1025-00006 · Graystone Forensics LLC · Vendor Accountability

draft-indemnification-settlement-term-sheet.docx DOCUMENT Data Privacy

81 / 88 ← → ✕

Contract analysis Extract to table

DRAFT — FOR SETTLEMENT DISCUSSION PURPOSES ONLY PRIVILEGED AND CONFIDENTIAL

INDEMNIFICATION SETTLEMENT TERM SHEET

September 18, 2023

Prepared by: Alan Burke, Lead Associate, Privacy & Data Security Practice Group, Calderwood & Harkness LLP

On behalf of: Quorum Insurance Holdings Corp.

Circulated to: Catherine Langford, Partner, Mercer, Haight & Dunlop LLP (counsel to Palomar Data Solutions, Inc.)

Matter No.: 1025-00006

Status: Initial Draft — Subject to Negotiation

This term sheet is a non-binding summary of proposed settlement terms and is submitted for discussion purposes only pursuant to Federal Rule of Evidence 408 and applicable state equivalents. Nothing herein constitutes an admission of liability by either party. All prior and contemporaneous negotiations, statements, and correspondence remain subject to the protections of FRE 408 and any applicable state-law settlement-privilege protections. This document is further protected by the attorney-client privilege and the work product doctrine, and its circulation to opposing counsel is solely for the purpose of facilitating resolution of the matters described herein.

Right-click to update Table of Contents

Section 1: Parties

1.1 Claimant / Indemnified Party

Quorum Insurance Holdings Corp. ("Quorum"), a corporation organized and existing under the laws of the State of Delaware, with its principal executive offices located at 400 Constitution Plaza, Suite 2200, Hartford, Connecticut 06103 (Nasdaq: QIHC; Employer Identification Number: 06-4832197). Quorum is a publicly traded specialty insurance holding company with personal lines, commercial lines, and specialty program divisions. In this matter, Quorum is represented by Calderwood & Harkness LLP (Kevin Ostrowski, Responsible Partner; Marissa Bernstein, Of Counsel; Alan Burke, Lead Associate), 1700 K Street NW, Suite 900, Washington, D.C. 20006.

1.2 Respondent / Indemnifying Party

Palomar Data Solutions, Inc. ("Palomar"), a corporation organized and existing under the laws of the State of Texas, with its principal offices located at 7100 Greenville Avenue, Suite 450, Dallas, Texas 75231 (Employer Identification Number: 75-3291048). Palomar is a privately held data processing and analytics services company providing claims data processing, enterprise document management, and data analytics services to the insurance and financial services industries. In this matter, Palomar is represented by Mercer, Haight & Dunlop LLP (Catherine Langford, Partner), 2100 Ross Avenue, Suite 3600, Dallas, Texas 75201.

Quorum and Palomar are referred to herein individually as a "Party" and collectively as the "Parties."

Section 2: Recitals / Background

2.1 The Master Services Agreement

The Parties entered into that certain Master Services Agreement dated November 12, 2019 (the "MSA"), pursuant to which Palomar agreed to provide certain claims data processing, enterprise document management, and analytics services to Quorum's personal lines insurance division. The MSA was executed for an original five-year term commencing on November 12, 2019 and expiring on November 11, 2024. The original annual contract value ("ACV") under the MSA was Fourteen Million Two Hundred Thousand Dollars ($14,200,000), resulting in a five-year total contract value ("TCV") of Seventy-One Million Dollars ($71,000,000).

The MSA has been amended twice since its initial execution:

(a) Amendment 1 (executed March 3, 2021): Amendment 1 expanded the scope of Palomar's services to include data processing for Quorum's proprietary QuorumEdge analytics platform, which was developed to support real-time claims adjudication and policyholder risk scoring within Quorum's personal lines division. This expansion increased the ACV by Two Million One Hundred Thousand Dollars ($2,100,000), bringing the total ACV to Sixteen Million Three Hundred Thousand Dollars ($16,300,000), effective as of April 1, 2021.

(b) Amendment 2 (executed September 15, 2022): Amendment 2 updated the Data Security Exhibit (Exhibit D) to the MSA, incorporating enhanced data security requirements including, among other provisions, a requirement that Palomar maintain a current SOC 2 Type II audit report covering the systems, processes, and controls relevant to the services provided under the MSA. Amendment 2 also updated the minimum cyber liability insurance coverage requirements set forth in Exhibit E (Insurance Requirements) to the MSA.

Under the MSA, Palomar provides claims data processing, enterprise document management, and analytics services that are integral to the day-to-day operations of Quorum's personal lines division. Quorum is understood to be Palomar's second-largest client by revenue, representing approximately $14.2 million in original ACV (prior to Amendment 1 increases) and a significant portion of Palomar's overall client portfolio. The depth of this relationship and the volume and sensitivity of the data entrusted to Palomar are relevant context for the settlement terms proposed herein.

2.2 The Security Incident

On or about March 14, 2023, a threat actor exploited CVE-2023-0669, a known remote code execution vulnerability in the GoAnywhere MFT (Managed File Transfer) file transfer appliance operated by Palomar within its production environment (the "Security Incident"). CVE-2023-0669 was a widely publicized critical vulnerability that had been the subject of an emergency vendor advisory and patch release. The threat actor leveraged this vulnerability to gain unauthorized initial access to Palomar's network infrastructure.

Following the initial compromise, the threat actor engaged in lateral movement within Palomar's network over a period of approximately thirty-five (35) days, from on or about March 14, 2023 through on or about April 18, 2023. During this period, the threat actor identified, accessed, and exfiltrated data from systems hosting Quorum data, among other Palomar client data sets. The extended dwell time of the threat actor within Palomar's environment is indicative of the severity of the initial compromise and the insufficiency of Palomar's detection and response capabilities during the relevant period.

On April 18, 2023, Palomar's Security Operations Center ("SOC") detected anomalous outbound data transfers from systems within Palomar's network that hosted or processed Quorum data. Upon detection of the anomalous activity, Palomar initiated its internal incident response procedures.

Palomar notified Quorum of the Security Incident on April 21, 2023, via email from Derek Copeland, General Counsel of Palomar, to Thomas R. Whitfield, General Counsel of Quorum, and David Naranjo, Chief Information Security Officer ("CISO") of Quorum. The notification provided preliminary details regarding the nature of the unauthorized access but lacked specificity as to the scope of data compromised.

On May 5, 2023, Calderwood & Harkness LLP retained Graystone Forensics LLC ("Graystone") under the direction of counsel to conduct a comprehensive forensic investigation of the Security Incident. Graystone's engagement was structured under the attorney-client privilege and work product doctrine. Graystone's forensic analysts conducted an in-depth examination of Palomar's network infrastructure, system logs, and data repositories, with the cooperation of Palomar's IT and security teams.

On July 14, 2023, Graystone issued its final forensic investigation report (the "Graystone Report"). The Graystone Report confirmed that the Security Incident resulted in the exfiltration of data pertaining to 318,247 individuals across twenty-nine (29) states and the District of Columbia. The compromised data included the following categories:

(a) Personally Identifiable Information ("PII"): Names, dates of birth, Social Security numbers, and driver's license numbers for all 318,247 affected individuals;

(b) Financial Information: Bank account numbers and/or payment card numbers for 84,619 of the affected individuals; and

(c) Protected Health Information ("PHI"): Health conditions, medical diagnosis codes, and treatment information derived from workers' compensation and health-related insurance claims for 41,203 of the affected individuals. The presence of PHI within the compromised data set implicates the Health Insurance Portability and Accountability Act of 1996 ("HIPAA") and its implementing regulations, as well as applicable state health information privacy laws.

The volume and sensitivity of the compromised data, including Social Security numbers, financial account information, and protected health information, places this Security Incident among the most consequential data breaches to affect Quorum and its policyholders, insureds, and claimants.

2.3 Palomar's Contractual Breaches

Quorum's investigation of the Security Incident revealed that Palomar failed to comply with multiple contractual obligations under the MSA, as set forth below:

(a) Failure to Timely Patch (Exhibit D, Data Security Requirements): Under Exhibit D to the MSA, as updated by Amendment 2, Palomar was required to apply patches for critical vulnerabilities (defined by reference to CVSS scores of 9.0 or above, or vendor-designated "critical" severity) within thirty (30) days of the date the applicable vendor patch was released. CVE-2023-0669 was assigned a critical severity rating, and the vendor (Severin Corporation, formerly Strathmore Industries) released a patch prior to March 14, 2023, the date of the initial exploitation. Palomar failed to apply the available patch within the contractually required 30-day window, and in fact had not applied the patch as of the date of the initial compromise. This failure to timely patch a known critical vulnerability in an internet-facing file transfer appliance constituted a direct and material breach of Palomar's obligations under Exhibit D and was the proximate cause of the threat actor's initial access to Palomar's network.

(b) Late Breach Notification (Section 9.4, Breach Notification): Under Section 9.4 of the MSA, Palomar was required to notify Quorum within forty-eight (48) hours of Palomar's discovery of any security incident that affected, or was reasonably believed to affect, Quorum data. Palomar's SOC discovered the anomalous outbound data transfers on April 18, 2023. Palomar did not notify Quorum until April 21, 2023 — approximately seventy-two (72) hours after discovery — which exceeded the contractual 48-hour notification deadline by approximately twenty-four (24) hours. While Palomar has asserted that the additional time was necessary to conduct a preliminary internal assessment of the scope of the incident, this delay nonetheless constituted a breach of the express notification timeline set forth in Section 9.4 of the MSA.

2.4 Quorum's Indemnification Demand

On June 20, 2023, Calderwood & Harkness LLP, acting on behalf of Quorum, transmitted a formal breach of contract and indemnification demand letter (the "Demand Letter") to Mercer, Haight & Dunlop LLP, as counsel to Palomar. The Demand Letter asserted Palomar's breaches of the MSA as described in Section 2.3 above and demanded full indemnification of Quorum's losses and expenses arising from the Security Incident pursuant to Section 12.2 of the MSA. The Demand Letter included a preliminary accounting of Quorum's incurred and anticipated incident response costs.

On July 7, 2023, Mercer, Haight & Dunlop LLP responded on behalf of Palomar, disputing certain aspects of Quorum's causation theory and the scope of Quorum's claimed losses. In its response, Palomar offered a One Million Five Hundred Thousand Dollar ($1,500,000) goodwill credit to be applied against future service fees under the MSA, expressly characterizing the offer as a "goodwill gesture" rather than an acknowledgment of liability.

