1025-00006 · Graystone Forensics LLC · Vendor Accountability

negotiation-strategy-memo-palomar.docx DOCUMENT Data Privacy

84 / 88 ← → ✕

PRIVILEGED AND CONFIDENTIAL ATTORNEY-CLIENT COMMUNICATION ATTORNEY WORK PRODUCT PREPARED IN ANTICIPATION OF LITIGATION

CALDERWOOD & HARKNESS LLP Privacy & Data Security Practice Group 1700 K Street NW, Suite 900 Washington, D.C. 20006

August 28, 2023

MEMORANDUM

TO: Thomas R. Whitfield, General Counsel, Quorum Insurance Holdings Corp.

FROM: Kevin Ostrowski, Partner, and Alan Burke, Associate, Calderwood & Harkness LLP, Privacy & Data Security Practice Group

RE: Negotiation Strategy — Indemnification Claim Against Palomar Data Solutions, Inc.

MATTER NO.: 1025-00006

This memorandum constitutes a privileged and confidential attorney-client communication and attorney work product prepared in anticipation of litigation. It is protected from disclosure by the attorney-client privilege, the work product doctrine, and all other applicable privileges. Distribution of this memorandum is strictly limited to the addressee. Do not forward, copy, or distribute without the prior written consent of Calderwood & Harkness LLP.

I. Executive Summary

The purpose of this memorandum is to recommend a comprehensive negotiation strategy for Quorum Insurance Holdings Corp.'s ("Quorum") indemnification claim against Palomar Data Solutions, Inc. ("Palomar") arising from the vendor-originated data breach discovered on April 18, 2023. This memorandum assesses Quorum's legal position, evaluates Palomar's likely defenses, identifies strategic considerations that should guide the negotiation, and outlines specific tactics and settlement parameters designed to achieve an optimal outcome for Quorum.

In our assessment, Quorum occupies a strong legal position. The underpinning of this strength rests on three pillars: first, Palomar's clear breach of the Master Services Agreement ("MSA"), specifically the failure to patch CVE-2023-0669 within the contractual thirty-day window mandated by Exhibit D (the Data Security Exhibit, as updated by Amendments 1 and 2); second, compelling forensic evidence prepared by Graystone Forensics LLC confirming that the attack vector was the unpatched GoAnywhere MFT file transfer appliance, establishing a direct causal link between Palomar's patching failure and the exfiltration of personal data belonging to 318,247 individuals; and third, Palomar's late breach notification — approximately seventy-two hours after discovery, roughly twenty-four hours past the forty-eight-hour deadline established by MSA Section 9.4.

Based on this assessment, we recommend that Quorum pursue a negotiated resolution that achieves substantial cost recovery while preserving the vendor relationship for the remaining MSA term, which runs through November 11, 2024. The recommended target outcome is a combined monetary recovery in the range of $5,500,000 to $7,000,000 in total effective value, structured as a combination of a direct cash payment and fee concessions over the remaining term of the MSA, together with enhanced prospective security commitments from Palomar codified in a formal third amendment to the MSA ("Amendment 3").

This recommended approach reflects a key tension that must be carefully managed throughout the negotiation: Palomar is Quorum's second-largest claims processing vendor, and the MSA governs the processing of personal lines claims data that is critical to Quorum's day-to-day operations. Abrupt termination of the relationship — while legally available under Section 14.2's material breach termination provision — would disrupt Quorum's personal lines claims operations and trigger significant transition costs estimated at several million dollars over a six-to-twelve-month migration period. The recommended strategy therefore balances aggressive cost recovery with the practical imperative of relationship preservation, while simultaneously positioning Quorum favorably in connection with the ongoing multistate attorneys general inquiry.

We are prepared to proceed upon your authorization and look forward to discussing this memorandum with you at your earliest convenience.

II. Background — The Incident and Quorum's Indemnification Demand

A. Incident Summary

On or about March 14, 2023, a threat actor exploited CVE-2023-0669, a remote code execution vulnerability present in Palomar's GoAnywhere MFT file transfer appliance. The GoAnywhere MFT platform is a managed file transfer solution that Palomar uses to process, transmit, and store structured data files on behalf of its clients, including Quorum. CVE-2023-0669 was a publicly disclosed vulnerability for which the software vendor had released a patch prior to the date of exploitation. Palomar, however, had not applied the patch within the thirty-day remediation window required by Exhibit D to the MSA.

Following the initial exploitation, the threat actor maintained unauthorized access to Palomar's environment and engaged in the systematic exfiltration of data over a period of approximately thirty-five days, from March 14, 2023 through April 18, 2023. During this period, the threat actor accessed and extracted structured data files containing the personal information of hundreds of thousands of individuals whose data Quorum had entrusted to Palomar for processing.

Palomar's Security Operations Center ("SOC") detected anomalous outbound data transfers on April 18, 2023. Upon detection, Palomar initiated internal investigation procedures. However, Palomar did not notify Quorum of the security incident until April 21, 2023 — approximately seventy-two hours after Palomar's initial discovery, which was roughly twenty-four hours past the forty-eight-hour notification deadline established by MSA Section 9.4. This delay in notification materially impeded Quorum's ability to initiate its own incident response procedures, engage outside counsel, and take steps to preserve relevant evidence.

On May 5, 2023, Calderwood & Harkness retained Graystone Forensics LLC to conduct an independent forensic investigation of the incident under the protection of the attorney-client privilege and work product doctrine. The Graystone engagement team was led by Dr. Nolan Briggs, Managing Director, and Kendra Faulkner, Senior Forensic Analyst. Graystone's investigation involved analysis of log data, network traffic captures, and system artifacts provided by Palomar pursuant to Quorum's contractual audit and cooperation rights under the MSA, as well as independent analysis conducted on Quorum's own systems and data repositories.

Graystone's final forensic report, dated July 14, 2023, confirmed the exfiltration of structured data files containing the personal information of 318,247 individuals across twenty-nine states and the District of Columbia. The categories of data compromised were as follows:

• Personally Identifiable Information (PII): All 318,247 affected individuals had the following data types compromised: full legal names, dates of birth, Social Security numbers, and driver's license numbers.

• Financial Information: A subset of 84,619 individuals had financial information compromised, including bank account numbers and payment card numbers associated with claims payments and premium transactions.

• Protected Health Information (PHI): A subset of 41,203 individuals had protected health information compromised within the meaning of the Health Insurance Portability and Accountability Act ("HIPAA"), including health conditions, diagnosis codes, and treatment information drawn from workers' compensation claims and health-related insurance claims processed by Palomar on Quorum's behalf.

The scope of the data compromise — particularly the involvement of PHI and financial account information in addition to Social Security numbers — places this incident among the more significant vendor-originated breaches in the insurance industry in recent years and has driven substantial incident response costs, as detailed below.

B. The Demand

On June 20, 2023, Calderwood & Harkness sent a formal breach of contract demand letter to Catherine Langford, Partner at Mercer, Haight & Dunlop LLP, who serves as Palomar's outside counsel for this matter. The demand letter set forth Quorum's position that Palomar had breached its data security obligations under the MSA and that Quorum was entitled to full indemnification under MSA Section 12.2 for all losses arising from the breach.

The demand letter sought indemnification in the total amount of $8,230,250, representing Quorum's aggregate incident response costs incurred through the date of the demand and reasonably anticipated future costs. The breakdown of total costs is as follows:

Each of these cost categories represents a direct and foreseeable consequence of the data breach caused by Palomar's failure to maintain adequate data security in accordance with its contractual obligations. The notification costs are particularly significant and reflect the large number of affected individuals (318,247), the involvement of data across twenty-nine states and the District of Columbia (each with its own notification requirements), and the decision — recommended by Calderwood & Harkness and consistent with regulatory expectations — to provide twenty-four months of credit monitoring services to all affected individuals given the sensitivity of the compromised data categories (Social Security numbers, financial account information, and PHI).

C. Palomar's Response

Catherine Langford responded on behalf of Palomar by letter dated July 7, 2023. In her response, Palomar disputed both causation and the scope of its liability under the MSA. Palomar's principal defense was its characterization of the exploitation of CVE-2023-0669 as a "sophisticated zero-day-like attack," notwithstanding the fact that the vulnerability had been publicly disclosed and a vendor patch had been made available prior to the March 14, 2023 intrusion. Palomar's letter further argued that the complexity and persistence of the threat actor's techniques were such that even a timely patch might not have prevented the breach, a contention that is squarely contradicted by Graystone's forensic findings.

In lieu of the full indemnification sought by Quorum, Palomar offered a $1,500,000 goodwill credit against future service fees under the MSA. Notably, Palomar's offer was structured as a fee credit rather than a cash payment, and Palomar expressly stated that the offer was made "without any admission of liability or fault." The offer represented approximately 18.2% of Quorum's total demand — a figure that we view as inadequate given the strength of Quorum's legal position and the magnitude of the documented losses.

On July 25, 2023, Calderwood & Harkness sent a detailed rebuttal letter to Catherine Langford refuting Palomar's causation defenses point by point. The rebuttal letter emphasized the following: (i) CVE-2023-0669 was a known vulnerability with a publicly available patch, not a zero-day; (ii) Palomar's contractual obligation under Exhibit D was to patch critical vulnerabilities within thirty days — an obligation that Palomar failed to meet; (iii) Graystone's forensic evidence establishes a direct and unbroken causal chain from the unpatched GoAnywhere MFT appliance to the unauthorized data exfiltration; and (iv) the $1,500,000 goodwill credit was wholly inadequate in light of Quorum's documented losses of $8,230,250. The rebuttal letter reiterated Quorum's demand for full indemnification and indicated Quorum's willingness to engage in substantive settlement discussions, while reserving all rights under the MSA, including the right to terminate for cause under Section 14.2.

As of the date of this memorandum, Palomar has not provided a formal response to the July 25 rebuttal letter. We understand through informal communications between counsel that Palomar is undertaking an internal review of its position and is open to further discussions.

III. Analysis of Quorum's Legal Position — Strengths

This section provides a detailed analysis of the legal bases supporting Quorum's indemnification claim. As discussed below, Quorum's position is strong across multiple dimensions: the contractual breach is clear, the forensic evidence is compelling, and the indemnification provision is broadly drafted and well within its applicable cap.

A. Breach of Data Security Exhibit (Exhibit D, as Amended by Amendments 1 and 2)

The MSA between Quorum and Palomar was originally executed on November 12, 2019, with an initial five-year term. The agreement has been amended twice since its inception:

• Amendment 1 (executed March 3, 2021): Added the processing of data generated by the QuorumEdge platform, Quorum's proprietary claims management system, to the scope of services. This amendment expanded the data categories processed by Palomar and increased the annual contract value ("ACV") from $14.2 million to $16.3 million, effective April 1, 2021.

• Amendment 2 (executed September 15, 2022): Updated the Data Security Exhibit (Exhibit D) to incorporate enhanced security requirements, including a new requirement that Palomar obtain an annual SOC 2 Type II audit report from an independent auditor, and updated the minimum cyber insurance coverage requirements applicable to Palomar. Amendment 2 also refined the vulnerability remediation timelines and strengthened the breach notification provisions.

Exhibit D to the MSA, as updated by Amendments 1 and 2, establishes the data security obligations that Palomar is required to maintain with respect to Quorum data processed under the agreement. The central obligation is the requirement that Palomar maintain "commercially reasonable" administrative, technical, and physical safeguards to protect the confidentiality, integrity, and availability of Quorum data. This general obligation is supplemented by specific, measurable requirements, including — critically for purposes of this matter — the requirement that Palomar apply patches for critical vulnerabilities within thirty (30) days of the release of a vendor patch.

The patch for CVE-2023-0669 was publicly available prior to the March 14, 2023 exploitation date. The vulnerability had been assigned a critical severity rating. Palomar was therefore contractually obligated to apply the patch within thirty days of its release. Palomar failed to do so. This failure constitutes a clear, documented breach of Exhibit D's patching requirement — a breach that is not subject to reasonable dispute.

