, this provision removes the $32,600,000 ceiling from Palomar's indemnification obligation for data security breaches, rendering that obligation effectively uncapped. This is a powerful provision from Quorum's perspective and reflects the parties' recognition, at the time the MSA was negotiated, that the potential damages from a data security incident could exceed even a generous multiple of annual fees.
However, we anticipate that Palomar's outside counsel, Catherine Langford of Mercer, Haight & Dunlop LLP, will contest this interpretation. Palomar may advance one or more of the following arguments:
(i) Ambiguity argument. Palomar may argue that the carve-out in Section 13.2 is ambiguous in scope, and that the two sub-clauses — (a) Section 12.2 indemnification and (b) gross negligence or willful misconduct — should be read in conjunction, such that the Liability Cap is removed only for indemnification claims arising from gross negligence or willful misconduct, and not for indemnification claims arising from ordinary breaches of data security obligations.
(ii) Reasonableness argument. Palomar may argue that an uncapped indemnification obligation is commercially unreasonable and that the contract should be interpreted to avoid such a result. However, this argument is weakened by the fact that the carve-out language is clear and unambiguous, and Delaware courts generally enforce limitation of liability provisions (and carve-outs therefrom) as written.
(iii) Course-of-dealing argument. Palomar may argue that the parties' course of dealing or the negotiating history of the MSA supports a narrower interpretation of the carve-out. This argument would require Palomar to introduce extrinsic evidence, which is generally disfavored under Delaware law when the contract language is unambiguous.
In our view, the plain language of Section 13.2(a) supports Quorum's position that the Liability Cap does not apply to data security indemnification claims under Section 12.2, regardless of whether Palomar's conduct rises to the level of gross negligence or willful misconduct. Subsection (a) and subsection (b) of Section 13.2 are separated by a comma and the conjunction "and," indicating that they are independent carve-outs: the Liability Cap does not apply to (a) Section 12.2 indemnification and (b) gross negligence or willful misconduct. If the parties had intended the carve-out to apply only when both conditions were met (i.e., only for indemnification claims based on gross negligence or willful misconduct), they would have used the conjunction "to the extent arising from" or similar limiting language. The use of "and" to connect two separate items in a list is a standard drafting convention indicating independent, cumulative carve-outs.
Recommended Approach. For purposes of the initial indemnification demand, we recommend that Quorum assert that the carve-out in Section 13.2(a) renders Palomar's indemnification obligation under Section 12.2 uncapped. This is the strongest reading of the contract and is supported by the plain language of the provision. However, for purposes of internal planning and risk assessment, we should acknowledge that Palomar's counsel will likely contest this interpretation, and there is a reasonable possibility that a court or arbitrator could adopt a narrower reading of the carve-out. Even under the more conservative reading — which would apply the $32,600,000 Liability Cap to data security indemnification claims — the cap substantially exceeds the anticipated total incident response costs at this time. Accordingly, the interpretive question, while important to Quorum's legal position, may not be outcome-determinative unless total costs escalate significantly beyond current projections.
C. Indemnification Procedure
Section 12.4 of the MSA, titled "Indemnification Procedure," establishes the process that the indemnified party (Quorum) must follow to assert its right to indemnification and that the indemnifying party (Palomar) must follow to satisfy its indemnification obligation. The key procedural requirements are as follows:
(a) Prompt Written Notice. The indemnified party must provide "prompt written notice" to the indemnifying party of any claim, action, or proceeding for which indemnification is sought under Section 12.2. The notice must describe the nature of the claim in reasonable detail and identify the applicable provision(s) of the MSA that give rise to the indemnification obligation. While Section 12.4 provides that a failure to provide prompt notice does not relieve the indemnifying party of its indemnification obligation except to the extent the indemnifying party is materially prejudiced by such failure, best practice dictates that Quorum provide notice promptly to eliminate any basis for a prejudice argument.
(b) Participation in Defense. The indemnifying party has the right, at its own cost and expense, to participate in the defense of any third-party claim for which indemnification is sought. However, the indemnified party retains the right to control the defense of any claim and to select its own counsel.