On July 25, 2023, Calderwood & Harkness LLP transmitted a rebuttal letter on behalf of Quorum, rejecting Palomar's goodwill offer as wholly inadequate in light of the magnitude of Quorum's documented losses and the clarity of Palomar's contractual breaches. The rebuttal letter reasserted Quorum's full indemnification claim and proposed that the Parties engage in structured settlement discussions. The Parties subsequently agreed to engage in without-prejudice settlement negotiations, which have culminated in the preparation of this term sheet.

2.5 Applicable Contractual Provisions

The following provisions of the MSA (as amended) are directly relevant to the indemnification claim and the proposed settlement terms:

(a) Section 12.2 (Indemnification): Palomar has agreed to indemnify, defend, and hold harmless Quorum and its affiliates, officers, directors, employees, and agents from and against all losses, damages, liabilities, costs, and expenses (including reasonable attorneys' fees) arising out of or related to Palomar's breach of its data security obligations under the MSA. The indemnification obligations under Section 12.2 are subject to a liability cap equal to two times (2×) the trailing twelve-month fees paid by Quorum to Palomar under the MSA. Based on the current ACV of $16,300,000, the applicable liability cap is $32,600,000 (i.e., $16,300,000 × 2).

(b) Exhibit D (Data Security Requirements): Palomar is required to implement and maintain "commercially reasonable" administrative, technical, and physical safeguards to protect Quorum data. Specific requirements include, among others: (i) the 30-day critical vulnerability patching requirement; (ii) annual penetration testing conducted by qualified third-party assessors; and (iii) maintenance of a current SOC 2 Type II audit report (added by Amendment 2).

(c) Section 9.4 (Breach Notification): Palomar is required to notify Quorum within forty-eight (48) hours of discovering any security incident that affects, or is reasonably believed to affect, Quorum data. Notification is required to be provided to Quorum's General Counsel.

(d) Exhibit E (Insurance Requirements): Palomar is required to maintain cyber liability insurance coverage with minimum limits of Ten Million Dollars ($10,000,000) per occurrence and in the aggregate, naming Quorum as an additional insured.

(e) Section 14.2 (Termination for Cause): Quorum may terminate the MSA upon material breach by Palomar, subject to a thirty (30) day written notice and cure period.

Section 3: Quorum's Claimed Losses

3.1 Total Incident Response Costs

Quorum has incurred significant costs in responding to the Security Incident, including forensic investigation, regulatory notification and consumer credit monitoring, crisis communications, legal advisory fees, and internal IT remediation and related operational costs. The table below sets forth an itemized summary of Quorum's total incident response costs incurred or committed through the date of this term sheet. Detailed invoice-level backup for each cost category is set forth in Exhibit A to this term sheet.

The costs set forth above reflect Quorum's direct, out-of-pocket expenditures incurred as a proximate result of the Security Incident and Palomar's contractual breaches. These costs do not include potential regulatory penalties or fines, costs of potential future litigation by affected individuals, reputational harm, or the value of management time and attention diverted to incident response. Quorum expressly reserves its right to pursue indemnification for additional costs that may be incurred in the future in connection with the Security Incident, to the extent not released under the terms of the definitive settlement agreement.

3.2 Indemnification Demand Amount

Quorum's total indemnification demand is Eight Million Two Hundred Thirty Thousand Two Hundred Fifty Dollars ($8,230,250), representing the aggregate incident response costs set forth in Section 3.1 above. Quorum notes that this amount falls well within the contractual indemnification liability cap of Thirty-Two Million Six Hundred Thousand Dollars ($32,600,000) under Section 12.2 of the MSA. In addition, the claimed amount does not include consequential, punitive, or speculative damages, which Quorum has elected not to pursue in the interest of reaching an expeditious resolution.

Section 4: Proposed Settlement Terms

4.1 Cash Payment

Palomar shall pay to Quorum a lump-sum cash payment of Five Million Five Hundred Thousand Dollars ($5,500,000) (the "Cash Payment") within thirty (30) calendar days of the date of execution of the definitive settlement agreement by both Parties. The Cash Payment shall be made by wire transfer of immediately available funds to a bank account designated by Quorum in writing. Quorum shall provide wire transfer instructions to Palomar (or its counsel) within five (5) business days of execution of the definitive settlement agreement.

The Cash Payment represents partial indemnification of Quorum's total incident response costs of $8,230,250, as described in Section 3 above. Palomar's obligation to make the Cash Payment shall be absolute and unconditional upon execution of the definitive settlement agreement, and shall not be subject to any conditions precedent other than the mutual execution of the definitive settlement agreement.

In the event that Palomar fails to remit the Cash Payment within the 30-day period specified herein, the unpaid amount shall bear interest at the rate of one percent (1%) per month (or the maximum rate permitted by applicable law, whichever is less) from the date due until the date of actual payment, without prejudice to any other rights or remedies available to Quorum.

4.2 Fee Reduction

In addition to the Cash Payment, Palomar shall reduce the annual contract value under the MSA by eight percent (8%) for a period of eighteen (18) months commencing on the first day of the calendar month following the date of execution of the definitive settlement agreement (the "Fee Reduction Period"). Based on the current ACV of $16,300,000, the eight percent (8%) reduction is equal to $1,304,000 per annum. Over the 18-month Fee Reduction Period, the aggregate value of the fee reduction is One Million Nine Hundred Fifty-Six Thousand Dollars ($1,956,000) (calculated as $16,300,000 × 8% × 1.5 years).

The fee reduction shall be applied automatically and pro rata to each monthly invoice issued by Palomar to Quorum during the Fee Reduction Period. Palomar shall reflect the fee reduction as a separate line item on each applicable invoice, identifying it as the "Settlement Fee Adjustment."

Upon expiration of the 18-month Fee Reduction Period, the monthly invoiced fees shall automatically revert to the then-applicable ACV under the MSA (as may be amended from time to time), without any further action required by either Party. For the avoidance of doubt, any adjustments to the ACV that occur during the Fee Reduction Period (e.g., pursuant to a future amendment to the MSA expanding or reducing the scope of services) shall be applied to the base ACV, and the eight percent (8%) reduction shall be calculated on the basis of the ACV as it existed on the date of execution of the definitive settlement agreement (i.e., $16,300,000).

4.3 Effective Total Recovery (Proposed)

The aggregate proposed settlement recovery to Quorum is as follows:

The total proposed recovery of $7,456,000 represents approximately 90.6% of Quorum's total documented incident response costs of $8,230,250. Quorum views this recovery percentage as a reasonable outcome in light of the strength of its contractual indemnification claim, the desire to maintain a productive commercial relationship with Palomar for the balance of the MSA term, and the costs and uncertainties associated with pursuing formal dispute resolution.

4.4 Payment Not Subject to Set-Off

The Cash Payment and the fee reduction described in this Section 4 shall not be subject to set-off, counterclaim, deduction, recoupment, or withholding by Palomar for any reason, whether arising under the MSA, at law, in equity, or otherwise. Palomar waives any right to assert a set-off, counterclaim, or deduction against the Cash Payment or any portion of the fee reduction.

Section 5: Enhanced Data Security Requirements

In addition to the financial terms set forth in Section 4, Quorum requires that Palomar implement the following enhanced data security measures to reduce the risk of future security incidents and to strengthen the protections afforded to Quorum data processed, stored, or transmitted by Palomar. These enhanced requirements are a material component of the proposed settlement and shall be memorialized in a formal amendment to the MSA (Amendment 3), as described in Section 5.6 below.

5.1 Enhanced Patch Management

Palomar shall implement enhanced patch management protocols applicable to all systems within the scope of the MSA. Specifically:

(a) The critical vulnerability patching window shall be reduced from thirty (30) days to fourteen (14) days following the date of the applicable vendor patch release. For purposes of this requirement, "critical vulnerability" shall be defined as any vulnerability assigned a CVSS Base Score of 9.0 or higher, or any vulnerability designated as "critical" severity by the applicable vendor.

(b) Palomar shall deploy and maintain automated patch management tools for all internet-facing systems, file transfer appliances (including, without limitation, any GoAnywhere MFT or successor managed file transfer platforms), and other externally accessible infrastructure components that process, store, or transmit Quorum data.

(c) Palomar shall maintain documentation sufficient to evidence compliance with the enhanced patching timelines, including records of patch deployment dates and any exceptions or deferrals approved through a formal risk-acceptance process.

(d) Compliance with the enhanced patch management protocols shall be achieved within ninety (90) days of execution of the definitive settlement agreement.

5.2 Endpoint Detection and Response (EDR)

Palomar shall deploy and maintain an enterprise-grade endpoint detection and response ("EDR") solution across all endpoints, servers, and systems that process, store, or transmit Quorum data. The EDR solution shall provide, at a minimum, the following capabilities: real-time threat detection, automated alerting, incident response workflow support, and forensic data collection and retention. Implementation of the EDR solution shall be completed within ninety (90) days of execution of the definitive settlement agreement. Palomar shall provide written confirmation to Quorum's CISO upon completion of deployment.

5.3 Quarterly Vulnerability Scanning

Palomar shall conduct comprehensive vulnerability scans of all systems, applications, and network infrastructure within the scope of the MSA on a quarterly basis. Following each quarterly scan, Palomar shall prepare a written summary report (the "Vulnerability Scan Report") documenting the results of the scan, including all identified vulnerabilities, their severity classifications, and the remediation actions taken or planned. Each Vulnerability Scan Report shall be provided to Quorum's CISO (currently David Naranjo) and Quorum's Vice President, Vendor Risk Management (currently Priya Deshmukh) within fifteen (15) business days of the completion of each quarterly scan.

The first quarterly vulnerability scan shall be conducted within thirty (30) days of execution of the definitive settlement agreement, with subsequent scans to be conducted at intervals of no more than ninety (90) calendar days thereafter for the remaining term of the MSA.

5.4 Independent Third-Party Security Assessment

Palomar shall engage, at its sole cost and expense, an independent third-party security assessor (the "Independent Assessor") to conduct an enhanced annual security assessment of Palomar's information security program as it relates to the processing, storage, and transmission of Quorum data. The Independent Assessor shall be mutually agreed upon by the Parties; provided, however, that if the Parties are unable to agree within fifteen (15) business days, each Party shall propose two (2) qualified firms, and the selection shall be made by lot from among the four proposed firms.