The causal significance of this breach is equally clear. Graystone's forensic report confirms that the attack vector was the unpatched GoAnywhere MFT appliance. The threat actor exploited the specific vulnerability (CVE-2023-0669) for which the patch was available but had not been applied. Had Palomar complied with its contractual obligation to patch the vulnerability within thirty days, the exploitation would not have occurred through this vector. The direct causal link between Palomar's patching failure and the resulting data compromise is thus firmly established by the forensic evidence.

B. Late Breach Notification (MSA Section 9.4)

MSA Section 9.4 imposes a specific and unambiguous notification obligation on Palomar: upon discovering any security incident that affects or may affect Quorum data, Palomar is required to notify Quorum within forty-eight (48) hours of such discovery. This notification requirement was included in the original MSA and was not modified by either Amendment 1 or Amendment 2 (although, as discussed in Section VI.B below, we recommend reducing this window to twenty-four hours as part of the proposed Amendment 3).

The facts establish a clear violation of this notification requirement. Palomar's SOC detected anomalous outbound data transfers on April 18, 2023. Under Section 9.4, Palomar was obligated to notify Quorum no later than April 20, 2023. Palomar did not notify Quorum until April 21, 2023 — approximately seventy-two hours after discovery and approximately twenty-four hours past the contractual deadline.

While the late notification is a secondary breach compared to the patching failure that caused the underlying incident, it is strategically significant for several reasons. First, the delay impeded Quorum's ability to initiate its own incident response in a timely manner, including the engagement of outside counsel and forensic investigators, and may have resulted in the loss of certain time-sensitive evidentiary opportunities. Second, and more importantly from a negotiation perspective, the late notification strengthens the overall narrative of Palomar's failure to meet its contractual obligations. It demonstrates a pattern of non-compliance — not merely a single isolated lapse in vulnerability management, but a broader failure to adhere to the contractual framework that Palomar agreed to when it assumed responsibility for processing Quorum's sensitive data. This narrative of systemic non-compliance will be persuasive both in settlement discussions with Palomar's counsel and, if necessary, in any formal dispute resolution proceeding.

C. Indemnification Provision (MSA Section 12.2)

MSA Section 12.2 contains a broad indemnification obligation that requires Palomar to indemnify, defend, and hold harmless Quorum from and against all losses, damages, liabilities, costs, and expenses (including reasonable attorneys' fees) arising from or relating to Palomar's breach of its data security obligations under the MSA, including without limitation the obligations set forth in Exhibit D.

The indemnification obligation is subject to a liability cap equal to two times (2×) the trailing twelve-month fees paid by Quorum to Palomar. Based on the current ACV of $16.3 million (as established by Amendment 1), the applicable liability cap is $32,600,000. Quorum's total indemnification claim of $8,230,250 falls well within this cap — representing approximately 25.2% of the maximum recoverable amount. This provides Quorum with significant headroom and eliminates any argument by Palomar that the claim exceeds the contractual liability cap.

The scope of costs covered by Section 12.2's indemnification is broad. The provision covers first-party costs — that is, costs incurred by Quorum itself in responding to the breach — including forensic investigation costs, notification and credit monitoring costs, crisis communications expenses, legal fees, and internal remediation costs. All categories of costs included in Quorum's $8,230,250 demand fall squarely within the scope of Section 12.2's indemnification obligation. Importantly, the indemnification provision does not contain a carve-out for consequential damages, which is a common limitation in many commercial contracts. The absence of such a carve-out in the indemnification clause (as distinct from the general limitation of liability provision) provides Quorum with a strong argument that all damages flowing from the breach, including those that might be characterized as consequential, are within the scope of the indemnification.

D. Forensic Evidence

The cornerstone of Quorum's factual position is the Graystone Forensics LLC final forensic report dated July 14, 2023. This report, prepared by Dr. Nolan Briggs and Kendra Faulkner, provides compelling, detailed, and methodologically rigorous evidence on each element necessary to support Quorum's indemnification claim:

(i) Specific Vulnerability Exploited: The report identifies CVE-2023-0669 as the specific vulnerability exploited by the threat actor, based on analysis of system logs, network traffic captures, and forensic artifacts recovered from the GoAnywhere MFT appliance and associated systems.

(ii) Timeline of Unauthorized Access: The report establishes a detailed timeline of the threat actor's activities, from the initial exploitation on or about March 14, 2023 through the detection of anomalous data transfers on April 18, 2023 — a period of approximately thirty-five days during which the threat actor maintained persistent access to Palomar's environment.

(iii) Data Exfiltrated: The report identifies and quantifies the data that was exfiltrated, including the specific data categories (PII, financial information, PHI) and the number of affected individuals (318,247 total; 84,619 with financial information; 41,203 with PHI).

(iv) Causal Chain: Most critically, the report establishes a clear and unbroken causal chain from the unpatched GoAnywhere MFT appliance to the unauthorized data compromise. The report concludes that the exploitation of CVE-2023-0669 was the initial attack vector and the primary means by which the threat actor gained unauthorized access to the environment containing Quorum data.

This forensic evidence effectively forecloses Palomar's "sophisticated attack" defense. The vulnerability exploited was not a zero-day or novel attack technique — it was a known vulnerability with a publicly available patch. Palomar's failure to apply that patch within the contractual window was the direct and proximate cause of the breach. The Graystone report provides the evidentiary foundation necessary to establish these facts in any dispute resolution proceeding, and the report's conclusions are expected to be highly persuasive to any neutral decision-maker.

E. SOC 2 Type II Audit Deficiencies

Amendment 2 to the MSA, executed on September 15, 2022, introduced a requirement that Palomar obtain an annual SOC 2 Type II report from an independent auditing firm. This requirement was designed to provide Quorum with independent assurance regarding the design and operating effectiveness of Palomar's security controls.

Palomar's most recent SOC 2 Type II report was issued by Kessler, Park & Associates CPA, PLLC, with Vivian Park serving as Engagement Partner. The report covered the twelve-month period ending December 31, 2022. Our review of this report has identified certain findings and qualified exceptions relating to Palomar's vulnerability management and patch remediation processes. Specifically, the report noted that Palomar's patch management procedures did not consistently meet the organization's own stated remediation timelines for critical vulnerabilities during the audit period. While the SOC 2 report was issued before the March 2023 breach, the identified deficiencies in patch management processes are directly relevant to the failure that enabled the CVE-2023-0669 exploitation and further undermine Palomar's defense that the exploitation was an unforeseeable event. The SOC 2 findings serve as additional evidence that Palomar's vulnerability management posture was inadequate — a fact that Palomar's own independent auditors identified months before the breach occurred.

IV. Analysis of Palomar's Potential Defenses — Weaknesses in Their Position

While Quorum's legal position is strong, it is important to anticipate and evaluate the defenses that Palomar is likely to assert in the course of settlement negotiations. This section assesses the principal arguments available to Palomar and evaluates their likely effectiveness.

A. "Sophisticated Attack" / Causation Defense

Palomar's Argument: In its July 7, 2023 response letter, Palomar characterized the exploitation of CVE-2023-0669 as a "sophisticated zero-day-like attack" and argued that causation cannot be established with certainty — specifically, that even if Palomar had applied the patch within the contractual window, a sophisticated threat actor might have exploited alternative attack vectors to achieve the same result.

Rebuttal: This defense is fundamentally flawed for several reasons. First, CVE-2023-0669 was not a zero-day vulnerability. It was a known vulnerability that had been publicly disclosed, assigned a CVE identifier, and for which a vendor patch had been released prior to the date of exploitation. The characterization of the attack as "zero-day-like" is misleading and without factual basis. Second, Exhibit D's thirty-day patching requirement exists precisely to prevent the exploitation of known vulnerabilities. Palomar cannot agree to a contractual obligation to patch critical vulnerabilities within thirty days and then, having failed to do so, argue that its failure was immaterial because the attack was sophisticated. The entire purpose of the contractual requirement is to prevent this exact scenario. Third, Graystone's forensic report directly and specifically ties the unpatched GoAnywhere MFT appliance to the intrusion. The forensic evidence establishes that CVE-2023-0669 was the initial attack vector — not one of several possible vectors, but the specific means by which the threat actor gained unauthorized access. This is not a case of speculative causation; it is a case of forensically documented causation.

Assessment: This defense is weak and unlikely to succeed in litigation or arbitration. It is the type of argument that may have superficial appeal in a demand letter but would not withstand rigorous scrutiny by a neutral decision-maker presented with Graystone's forensic findings.

B. Scope of Damages Defense

Palomar's Argument: Palomar may argue that certain categories of costs included in Quorum's $8,230,250 demand are not "losses arising from" Palomar's breach within the meaning of Section 12.2, or that certain costs were not reasonably foreseeable at the time of contracting and are therefore not recoverable. Specific cost categories that Palomar may challenge include: Calderwood & Harkness legal fees ($2,163,750), BrightPath crisis communications costs ($385,000), and Quorum's internal costs for IT remediation and employee overtime ($620,000, estimated).

Rebuttal: All categories of costs included in Quorum's demand represent standard incident response costs that flow directly and foreseeably from a data breach of this nature and magnitude. It is well established in both judicial decisions and arbitration awards that indemnification clauses in data processing agreements cover forensic investigation costs, notification and credit monitoring costs, crisis communications expenses, legal fees incurred in responding to the breach, and reasonable internal costs associated with remediation efforts. These are precisely the types of costs that both parties would have contemplated at the time of contracting as foreseeable consequences of a vendor-originated data breach. Moreover, each cost category is documented and reasonable in light of the scope of the incident (318,247 affected individuals across twenty-nine states and the District of Columbia).

Assessment: Palomar may have some limited traction in challenging specific line items, particularly Quorum's estimated internal costs ($620,000), to the extent Palomar can argue that some portion of those costs represents overhead that Quorum would have incurred regardless of the breach. However, the core cost categories — forensic investigation, notification, credit monitoring, and legal fees — are indisputably within the scope of Section 12.2's indemnification obligation and represent the vast majority of the total claim ($7,225,250 of $8,230,250, or 87.8%). Even if Palomar were to succeed in excluding or reducing the internal cost estimate, the impact on the total claim would be marginal.

C. Contributory Conduct / Shared Responsibility

Palomar's Argument: Palomar may argue that Quorum bears some measure of responsibility for the incident, either because Quorum failed to conduct adequate vendor oversight of Palomar's security practices, or because Quorum failed to perform its own independent security assessments of Palomar's environment. This argument would seek to reduce or offset Palomar's indemnification obligation by attributing a portion of fault to Quorum.

Rebuttal: The MSA places the data security obligation squarely on Palomar as the data processor. Under the contractual framework, Palomar assumed responsibility for maintaining the administrative, technical, and physical safeguards necessary to protect Quorum data. Quorum contracted for and was entitled to rely on Palomar's compliance with the specific requirements set forth in Exhibit D, including the thirty-day patching requirement. The MSA does not impose a duty on Quorum to independently verify Palomar's compliance with each specific security control on an ongoing basis; rather, the contractual mechanism for verification is the SOC 2 Type II audit requirement introduced by Amendment 2, which Palomar was obligated to fulfill.

Moreover, Quorum maintained a vendor risk management program overseen by Priya Deshmukh, Vice President, Vendor Risk Management, that included periodic reviews of Palomar's compliance with its contractual obligations. Ms. Deshmukh's team conducted regular risk assessments, reviewed Palomar's SOC 2 reports, and maintained an ongoing dialogue with Palomar's security leadership regarding compliance matters. The existence and operation of Quorum's vendor risk management program undermines any argument that Quorum was negligent in its oversight of Palomar.

Assessment: Moderate risk. Palomar may attempt to probe the adequacy of Quorum's vendor oversight in discovery or during negotiations, and any gaps in Quorum's monitoring activities could be used to support a shared-responsibility narrative. However, the contractual allocation of responsibility clearly favors Quorum, and the MSA's structure — which assigns the data security obligation to Palomar and provides for SOC 2 audits as the primary verification mechanism — supports Quorum's position that it was entitled to rely on Palomar's contractual commitments.