(c) Settlement Consent. The indemnified party shall not settle any third-party claim for which indemnification is sought without the prior written consent of the indemnifying party, which consent shall not be unreasonably withheld, conditioned, or delayed. This provision is intended to protect the indemnifying party's financial interest by preventing the indemnified party from agreeing to an unreasonable settlement that the indemnifying party would be obligated to fund.
Action Item. Quorum should issue a formal written notice to Palomar asserting its right to indemnification under Section 12.2 of the MSA at the earliest practicable date. The notice should: (i) identify the specific breaches giving rise to the indemnification obligation (i.e., the patching failure under Exhibit D, Section 3(f) and the late notification under Section 9.4); (ii) identify the categories of anticipated losses (as enumerated in Section V.A above); (iii) expressly reserve all of Quorum's rights under the MSA, including the right to assert additional breaches and to seek additional categories of damages as they become known; and (iv) request that Palomar confirm its acceptance of its indemnification obligations and provide proof of its cyber liability insurance coverage and the status of its claim with its insurer. We recommend that this notice be sent within the next two weeks, concurrently with the notice of material breach discussed in Section VII below. A draft notice will be circulated for review and approval.
VI. INSURANCE REQUIREMENTS — EXHIBIT E
A. Palomar's Insurance Obligations
Exhibit E to the MSA, titled "Insurance Requirements," sets forth the minimum insurance coverages that Palomar is required to maintain throughout the term of the agreement. Exhibit E was updated by Amendment No. 2 (September 15, 2022) to increase the minimum cyber liability insurance requirement. The current minimum insurance requirements, as amended, are as follows:
In addition to maintaining the foregoing minimum coverages, Palomar is required under Exhibit E to: (i) provide certificates of insurance to Quorum annually and upon Quorum's reasonable request, evidencing the required coverages and limits; (ii) name Quorum as an additional insured under Palomar's commercial general liability and cyber liability policies; and (iii) provide Quorum with at least thirty (30) days' prior written notice of any cancellation, non-renewal, or material modification of any required coverage.
The requirement that Quorum be named as an additional insured under Palomar's cyber liability policy is particularly significant. As an additional insured, Quorum may have direct rights against Palomar's cyber insurer, which could provide an additional avenue of recovery if Palomar is unable or unwilling to satisfy its indemnification obligations.
B. Relevance to Indemnification
Palomar's cyber liability insurance coverage is directly relevant to the indemnification analysis in several respects:
Funding of Indemnification. To the extent Palomar maintains the required $10,000,000 in cyber liability coverage, this coverage should be available to fund Palomar's indemnification obligations to Quorum. Cyber liability policies typically cover costs associated with forensic investigations, notification expenses, credit monitoring, regulatory defense, and related incident response activities — the same categories of costs that Palomar is obligated to indemnify under Section 12.2. If Palomar's insurer acknowledges coverage and agrees to fund the indemnification, this significantly reduces the risk that Palomar's indemnification obligation will go unsatisfied due to Palomar's financial inability to pay.
Gap Between Insurance and Indemnification. It is important to note that the minimum cyber liability coverage requirement under Exhibit E ($10,000,000) is substantially lower than the Liability Cap under Section 13.1 ($32,600,000) and lower still than Palomar's potentially uncapped indemnification obligation under the Section 13.2 carve-out. If total incident response costs exceed $10,000,000, Palomar will need to fund the excess indemnification from its own balance sheet (or from other available insurance coverages, if any). We do not have current information regarding Palomar's financial condition or whether it maintains cyber liability coverage in excess of the contractual minimum.
Action Items. We recommend that Quorum, through Priya Deshmukh (VP, Vendor Risk Management) or other appropriate personnel, take the following steps regarding Palomar's insurance:
(a) Request that Palomar provide current certificates of insurance for all required coverages, including commercial general liability, professional liability/E&O, and cyber liability, confirming that all policies are in full force and effect and that limits have not been eroded by prior claims;
(b) Confirm that Quorum is named as an additional insured under Palomar's commercial general liability and cyber liability policies, as required by Exhibit E;
(c) Request that Palomar confirm in writing that it has placed its cyber liability insurer on notice of the Incident and provide the claim number, the name of the insurer, and the contact information for the assigned claims adjuster;
(d) Request that Palomar authorize its cyber liability insurer to communicate directly with Quorum (through Calderwood & Harkness, if appropriate) regarding coverage and the status of Palomar's claim.