The initial assessment shall be completed within one hundred twenty (120) days of execution of the definitive settlement agreement, and subsequent assessments shall be conducted annually thereafter for the remaining term of the MSA. The scope of each assessment shall include, at a minimum: network security architecture, access controls, vulnerability management practices, incident response capabilities, data encryption (at rest and in transit), and third-party risk management.

Full assessment reports shall be provided to Quorum's Vice President, Vendor Risk Management within thirty (30) calendar days of completion of each assessment. Palomar shall prepare and provide a written remediation plan for any findings rated as "high" or "critical" within forty-five (45) days of receipt of the assessment report.

The Independent Assessor engagement shall be in addition to, and not in substitution for, the SOC 2 Type II audits currently required under MSA Amendment 2, which are performed by Kessler, Park & Associates CPA, PLLC (or a qualified successor firm approved by Quorum).

5.5 Enhanced Incident Notification

The breach notification window set forth in Section 9.4 of the MSA shall be reduced from forty-eight (48) hours to twenty-four (24) hours from Palomar's discovery of any security incident that affects, or is reasonably believed to affect, Quorum data. Notification shall be provided simultaneously to both of the following Quorum representatives:

(a) Quorum's General Counsel (currently Thomas R. Whitfield); and

(b) Quorum's Chief Information Security Officer (currently David Naranjo).

Notification shall be provided by email and telephone, with a written confirmation to follow within six (6) hours of the initial notification. Palomar shall designate a primary and secondary contact responsible for providing such notifications, and shall provide Quorum with current contact information for such designees.

5.6 MSA Amendment

The enhanced data security requirements set forth in Sections 5.1 through 5.5 above shall be memorialized in a formal amendment to the MSA designated as Amendment 3 — Enhanced Data Security and Audit Provisions. Amendment 3 shall be executed contemporaneously with the definitive settlement agreement and shall be effective as of the date of such execution. A summary of the proposed terms for Amendment 3 is set forth in Exhibit B to this term sheet. The Parties shall negotiate the final form of Amendment 3 in good faith, with the objective of reflecting the substantive requirements described in this Section 5 in contractually binding and operationally implementable terms.

Section 6: Mutual Release

6.1 Scope of Release

Upon (i) execution of the definitive settlement agreement by both Parties, and (ii) Palomar's timely remittance of the Cash Payment in accordance with Section 4.1, each Party shall release, remise, and forever discharge the other Party, and its respective affiliates, subsidiaries, parent companies, officers, directors, employees, agents, attorneys, successors, and assigns, from any and all claims, demands, actions, causes of action, suits, debts, dues, sums of money, accounts, reckonings, bonds, bills, specialties, covenants, contracts, controversies, agreements, promises, variances, trespasses, damages, judgments, extents, executions, losses, costs, and expenses of whatever kind or nature, whether known or unknown, suspected or unsuspected, accrued or unaccrued, that arise out of or relate to the Security Incident described herein.

The release shall specifically encompass: (a) all indemnification claims under Section 12.2 of the MSA arising from the Security Incident; and (b) all breach of contract claims related to Palomar's data security obligations under Exhibit D and notification obligations under Section 9.4 of the MSA, in each case solely with respect to the Security Incident that is the subject of this term sheet (i.e., the CVE-2023-0669 exploitation and resulting data exfiltration occurring between on or about March 14, 2023 and on or about April 18, 2023).

6.2 Carve-Outs from Release

The mutual release described in Section 6.1 shall expressly not extend to, and shall expressly preserve, the following:

(a) Any obligations arising under the MSA (as amended, including Amendment 3) that are prospective in nature, including without limitation all enhanced data security requirements set forth in Amendment 3 and all ongoing service performance obligations;

(b) Any claims arising out of or related to any future security incidents occurring after the date of the definitive settlement agreement, regardless of similarity to the Security Incident;

(c) Palomar's ongoing performance obligations under the MSA, including but not limited to its obligations to provide services in accordance with the applicable service level agreements, data security requirements, and reporting obligations;

(d) Any claims by third parties — including without limitation regulators, state attorneys general, affected individuals, class action plaintiffs, governmental entities, or health plan sponsors — against Quorum that arise after the date of the definitive settlement agreement and that are attributable to or arise out of the Security Incident, for which Palomar's indemnification obligations under Section 12.2 of the MSA (as amended) shall survive and remain in full force and effect to the extent provided therein; and

(e) Any obligations of either Party arising under the definitive settlement agreement itself, including Palomar's obligation to make the Cash Payment and provide the fee reduction.

6.3 No Admission of Liability

The definitive settlement agreement shall contain mutual provisions confirming that neither Party admits any liability, wrongdoing, or fault by entering into the settlement or by performing its obligations thereunder. The settlement, the Cash Payment, the fee reduction, and the enhanced data security requirements shall not be construed as, and do not constitute, an admission by Palomar that it breached the MSA, its data security obligations, its notification obligations, or any applicable law or regulation. Similarly, the settlement shall not be construed as an admission by Quorum that any of its claims lacked merit or that Quorum's own security practices contributed in any way to the Security Incident. The no-admission-of-liability provisions shall survive termination or expiration of the definitive settlement agreement.

Section 7: Confidentiality

7.1 Confidentiality of Settlement Terms

The terms of the settlement, including without limitation the amount of the Cash Payment, the terms and duration of the fee reduction, the aggregate settlement recovery, and the specific enhanced data security requirements, shall be treated as strictly confidential and shall not be disclosed by either Party to any third party, except in the following circumstances:

(a) Disclosures to the disclosing Party's respective officers, directors, employees, in-house and outside counsel, independent auditors, and insurers, in each case on a need-to-know basis and subject to obligations of confidentiality no less restrictive than those set forth herein;

(b) Disclosures required by applicable law, regulation, governmental order, or compulsory legal process (including subpoenas and civil investigative demands), provided that the disclosing Party shall provide the non-disclosing Party with prompt written notice (to the extent not prohibited by law) and shall cooperate with the non-disclosing Party's reasonable efforts to obtain a protective order or other appropriate relief limiting the scope of disclosure;

(c) Disclosures required in connection with Quorum's periodic reporting obligations under the Securities Exchange Act of 1934, as amended, including without limitation disclosures in Quorum's Annual Report on Form 10-K, Quarterly Reports on Form 10-Q, or Current Reports on Form 8-K, in which case Quorum shall provide Palomar with reasonable advance written notice (not less than five (5) business days, to the extent practicable) and shall afford Palomar a reasonable opportunity to review and comment on the proposed disclosure; and

(d) Disclosures made in connection with regulatory inquiries or proceedings related to the underlying Security Incident.

7.2 Regulatory Disclosures

Notwithstanding the confidentiality obligations set forth in Section 7.1, the Parties acknowledge and agree that Quorum may be required to disclose certain settlement terms to state and federal regulators in connection with pending and anticipated regulatory inquiries and proceedings related to the Security Incident. Such inquiries include, without limitation:

(a) The pending multistate attorney general inquiry, which is being coordinated by the Connecticut Attorney General's office and involves participation by attorneys general from multiple affected states;

(b) The inquiry by the Connecticut Insurance Department regarding the impact of the Security Incident on Quorum's policyholders and the adequacy of Quorum's vendor risk management practices; and

(c) Any inquiry by the U.S. Department of Health and Human Services, Office for Civil Rights ("HHS-OCR"), regarding the compromise of protected health information of the 41,203 individuals identified in the Graystone Report.

Disclosures made in good faith in connection with such regulatory inquiries shall not constitute a breach of the confidentiality provisions set forth in Section 7.1 or in the definitive settlement agreement.

Section 8: Continuation of MSA

8.1 MSA Remains in Effect

The Parties confirm and agree that the MSA, as amended by Amendment 1, Amendment 2, and the proposed Amendment 3 (to be executed contemporaneously with the definitive settlement agreement), shall remain in full force and effect for the remainder of its term through November 11, 2024, and shall continue to govern the Parties' commercial relationship, service delivery obligations, data security requirements, and all other matters addressed therein.

Quorum expressly reserves its right to terminate the MSA for cause under Section 14.2 in the event of any future material breach by Palomar, including without limitation any failure to comply with the enhanced data security requirements set forth in Amendment 3. However, Quorum agrees that it shall not exercise its termination right under Section 14.2 based solely on the Security Incident that is the subject of this settlement, provided that Palomar fully and timely performs its obligations under the definitive settlement agreement and Amendment 3.

8.2 Ongoing Performance Standards

Palomar shall continue to perform its obligations under the MSA in accordance with all applicable terms, including without limitation the service level agreements, data security requirements (as enhanced by Amendment 3), reporting obligations, and insurance requirements. The settlement shall not diminish, impair, or modify any of Palomar's ongoing obligations under the MSA except as expressly set forth in this term sheet and the definitive settlement agreement.

Section 9: Insurance Coordination

9.1 No Double Recovery

The Parties acknowledge that Quorum has submitted a claim under its own cyber-liability insurance program in connection with the Security Incident. The relevant policies and claim information are as follows:

Primary Policy: Atlas Mutual Insurance Company, Cyber Liability Policy No. CYB-2023-041587, Claim No. CYB-CLM-2023-05892.

Excess Policy: Pinnacle Surplus Lines Insurance Corp., Excess Cyber Liability Policy No. XS-CYB-2023-7812.

As of the date of this term sheet, Quorum's insurance claim is pending and no determination of coverage or payment has been made by Atlas Mutual or Pinnacle Surplus Lines. To the extent that Quorum receives insurance proceeds from Atlas Mutual, Pinnacle Surplus Lines, or any other insurer that, when combined with the settlement recovery described in Section 4, would result in Quorum's total recoveries exceeding Quorum's total documented incident response costs of $8,230,250, the Parties shall coordinate in good faith to ensure that no impermissible double recovery occurs. The mechanism for such coordination shall be specified in the definitive settlement agreement.

Notwithstanding the foregoing, the Parties agree that Palomar's settlement obligations under this term sheet and the definitive settlement agreement are independent of, and not contingent upon, the outcome of Quorum's insurance claim or the amount of any insurance recovery. Palomar shall not be entitled to delay, reduce, or withhold any portion of the Cash Payment or fee reduction based on the pendency or outcome of Quorum's insurance claim.