D. Limitation of Liability / Cap Argument

Palomar's Argument: Given that Quorum's claim of $8,230,250 falls well within the $32,600,000 indemnification cap (2× trailing twelve-month fees), Palomar is unlikely to challenge the applicability of the cap itself. However, Palomar may argue that the indemnification obligation should be subject to additional limitations not expressly stated in Section 12.2, such as an exclusion of consequential, incidental, or indirect damages.

Rebuttal: Section 12.2's language is broad and covers "all losses, damages, liabilities, costs, and expenses arising from or relating to" Palomar's breach of its data security obligations. The indemnification provision does not include a carve-out for consequential damages. While the MSA's general limitation of liability provision (Section 13.1) does include a mutual exclusion of consequential damages, that exclusion is subject to a standard exception for indemnification obligations. This structural distinction — a consequential damages exclusion in the general limitation of liability provision, with a carve-out for indemnification claims — is a common and well-understood contractual mechanism that preserves the full scope of the indemnification obligation despite the general consequential damages waiver.

Assessment: Low risk. Assuming our reading of the MSA's limitation of liability and indemnification provisions is confirmed upon final review (which we recommend completing in advance of the negotiation session), Palomar's ability to invoke additional limitations beyond the express terms of Section 12.2 is limited. The contractual language favors Quorum on this point.

V. Strategic Considerations

While the legal analysis supports a strong claim by Quorum, the negotiation strategy must account for a range of commercial, operational, regulatory, and insurance-related considerations. This section addresses each of these factors and their implications for the recommended approach.

A. Preserving the Vendor Relationship

Palomar is Quorum's second-largest claims processing vendor by revenue, with an annual contract value of $16.3 million (as established by Amendment 1). Palomar processes claims data for Quorum's personal lines division — a core business function that directly impacts Quorum's policyholder service delivery and claims cycle times.

The MSA has a five-year term and does not expire until November 11, 2024 — approximately fourteen months from the date of this memorandum. Terminating the MSA for cause under Section 14.2 (material breach with a thirty-day cure period) is legally available given Palomar's documented breaches of Exhibit D and Section 9.4. However, termination would be operationally disruptive. Based on our understanding of Quorum's IT infrastructure and the complexity of the claims data processing function, transitioning to an alternative vendor would require approximately six to twelve months and would entail significant direct costs (vendor selection, contracting, data migration, system integration, testing, and parallel processing) as well as indirect costs (productivity losses, risk of processing errors during transition, and potential regulatory scrutiny).

We therefore recommend that Quorum pursue a negotiated resolution that holds Palomar financially accountable for the breach while preserving the vendor relationship for the remaining MSA term. This approach should be supplemented by enhanced security obligations codified in a formal Amendment 3 to the MSA, which will reduce the prospective risk of a similar incident during the remaining term and provide Quorum with stronger contractual protections going forward.

This recommendation does not foreclose the option of transitioning away from Palomar at the natural expiration of the MSA in November 2024. Indeed, the enhanced security commitments and fee concessions obtained through the settlement will serve as useful data points in Quorum's evaluation of whether to renew the MSA or transition to an alternative vendor at that time.

B. Relationship Dynamics and Leverage

An assessment of the negotiation dynamics confirms that Quorum holds significant leverage in this matter. Quorum is Palomar's second-largest client. The loss of the Quorum account — which represents approximately $16.3 million in annual revenue, or roughly 4.8% of Palomar's estimated $340 million in total annual revenue — would be a material event for Palomar. Palomar's senior leadership, including Marcus J. Trevino (CEO) and Anita Raghavan (CTO), have a strong commercial incentive to preserve the relationship and avoid the reputational and financial consequences of a high-profile client departure triggered by a data security failure.

Palomar's initial offer of a $1,500,000 goodwill credit signals a willingness to engage in settlement discussions but also suggests that Palomar may underestimate its legal exposure. The wide gap between Quorum's $8,230,250 demand and Palomar's $1,500,000 offer indicates that a significant education effort will be required to move Palomar's position to a range that is acceptable to Quorum. The strength of the forensic evidence and the clarity of the contractual breach provide the tools necessary to accomplish this.

Quorum's leverage is further enhanced by the credible threat of termination for cause. While Quorum's preferred outcome is a negotiated resolution that preserves the relationship, Palomar must understand that termination remains a viable option and that Quorum will exercise that option if Palomar fails to make a meaningful and adequate offer. The termination threat should be deployed strategically — not as an opening gambit, but as an escalation tool to be used if Palomar's counteroffers remain in an unacceptable range.

C. Insurance Considerations

Quorum has filed a claim under its cyber insurance program in connection with the incident. The relevant policies and claim details are as follows:

• Primary Policy: Atlas Mutual Insurance Company, Policy No. CYB-2023-041587, Claim No. CYB-CLM-2023-05892. The primary policy has a per-occurrence limit of $15,000,000 and a self-insured retention ("SIR") of $2,500,000.

• Excess Policy: Pinnacle Surplus Lines, providing $25,000,000 in coverage in excess of the $15,000,000 primary policy limit.

• Claims Adjuster: Paul Enriquez, Atlas Mutual Insurance Company.

• Cyber Insurance Broker: Sandra Whitmore-Kim, Whitmore Risk Advisors.

Quorum's total incident response costs of $8,230,250 exceed the $2,500,000 SIR by $5,730,250. The excess amount is covered under the Atlas primary policy and falls well within the $15,000,000 per-occurrence limit. The Pinnacle excess policy is unlikely to be implicated given the current cost estimates.

The insurance posture creates several important considerations for the negotiation:

Subrogation Rights. Atlas may assert subrogation rights against Palomar — that is, Atlas may seek to recover from Palomar the amounts that Atlas has paid or will pay under the primary policy. Any settlement between Quorum and Palomar must be coordinated with Atlas to ensure that the settlement does not prejudice or release Atlas's potential subrogation claim without Atlas's express consent. Failure to coordinate with Atlas on this point could result in Quorum breaching its obligations under the insurance policy and jeopardizing coverage.

Recovery Allocation. Any monetary recovery obtained from Palomar through the settlement will need to be allocated between Quorum's self-insured retention ($2,500,000) and Atlas's covered portion ($5,730,250). The allocation methodology should be discussed and agreed upon with Sandra Whitmore-Kim (Whitmore Risk Advisors) and Paul Enriquez (Atlas Mutual) prior to the finalization of settlement terms. In general, recoveries are allocated pro rata between the insured's retained loss and the insurer's covered loss, but the specific allocation methodology will depend on the terms of the Atlas policy and any applicable law.

Recommendation: We recommend proactive coordination with both Atlas Mutual and Whitmore Risk Advisors before entering into substantive settlement negotiations with Palomar. The settlement should be structured to preserve Atlas's subrogation rights and should include appropriate provisions regarding the allocation of any recovery. If Atlas requires consent to any settlement terms, that consent should be obtained before the settlement is executed.

D. Regulatory Posture

The data breach has attracted the attention of state regulators. On September 8, 2023, a multistate attorneys general coalition comprising twenty-nine states issued a joint demand letter to Quorum. The coalition is led by Assistant Attorney General Diane Marchetti of the Connecticut Attorney General's Office and Assistant Attorney General Mark Petrosian of the New York Attorney General's Office. The demand letter seeks detailed information regarding the breach, Quorum's incident response, and Quorum's vendor management practices. Quorum's response to the joint demand letter is due on October 13, 2023.

The Palomar negotiation and the multistate AG response are strategically intertwined. Demonstrating robust vendor accountability in the AG response will strengthen Quorum's position with regulators and reduce the likelihood of an enforcement action or consent order. A settlement with Palomar that includes meaningful financial recovery and enhanced security commitments can be presented to the attorneys general as evidence of Quorum's diligent and proactive response to the vendor-originated breach. Specifically, the AG response can highlight: (i) that Quorum held its vendor financially accountable through an indemnification claim and achieved substantial cost recovery; (ii) that Quorum required its vendor to implement enhanced security measures, including a shortened patching window, endpoint detection and response technology, and quarterly vulnerability scanning; and (iii) that these commitments were formalized in a binding MSA amendment.

Timing Implication: Ideally, the Palomar negotiation should be concluded before or contemporaneously with the submission of the multistate AG response on October 13, 2023, in order to maximize the narrative value of the settlement. If a final agreement cannot be reached by that date, Quorum should at minimum be in a position to report that substantive settlement discussions are underway and that Quorum has demanded enhanced security commitments from its vendor. The target resolution date of mid-to-late October 2023 (discussed further in Section VI.C below) is designed to align with this regulatory timeline.

E. Potential Litigation Risk

If settlement negotiations with Palomar are unsuccessful, Quorum retains the option of pursuing breach of contract litigation (or arbitration, depending on the MSA's dispute resolution clause) against Palomar. A preliminary review of the MSA's dispute resolution provisions indicates that the agreement may contain an arbitration clause and/or a forum selection clause; we are in the process of confirming the specific terms and will advise accordingly.

In the event of formal dispute resolution, Quorum would be well-positioned on liability given the strength of the contractual breach evidence and the forensic findings. However, litigation or arbitration would entail several risks and costs:

• Time and Expense: Formal dispute resolution proceedings would likely take twelve to eighteen months to reach a resolution and would involve substantial additional legal costs, including costs associated with discovery, expert testimony, briefing, and the hearing or trial.

• Damages Scope Risk: While Quorum would likely prevail on the question of liability, there is execution risk on the scope of damages. A neutral decision-maker might exclude or reduce certain cost categories, particularly Quorum's internal costs and a portion of the legal fees, which could reduce the ultimate recovery below the target settlement range.

• Relationship Impact: Initiating formal dispute resolution proceedings would almost certainly make the vendor relationship untenable, requiring Quorum to develop and execute a transition plan to migrate claims processing to an alternative vendor — a process that, as discussed above, would be costly and operationally disruptive.

• Public Exposure: Depending on the forum and the applicable confidentiality protections, litigation could result in the public disclosure of details regarding the breach that Quorum would prefer to keep confidential, including the specific categories of data compromised and the number of affected individuals.

Recommendation: Litigation or arbitration is a credible threat that should be deployed in negotiations to underscore the seriousness of Quorum's position and the consequences of Palomar's failure to make an adequate settlement offer. However, formal dispute resolution should be treated as a last resort rather than a preferred course of action. If a reasonable settlement can be achieved within the target range described in Section VI below, a negotiated resolution will be more efficient, less costly, and better aligned with Quorum's commercial interests.

VI. Recommended Negotiation Strategy

Based on the legal analysis and strategic considerations set forth above, we recommend the following negotiation strategy for the Palomar indemnification claim.

A. Target Settlement Range

The settlement parameters should be defined as follows:

Opening Demand Position: Maintain the $8,230,250 full indemnification demand as the anchor. The opening position should not be reduced prior to the first substantive negotiation session. The strength of Quorum's legal position supports the full demand as a reasonable and defensible starting point, and the initial demand serves as an important anchor that will influence the trajectory of the negotiation.

Target Resolution Range: $5,500,000 to $7,000,000 in total effective value, structured as a combination of direct cash payment and fee concessions over the remaining MSA term. This range represents approximately 67% to 85% of Quorum's total documented costs. We believe this range represents a strong and achievable outcome given the strength of Quorum's position but appropriately reflects the practical realities of negotiation (including the litigation discount, the value of relationship preservation, and Palomar's willingness to negotiate) and the economic benefit of a prompt resolution.

Floor / Walk-Away Threshold: $4,500,000 in total effective value. Below this threshold, we recommend that Quorum decline the settlement offer and proceed to formal dispute resolution under the MSA. A recovery below $4,500,000 (approximately 54.7% of total costs) would not adequately compensate Quorum for its documented losses and would signal to Palomar that contractual non-compliance carries limited financial consequences — a message that is both commercially and regulatorily undesirable.