Palomar's insurer's willingness to acknowledge coverage and to fund indemnification payments will be a significant factor in any settlement negotiation with Palomar. If Palomar's insurer denies coverage or seeks to limit its exposure, the indemnification negotiation will become more complex, and Quorum may need to consider alternative enforcement strategies, including direct action against Palomar and/or its insurer.
VII. TERMINATION FOR CAUSE — SECTION 14.2
A. Termination Provisions
Section 14.2 of the MSA, titled "Termination for Cause," provides either party with the right to terminate the agreement upon the occurrence of a material breach by the other party, subject to a notice and cure period. Section 14.2 provides in relevant part:
"Either party may terminate this Agreement upon written notice if the other party commits a material breach of this Agreement and fails to cure such breach within thirty (30) calendar days after receiving written notice specifying the nature of the breach."
Palomar's failure to comply with the vulnerability patching requirements of Exhibit D, Section 3(f) — which directly caused the security incident and all resulting losses — should qualify as a "material breach" of the MSA for purposes of Section 14.2. A breach is material when it goes to the essence of the agreement and deprives the non-breaching party of the benefit it reasonably expected to receive. The data security obligations in Exhibit D are core obligations of the MSA, reflecting the fundamental importance of data protection in the outsourcing of claims data processing. Palomar's failure to patch a critical vulnerability that led to a significant data breach is precisely the type of failure that the data security provisions were designed to prevent, and it deprives Quorum of the core benefit of the security protections it bargained for.
Similarly, the late breach notification under Section 9.4 — while perhaps less severe in isolation — constitutes an additional breach that, when combined with the patching failure, reinforces the materiality of Palomar's non-compliance.
The 30-day cure period raises a practical question: what would constitute adequate "cure" of a data security breach of this nature? Unlike a breach involving a failure to pay fees or deliver a report, a data security breach that has already resulted in unauthorized access and data exfiltration cannot be retrospectively "cured" in the traditional sense. Palomar cannot un-exploit the vulnerability, retrieve exfiltrated data, or reverse the harm to affected individuals. At most, Palomar could apply the patch (which, presumably, it has now done), implement additional security measures, and cooperate fully with the forensic investigation and incident response. While such remedial actions would be welcome and expected, they do not undo the breach or its consequences, and Quorum should take the position that the breach is incapable of cure in any meaningful sense.
B. Strategic Considerations Regarding Termination
The decision whether to exercise the termination right requires careful consideration of both the legal and operational implications.
Remaining Term. The MSA does not expire until November 11, 2024, approximately eighteen (18) months from the date of this memorandum. Premature termination would end Quorum's receipt of Palomar's services and require Quorum to transition claims data processing to an alternative vendor or bring the function in-house.
Operational Impact. Palomar is a significant vendor to Quorum. It processes claims data for the personal lines division, which represents a substantial portion of Quorum's overall business. Termination would require Quorum to: (i) identify and select a replacement vendor capable of handling the volume and complexity of Quorum's claims data processing needs; (ii) negotiate and execute a new services agreement with the replacement vendor; (iii) plan and execute a data migration from Palomar's systems to the replacement vendor's systems, with all of the attendant data integrity, security, and business continuity risks; and (iv) manage the operational disruption during the transition period, including potential delays in claims processing, policyholder complaints, and increased error rates. The transition timeline could be six to twelve months or longer, depending on the complexity of the data migration and the readiness of the replacement vendor.
Transition Costs. The costs of transitioning away from Palomar would be substantial and would include vendor selection and procurement costs, data migration and integration costs, parallel processing costs during the transition period, employee training and redeployment costs, and potential increased fees from a replacement vendor. These transition costs would be borne by Quorum (unless recoverable from Palomar as damages arising from the breach, which would depend on the specific circumstances and the applicable legal standards).