9.2 Subrogation. Quorum shall use commercially reasonable efforts to ensure that the terms of the definitive settlement agreement do not impair Quorum's rights under its cyber-liability insurance policies or create subrogation issues with Atlas Mutual Insurance Company or Pinnacle Surplus Lines Insurance Corp. In furtherance thereof, Quorum shall consult with its insurance counsel and insurance broker prior to finalizing the definitive settlement agreement to confirm that the settlement structure and terms are consistent with Quorum's obligations under its cyber-liability policies, including any anti-subrogation or cooperation provisions contained therein. Palomar shall cooperate reasonably with Quorum in connection with any reasonable requests to address subrogation-related concerns in the definitive settlement agreement.

Section 10: Definitive Documentation

10.1 Documents to be Executed

The Parties anticipate that the following definitive documents will be negotiated, finalized, and executed to implement the settlement terms described herein:

(a) Settlement Agreement and Mutual Release — A comprehensive settlement agreement incorporating all financial terms, release provisions, confidentiality obligations, insurance coordination provisions, and other terms set forth in this term sheet, together with customary representations, warranties, and miscellaneous provisions.

(b) MSA Amendment 3 — Enhanced Data Security and Audit Provisions — A formal amendment to the MSA incorporating the enhanced data security requirements described in Section 5 of this term sheet, including the enhanced patch management protocols, EDR deployment requirements, quarterly vulnerability scanning obligations, independent third-party security assessment requirements, and reduced incident notification timeline.

Both documents shall be executed contemporaneously, and the effectiveness of each shall be conditioned upon the execution and delivery of the other.

10.2 Governing Law

The definitive settlement agreement shall be governed by and construed in accordance with the laws of the State of Delaware, without regard to its conflicts of law principles. This governing law provision is consistent with Section 16.1 of the MSA, which similarly designates Delaware law as the governing law for the MSA and all related agreements.

10.3 Dispute Resolution

Any disputes arising under or relating to the definitive settlement agreement, including without limitation disputes regarding the interpretation or enforcement of its terms, shall be resolved through binding arbitration administered in accordance with the Commercial Arbitration Rules of the American Arbitration Association. The arbitration shall be conducted in Hartford, Connecticut, consistent with the dispute resolution provisions of Section 16.3 of the MSA. The arbitration shall be conducted before a single arbitrator with experience in data security and technology services disputes.

10.4 Timeline for Execution

The Parties shall use good-faith efforts to negotiate, finalize, and execute the definitive settlement agreement and MSA Amendment 3 within thirty (30) days of the date upon which the Parties reach agreement on the material terms set forth herein. Based on the date of this term sheet, the target date for execution of the definitive documents is on or before October 18, 2023. The Parties acknowledge that this timeline is aspirational and that the actual date of execution may be affected by the complexity of the negotiations, review by the Parties' respective leadership teams, and coordination with the Parties' respective insurers and auditors.

Section 11: Non-Binding Nature of Term Sheet

This term sheet is intended solely to facilitate settlement discussions between the Parties and does not constitute a binding agreement between the Parties. Neither Party shall be bound by any term set forth herein unless and until the Parties negotiate, finalize, and execute a definitive settlement agreement containing mutually acceptable terms. Until such time, either Party may withdraw from negotiations at any time and for any reason, without liability to the other Party.

This term sheet is submitted pursuant to Federal Rule of Evidence 408 and applicable state-law equivalents (including, without limitation, Texas Rule of Evidence 408 and Connecticut Code of Evidence § 4-8) and shall not be admissible in any judicial, arbitral, administrative, or other proceeding for any purpose, including to prove the validity or amount of a disputed claim, to impeach, or to prove an admission of liability or wrongdoing.

Nothing in this term sheet shall constitute a waiver of any right, claim, or defense of either Party.

Acknowledgment and Agreement to Negotiate in Good Faith

By signing below, each Party acknowledges receipt of this term sheet and agrees to engage in good-faith negotiations to reach a definitive settlement agreement on terms substantially consistent with those set forth herein. This acknowledgment does not constitute a binding commitment to settle and is subject in all respects to the non-binding disclaimer set forth in Section 11 above.

QUORUM INSURANCE HOLDINGS CORP.

By: ________

Name: Thomas R. Whitfield

Title: General Counsel

Date: ________

With:

________________________________________

Kevin Ostrowski, Partner Calderwood & Harkness LLP Counsel to Quorum Insurance Holdings Corp.

Date: ________

PALOMAR DATA SOLUTIONS, INC.

By: ________

Name: Derek Copeland

Title: General Counsel

Date: ________

With:

________________________________________

Catherine Langford, Partner Mercer, Haight & Dunlop LLP Counsel to Palomar Data Solutions, Inc.

Date: ________

EXHIBIT A

Summary of Incident Response Costs

The following table provides invoice-level detail for each category of incident response costs incurred or committed by Quorum Insurance Holdings Corp. in connection with the Security Incident described in this term sheet. This Exhibit A serves as detailed backup to the summary set forth in Section 3.1 of the term sheet.

Note: All amounts are denominated in U.S. Dollars. The Clearfield Notification Services LLC amounts reflect a negotiated flat-fee structure under a statement of work executed on August 6, 2023. Calderwood & Harkness LLP fees reflect actual time charges through the date of this term sheet and are subject to final reconciliation. Quorum internal costs are estimated and subject to final accounting.

EXHIBIT B

Proposed Enhanced Data Security Requirements

(Draft Amendment 3 Terms — Summary Form)

The following is a summary-form outline of the enhanced data security provisions proposed for incorporation into MSA Amendment 3 — Enhanced Data Security and Audit Provisions. This summary is intended to serve as the basis for negotiation of the definitive Amendment 3 language and is subject to revision during the drafting process.

1. Patch Management

Critical vulnerability patches (CVSS 9.0+ or vendor-designated "critical") shall be applied within fourteen (14) calendar days of vendor patch release, reduced from the current thirty (30) day requirement under Exhibit D (as amended by Amendment 2). Palomar shall deploy automated patch management tools for all internet-facing systems and managed file transfer appliances. Compliance with the enhanced patching timeline shall be documented and available for Quorum audit.

2. Endpoint Detection and Response (EDR)

Palomar shall deploy enterprise-grade EDR solutions across all systems that process, store, or transmit Quorum data. Deployment shall be completed within ninety (90) days of execution of Amendment 3. The EDR solution shall provide real-time threat detection, automated alerting, incident response workflow support, and forensic data retention capabilities.

3. Quarterly Vulnerability Scanning

Palomar shall conduct vulnerability scans of all in-scope systems on a quarterly basis. Written Vulnerability Scan Reports shall be provided to Quorum's CISO (currently David Naranjo) and Quorum's VP, Vendor Risk Management (currently Priya Deshmukh) within fifteen (15) business days of each quarterly scan. The first scan shall be completed within thirty (30) days of execution of Amendment 3.

4. Independent Third-Party Security Assessment

Palomar shall engage, at its sole expense, an independent third-party security assessor, mutually agreed upon by the Parties, to conduct an enhanced annual security assessment of Palomar's information security program as it relates to Quorum data. Full assessment reports shall be provided to Quorum's VP, Vendor Risk Management within thirty (30) calendar days of completion. This requirement is supplemental to the existing SOC 2 Type II audit requirement (currently performed by Kessler, Park & Associates CPA, PLLC or a qualified successor).

5. Incident Notification

The security incident notification window shall be reduced from forty-eight (48) hours to twenty-four (24) hours from Palomar's discovery of any security incident affecting Quorum data. Notification shall be provided simultaneously to:

• Quorum's General Counsel (currently Thomas R. Whitfield)

• Quorum's Chief Information Security Officer (currently David Naranjo)

Notification shall be made by both email and telephone, with a written confirmation to follow within six (6) hours of the initial notification.

END OF TERM SHEET

Calderwood & Harkness LLP — Matter No. 1025-00006 DRAFT — For Settlement Discussion Purposes Only — Privileged and Confidential

Cost Category	Vendor / Provider	Amount
Forensic Investigation	Graystone Forensics LLC	$1,847,000
Notification & Credit Monitoring (subtotal)	Clearfield Notification Services LLC	$3,214,500
— Notification printing and mailing (318,247 individuals)	Clearfield Notification Services LLC	$636,000
— Call center operations (12-week operational window)	Clearfield Notification Services LLC	$478,500
— Credit monitoring enrollment (24-month term, negotiated flat fee)	Clearfield Notification Services LLC	$2,100,000
Crisis Communications / Public Relations	BrightPath Consulting Group Inc.	$385,000
Legal Fees (investigation, regulatory, and settlement)	Calderwood & Harkness LLP	$2,163,750
Internal Costs (IT remediation, employee overtime, miscellaneous)	Quorum Internal	$620,000 (estimated)
Total Incident Response Costs	$8,230,250
Component	Amount
Cash Payment	$5,500,000
Fee Reduction (18 months at 8% of $16,300,000 ACV)	$1,956,000
Total Proposed Recovery	$7,456,000
Cost Category	Vendor / Provider	Date Range of Services	Amount
Forensic Investigation	Graystone Forensics LLC	May 5, 2023 – July 14, 2023	$1,847,000
Notification & Credit Monitoring	Clearfield Notification Services LLC	August 6, 2023 SOW; services through completion of 24-month credit monitoring period (est. August 2025)	$3,214,500
— Notification printing and mailing (318,247 individuals)	Clearfield Notification Services LLC	August – September 2023 (est.)	$636,000
— Call center operations (12-week operational window)	Clearfield Notification Services LLC	August – November 2023 (est.)	$478,500
— Credit monitoring enrollment (24-month term, negotiated flat fee)	Clearfield Notification Services LLC	August 2023 – August 2025 (est.)	$2,100,000
Crisis Communications / PR	BrightPath Consulting Group Inc.	May 2023 – September 2023	$385,000
Legal Fees — Investigation, regulatory response, and settlement	Calderwood & Harkness LLP	April 2023 – September 2023 (ongoing)	$2,163,750

Calderwood & Harkness LLP — Fee Detail:

— Kevin Ostrowski, Partner (est. hours)	Billing rate: $1,250/hr
— Marissa Bernstein, Of Counsel (est. hours)	Billing rate: $1,175/hr
— Alan Burke, Lead Associate (est. hours)	Billing rate: $825/hr
— Rachel Hendricks, Associate (est. hours)	Billing rate: $650/hr
— Total hours: approximately 2,400 hours	$2,163,750
Internal Costs (IT remediation, employee overtime, miscellaneous operational costs)	Quorum Internal	March – September 2023	$620,000 (estimated)
TOTAL	$8,230,250