Rationale: The target range of $5,500,000 to $7,000,000 is calibrated to achieve a substantial recovery that reflects the strength of Quorum's legal position while recognizing that negotiated resolutions typically involve some degree of discount relative to the full demand. This range is supportable by the legal analysis, the forensic evidence, and the commercial dynamics described in this memorandum. It also accounts for the strategic value of a prompt resolution that can be presented to the multistate attorneys general as evidence of Quorum's diligent vendor accountability efforts.

B. Recommended Deal Structure

We recommend structuring the settlement as a multi-component package that includes a direct cash payment, fee concessions, and enhanced security commitments. This structure maximizes the total effective value to Quorum while providing Palomar with some flexibility in how it satisfies its financial obligations. The recommended components are as follows:

1. Cash Payment. Seek a direct cash payment in the range of $4,000,000 to $5,000,000, payable within thirty (30) days of the execution of the settlement agreement. The cash payment component is the most important element of the deal structure and should be the primary focus of negotiation. A cash payment of this magnitude ensures that Quorum recovers a substantial portion of its out-of-pocket costs in a prompt and certain manner. The thirty-day payment timeline provides Quorum with near-term liquidity and avoids the uncertainty associated with deferred payment arrangements.

2. Fee Reduction. Negotiate a temporary reduction in the annual contract value for a period of twelve to eighteen months, yielding an additional $1,500,000 to $2,900,000 in economic value to Quorum. The specific parameters we recommend pursuing are as follows:

• At the low end of the range: an 8% reduction in the ACV ($16.3M × 8% = $1,304,000 per year) for a period of 18 months, yielding approximately $1,956,000 in total fee savings.

• At the high end of the range: a 10% reduction in the ACV ($16.3M × 10% = $1,630,000 per year) for a period of 18 months, yielding approximately $2,445,000 in total fee savings.

The fee reduction component offers two advantages. First, it provides Quorum with ongoing economic benefit over the remaining MSA term, effectively reducing the cost of the vendor relationship during a period in which Palomar is rebuilding trust with Quorum. Second, it provides Palomar with an alternative to a larger lump-sum cash payment, which may be more palatable to Palomar from a cash-flow and financial reporting perspective. The combination of cash payment and fee reduction is designed to reach the target total effective value range of $5,500,000 to $7,000,000.

3. Enhanced Security Commitments (Non-Monetary). In addition to the monetary components of the settlement, we recommend that Quorum require Palomar to implement the following enhanced security measures:

(a) Independent Third-Party Security Assessment: Require Palomar to engage, at Palomar's sole expense, an independent third-party security assessor to conduct enhanced annual security audits of Palomar's environment, with complete audit reports provided directly to Quorum. This assessment would be in addition to, and not a replacement for, the SOC 2 Type II audit requirement established by Amendment 2.

(b) Enhanced Patch Management: Reduce the patching window for critical vulnerabilities from thirty (30) days to fourteen (14) days from the date of vendor patch release. This shortened timeline directly addresses the specific vulnerability management failure that enabled the CVE-2023-0669 exploitation and provides Quorum with stronger contractual protections against similar incidents in the future.

(c) Endpoint Detection and Response (EDR) Technology: Require Palomar to deploy enterprise-grade endpoint detection and response technology across all systems that process, store, or transmit Quorum data within ninety (90) days of the execution of Amendment 3. EDR technology provides enhanced threat detection and response capabilities that would improve Palomar's ability to identify and contain future intrusions in a timely manner.

(d) Quarterly Vulnerability Scanning: Require Palomar to conduct quarterly vulnerability scans of all systems that process, store, or transmit Quorum data, with scan results and remediation reports provided to Quorum within fifteen (15) business days of each scan.

(e) Reduced Breach Notification Window: Reduce the breach notification window from forty-eight (48) hours to twenty-four (24) hours following Palomar's discovery of any security incident affecting or potentially affecting Quorum data. This modification addresses the late notification that occurred in connection with the current incident and ensures that Quorum receives prompt notice of any future security events.

These enhanced security commitments serve dual purposes: they reduce the prospective risk of a similar incident during the remaining MSA term and they demonstrate to regulators that Quorum has taken concrete steps to strengthen its vendor security posture in response to the breach.

4. MSA Amendment 3. All enhanced security commitments should be codified in a formal third amendment to the MSA ("Amendment 3"). Formalizing these commitments in a contractual amendment — rather than relying on informal assurances or side letters — ensures enforceability and provides a clear baseline against which Palomar's compliance can be measured.

5. Mutual Release. The settlement should include an exchange of mutual releases of all claims related to the April 2023 data breach incident, subject to the following carve-outs:

(a) Obligations arising under the settlement agreement itself, including the cash payment and fee reduction obligations;

(b) Obligations arising under MSA Amendment 3, including all enhanced security commitments;

(d) Any carve-out necessary to preserve Atlas Mutual Insurance Company's subrogation rights, as discussed in Section V.C above.

C. Negotiation Tactics

The following tactical recommendations are designed to guide the conduct of settlement negotiations with Palomar's counsel:

Initial Session. Open with a firm reiteration of the $8,230,250 demand in a face-to-face or video meeting between Kevin Ostrowski and Catherine Langford. The initial session should be used to set the tone for the negotiation, demonstrate the seriousness of Quorum's position, and begin the process of educating Palomar's counsel on the strength of Quorum's factual and legal position.

Presentation of Forensic Findings. During the initial session or a follow-up session, present key forensic findings from the Graystone report at an appropriate level of detail. The presentation should emphasize the specific vulnerability exploited (CVE-2023-0669), the availability of the patch prior to the exploitation, the timeline of unauthorized access, and the direct causal chain from the unpatched appliance to the data compromise. The presentation of forensic findings should be calibrated to reinforce the strength of Quorum's evidentiary position without waiving privilege over the full Graystone report. We recommend preparing a summary of key findings for use in the negotiation that is designated as settlement communication and protected by Federal Rule of Evidence 408 (or its state-law equivalent).

Termination Leverage. Emphasize the alternative: termination for cause under MSA Section 14.2, with the associated revenue loss to Palomar of approximately $16.3 million per year. This message should be conveyed clearly but not as an ultimatum in the initial sessions. The goal is to ensure that Palomar's decision-makers understand that the status quo is not an option — either Palomar will make a meaningful settlement offer, or Quorum will exercise its contractual right to terminate the relationship and pursue formal dispute resolution.

Structured Resolution Signal. Signal willingness to accept a structured resolution — combining a cash payment with fee concessions and enhanced security commitments — rather than insisting on a single lump-sum payment. This flexibility gives Palomar a path to a resolution that may be more manageable from a financial and operational perspective, while enabling Quorum to achieve its target total effective value. The signal should be timed to coincide with Palomar's initial engagement with the substance of the negotiation, after the demand anchor has been firmly established.

Escalation. If Palomar's initial counteroffers remain in the $1,500,000 to $2,500,000 range, escalate by sharing (with appropriate privilege protections) specific Graystone findings regarding the unpatched appliance and the exfiltration timeline. At this stage, we may also consider providing Palomar with a more detailed breakdown of Quorum's costs, with supporting documentation, to demonstrate the reasonableness and documentation of each cost category. The escalation should also include a more explicit discussion of the litigation alternative and its consequences for the vendor relationship.

Target Resolution Date. Set a target resolution date of mid-to-late October 2023 to align with the multistate AG response timeline. The target date should be communicated to Palomar's counsel early in the negotiation process to establish a sense of urgency and to ensure that both parties are working toward a defined timeline. If the target date cannot be met, Quorum should at minimum be able to report to the attorneys general that substantive settlement discussions are underway.

D. Coordination Requirements

The successful execution of this negotiation strategy requires coordination across several internal and external stakeholders. The following coordination activities should be completed before or during the negotiation:

1. Commercial and Operational Coordination: Coordinate with Thomas R. Whitfield (General Counsel) and Priya Deshmukh (VP, Vendor Risk Management) on the commercial terms and operational implications of the proposed settlement, including the fee reduction parameters and the enhanced security requirements. Ms. Deshmukh's team should assess the operational feasibility of the proposed enhanced security commitments and identify any potential implementation challenges that should be addressed in the negotiation.

2. Technical Security Coordination: Coordinate with David Naranjo (Chief Information Security Officer) on the technical adequacy of the proposed enhanced security commitments, including the shortened patching window, EDR deployment, and quarterly vulnerability scanning requirements. Mr. Naranjo's input will ensure that the enhanced security commitments are technically sound and will meaningfully reduce Quorum's prospective risk.

3. Insurance Coordination: Coordinate with Sandra Whitmore-Kim (Whitmore Risk Advisors) and Paul Enriquez (Atlas Mutual Insurance Company) regarding insurance subrogation rights and recovery allocation. As discussed in Section V.C, the settlement must be structured to preserve Atlas's subrogation rights, and any necessary consent from Atlas must be obtained before the settlement is finalized.

4. Executive Authorization: Obtain sign-off from Margaret D. Calloway (CEO) or her designee for any settlement above $3,000,000, or as otherwise required by Quorum's internal authorization matrix. Given the magnitude of the settlement parameters described in this memorandum, executive-level authorization will be required before Quorum can commit to final terms.

5. Board Briefing: Brief Franklin Reeves (Board Chair, Audit Committee) on settlement parameters, consistent with Quorum's Board reporting obligations. The Board Audit Committee should be apprised of the negotiation strategy, the target settlement range, and the key risk factors identified in this memorandum.

VII. Risk Assessment Summary

The following table summarizes the key risk factors that inform the recommended negotiation strategy, together with our assessment of each factor and its likely impact on the outcome.

VIII. Recommended Next Steps

Based on the analysis and recommendations set forth in this memorandum, we recommend the following next steps, organized by target timing:

1. Week of September 4, 2023: Schedule a call with Thomas R. Whitfield and Priya Deshmukh to confirm commercial parameters, internal authorization thresholds, and any operational constraints that should be factored into the negotiation. This call should also address Ms. Deshmukh's assessment of the feasibility of the proposed enhanced security commitments from a vendor management perspective.

2. Week of September 4–8, 2023: Coordinate with Sandra Whitmore-Kim (Whitmore Risk Advisors) and Paul Enriquez (Atlas Mutual Insurance Company) regarding Atlas's subrogation position and any settlement consent requirements under the cyber insurance policy. This coordination should be completed before the first substantive negotiation session with Palomar's counsel.

3. Week of September 11–15, 2023: Schedule the initial settlement negotiation session with Catherine Langford at Mercer, Haight & Dunlop LLP. The session should be structured as a face-to-face or video meeting between Kevin Ostrowski and Catherine Langford, with Alan Burke attending in a supporting role. The agenda for the initial session should include: (i) reiteration of Quorum's demand; (ii) presentation of key forensic findings (at an appropriate level of detail); and (iii) discussion of the framework for a potential structured resolution.

4. Concurrent with Step 3: Prepare detailed negotiation materials, including a damages summary with supporting documentation for each cost category, a timeline of key events and Palomar's contractual obligations, and a draft term sheet for use once substantive agreement in principle is reached.

5. Week of September 11–15, 2023: Brief David Naranjo (CISO) on the proposed enhanced security commitments — including the fourteen-day patching window, EDR deployment, quarterly vulnerability scanning, and twenty-four-hour notification requirement — to confirm their technical adequacy and identify any refinements that should be made before the commitments are proposed to Palomar.

6. Target: Mid-to-Late October 2023: Conclude the Palomar negotiation and reach agreement in principle, timed to support the multistate AG response narrative. If a final agreement cannot be reached by this date, Quorum should at minimum be in a position to report substantive progress in the AG response.

7. Upon Reaching Agreement in Principle: Prepare the following documents for review and execution:

(a) Settlement Agreement and Mutual Release, incorporating the cash payment, fee reduction, and mutual release provisions;

(b) MSA Amendment 3, codifying all enhanced security commitments;

(c) Summary memorandum to Thomas R. Whitfield and Margaret D. Calloway confirming the terms of the settlement and requesting final executive authorization for execution;

(d) Updated Board Audit Committee briefing for Franklin Reeves, summarizing the settlement terms and the rationale for the recommended resolution.