Consultation Required. Robert Wentworth, SVP, Claims Operations, should be consulted regarding the operational feasibility and timeline for transitioning away from Palomar. Mr. Wentworth's team has the most direct knowledge of the day-to-day reliance on Palomar's services and the potential impact of a transition on claims processing operations. Priya Deshmukh, VP, Vendor Risk Management, should also be consulted regarding the vendor marketplace and the availability of alternative service providers.
Recommendation. We recommend that Quorum preserve its right to terminate for cause by issuing a formal notice of material breach under Section 14.2, identifying both the patching failure (Exhibit D, Section 3(f)) and the late notification (Section 9.4) as material breaches of the MSA, and commencing the 30-day cure period. However, we recommend that Quorum not exercise the termination right at this time. Instead, the preserved termination right should be used as leverage in indemnification and remediation negotiations with Palomar. Palomar has a strong incentive to preserve the Quorum relationship (given that Quorum is its second-largest client by revenue), and the threat of termination — backed by a formal notice of material breach — will strengthen Quorum's negotiating position in seeking full indemnification, enhanced security commitments, and potentially a price reduction or other concessions.
The formal notice of material breach can be sent concurrently with the indemnification notice discussed in Section V.C above, either as a single integrated communication or as two separate letters. We will prepare drafts of both notices for review and approval.
VIII. SUMMARY OF PALOMAR'S IDENTIFIED BREACHES
Based on our analysis of the MSA and the information available to date, Palomar has committed the following identified breaches of the MSA in connection with the Incident:
A. Breach 1: Failure to Timely Patch Critical Vulnerability (Exhibit D, Section 3(f))
Palomar failed to apply the available patch for CVE-2023-0669 — a critical remote code execution vulnerability in Severin Corporation's GoAnywhere MFT file transfer appliance — within thirty (30) calendar days of the date the patch was made generally available by the software vendor, as required by Exhibit D, Section 3(f) of the MSA (as amended by Amendment No. 2). The available evidence indicates that Severin Corporation released the patch on or about February 7, 2023, and that the patch had not been applied to Palomar's GoAnywhere MFT appliance as of March 14, 2023, when the threat actor exploited the vulnerability to gain unauthorized access to Palomar's network.
This failure is the direct and proximate cause of the Incident. Had Palomar applied the patch within the contractually required 30-day window, the threat actor would not have been able to exploit the vulnerability, and the unauthorized access, lateral movement, and data exfiltration would not have occurred. This breach is therefore the root cause of all losses arising from the Incident, and it triggers Palomar's indemnification obligation under Section 12.2 for all such losses.
The approximately 35-day exfiltration window (March 14, 2023 through April 18, 2023) during which the threat actor had persistent access to Palomar's network and was actively exfiltrating data underscores the severity of this breach. The extended dwell time suggests not only a failure to patch, but also potential deficiencies in Palomar's monitoring, detection, and incident response capabilities — further supporting the conclusion that Palomar's data security practices fell short of the "commercially reasonable safeguards" standard required by Exhibit D.
B. Breach 2: Late Breach Notification (Section 9.4)
Palomar discovered the Security Incident on April 18, 2023, when its SOC detected anomalous outbound data transfers. Under Section 9.4 of the MSA, Palomar was required to notify Quorum in writing within forty-eight (48) hours of discovery — i.e., by approximately April 20, 2023. Palomar did not provide written notification to Quorum until April 21, 2023, approximately twenty-four (24) hours past the contractual deadline.
This late notification constitutes a separate and independent breach of the MSA, distinct from the patching failure. While the 24-hour delay is relatively brief, it is legally significant for the reasons discussed in Section IV.C above, including its impact on Quorum's ability to commence its own investigation and response activities, its relevance to Quorum's regulatory notification obligations, and its contribution to the overall narrative of Palomar's non-compliance with its data security and incident response obligations.
C. Potential Additional Breaches (Under Investigation)
In addition to the two confirmed breaches described above, the following potential additional breaches are under investigation and may be identified as the forensic investigation progresses:
(i) Fail