DRAFT — FOR SETTLEMENT DISCUSSION PURPOSES ONLY PRIVILEGED AND CONFIDENTIAL
INDEMNIFICATION SETTLEMENT TERM SHEET
September 18, 2023
Prepared by: Alan Burke, Lead Associate, Privacy & Data Security Practice Group, Calderwood & Harkness LLP
On behalf of: Quorum Insurance Holdings Corp.
Circulated to: Catherine Langford, Partner, Mercer, Haight & Dunlop LLP (counsel to Palomar Data Solutions, Inc.)
Matter No.: 1025-00006
Status: Initial Draft — Subject to Negotiation
This term sheet is a non-binding summary of proposed settlement terms and is submitted for discussion purposes only pursuant to Federal Rule of Evidence 408 and applicable state equivalents. Nothing herein constitutes an admission of liability by either party. All prior and contemporaneous negotiations, statements, and correspondence remain subject to the protections of FRE 408 and any applicable state-law settlement-privilege protections. This document is further protected by the attorney-client privilege and the work product doctrine, and its circulation to opposing counsel is solely for the purpose of facilitating resolution of the matters described herein.
Right-click to update Table of Contents
Section 1: Parties
1.1 Claimant / Indemnified Party
Quorum Insurance Holdings Corp. ("Quorum"), a corporation organized and existing under the laws of the State of Delaware, with its principal executive offices located at 400 Constitution Plaza, Suite 2200, Hartford, Connecticut 06103 (Nasdaq: QIHC; Employer Identification Number: 06-4832197). Quorum is a publicly traded specialty insurance holding company with personal lines, commercial lines, and specialty program divisions. In this matter, Quorum is represented by Calderwood & Harkness LLP (Kevin Ostrowski, Responsible Partner; Marissa Bernstein, Of Counsel; Alan Burke, Lead Associate), 1700 K Street NW, Suite 900, Washington, D.C. 20006.
1.2 Respondent / Indemnifying Party
Palomar Data Solutions, Inc. ("Palomar"), a corporation organized and existing under the laws of the State of Texas, with its principal offices located at 7100 Greenville Avenue, Suite 450, Dallas, Texas 75231 (Employer Identification Number: 75-3291048). Palomar is a privately held data processing and analytics services company providing claims data processing, enterprise document management, and data analytics services to the insurance and financial services industries. In this matter, Palomar is represented by Mercer, Haight & Dunlop LLP (Catherine Langford, Partner), 2100 Ross Avenue, Suite 3600, Dallas, Texas 75201.
Quorum and Palomar are referred to herein individually as a "Party" and collectively as the "Parties."
Section 2: Recitals / Background
2.1 The Master Services Agreement
The Parties entered into that certain Master Services Agreement dated November 12, 2019 (the "MSA"), pursuant to which Palomar agreed to provide certain claims data processing, enterprise document management, and analytics services to Quorum's personal lines insurance division. The MSA was executed for an original five-year term commencing on November 12, 2019 and expiring on November 11, 2024. The original annual contract value ("ACV") under the MSA was Fourteen Million Two Hundred Thousand Dollars ($14,200,000), resulting in a five-year total contract value ("TCV") of Seventy-One Million Dollars ($71,000,000).
The MSA has been amended twice since its initial execution:
(a) Amendment 1 (executed March 3, 2021): Amendment 1 expanded the scope of Palomar's services to include data processing for Quorum's proprietary QuorumEdge analytics platform, which was developed to support real-time claims adjudication and policyholder risk scoring within Quorum's personal lines division. This expansion increased the ACV by Two Million One Hundred Thousand Dollars ($2,100,000), bringing the total ACV to Sixteen Million Three Hundred Thousand Dollars ($16,300,000), effective as of April 1, 2021.
(b) Amendment 2 (executed September 15, 2022): Amendment 2 updated the Data Security Exhibit (Exhibit D) to the MSA, incorporating enhanced data security requirements including, among other provisions, a requirement that Palomar maintain a current SOC 2 Type II audit report covering the systems, processes, and controls relevant to the services provided under the MSA. Amendment 2 also updated the minimum cyber liability insurance coverage requirements set forth in Exhibit E (Insurance Requirements) to the MSA.
Under the MSA, Palomar provides claims data processing, enterprise document management, and analytics services that are integral to the day-to-day operations of Quorum's personal lines division. Quorum is understood to be Palomar's second-largest client by revenue, representing approximately $14.2 million in original ACV (prior to Amendment 1 increases) and a significant portion of Palomar's overall client portfolio. The depth of this relationship and the volume and sensitivity of the data entrusted to Palomar are relevant context for the settlement terms proposed herein.
2.2 The Security Incident
On or about March 14, 2023, a threat actor exploited CVE-2023-0669, a known remote code execution vulnerability in the GoAnywhere MFT (Managed File Transfer) file transfer appliance operated by Palomar within its production environment (the "Security Incident"). CVE-2023-0669 was a widely publicized critical vulnerability that had been the subject of an emergency vendor advisory and patch release. The threat actor leveraged this vulnerability to gain unauthorized initial access to Palomar's network infrastructure.
Following the initial compromise, the threat actor engaged in lateral movement within Palomar's network over a period of approximately thirty-five (35) days, from on or about March 14, 2023 through on or about April 18, 2023. During this period, the threat actor identified, accessed, and exfiltrated data from systems hosting Quorum data, among other Palomar client data sets. The extended dwell time of the threat actor within Palomar's environment is indicative of the severity of the initial compromise and the insufficiency of Palomar's detection and response capabilities during the relevant period.
On April 18, 2023, Palomar's Security Operations Center ("SOC") detected anomalous outbound data transfers from systems within Palomar's network that hosted or processed Quorum data. Upon detection of the anomalous activity, Palomar initiated its internal incident response procedures.
Palomar notified Quorum of the Security Incident on April 21, 2023, via email from Derek Copeland, General Counsel of Palomar, to Thomas R. Whitfield, General Counsel of Quorum, and David Naranjo, Chief Information Security Officer ("CISO") of Quorum. The notification provided preliminary details regarding the nature of the unauthorized access but lacked specificity as to the scope of data compromised.
On May 5, 2023, Calderwood & Harkness LLP retained Graystone Forensics LLC ("Graystone") under the direction of counsel to conduct a comprehensive forensic investigation of the Security Incident. Graystone's engagement was structured under the attorney-client privilege and work product doctrine. Graystone's forensic analysts conducted an in-depth examination of Palomar's network infrastructure, system logs, and data repositories, with the cooperation of Palomar's IT and security teams.
On July 14, 2023, Graystone issued its final forensic investigation report (the "Graystone Report"). The Graystone Report confirmed that the Security Incident resulted in the exfiltration of data pertaining to 318,247 individuals across twenty-nine (29) states and the District of Columbia. The compromised data included the following categories:
(a) Personally Identifiable Information ("PII"): Names, dates of birth, Social Security numbers, and driver's license numbers for all 318,247 affected individuals;
(b) Financial Information: Bank account numbers and/or payment card numbers for 84,619 of the affected individuals; and
(c) Protected Health Information ("PHI"): Health conditions, medical diagnosis codes, and treatment information derived from workers' compensation and health-related insurance claims for 41,203 of the affected individuals. The presence of PHI within the compromised data set implicates the Health Insurance Portability and Accountability Act of 1996 ("HIPAA") and its implementing regulations, as well as applicable state health information privacy laws.
The volume and sensitivity of the compromised data, including Social Security numbers, financial account information, and protected health information, places this Security Incident among the most consequential data breaches to affect Quorum and its policyholders, insureds, and claimants.
2.3 Palomar's Contractual Breaches
Quorum's investigation of the Security Incident revealed that Palomar failed to comply with multiple contractual obligations under the MSA, as set forth below:
(a) Failure to Timely Patch (Exhibit D, Data Security Requirements): Under Exhibit D to the MSA, as updated by Amendment 2, Palomar was required to apply patches for critical vulnerabilities (defined by reference to CVSS scores of 9.0 or above, or vendor-designated "critical" severity) within thirty (30) days of the date the applicable vendor patch was released. CVE-2023-0669 was assigned a critical severity rating, and the vendor (Severin Corporation, formerly Strathmore Industries) released a patch prior to March 14, 2023, the date of the initial exploitation. Palomar failed to apply the available patch within the contractually required 30-day window, and in fact had not applied the patch as of the date of the initial compromise. This failure to timely patch a known critical vulnerability in an internet-facing file transfer appliance constituted a direct and material breach of Palomar's obligations under Exhibit D and was the proximate cause of the threat actor's initial access to Palomar's network.
(b) Late Breach Notification (Section 9.4, Breach Notification): Under Section 9.4 of the MSA, Palomar was required to notify Quorum within forty-eight (48) hours of Palomar's discovery of any security incident that affected, or was reasonably believed to affect, Quorum data. Palomar's SOC discovered the anomalous outbound data transfers on April 18, 2023. Palomar did not notify Quorum until April 21, 2023 — approximately seventy-two (72) hours after discovery — which exceeded the contractual 48-hour notification deadline by approximately twenty-four (24) hours. While Palomar has asserted that the additional time was necessary to conduct a preliminary internal assessment of the scope of the incident, this delay nonetheless constituted a breach of the express notification timeline set forth in Section 9.4 of the MSA.
2.4 Quorum's Indemnification Demand
On June 20, 2023, Calderwood & Harkness LLP, acting on behalf of Quorum, transmitted a formal breach of contract and indemnification demand letter (the "Demand Letter") to Mercer, Haight & Dunlop LLP, as counsel to Palomar. The Demand Letter asserted Palomar's breaches of the MSA as described in Section 2.3 above and demanded full indemnification of Quorum's losses and expenses arising from the Security Incident pursuant to Section 12.2 of the MSA. The Demand Letter included a preliminary accounting of Quorum's incurred and anticipated incident response costs.
On July 7, 2023, Mercer, Haight & Dunlop LLP responded on behalf of Palomar, disputing certain aspects of Quorum's causation theory and the scope of Quorum's claimed losses. In its response, Palomar offered a One Million Five Hundred Thousand Dollar ($1,500,000) goodwill credit to be applied against future service fees under the MSA, expressly characterizing the offer as a "goodwill gesture" rather than an acknowledgment of liability.
On July 25, 2023, Calderwood & Harkness LLP transmitted a rebuttal letter on behalf of Quorum, rejecting Palomar's goodwill offer as wholly inadequate in light of the magnitude of Quorum's documented losses and the clarity of Palomar's contractual breaches. The rebuttal letter reasserted Quorum's full indemnification claim and proposed that the Parties engage in structured settlement discussions. The Parties subsequently agreed to engage in without-prejudice settlement negotiations, which have culminated in the preparation of this term sheet.