IX. Conclusion

Quorum Insurance Holdings Corp. holds a strong legal position in its indemnification claim against Palomar Data Solutions, Inc. The claim rests on documented breaches of the MSA — specifically, Palomar's failure to patch CVE-2023-0669 within the thirt

PRIVILEGED AND CONFIDENTIAL ATTORNEY-CLIENT COMMUNICATION ATTORNEY WORK PRODUCT PREPARED IN ANTICIPATION OF LITIGATION
CALDERWOOD & HARKNESS LLP Privacy & Data Security Practice Group 1700 K Street NW, Suite 900 Washington, D.C. 20006
August 28, 2023
MEMORANDUM
TO: Thomas R. Whitfield, General Counsel, Quorum Insurance Holdings Corp.
FROM: Kevin Ostrowski, Partner, and Alan Burke, Associate, Calderwood & Harkness LLP, Privacy & Data Security Practice Group
RE: Negotiation Strategy — Indemnification Claim Against Palomar Data Solutions, Inc.
MATTER NO.: 1025-00006
This memorandum constitutes a privileged and confidential attorney-client communication and attorney work product prepared in anticipation of litigation. It is protected from disclosure by the attorney-client privilege, the work product doctrine, and all other applicable privileges. Distribution of this memorandum is strictly limited to the addressee. Do not forward, copy, or distribute without the prior written consent of Calderwood & Harkness LLP.
I. Executive Summary
The purpose of this memorandum is to recommend a comprehensive negotiation strategy for Quorum Insurance Holdings Corp.'s ("Quorum") indemnification claim against Palomar Data Solutions, Inc. ("Palomar") arising from the vendor-originated data breach discovered on April 18, 2023. This memorandum assesses Quorum's legal position, evaluates Palomar's likely defenses, identifies strategic considerations that should guide the negotiation, and outlines specific tactics and settlement parameters designed to achieve an optimal outcome for Quorum.
In our assessment, Quorum occupies a strong legal position. The underpinning of this strength rests on three pillars: first, Palomar's clear breach of the Master Services Agreement ("MSA"), specifically the failure to patch CVE-2023-0669 within the contractual thirty-day window mandated by Exhibit D (the Data Security Exhibit, as updated by Amendments 1 and 2); second, compelling forensic evidence prepared by Graystone Forensics LLC confirming that the attack vector was the unpatched GoAnywhere MFT file transfer appliance, establishing a direct causal link between Palomar's patching failure and the exfiltration of personal data belonging to 318,247 individuals; and third, Palomar's late breach notification — approximately seventy-two hours after discovery, roughly twenty-four hours past the forty-eight-hour deadline established by MSA Section 9.4.
Based on this assessment, we recommend that Quorum pursue a negotiated resolution that achieves substantial cost recovery while preserving the vendor relationship for the remaining MSA term, which runs through November 11, 2024. The recommended target outcome is a combined monetary recovery in the range of $5,500,000 to $7,000,000 in total effective value, structured as a combination of a direct cash payment and fee concessions over the remaining term of the MSA, together with enhanced prospective security commitments from Palomar codified in a formal third amendment to the MSA ("Amendment 3").
This recommended approach reflects a key tension that must be carefully managed throughout the negotiation: Palomar is Quorum's second-largest claims processing vendor, and the MSA governs the processing of personal lines claims data that is critical to Quorum's day-to-day operations. Abrupt termination of the relationship — while legally available under Section 14.2's material breach termination provision — would disrupt Quorum's personal lines claims operations and trigger significant transition costs estimated at several million dollars over a six-to-twelve-month migration period. The recommended strategy therefore balances aggressive cost recovery with the practical imperative of relationship preservation, while simultaneously positioning Quorum favorably in connection with the ongoing multistate attorneys general inquiry.
We are prepared to proceed upon your authorization and look forward to discussing this memorandum with you at your earliest convenience.
II. Background — The Incident and Quorum's Indemnification Demand
A. Incident Summary
On or about March 14, 2023, a threat actor exploited CVE-2023-0669, a remote code execution vulnerability present in Palomar's GoAnywhere MFT file transfer appliance. The GoAnywhere MFT platform is a managed file transfer solution that Palomar uses to process, transmit, and store structured data files on behalf of its clients, including Quorum. CVE-2023-0669 was a publicly disclosed vulnerability for which the software vendor had released a patch prior to the date of exploitation. Palomar, however, had not applied the patch within the thirty-day remediation window required by Exhibit D to the MSA.
Following the initial exploitation, the threat actor maintained unauthorized access to Palomar's environment and engaged in the systematic exfiltration of data over a period of approximately thirty-five days, from March 14, 2023 through April 18, 2023. During this period, the threat actor accessed and extracted structured data files containing the personal information of hundreds of thousands of individuals whose data Quorum had entrusted to Palomar for processing.
Palomar's Security Operations Center ("SOC") detected anomalous outbound data transfers on April 18, 2023. Upon detection, Palomar initiated internal investigation procedures. However, Palomar did not notify Quorum of the security incident until April 21, 2023 — approximately seventy-two hours after Palomar's initial discovery, which was roughly twenty-four hours past the forty-eight-hour notification deadline established by MSA Section 9.4. This delay in notification materially impeded Quorum's ability to initiate its own incident response procedures, engage outside counsel, and take steps to preserve relevant evidence.
On May 5, 2023, Calderwood & Harkness retained Graystone Forensics LLC to conduct an independent forensic investigation of the incident under the protection of the attorney-client privilege and work product doctrine. The Graystone engagement team was led by Dr. Nolan Briggs, Managing Director, and Kendra Faulkner, Senior Forensic Analyst. Graystone's investigation involved analysis of log data, network traffic captures, and system artifacts provided by Palomar pursuant to Quorum's contractual audit and cooperation rights under the MSA, as well as independent analysis conducted on Quorum's own systems and data repositories.
Graystone's final forensic report, dated July 14, 2023, confirmed the exfiltration of structured data files containing the personal information of 318,247 individuals across twenty-nine states and the District of Columbia. The categories of data compromised were as follows:
• Personally Identifiable Information (PII): All 318,247 affected individuals had the following data types compromised: full legal names, dates of birth, Social Security numbers, and driver's license numbers.
• Financial Information: A subset of 84,619 individuals had financial information compromised, including bank account numbers and payment card numbers associated with claims payments and premium transactions.
• Protected Health Information (PHI): A subset of 41,203 individuals had protected health information compromised within the meaning of the Health Insurance Portability and Accountability Act ("HIPAA"), including health conditions, diagnosis codes, and treatment information drawn from workers' compensation claims and health-related insurance claims processed by Palomar on Quorum's behalf.
The scope of the data compromise — particularly the involvement of PHI and financial account information in addition to Social Security numbers — places this incident among the more significant vendor-originated breaches in the insurance industry in recent years and has driven substantial incident response costs, as detailed below.
B. The Demand
On June 20, 2023, Calderwood & Harkness sent a formal breach of contract demand letter to Catherine Langford, Partner at Mercer, Haight & Dunlop LLP, who serves as Palomar's outside counsel for this matter. The demand letter set forth Quorum's position that Palomar had breached its data security obligations under the MSA and that Quorum was entitled to full indemnification under MSA Section 12.2 for all losses arising from the breach.
The demand letter sought indemnification in the total amount of $8,230,250, representing Quorum's aggregate incident response costs incurred through the date of the demand and reasonably anticipated future costs. The breakdown of total costs is as follows:
Each of these cost categories represents a direct and foreseeable consequence of the data breach caused by Palomar's failure to maintain adequate data security in accordance with its contractual obligations. The notification costs are particularly significant and reflect the large number of affected individuals (318,247), the involvement of data across twenty-nine states and the District of Columbia (each with its own notification requirements), and the decision — recommended by Calderwood & Harkness and consistent with regulatory expectations — to provide twenty-four months of credit monitoring services to all affected individuals given the sensitivity of the compromised data categories (Social Security numbers, financial account information, and PHI).
C. Palomar's Response
Catherine Langford responded on behalf of Palomar by letter dated July 7, 2023. In her response, Palomar disputed both causation and the scope of its liability under the MSA. Palomar's principal defense was its characterization of the exploitation of CVE-2023-0669 as a "sophisticated zero-day-like attack," notwithstanding the fact that the vulnerability had been publicly disclosed and a vendor patch had been made available prior to the March 14, 2023 intrusion. Palomar's letter further argued that the complexity and persistence of the threat actor's techniques were such that even a timely patch might not have prevented the breach, a contention that is squarely contradicted by Graystone's forensic findings.
In lieu of the full indemnification sought by Quorum, Palomar offered a $1,500,000 goodwill credit against future service fees under the MSA. Notably, Palomar's offer was structured as a fee credit rather than a cash payment, and Palomar expressly stated that the offer was made "without any admission of liability or fault." The offer represented approximately 18.2% of Quorum's total demand — a figure that we view as inadequate given the strength of Quorum's legal position and the magnitude of the documented losses.
On July 25, 2023, Calderwood & Harkness sent a detailed rebuttal letter to Catherine Langford refuting Palomar's causation defenses point by point. The rebuttal letter emphasized the following: (i) CVE-2023-0669 was a known vulnerability with a publicly available patch, not a zero-day; (ii) Palomar's contractual obligation under Exhibit D was to patch critical vulnerabilities within thirty days — an obligation that Palomar failed to meet; (iii) Graystone's forensic evidence establishes a direct and unbroken causal chain from the unpatched GoAnywhere MFT appliance to the unauthorized data exfiltration; and (iv) the $1,500,000 goodwill credit was wholly inadequate in light of Quorum's documented losses of $8,230,250. The rebuttal letter reiterated Quorum's demand for full indemnification and indicated Quorum's willingness to engage in substantive settlement discussions, while reserving all rights under the MSA, including the right to terminate for cause under Section 14.2.
As of the date of this memorandum, Palomar has not provided a formal response to the July 25 rebuttal letter. We understand through informal communications between counsel that Palomar is undertaking an internal review of its position and is open to further discussions.
III. Analysis of Quorum's Legal Position — Strengths
This section provides a detailed analysis of the legal bases supporting Quorum's indemnification claim. As discussed below, Quorum's position is strong across multiple dimensions: the contractual breach is clear, the forensic evidence is compelling, and the indemnification provision is broadly drafted and well within its applicable cap.
A. Breach of Data Security Exhibit (Exhibit D, as Amended by Amendments 1 and 2)
The MSA between Quorum and Palomar was originally executed on November 12, 2019, with an initial five-year term. The agreement has been amended twice since its inception:
• Amendment 1 (executed March 3, 2021): Added the processing of data generated by the QuorumEdge platform, Quorum's proprietary claims management system, to the scope of services. This amendment expanded the data categories processed by Palomar and increased the annual contract value ("ACV") from $14.2 million to $16.3 million, effective April 1, 2021.
• Amendment 2 (executed September 15, 2022): Updated the Data Security Exhibit (Exhibit D) to incorporate enhanced security requirements, including a new requirement that Palomar obtain an annual SOC 2 Type II audit report from an independent auditor, and updated the minimum cyber insurance coverage requirements applicable to Palomar. Amendment 2 also refined the vulnerability remediation timelines and strengthened the breach notification provisions.
Exhibit D to the MSA, as updated by Amendments 1 and 2, establishes the data security obligations that Palomar is required to maintain with respect to Quorum data processed under the agreement. The central obligation is the requirement that Palomar maintain "commercially reasonable" administrative, technical, and physical safeguards to protect the confidentiality, integrity, and availability of Quorum data. This general obligation is supplemented by specific, measurable requirements, including — critically for purposes of this matter — the requirement that Palomar apply patches for critical vulnerabilities within thirty (30) days of the release of a vendor patch.
The patch for CVE-2023-0669 was publicly available prior to the March 14, 2023 exploitation date. The vulnerability had been assigned a critical severity rating. Palomar was therefore contractually obligated to apply the patch within thirty days of its release. Palomar failed to do so. This failure constitutes a clear, documented breach of Exhibit D's patching requirement — a breach that is not subject to reasonable dispute.