2.5 Applicable Contractual Provisions
The following provisions of the MSA (as amended) are directly relevant to the indemnification claim and the proposed settlement terms:
(a) Section 12.2 (Indemnification): Palomar has agreed to indemnify, defend, and hold harmless Quorum and its affiliates, officers, directors, employees, and agents from and against all losses, damages, liabilities, costs, and expenses (including reasonable attorneys' fees) arising out of or related to Palomar's breach of its data security obligations under the MSA. The indemnification obligations under Section 12.2 are subject to a liability cap equal to two times (2×) the trailing twelve-month fees paid by Quorum to Palomar under the MSA. Based on the current ACV of $16,300,000, the applicable liability cap is $32,600,000 (i.e., $16,300,000 × 2).
(b) Exhibit D (Data Security Requirements): Palomar is required to implement and maintain "commercially reasonable" administrative, technical, and physical safeguards to protect Quorum data. Specific requirements include, among others: (i) the 30-day critical vulnerability patching requirement; (ii) annual penetration testing conducted by qualified third-party assessors; and (iii) maintenance of a current SOC 2 Type II audit report (added by Amendment 2).
(c) Section 9.4 (Breach Notification): Palomar is required to notify Quorum within forty-eight (48) hours of discovering any security incident that affects, or is reasonably believed to affect, Quorum data. Notification is required to be provided to Quorum's General Counsel.
(d) Exhibit E (Insurance Requirements): Palomar is required to maintain cyber liability insurance coverage with minimum limits of Ten Million Dollars ($10,000,000) per occurrence and in the aggregate, naming Quorum as an additional insured.
(e) Section 14.2 (Termination for Cause): Quorum may terminate the MSA upon material breach by Palomar, subject to a thirty (30) day written notice and cure period.
Section 3: Quorum's Claimed Losses
3.1 Total Incident Response Costs
Quorum has incurred significant costs in responding to the Security Incident, including forensic investigation, regulatory notification and consumer credit monitoring, crisis communications, legal advisory fees, and internal IT remediation and related operational costs. The table below sets forth an itemized summary of Quorum's total incident response costs incurred or committed through the date of this term sheet. Detailed invoice-level backup for each cost category is set forth in Exhibit A to this term sheet.
The costs set forth above reflect Quorum's direct, out-of-pocket expenditures incurred as a proximate result of the Security Incident and Palomar's contractual breaches. These costs do not include potential regulatory penalties or fines, costs of potential future litigation by affected individuals, reputational harm, or the value of management time and attention diverted to incident response. Quorum expressly reserves its right to pursue indemnification for additional costs that may be incurred in the future in connection with the Security Incident, to the extent not released under the terms of the definitive settlement agreement.
3.2 Indemnification Demand Amount
Quorum's total indemnification demand is Eight Million Two Hundred Thirty Thousand Two Hundred Fifty Dollars ($8,230,250), representing the aggregate incident response costs set forth in Section 3.1 above. Quorum notes that this amount falls well within the contractual indemnification liability cap of Thirty-Two Million Six Hundred Thousand Dollars ($32,600,000) under Section 12.2 of the MSA. In addition, the claimed amount does not include consequential, punitive, or speculative damages, which Quorum has elected not to pursue in the interest of reaching an expeditious resolution.
Section 4: Proposed Settlement Terms
4.1 Cash Payment
Palomar shall pay to Quorum a lump-sum cash payment of Five Million Five Hundred Thousand Dollars ($5,500,000) (the "Cash Payment") within thirty (30) calendar days of the date of execution of the definitive settlement agreement by both Parties. The Cash Payment shall be made by wire transfer of immediately available funds to a bank account designated by Quorum in writing. Quorum shall provide wire transfer instructions to Palomar (or its counsel) within five (5) business days of execution of the definitive settlement agreement.
The Cash Payment represents partial indemnification of Quorum's total incident response costs of $8,230,250, as described in Section 3 above. Palomar's obligation to make the Cash Payment shall be absolute and unconditional upon execution of the definitive settlement agreement, and shall not be subject to any conditions precedent other than the mutual execution of the definitive settlement agreement.
In the event that Palomar fails to remit the Cash Payment within the 30-day period specified herein, the unpaid amount shall bear interest at the rate of one percent (1%) per month (or the maximum rate permitted by applicable law, whichever is less) from the date due until the date of actual payment, without prejudice to any other rights or remedies available to Quorum.
4.2 Fee Reduction
In addition to the Cash Payment, Palomar shall reduce the annual contract value under the MSA by eight percent (8%) for a period of eighteen (18) months commencing on the first day of the calendar month following the date of execution of the definitive settlement agreement (the "Fee Reduction Period"). Based on the current ACV of $16,300,000, the eight percent (8%) reduction is equal to $1,304,000 per annum. Over the 18-month Fee Reduction Period, the aggregate value of the fee reduction is One Million Nine Hundred Fifty-Six Thousand Dollars ($1,956,000) (calculated as $16,300,000 × 8% × 1.5 years).
The fee reduction shall be applied automatically and pro rata to each monthly invoice issued by Palomar to Quorum during the Fee Reduction Period. Palomar shall reflect the fee reduction as a separate line item on each applicable invoice, identifying it as the "Settlement Fee Adjustment."
Upon expiration of the 18-month Fee Reduction Period, the monthly invoiced fees shall automatically revert to the then-applicable ACV under the MSA (as may be amended from time to time), without any further action required by either Party. For the avoidance of doubt, any adjustments to the ACV that occur during the Fee Reduction Period (e.g., pursuant to a future amendment to the MSA expanding or reducing the scope of services) shall be applied to the base ACV, and the eight percent (8%) reduction shall be calculated on the basis of the ACV as it existed on the date of execution of the definitive settlement agreement (i.e., $16,300,000).
4.3 Effective Total Recovery (Proposed)
The aggregate proposed settlement recovery to Quorum is as follows:
The total proposed recovery of $7,456,000 represents approximately 90.6% of Quorum's total documented incident response costs of $8,230,250. Quorum views this recovery percentage as a reasonable outcome in light of the strength of its contractual indemnification claim, the desire to maintain a productive commercial relationship with Palomar for the balance of the MSA term, and the costs and uncertainties associated with pursuing formal dispute resolution.
4.4 Payment Not Subject to Set-Off
The Cash Payment and the fee reduction described in this Section 4 shall not be subject to set-off, counterclaim, deduction, recoupment, or withholding by Palomar for any reason, whether arising under the MSA, at law, in equity, or otherwise. Palomar waives any right to assert a set-off, counterclaim, or deduction against the Cash Payment or any portion of the fee reduction.
Section 5: Enhanced Data Security Requirements
In addition to the financial terms set forth in Section 4, Quorum requires that Palomar implement the following enhanced data security measures to reduce the risk of future security incidents and to strengthen the protections afforded to Quorum data processed, stored, or transmitted by Palomar. These enhanced requirements are a material component of the proposed settlement and shall be memorialized in a formal amendment to the MSA (Amendment 3), as described in Section 5.6 below.
5.1 Enhanced Patch Management
Palomar shall implement enhanced patch management protocols applicable to all systems within the scope of the MSA. Specifically:
(a) The critical vulnerability patching window shall be reduced from thirty (30) days to fourteen (14) days following the date of the applicable vendor patch release. For purposes of this requirement, "critical vulnerability" shall be defined as any vulnerability assigned a CVSS Base Score of 9.0 or higher, or any vulnerability designated as "critical" severity by the applicable vendor.
(b) Palomar shall deploy and maintain automated patch management tools for all internet-facing systems, file transfer appliances (including, without limitation, any GoAnywhere MFT or successor managed file transfer platforms), and other externally accessible infrastructure components that process, store, or transmit Quorum data.
(c) Palomar shall maintain documentation sufficient to evidence compliance with the enhanced patching timelines, including records of patch deployment dates and any exceptions or deferrals approved through a formal risk-acceptance process.
(d) Compliance with the enhanced patch management protocols shall be achieved within ninety (90) days of execution of the definitive settlement agreement.
5.2 Endpoint Detection and Response (EDR)
Palomar shall deploy and maintain an enterprise-grade endpoint detection and response ("EDR") solution across all endpoints, servers, and systems that process, store, or transmit Quorum data. The EDR solution shall provide, at a minimum, the following capabilities: real-time threat detection, automated alerting, incident response workflow support, and forensic data collection and retention. Implementation of the EDR solution shall be completed within ninety (90) days of execution of the definitive settlement agreement. Palomar shall provide written confirmation to Quorum's CISO upon completion of deployment.
5.3 Quarterly Vulnerability Scanning
Palomar shall conduct comprehensive vulnerability scans of all systems, applications, and network infrastructure within the scope of the MSA on a quarterly basis. Following each quarterly scan, Palomar shall prepare a written summary report (the "Vulnerability Scan Report") documenting the results of the scan, including all identified vulnerabilities, their severity classifications, and the remediation actions taken or planned. Each Vulnerability Scan Report shall be provided to Quorum's CISO (currently David Naranjo) and Quorum's Vice President, Vendor Risk Management (currently Priya Deshmukh) within fifteen (15) business days of the completion of each quarterly scan.
The first quarterly vulnerability scan shall be conducted within thirty (30) days of execution of the definitive settlement agreement, with subsequent scans to be conducted at intervals of no more than ninety (90) calendar days thereafter for the remaining term of the MSA.
5.4 Independent Third-Party Security Assessment
Palomar shall engage, at its sole cost and expense, an independent third-party security assessor (the "Independent Assessor") to conduct an enhanced annual security assessment of Palomar's information security program as it relates to the processing, storage, and transmission of Quorum data. The Independent Assessor shall be mutually agreed upon by the Parties; provided, however, that if the Parties are unable to agree within fifteen (15) business days, each Party shall propose two (2) qualified firms, and the selection shall be made by lot from among the four proposed firms.
The initial assessment shall be completed within one hundred twenty (120) days of execution of the definitive settlement agreement, and subsequent assessments shall be conducted annually thereafter for the remaining term of the MSA. The scope of each assessment shall include, at a minimum: network security architecture, access controls, vulnerability management practices, incident response capabilities, data encryption (at rest and in transit), and third-party risk management.
Full assessment reports shall be provided to Quorum's Vice President, Vendor Risk Management within thirty (30) calendar days of completion of each assessment. Palomar shall prepare and provide a written remediation plan for any findings rated as "high" or "critical" within forty-five (45) days of receipt of the assessment report.
The Independent Assessor engagement shall be in addition to, and not in substitution for, the SOC 2 Type II audits currently required under MSA Amendment 2, which are performed by Kessler, Park & Associates CPA, PLLC (or a qualified successor firm approved by Quorum).
5.5 Enhanced Incident Notification
The breach notification window set forth in Section 9.4 of the MSA shall be reduced from forty-eight (48) hours to twenty-four (24) hours from Palomar's discovery of any security incident that affects, or is reasonably believed to affect, Quorum data. Notification shall be provided simultaneously to both of the following Quorum representatives:
(a) Quorum's General Counsel (currently Thomas R. Whitfield); and
(b) Quorum's Chief Information Security Officer (currently David Naranjo).
Notification shall be provided by email and telephone, with a written confirmation to follow within six (6) hours of the initial notification. Palomar shall designate a primary and secondary contact responsible for providing such notifications, and shall provide Quorum with current contact information for such designees.
5.6 MSA Amendment
The enhanced data security requirements set forth in Sections 5.1 through 5.5 above shall be memorialized in a formal amendment to the MSA designated as Amendment 3 — Enhanced Data Security and Audit Provisions. Amendment 3 shall be executed contemporaneously with the definitive settlement agreement and shall be effective as of the date of such execution. A summary of the proposed terms for Amendment 3 is set forth in Exhibit B to this term sheet. The Parties shall negotiate the final form of Amendment 3 in good faith, with the objective of reflecting the substantive requirements described in this Section 5 in contractually binding and operationally implementable terms.
Section 6: Mutual Release
6.1 Scope of Release
Upon (i) execution of the definitive settlement agreement by both Parties, and (ii) Palomar's timely remittance of the Cash Payment in accordance with Section 4.1, each Party shall release, remise, and forever discharge the other Party, and its respective affiliates, subsidiaries, parent companies, officers, directors, employees, agents, attorneys, successors, and assigns, from any and all claims, demands, actions, causes of action, suits, debts, dues, sums of money, accounts, reckonings, bonds, bills, specialties, covenants, contracts, controversies, agreements, promises, variances, trespasses, damages, judgments, extents, executions, losses, costs, and expenses of whatever kind or nature, whether known or unknown, suspected or unsuspected, accrued or unaccrued, that arise out of or relate to the Security Incident described herein.
The release shall specifically encompass: (a) all indemnification claims under Section 12.2 of the MSA arising from the Security Incident; and (b) all breach of contract claims related to Palomar's data security obligations under Exhibit D and notification obligations under Section 9.4 of the MSA, in each case solely with respect to the Security Incident that is the subject of this term sheet (i.e., the CVE-2023-0669 exploitation and resulting data exfiltration occurring between on or about March 14, 2023 and on or about April 18, 2023).
6.2 Carve-Outs from Release
The mutual release described in Section 6.1 shall expressly not extend to, and shall expressly preserve, the following:
(a) Any obligations arising under the MSA (as amended, including Amendment 3) that are prospective in nature, including without limitation all enhanced data security requirements set forth in Amendment 3 and all ongoing service performance obligations;
(b) Any claims arising out of or related to any future security incidents occurring after the date of the definitive settlement agreement, regardless of similarity to the Security Incident;
(c) Palomar's ongoing performance obligations under the MSA, including but not limited to its obligations to provide services in accordance with the applicable service level agreements, data security requirements, and reporting obligations;
(d) Any claims by third parties — including without limitation regulators, state attorneys general, affected individuals, class action plaintiffs, governmental entities, or health plan sponsors — against Quorum that arise after the date of the definitive settlement agreement and that are attributable to or arise out of the Security Incident, for which Palomar's indemnification obligations under Section 12.2 of the MSA (as amended) shall survive and remain in full force and effect to the extent provided therein; and
(e) Any obligations of either Party arising under the definitive settlement agreement itself, including Palomar's obligation to make the Cash Payment and provide the fee reduction.
6.3 No Admission of Liability
The definitive settlement agreement shall contain mutual provisions confirming that neither Party admits any liability, wrongdoing, or fault by entering into the settlement or by performing its obligations thereunder. The settlement, the Cash Payment, the fee reduction, and the enhanced data security requirements shall not be construed as, and do not constitute, an admission by Palomar that it breached the MSA, its data security obligations, its notification obligations, or any applicable law or regulation. Similarly, the settlement shall not be construed as an admission by Quorum that any of its claims lacked merit or that Quorum's own security practices contributed in any way to the Security Incident. The no-admission-of-liability provisions shall survive termination or expiration of the definitive settlement agreement.
Section 7: Confidentiality
7.1 Confidentiality of Settlement Terms
The terms of the settlement, including without limitation the amount of the Cash Payment, the terms and duration of the fee reduction, the aggregate settlement recovery, and the specific enhanced data security requirements, shall be treated as strictly confidential and shall not be disclosed by either Party to any third party, except in the following circumstances:
(a) Disclosures to the disclosing Party's respective officers, directors, employees, in-house and outside counsel, independent auditors, and insurers, in each case on a need-to-know basis and subject to obligations of confidentiality no less restrictive than those set forth herein;
(b) Disclosures required by applicable law, regulation, governmental order, or compulsory legal process (including subpoenas and civil investigative demands), provided that the disclosing Party shall provide the non-disclosing Party with prompt written notice (to the extent not prohibited by law) and shall cooperate with the non-disclosing Party's reasonable efforts to obtain a protective order or other appropriate relief limiting the scope of disclosure;
(c) Disclosures required in connection with Quorum's periodic reporting obligations under the Securities Exchange Act of 1934, as amended, including without limitation disclosures in Quorum's Annual Report on Form 10-K, Quarterly Reports on Form 10-Q, or Current Reports on Form 8-K, in which case Quorum shall provide Palomar with reasonable advance written notice (not less than five (5) business days, to the extent practicable) and shall afford Palomar a reasonable opportunity to review and comment on the proposed disclosure; and
(d) Disclosures made in connection with regulatory inquiries or proceedings related to the underlying Security Incident.
7.2 Regulatory Disclosures
Notwithstanding the confidentiality obligations set forth in Section 7.1, the Parties acknowledge and agree that Quorum may be required to disclose certain settlement terms to state and federal regulators in connection with pending and anticipated regulatory inquiries and proceedings related to the Security Incident. Such inquiries include, without limitation:
(a) The pending multistate attorney general inquiry, which is being coordinated by the Connecticut Attorney General's office and involves participation by attorneys general from multiple affected states;
(b) The inquiry by the Connecticut Insurance Department regarding the impact of the Security Incident on Quorum's policyholders and the adequacy of Quorum's vendor risk management practices; and
(c) Any inquiry by the U.S. Department of Health and Human Services, Office for Civil Rights ("HHS-OCR"), regarding the compromise of protected health information of the 41,203 individuals identified in the Graystone Report.
Disclosures made in good faith in connection with such regulatory inquiries shall not constitute a breach of the confidentiality provisions set forth in Section 7.1 or in the definitive settlement agreement.
Section 8: Continuation of MSA
8.1 MSA Remains in Effect
The Parties confirm and agree that the MSA, as amended by Amendment 1, Amendment 2, and the proposed Amendment 3 (to be executed contemporaneously with the definitive settlement agreement), shall remain in full force and effect for the remainder of its term through November 11, 2024, and shall continue to govern the Parties' commercial relationship, service delivery obligations, data security requirements, and all other matters addressed therein.
Quorum expressly reserves its right to terminate the MSA for cause under Section 14.2 in the event of any future material breach by Palomar, including without limitation any failure to comply with the enhanced data security requirements set forth in Amendment 3. However, Quorum agrees that it shall not exercise its termination right under Section 14.2 based solely on the Security Incident that is the subject of this settlement, provided that Palomar fully and timely performs its obligations under the definitive settlement agreement and Amendment 3.
8.2 Ongoing Performance Standards
Palomar shall continue to perform its obligations under the MSA in accordance with all applicable terms, including without limitation the service level agreements, data security requirements (as enhanced by Amendment 3), reporting obligations, and insurance requirements. The settlement shall not diminish, impair, or modify any of Palomar's ongoing obligations under the MSA except as expressly set forth in this term sheet and the definitive settlement agreement.
Section 9: Insurance Coordination
9.1 No Double Recovery
The Parties acknowledge that Quorum has submitted a claim under its own cyber-liability insurance program in connection with the Security Incident. The relevant policies and claim information are as follows:
Primary Policy: Atlas Mutual Insurance Company, Cyber Liability Policy No. CYB-2023-041587, Claim No. CYB-CLM-2023-05892.
Excess Policy: Pinnacle Surplus Lines Insurance Corp., Excess Cyber Liability Policy No. XS-CYB-2023-7812.
As of the date of this term sheet, Quorum's insurance claim is pending and no determination of coverage or payment has been made by Atlas Mutual or Pinnacle Surplus Lines. To the extent that Quorum receives insurance proceeds from Atlas Mutual, Pinnacle Surplus Lines, or any other insurer that, when combined with the settlement recovery described in Section 4, would result in Quorum's total recoveries exceeding Quorum's total documented incident response costs of $8,230,250, the Parties shall coordinate in good faith to ensure that no impermissible double recovery occurs. The mechanism for such coordination shall be specified in the definitive settlement agreement.
Notwithstanding the foregoing, the Parties agree that Palomar's settlement obligations under this term sheet and the definitive settlement agreement are independent of, and not contingent upon, the outcome of Quorum's insurance claim or the amount of any insurance recovery. Palomar shall not be entitled to delay, reduce, or withhold any portion of the Cash Payment or fee reduction based on the pendency or outcome of Quorum's insurance claim.