The causal significance of this breach is equally clear. Graystone's forensic report confirms that the attack vector was the unpatched GoAnywhere MFT appliance. The threat actor exploited the specific vulnerability (CVE-2023-0669) for which the patch was available but had not been applied. Had Palomar complied with its contractual obligation to patch the vulnerability within thirty days, the exploitation would not have occurred through this vector. The direct causal link between Palomar's patching failure and the resulting data compromise is thus firmly established by the forensic evidence.
B. Late Breach Notification (MSA Section 9.4)
MSA Section 9.4 imposes a specific and unambiguous notification obligation on Palomar: upon discovering any security incident that affects or may affect Quorum data, Palomar is required to notify Quorum within forty-eight (48) hours of such discovery. This notification requirement was included in the original MSA and was not modified by either Amendment 1 or Amendment 2 (although, as discussed in Section VI.B below, we recommend reducing this window to twenty-four hours as part of the proposed Amendment 3).
The facts establish a clear violation of this notification requirement. Palomar's SOC detected anomalous outbound data transfers on April 18, 2023. Under Section 9.4, Palomar was obligated to notify Quorum no later than April 20, 2023. Palomar did not notify Quorum until April 21, 2023 — approximately seventy-two hours after discovery and approximately twenty-four hours past the contractual deadline.
While the late notification is a secondary breach compared to the patching failure that caused the underlying incident, it is strategically significant for several reasons. First, the delay impeded Quorum's ability to initiate its own incident response in a timely manner, including the engagement of outside counsel and forensic investigators, and may have resulted in the loss of certain time-sensitive evidentiary opportunities. Second, and more importantly from a negotiation perspective, the late notification strengthens the overall narrative of Palomar's failure to meet its contractual obligations. It demonstrates a pattern of non-compliance — not merely a single isolated lapse in vulnerability management, but a broader failure to adhere to the contractual framework that Palomar agreed to when it assumed responsibility for processing Quorum's sensitive data. This narrative of systemic non-compliance will be persuasive both in settlement discussions with Palomar's counsel and, if necessary, in any formal dispute resolution proceeding.
C. Indemnification Provision (MSA Section 12.2)
MSA Section 12.2 contains a broad indemnification obligation that requires Palomar to indemnify, defend, and hold harmless Quorum from and against all losses, damages, liabilities, costs, and expenses (including reasonable attorneys' fees) arising from or relating to Palomar's breach of its data security obligations under the MSA, including without limitation the obligations set forth in Exhibit D.
The indemnification obligation is subject to a liability cap equal to two times (2×) the trailing twelve-month fees paid by Quorum to Palomar. Based on the current ACV of $16.3 million (as established by Amendment 1), the applicable liability cap is $32,600,000. Quorum's total indemnification claim of $8,230,250 falls well within this cap — representing approximately 25.2% of the maximum recoverable amount. This provides Quorum with significant headroom and eliminates any argument by Palomar that the claim exceeds the contractual liability cap.
The scope of costs covered by Section 12.2's indemnification is broad. The provision covers first-party costs — that is, costs incurred by Quorum itself in responding to the breach — including forensic investigation costs, notification and credit monitoring costs, crisis communications expenses, legal fees, and internal remediation costs. All categories of costs included in Quorum's $8,230,250 demand fall squarely within the scope of Section 12.2's indemnification obligation. Importantly, the indemnification provision does not contain a carve-out for consequential damages, which is a common limitation in many commercial contracts. The absence of such a carve-out in the indemnification clause (as distinct from the general limitation of liability provision) provides Quorum with a strong argument that all damages flowing from the breach, including those that might be characterized as consequential, are within the scope of the indemnification.
D. Forensic Evidence
The cornerstone of Quorum's factual position is the Graystone Forensics LLC final forensic report dated July 14, 2023. This report, prepared by Dr. Nolan Briggs and Kendra Faulkner, provides compelling, detailed, and methodologically rigorous evidence on each element necessary to support Quorum's indemnification claim:
(i) Specific Vulnerability Exploited: The report identifies CVE-2023-0669 as the specific vulnerability exploited by the threat actor, based on analysis of system logs, network traffic captures, and forensic artifacts recovered from the GoAnywhere MFT appliance and associated systems.
(ii) Timeline of Unauthorized Access: The report establishes a detailed timeline of the threat actor's activities, from the initial exploitation on or about March 14, 2023 through the detection of anomalous data transfers on April 18, 2023 — a period of approximately thirty-five days during which the threat actor maintained persistent access to Palomar's environment.
(iii) Data Exfiltrated: The report identifies and quantifies the data that was exfiltrated, including the specific data categories (PII, financial information, PHI) and the number of affected individuals (318,247 total; 84,619 with financial information; 41,203 with PHI).
(iv) Causal Chain: Most critically, the report establishes a clear and unbroken causal chain from the unpatched GoAnywhere MFT appliance to the unauthorized data compromise. The report concludes that the exploitation of CVE-2023-0669 was the initial attack vector and the primary means by which the threat actor gained unauthorized access to the environment containing Quorum data.
This forensic evidence effectively forecloses Palomar's "sophisticated attack" defense. The vulnerability exploited was not a zero-day or novel attack technique — it was a known vulnerability with a publicly available patch. Palomar's failure to apply that patch within the contractual window was the direct and proximate cause of the breach. The Graystone report provides the evidentiary foundation necessary to establish these facts in any dispute resolution proceeding, and the report's conclusions are expected to be highly persuasive to any neutral decision-maker.
E. SOC 2 Type II Audit Deficiencies
Amendment 2 to the MSA, executed on September 15, 2022, introduced a requirement that Palomar obtain an annual SOC 2 Type II report from an independent auditing firm. This requirement was designed to provide Quorum with independent assurance regarding the design and operating effectiveness of Palomar's security controls.
Palomar's most recent SOC 2 Type II report was issued by Kessler, Park & Associates CPA, PLLC, with Vivian Park serving as Engagement Partner. The report covered the twelve-month period ending December 31, 2022. Our review of this report has identified certain findings and qualified exceptions relating to Palomar's vulnerability management and patch remediation processes. Specifically, the report noted that Palomar's patch management procedures did not consistently meet the organization's own stated remediation timelines for critical vulnerabilities during the audit period. While the SOC 2 report was issued before the March 2023 breach, the identified deficiencies in patch management processes are directly relevant to the failure that enabled the CVE-2023-0669 exploitation and further undermine Palomar's defense that the exploitation was an unforeseeable event. The SOC 2 findings serve as additional evidence that Palomar's vulnerability management posture was inadequate — a fact that Palomar's own independent auditors identified months before the breach occurred.
IV. Analysis of Palomar's Potential Defenses — Weaknesses in Their Position
While Quorum's legal position is strong, it is important to anticipate and evaluate the defenses that Palomar is likely to assert in the course of settlement negotiations. This section assesses the principal arguments available to Palomar and evaluates their likely effectiveness.
A. "Sophisticated Attack" / Causation Defense
Palomar's Argument: In its July 7, 2023 response letter, Palomar characterized the exploitation of CVE-2023-0669 as a "sophisticated zero-day-like attack" and argued that causation cannot be established with certainty — specifically, that even if Palomar had applied the patch within the contractual window, a sophisticated threat actor might have exploited alternative attack vectors to achieve the same result.
Rebuttal: This defense is fundamentally flawed for several reasons. First, CVE-2023-0669 was not a zero-day vulnerability. It was a known vulnerability that had been publicly disclosed, assigned a CVE identifier, and for which a vendor patch had been released prior to the date of exploitation. The characterization of the attack as "zero-day-like" is misleading and without factual basis. Second, Exhibit D's thirty-day patching requirement exists precisely to prevent the exploitation of known vulnerabilities. Palomar cannot agree to a contractual obligation to patch critical vulnerabilities within thirty days and then, having failed to do so, argue that its failure was immaterial because the attack was sophisticated. The entire purpose of the contractual requirement is to prevent this exact scenario. Third, Graystone's forensic report directly and specifically ties the unpatched GoAnywhere MFT appliance to the intrusion. The forensic evidence establishes that CVE-2023-0669 was the initial attack vector — not one of several possible vectors, but the specific means by which the threat actor gained unauthorized access. This is not a case of speculative causation; it is a case of forensically documented causation.
Assessment: This defense is weak and unlikely to succeed in litigation or arbitration. It is the type of argument that may have superficial appeal in a demand letter but would not withstand rigorous scrutiny by a neutral decision-maker presented with Graystone's forensic findings.
B. Scope of Damages Defense
Palomar's Argument: Palomar may argue that certain categories of costs included in Quorum's $8,230,250 demand are not "losses arising from" Palomar's breach within the meaning of Section 12.2, or that certain costs were not reasonably foreseeable at the time of contracting and are therefore not recoverable. Specific cost categories that Palomar may challenge include: Calderwood & Harkness legal fees ($2,163,750), BrightPath crisis communications costs ($385,000), and Quorum's internal costs for IT remediation and employee overtime ($620,000, estimated).
Rebuttal: All categories of costs included in Quorum's demand represent standard incident response costs that flow directly and foreseeably from a data breach of this nature and magnitude. It is well established in both judicial decisions and arbitration awards that indemnification clauses in data processing agreements cover forensic investigation costs, notification and credit monitoring costs, crisis communications expenses, legal fees incurred in responding to the breach, and reasonable internal costs associated with remediation efforts. These are precisely the types of costs that both parties would have contemplated at the time of contracting as foreseeable consequences of a vendor-originated data breach. Moreover, each cost category is documented and reasonable in light of the scope of the incident (318,247 affected individuals across twenty-nine states and the District of Columbia).
Assessment: Palomar may have some limited traction in challenging specific line items, particularly Quorum's estimated internal costs ($620,000), to the extent Palomar can argue that some portion of those costs represents overhead that Quorum would have incurred regardless of the breach. However, the core cost categories — forensic investigation, notification, credit monitoring, and legal fees — are indisputably within the scope of Section 12.2's indemnification obligation and represent the vast majority of the total claim ($7,225,250 of $8,230,250, or 87.8%). Even if Palomar were to succeed in excluding or reducing the internal cost estimate, the impact on the total claim would be marginal.
C. Contributory Conduct / Shared Responsibility
Palomar's Argument: Palomar may argue that Quorum bears some measure of responsibility for the incident, either because Quorum failed to conduct adequate vendor oversight of Palomar's security practices, or because Quorum failed to perform its own independent security assessments of Palomar's environment. This argument would seek to reduce or offset Palomar's indemnification obligation by attributing a portion of fault to Quorum.
Rebuttal: The MSA places the data security obligation squarely on Palomar as the data processor. Under the contractual framework, Palomar assumed responsibility for maintaining the administrative, technical, and physical safeguards necessary to protect Quorum data. Quorum contracted for and was entitled to rely on Palomar's compliance with the specific requirements set forth in Exhibit D, including the thirty-day patching requirement. The MSA does not impose a duty on Quorum to independently verify Palomar's compliance with each specific security control on an ongoing basis; rather, the contractual mechanism for verification is the SOC 2 Type II audit requirement introduced by Amendment 2, which Palomar was obligated to fulfill.
Moreover, Quorum maintained a vendor risk management program overseen by Priya Deshmukh, Vice President, Vendor Risk Management, that included periodic reviews of Palomar's compliance with its contractual obligations. Ms. Deshmukh's team conducted regular risk assessments, reviewed Palomar's SOC 2 reports, and maintained an ongoing dialogue with Palomar's security leadership regarding compliance matters. The existence and operation of Quorum's vendor risk management program undermines any argument that Quorum was negligent in its oversight of Palomar.
Assessment: Moderate risk. Palomar may attempt to probe the adequacy of Quorum's vendor oversight in discovery or during negotiations, and any gaps in Quorum's monitoring activities could be used to support a shared-responsibility narrative. However, the contractual allocation of responsibility clearly favors Quorum, and the MSA's structure — which assigns the data security obligation to Palomar and provides for SOC 2 audits as the primary verification mechanism — supports Quorum's position that it was entitled to rely on Palomar's contractual commitments.
D. Limitation of Liability / Cap Argument