9.2 Subrogation.  Quorum shall use commercially reasonable efforts to ensure that the terms of the definitive settlement agreement do not impair Quorum's rights under its cyber-liability insurance policies or create subrogation issues with Atlas Mutual Insurance Company or Pinnacle Surplus Lines Insurance Corp. In furtherance thereof, Quorum shall consult with its insurance counsel and insurance broker prior to finalizing the definitive settlement agreement to confirm that the settlement structure and terms are consistent with Quorum's obligations under its cyber-liability policies, including any anti-subrogation or cooperation provisions contained therein. Palomar shall cooperate reasonably with Quorum in connection with any reasonable requests to address subrogation-related concerns in the definitive settlement agreement.
Section 10: Definitive Documentation
10.1 Documents to be Executed
The Parties anticipate that the following definitive documents will be negotiated, finalized, and executed to implement the settlement terms described herein:
(a) Settlement Agreement and Mutual Release — A comprehensive settlement agreement incorporating all financial terms, release provisions, confidentiality obligations, insurance coordination provisions, and other terms set forth in this term sheet, together with customary representations, warranties, and miscellaneous provisions.
(b) MSA Amendment 3 — Enhanced Data Security and Audit Provisions — A formal amendment to the MSA incorporating the enhanced data security requirements described in Section 5 of this term sheet, including the enhanced patch management protocols, EDR deployment requirements, quarterly vulnerability scanning obligations, independent third-party security assessment requirements, and reduced incident notification timeline.
Both documents shall be executed contemporaneously, and the effectiveness of each shall be conditioned upon the execution and delivery of the other.
10.2 Governing Law
The definitive settlement agreement shall be governed by and construed in accordance with the laws of the State of Delaware, without regard to its conflicts of law principles. This governing law provision is consistent with Section 16.1 of the MSA, which similarly designates Delaware law as the governing law for the MSA and all related agreements.
10.3 Dispute Resolution
Any disputes arising under or relating to the definitive settlement agreement, including without limitation disputes regarding the interpretation or enforcement of its terms, shall be resolved through binding arbitration administered in accordance with the Commercial Arbitration Rules of the American Arbitration Association. The arbitration shall be conducted in Hartford, Connecticut, consistent with the dispute resolution provisions of Section 16.3 of the MSA. The arbitration shall be conducted before a single arbitrator with experience in data security and technology services disputes.
10.4 Timeline for Execution
The Parties shall use good-faith efforts to negotiate, finalize, and execute the definitive settlement agreement and MSA Amendment 3 within thirty (30) days of the date upon which the Parties reach agreement on the material terms set forth herein. Based on the date of this term sheet, the target date for execution of the definitive documents is on or before October 18, 2023. The Parties acknowledge that this timeline is aspirational and that the actual date of execution may be affected by the complexity of the negotiations, review by the Parties' respective leadership teams, and coordination with the Parties' respective insurers and auditors.
Section 11: Non-Binding Nature of Term Sheet
This term sheet is intended solely to facilitate settlement discussions between the Parties and does not constitute a binding agreement between the Parties. Neither Party shall be bound by any term set forth herein unless and until the Parties negotiate, finalize, and execute a definitive settlement agreement containing mutually acceptable terms. Until such time, either Party may withdraw from negotiations at any time and for any reason, without liability to the other Party.
This term sheet is submitted pursuant to Federal Rule of Evidence 408 and applicable state-law equivalents (including, without limitation, Texas Rule of Evidence 408 and Connecticut Code of Evidence § 4-8) and shall not be admissible in any judicial, arbitral, administrative, or other proceeding for any purpose, including to prove the validity or amount of a disputed claim, to impeach, or to prove an admission of liability or wrongdoing.
Nothing in this term sheet shall constitute a waiver of any right, claim, or defense of either Party.
Acknowledgment and Agreement to Negotiate in Good Faith
By signing below, each Party acknowledges receipt of this term sheet and agrees to engage in good-faith negotiations to reach a definitive settlement agreement on terms substantially consistent with those set forth herein. This acknowledgment does not constitute a binding commitment to settle and is subject in all respects to the non-binding disclaimer set forth in Section 11 above.
QUORUM INSURANCE HOLDINGS CORP.
By: ________
Name: Thomas R. Whitfield
Title: General Counsel
Date: ________
With:
________________________________________
Kevin Ostrowski, Partner Calderwood & Harkness LLP Counsel to Quorum Insurance Holdings Corp.
Date: ________
PALOMAR DATA SOLUTIONS, INC.
By: ________
Name: Derek Copeland
Title: General Counsel
Date: ________
With:
________________________________________
Catherine Langford, Partner Mercer, Haight & Dunlop LLP Counsel to Palomar Data Solutions, Inc.
Date: ________
EXHIBIT A
Summary of Incident Response Costs
The following table provides invoice-level detail for each category of incident response costs incurred or committed by Quorum Insurance Holdings Corp. in connection with the Security Incident described in this term sheet. This Exhibit A serves as detailed backup to the summary set forth in Section 3.1 of the term sheet.
Note: All amounts are denominated in U.S. Dollars. The Clearfield Notification Services LLC amounts reflect a negotiated flat-fee structure under a statement of work executed on August 6, 2023. Calderwood & Harkness LLP fees reflect actual time charges through the date of this term sheet and are subject to final reconciliation. Quorum internal costs are estimated and subject to final accounting.
EXHIBIT B
Proposed Enhanced Data Security Requirements
(Draft Amendment 3 Terms — Summary Form)
The following is a summary-form outline of the enhanced data security provisions proposed for incorporation into MSA Amendment 3 — Enhanced Data Security and Audit Provisions. This summary is intended to serve as the basis for negotiation of the definitive Amendment 3 language and is subject to revision during the drafting process.
1. Patch Management
Critical vulnerability patches (CVSS 9.0+ or vendor-designated "critical") shall be applied within fourteen (14) calendar days of vendor patch release, reduced from the current thirty (30) day requirement under Exhibit D (as amended by Amendment 2). Palomar shall deploy automated patch management tools for all internet-facing systems and managed file transfer appliances. Compliance with the enhanced patching timeline shall be documented and available for Quorum audit.
2. Endpoint Detection and Response (EDR)
Palomar shall deploy enterprise-grade EDR solutions across all systems that process, store, or transmit Quorum data. Deployment shall be completed within ninety (90) days of execution of Amendment 3. The EDR solution shall provide real-time threat detection, automated alerting, incident response workflow support, and forensic data retention capabilities.
3. Quarterly Vulnerability Scanning
Palomar shall conduct vulnerability scans of all in-scope systems on a quarterly basis. Written Vulnerability Scan Reports shall be provided to Quorum's CISO (currently David Naranjo) and Quorum's VP, Vendor Risk Management (currently Priya Deshmukh) within fifteen (15) business days of each quarterly scan. The first scan shall be completed within thirty (30) days of execution of Amendment 3.
4. Independent Third-Party Security Assessment
Palomar shall engage, at its sole expense, an independent third-party security assessor, mutually agreed upon by the Parties, to conduct an enhanced annual security assessment of Palomar's information security program as it relates to Quorum data. Full assessment reports shall be provided to Quorum's VP, Vendor Risk Management within thirty (30) calendar days of completion. This requirement is supplemental to the existing SOC 2 Type II audit requirement (currently performed by Kessler, Park & Associates CPA, PLLC or a qualified successor).
5. Incident Notification
The security incident notification window shall be reduced from forty-eight (48) hours to twenty-four (24) hours from Palomar's discovery of any security incident affecting Quorum data. Notification shall be provided simultaneously to:
•  Quorum's General Counsel (currently Thomas R. Whitfield)
•  Quorum's Chief Information Security Officer (currently David Naranjo)
Notification shall be made by both email and telephone, with a written confirmation to follow within six (6) hours of the initial notification.
END OF TERM SHEET
Calderwood & Harkness LLP — Matter No. 1025-00006 DRAFT — For Settlement Discussion Purposes Only — Privileged and Confidential
Cost Category | Vendor / Provider | Amount
Forensic Investigation | Graystone Forensics LLC | $1,847,000
Notification & Credit Monitoring (subtotal) | Clearfield Notification Services LLC | $3,214,500
— Notification printing and mailing (318,247 individuals) | Clearfield Notification Services LLC | $636,000
— Call center operations (12-week operational window) | Clearfield Notification Services LLC | $478,500
— Credit monitoring enrollment (24-month term, negotiated flat fee) | Clearfield Notification Services LLC | $2,100,000
Crisis Communications / Public Relations | BrightPath Consulting Group Inc. | $385,000
Legal Fees (investigation, regulatory, and settlement) | Calderwood & Harkness LLP | $2,163,750
Internal Costs (IT remediation, employee overtime, miscellaneous) | Quorum Internal | $620,000 (estimated)
Total Incident Response Costs | $8,230,250
Component | Amount
Cash Payment | $5,500,000
Fee Reduction (18 months at 8% of $16,300,000 ACV) | $1,956,000
Total Proposed Recovery | $7,456,000
Cost Category | Vendor / Provider | Date Range of Services | Amount
Forensic Investigation | Graystone Forensics LLC | May 5, 2023 – July 14, 2023 | $1,847,000
Notification & Credit Monitoring | Clearfield Notification Services LLC | August 6, 2023 SOW; services through completion of 24-month credit monitoring period (est. August 2025) | $3,214,500
— Notification printing and mailing (318,247 individuals) | Clearfield Notification Services LLC | August – September 2023 (est.) | $636,000
— Call center operations (12-week operational window) | Clearfield Notification Services LLC | August – November 2023 (est.) | $478,500
— Credit monitoring enrollment (24-month term, negotiated flat fee) | Clearfield Notification Services LLC | August 2023 – August 2025 (est.) | $2,100,000
Crisis Communications / PR | BrightPath Consulting Group Inc. | May 2023 – September 2023 | $385,000
Legal Fees — Investigation, regulatory response, and settlement | Calderwood & Harkness LLP | April 2023 – September 2023 (ongoing) | $2,163,750
Calderwood & Harkness LLP — Fee Detail:
— Kevin Ostrowski, Partner (est. hours) | Billing rate: $1,250/hr
— Marissa Bernstein, Of Counsel (est. hours) | Billing rate: $1,175/hr
— Alan Burke, Lead Associate (est. hours) | Billing rate: $825/hr
— Rachel Hendricks, Associate (est. hours) | Billing rate: $650/hr
— Total hours: approximately 2,400 hours | $2,163,750
Internal Costs (IT remediation, employee overtime, miscellaneous operational costs) | Quorum Internal | March – September 2023 | $620,000 (estimated)
TOTAL | $8,230,250

DRAFT — FOR SETTLEMENT DISCUSSION PURPOSES ONLY PRIVILEGED AND CONFIDENTIAL

INDEMNIFICATION SETTLEMENT TERM SHEET

QUORUM INSURANCE HOLDINGS CORP.

PALOMAR DATA SOLUTIONS, INC.

EXHIBIT A

EXHIBIT B

END OF TERM SHEET

Record

Parties

Dates

Amounts