Palomar's Argument: Given that Quorum's claim of $8,230,250 falls well within the $32,600,000 indemnification cap (2× trailing twelve-month fees), Palomar is unlikely to challenge the applicability of the cap itself. However, Palomar may argue that the indemnification obligation should be subject to additional limitations not expressly stated in Section 12.2, such as an exclusion of consequential, incidental, or indirect damages.
Rebuttal: Section 12.2's language is broad and covers "all losses, damages, liabilities, costs, and expenses arising from or relating to" Palomar's breach of its data security obligations. The indemnification provision does not include a carve-out for consequential damages. While the MSA's general limitation of liability provision (Section 13.1) does include a mutual exclusion of consequential damages, that exclusion is subject to a standard exception for indemnification obligations. This structural distinction — a consequential damages exclusion in the general limitation of liability provision, with a carve-out for indemnification claims — is a common and well-understood contractual mechanism that preserves the full scope of the indemnification obligation despite the general consequential damages waiver.
Assessment: Low risk. Assuming our reading of the MSA's limitation of liability and indemnification provisions is confirmed upon final review (which we recommend completing in advance of the negotiation session), Palomar's ability to invoke additional limitations beyond the express terms of Section 12.2 is limited. The contractual language favors Quorum on this point.
V. Strategic Considerations
While the legal analysis supports a strong claim by Quorum, the negotiation strategy must account for a range of commercial, operational, regulatory, and insurance-related considerations. This section addresses each of these factors and their implications for the recommended approach.
A. Preserving the Vendor Relationship
Palomar is Quorum's second-largest claims processing vendor by revenue, with an annual contract value of $16.3 million (as established by Amendment 1). Palomar processes claims data for Quorum's personal lines division — a core business function that directly impacts Quorum's policyholder service delivery and claims cycle times.
The MSA has a five-year term and does not expire until November 11, 2024 — approximately fourteen months from the date of this memorandum. Terminating the MSA for cause under Section 14.2 (material breach with a thirty-day cure period) is legally available given Palomar's documented breaches of Exhibit D and Section 9.4. However, termination would be operationally disruptive. Based on our understanding of Quorum's IT infrastructure and the complexity of the claims data processing function, transitioning to an alternative vendor would require approximately six to twelve months and would entail significant direct costs (vendor selection, contracting, data migration, system integration, testing, and parallel processing) as well as indirect costs (productivity losses, risk of processing errors during transition, and potential regulatory scrutiny).
We therefore recommend that Quorum pursue a negotiated resolution that holds Palomar financially accountable for the breach while preserving the vendor relationship for the remaining MSA term. This approach should be supplemented by enhanced security obligations codified in a formal Amendment 3 to the MSA, which will reduce the prospective risk of a similar incident during the remaining term and provide Quorum with stronger contractual protections going forward.
This recommendation does not foreclose the option of transitioning away from Palomar at the natural expiration of the MSA in November 2024. Indeed, the enhanced security commitments and fee concessions obtained through the settlement will serve as useful data points in Quorum's evaluation of whether to renew the MSA or transition to an alternative vendor at that time.
B. Relationship Dynamics and Leverage
An assessment of the negotiation dynamics confirms that Quorum holds significant leverage in this matter. Quorum is Palomar's second-largest client. The loss of the Quorum account — which represents approximately $16.3 million in annual revenue, or roughly 4.8% of Palomar's estimated $340 million in total annual revenue — would be a material event for Palomar. Palomar's senior leadership, including Marcus J. Trevino (CEO) and Anita Raghavan (CTO), have a strong commercial incentive to preserve the relationship and avoid the reputational and financial consequences of a high-profile client departure triggered by a data security failure.
Palomar's initial offer of a $1,500,000 goodwill credit signals a willingness to engage in settlement discussions but also suggests that Palomar may underestimate its legal exposure. The wide gap between Quorum's $8,230,250 demand and Palomar's $1,500,000 offer indicates that a significant education effort will be required to move Palomar's position to a range that is acceptable to Quorum. The strength of the forensic evidence and the clarity of the contractual breach provide the tools necessary to accomplish this.
Quorum's leverage is further enhanced by the credible threat of termination for cause. While Quorum's preferred outcome is a negotiated resolution that preserves the relationship, Palomar must understand that termination remains a viable option and that Quorum will exercise that option if Palomar fails to make a meaningful and adequate offer. The termination threat should be deployed strategically — not as an opening gambit, but as an escalation tool to be used if Palomar's counteroffers remain in an unacceptable range.
C. Insurance Considerations
Quorum has filed a claim under its cyber insurance program in connection with the incident. The relevant policies and claim details are as follows:
• Primary Policy: Atlas Mutual Insurance Company, Policy No. CYB-2023-041587, Claim No. CYB-CLM-2023-05892. The primary policy has a per-occurrence limit of $15,000,000 and a self-insured retention ("SIR") of $2,500,000.
• Excess Policy: Pinnacle Surplus Lines, providing $25,000,000 in coverage in excess of the $15,000,000 primary policy limit.
• Claims Adjuster: Paul Enriquez, Atlas Mutual Insurance Company.
• Cyber Insurance Broker: Sandra Whitmore-Kim, Whitmore Risk Advisors.
Quorum's total incident response costs of $8,230,250 exceed the $2,500,000 SIR by $5,730,250. The excess amount is covered under the Atlas primary policy and falls well within the $15,000,000 per-occurrence limit. The Pinnacle excess policy is unlikely to be implicated given the current cost estimates.
The insurance posture creates several important considerations for the negotiation:
Subrogation Rights. Atlas may assert subrogation rights against Palomar — that is, Atlas may seek to recover from Palomar the amounts that Atlas has paid or will pay under the primary policy. Any settlement between Quorum and Palomar must be coordinated with Atlas to ensure that the settlement does not prejudice or release Atlas's potential subrogation claim without Atlas's express consent. Failure to coordinate with Atlas on this point could result in Quorum breaching its obligations under the insurance policy and jeopardizing coverage.
Recovery Allocation. Any monetary recovery obtained from Palomar through the settlement will need to be allocated between Quorum's self-insured retention ($2,500,000) and Atlas's covered portion ($5,730,250). The allocation methodology should be discussed and agreed upon with Sandra Whitmore-Kim (Whitmore Risk Advisors) and Paul Enriquez (Atlas Mutual) prior to the finalization of settlement terms. In general, recoveries are allocated pro rata between the insured's retained loss and the insurer's covered loss, but the specific allocation methodology will depend on the terms of the Atlas policy and any applicable law.
Recommendation: We recommend proactive coordination with both Atlas Mutual and Whitmore Risk Advisors before entering into substantive settlement negotiations with Palomar. The settlement should be structured to preserve Atlas's subrogation rights and should include appropriate provisions regarding the allocation of any recovery. If Atlas requires consent to any settlement terms, that consent should be obtained before the settlement is executed.
D. Regulatory Posture
The data breach has attracted the attention of state regulators. On September 8, 2023, a multistate attorneys general coalition comprising twenty-nine states issued a joint demand letter to Quorum. The coalition is led by Assistant Attorney General Diane Marchetti of the Connecticut Attorney General's Office and Assistant Attorney General Mark Petrosian of the New York Attorney General's Office. The demand letter seeks detailed information regarding the breach, Quorum's incident response, and Quorum's vendor management practices. Quorum's response to the joint demand letter is due on October 13, 2023.
The Palomar negotiation and the multistate AG response are strategically intertwined. Demonstrating robust vendor accountability in the AG response will strengthen Quorum's position with regulators and reduce the likelihood of an enforcement action or consent order. A settlement with Palomar that includes meaningful financial recovery and enhanced security commitments can be presented to the attorneys general as evidence of Quorum's diligent and proactive response to the vendor-originated breach. Specifically, the AG response can highlight: (i) that Quorum held its vendor financially accountable through an indemnification claim and achieved substantial cost recovery; (ii) that Quorum required its vendor to implement enhanced security measures, including a shortened patching window, endpoint detection and response technology, and quarterly vulnerability scanning; and (iii) that these commitments were formalized in a binding MSA amendment.
Timing Implication: Ideally, the Palomar negotiation should be concluded before or contemporaneously with the submission of the multistate AG response on October 13, 2023, in order to maximize the narrative value of the settlement. If a final agreement cannot be reached by that date, Quorum should at minimum be in a position to report that substantive settlement discussions are underway and that Quorum has demanded enhanced security commitments from its vendor. The target resolution date of mid-to-late October 2023 (discussed further in Section VI.C below) is designed to align with this regulatory timeline.
E. Potential Litigation Risk
If settlement negotiations with Palomar are unsuccessful, Quorum retains the option of pursuing breach of contract litigation (or arbitration, depending on the MSA's dispute resolution clause) against Palomar. A preliminary review of the MSA's dispute resolution provisions indicates that the agreement may contain an arbitration clause and/or a forum selection clause; we are in the process of confirming the specific terms and will advise accordingly.
In the event of formal dispute resolution, Quorum would be well-positioned on liability given the strength of the contractual breach evidence and the forensic findings. However, litigation or arbitration would entail several risks and costs:
• Time and Expense: Formal dispute resolution proceedings would likely take twelve to eighteen months to reach a resolution and would involve substantial additional legal costs, including costs associated with discovery, expert testimony, briefing, and the hearing or trial.
• Damages Scope Risk: While Quorum would likely prevail on the question of liability, there is execution risk on the scope of damages. A neutral decision-maker might exclude or reduce certain cost categories, particularly Quorum's internal costs and a portion of the legal fees, which could reduce the ultimate recovery below the target settlement range.
• Relationship Impact: Initiating formal dispute resolution proceedings would almost certainly make the vendor relationship untenable, requiring Quorum to develop and execute a transition plan to migrate claims processing to an alternative vendor — a process that, as discussed above, would be costly and operationally disruptive.
• Public Exposure: Depending on the forum and the applicable confidentiality protections, litigation could result in the public disclosure of details regarding the breach that Quorum would prefer to keep confidential, including the specific categories of data compromised and the number of affected individuals.
Recommendation: Litigation or arbitration is a credible threat that should be deployed in negotiations to underscore the seriousness of Quorum's position and the consequences of Palomar's failure to make an adequate settlement offer. However, formal dispute resolution should be treated as a last resort rather than a preferred course of action. If a reasonable settlement can be achieved within the target range described in Section VI below, a negotiated resolution will be more efficient, less costly, and better aligned with Quorum's commercial interests.
VI. Recommended Negotiation Strategy
Based on the legal analysis and strategic considerations set forth above, we recommend the following negotiation strategy for the Palomar indemnification claim.
A. Target Settlement Range
The settlement parameters should be defined as follows:
Opening Demand Position: Maintain the $8,230,250 full indemnification demand as the anchor. The opening position should not be reduced prior to the first substantive negotiation session. The strength of Quorum's legal position supports the full demand as a reasonable and defensible starting point, and the initial demand serves as an important anchor that will influence the trajectory of the negotiation.
Target Resolution Range: $5,500,000 to $7,000,000 in total effective value, structured as a combination of direct cash payment and fee concessions over the remaining MSA term. This range represents approximately 67% to 85% of Quorum's total documented costs. We believe this range represents a strong and achievable outcome given the strength of Quorum's position but appropriately reflects the practical realities of negotiation (including the litigation discount, the value of relationship preservation, and Palomar's willingness to negotiate) and the economic benefit of a prompt resolution.
Floor / Walk-Away Threshold: $4,500,000 in total effective value. Below this threshold, we recommend that Quorum decline the settlement offer and proceed to formal dispute resolution under the MSA. A recovery below $4,500,000 (approximately 54.7% of total costs) would not adequately compensate Quorum for its documented losses and would signal to Palomar that contractual non-compliance carries limited financial consequences — a message that is both commercially and regulatorily undesirable.
Rationale: The target range of $5,500,000 to $7,000,000 is calibrated to achieve a substantial recovery that reflects the strength of Quorum's legal position while recognizing that negotiated resolutions typically involve some degree of discount relative to the full demand. This range is supportable by the legal analysis, the forensic evidence, and the commercial dynamics described in this memorandum. It also accounts for the strategic value of a prompt resolution that can be presented to the multistate attorneys general as evidence of Quorum's diligent vendor accountability efforts.
B. Recommended Deal Structure
We recommend structuring the settlement as a multi-component package that includes a direct cash payment, fee concessions, and enhanced security commitments. This structure maximizes the total effective value to Quorum while providing Palomar with some flexibility in how it satisfies its financial obligations. The recommended components are as follows:
1. Cash Payment. Seek a direct cash payment in the range of $4,000,000 to $5,000,000, payable within thirty (30) days of the execution of the settlement agreement. The cash payment component is the most important element of the deal structure and should be the primary focus of negotiation. A cash payment of this magnitude ensures that Quorum recovers a substantial portion of its out-of-pocket costs in a prompt and certain manner. The thirty-day payment timeline provides Quorum with near-term liquidity and avoids the uncertainty associated with deferred payment arrangements.
2. Fee Reduction. Negotiate a temporary reduction in the annual contract value for a period of twelve to eighteen months, yielding an additional $1,500,000 to $2,900,000 in economic value to Quorum. The specific parameters we recommend pursuing are as follows:
• At the low end of the range: an 8% reduction in the ACV ($16.3M × 8% = $1,304,000 per year) for a period of 18 months, yielding approximately $1,956,000 in total fee savings.
• At the high end of the range: a 10% reduction in the ACV ($16.3M × 10% = $1,630,000 per year) for a period of 18 months, yielding approximately $2,445,000 in total fee savings.
The fee reduction component offers two advantages. First, it provides Quorum with ongoing economic benefit over the remaining MSA term, effectively reducing the cost of the vendor relationship during a period in which Palomar is rebuilding trust with Quorum. Second, it provides Palomar with an alternative to a larger lump-sum cash payment, which may be more palatable to Palomar from a cash-flow and financial reporting perspective. The combination of cash payment and fee reduction is designed to reach the target total effective value range of $5,500,000 to $7,000,000.
3. Enhanced Security Commitments (Non-Monetary). In addition to the monetary components of the settlement, we recommend that Quorum require Palomar to implement the following enhanced security measures:
(a) Independent Third-Party Security Assessment: Require Palomar to engage, at Palomar's sole expense, an independent third-party security assessor to conduct enhanced annual security audits of Palomar's environment, with complete audit reports provided directly to Quorum. This assessment would be in addition to, and not a replacement for, the SOC 2 Type II audit requirement established by Amendment 2.
(b) Enhanced Patch Management: Reduce the patching window for critical vulnerabilities from thirty (30) days to fourteen (14) days from the date of vendor patch release. This shortened timeline directly addresses the specific vulnerability management failure that enabled the CVE-2023-0669 exploitation and provides Quorum with stronger contractual protections against similar incidents in the future.
(c) Endpoint Detection and Response (EDR) Technology: Require Palomar to deploy enterprise-grade endpoint detection and response technology across all systems that process, store, or transmit Quorum data within ninety (90) days of the execution of Amendment 3. EDR technology provides enhanced threat detection and response capabilities that would improve Palomar's ability to identify and contain future intrusions in a timely manner.
(d) Quarterly Vulnerability Scanning: Require Palomar to conduct quarterly vulnerability scans of all systems that process, store, or transmit Quorum data, with scan results and remediation reports provided to Quorum within fifteen (15) business days of each scan.
(e) Reduced Breach Notification Window: Reduce the breach notification window from forty-eight (48) hours to twenty-four (24) hours following Palomar's discovery of any security incident affecting or potentially affecting Quorum data. This modification addresses the late notification that occurred in connection with the current incident and ensures that Quorum receives prompt notice of any future security events.
These enhanced security commitments serve dual purposes: they reduce the prospective risk of a similar incident during the remaining MSA term and they demonstrate to regulators that Quorum has taken concrete steps to strengthen its vendor security posture in response to the breach.
4. MSA Amendment 3. All enhanced security commitments should be codified in a formal third amendment to the MSA ("Amendment 3"). Formalizing these commitments in a contractual amendment — rather than relying on informal assurances or side letters — ensures enforceability and provides a clear baseline against which Palomar's compliance can be measured.
5. Mutual Release. The settlement should include an exchange of mutual releases of all claims related to the April 2023 data breach incident, subject to the following carve-outs:
(a) Obligations arising under the settlement agreement itself, including the cash payment and fee reduction obligations;
(b) Obligations arising under MSA Amendment 3, including all enhanced security commitments;
(c) All ongoing obligations under the MSA that are unrelated to the specific claims being released;
(d) Any carve-out necessary to preserve Atlas Mutual Insurance Company's subrogation rights, as discussed in Section V.C above.
C. Negotiation Tactics
The following tactical recommendations are designed to guide the conduct of settlement negotiations with Palomar's counsel:
Initial Session. Open with a firm reiteration of the $8,230,250 demand in a face-to-face or video meeting between Kevin Ostrowski and Catherine Langford. The initial session should be used to set the tone for the negotiation, demonstrate the seriousness of Quorum's position, and begin the process of educating Palomar's counsel on the strength of Quorum's factual and legal position.
Presentation of Forensic Findings. During the initial session or a follow-up session, present key forensic findings from the Graystone report at an appropriate level of detail. The presentation should emphasize the specific vulnerability exploited (CVE-2023-0669), the availability of the patch prior to the exploitation, the timeline of unauthorized access, and the direct causal chain from the unpatched appliance to the data compromise. The presentation of forensic findings should be calibrated to reinforce the strength of Quorum's evidentiary position without waiving privilege over the full Graystone report. We recommend preparing a summary of key findings for use in the negotiation that is designated as settlement communication and protected by Federal Rule of Evidence 408 (or its state-law equivalent).
Termination Leverage. Emphasize the alternative: termination for cause under MSA Section 14.2, with the associated revenue loss to Palomar of approximately $16.3 million per year. This message should be conveyed clearly but not as an ultimatum in the initial sessions. The goal is to ensure that Palomar's decision-makers understand that the status quo is not an option — either Palomar will make a meaningful settlement offer, or Quorum will exercise its contractual right to terminate the relationship and pursue formal dispute resolution.
Structured Resolution Signal. Signal willingness to accept a structured resolution — combining a cash payment with fee concessions and enhanced security commitments — rather than insisting on a single lump-sum payment. This flexibility gives Palomar a path to a resolution that may be more manageable from a financial and operational perspective, while enabling Quorum to achieve its target total effective value. The signal should be timed to coincide with Palomar's initial engagement with the substance of the negotiation, after the demand anchor has been firmly established.
Escalation. If Palomar's initial counteroffers remain in the $1,500,000 to $2,500,000 range, escalate by sharing (with appropriate privilege protections) specific Graystone findings regarding the unpatched appliance and the exfiltration timeline. At this stage, we may also consider providing Palomar with a more detailed breakdown of Quorum's costs, with supporting documentation, to demonstrate the reasonableness and documentation of each cost category. The escalation should also include a more explicit discussion of the litigation alternative and its consequences for the vendor relationship.
Target Resolution Date. Set a target resolution date of mid-to-late October 2023 to align with the multistate AG response timeline. The target date should be communicated to Palomar's counsel early in the negotiation process to establish a sense of urgency and to ensure that both parties are working toward a defined timeline. If the target date cannot be met, Quorum should at minimum be able to report to the attorneys general that substantive settlement discussions are underway.
D. Coordination Requirements
The successful execution of this negotiation strategy requires coordination across several internal and external stakeholders. The following coordination activities should be completed before or during the negotiation:
1. Commercial and Operational Coordination: Coordinate with Thomas R. Whitfield (General Counsel) and Priya Deshmukh (VP, Vendor Risk Management) on the commercial terms and operational implications of the proposed settlement, including the fee reduction parameters and the enhanced security requirements. Ms. Deshmukh's team should assess the operational feasibility of the proposed enhanced security commitments and identify any potential implementation challenges that should be addressed in the negotiation.
2. Technical Security Coordination: Coordinate with David Naranjo (Chief Information Security Officer) on the technical adequacy of the proposed enhanced security commitments, including the shortened patching window, EDR deployment, and quarterly vulnerability scanning requirements. Mr. Naranjo's input will ensure that the enhanced security commitments are technically sound and will meaningfully reduce Quorum's prospective risk.
3. Insurance Coordination: Coordinate with Sandra Whitmore-Kim (Whitmore Risk Advisors) and Paul Enriquez (Atlas Mutual Insurance Company) regarding insurance subrogation rights and recovery allocation. As discussed in Section V.C, the settlement must be structured to preserve Atlas's subrogation rights, and any necessary consent from Atlas must be obtained before the settlement is finalized.
4. Executive Authorization: Obtain sign-off from Margaret D. Calloway (CEO) or her designee for any settlement above $3,000,000, or as otherwise required by Quorum's internal authorization matrix. Given the magnitude of the settlement parameters described in this memorandum, executive-level authorization will be required before Quorum can commit to final terms.
5. Board Briefing: Brief Franklin Reeves (Board Chair, Audit Committee) on settlement parameters, consistent with Quorum's Board reporting obligations. The Board Audit Committee should be apprised of the negotiation strategy, the target settlement range, and the key risk factors identified in this memorandum.
VII. Risk Assessment Summary
The following table summarizes the key risk factors that inform the recommended negotiation strategy, together with our assessment of each factor and its likely impact on the outcome.
VIII. Recommended Next Steps
Based on the analysis and recommendations set forth in this memorandum, we recommend the following next steps, organized by target timing:
1. Week of September 4, 2023: Schedule a call with Thomas R. Whitfield and Priya Deshmukh to confirm commercial parameters, internal authorization thresholds, and any operational constraints that should be factored into the negotiation. This call should also address Ms. Deshmukh's assessment of the feasibility of the proposed enhanced security commitments from a vendor management perspective.
2. Week of September 4–8, 2023: Coordinate with Sandra Whitmore-Kim (Whitmore Risk Advisors) and Paul Enriquez (Atlas Mutual Insurance Company) regarding Atlas's subrogation position and any settlement consent requirements under the cyber insurance policy. This coordination should be completed before the first substantive negotiation session with Palomar's counsel.
3. Week of September 11–15, 2023: Schedule the initial settlement negotiation session with Catherine Langford at Mercer, Haight & Dunlop LLP. The session should be structured as a face-to-face or video meeting between Kevin Ostrowski and Catherine Langford, with Alan Burke attending in a supporting role. The agenda for the initial session should include: (i) reiteration of Quorum's demand; (ii) presentation of key forensic findings (at an appropriate level of detail); and (iii) discussion of the framework for a potential structured resolution.
4. Concurrent with Step 3: Prepare detailed negotiation materials, including a damages summary with supporting documentation for each cost category, a timeline of key events and Palomar's contractual obligations, and a draft term sheet for use once substantive agreement in principle is reached.
5. Week of September 11–15, 2023: Brief David Naranjo (CISO) on the proposed enhanced security commitments — including the fourteen-day patching window, EDR deployment, quarterly vulnerability scanning, and twenty-four-hour notification requirement — to confirm their technical adequacy and identify any refinements that should be made before the commitments are proposed to Palomar.
6. Target: Mid-to-Late October 2023: Conclude the Palomar negotiation and reach agreement in principle, timed to support the multistate AG response narrative. If a final agreement cannot be reached by this date, Quorum should at minimum be in a position to report substantive progress in the AG response.
7. Upon Reaching Agreement in Principle: Prepare the following documents for review and execution:
(a) Settlement Agreement and Mutual Release, incorporating the cash payment, fee reduction, and mutual release provisions;
(b) MSA Amendment 3, codifying all enhanced security commitments;
(c) Summary memorandum to Thomas R. Whitfield and Margaret D. Calloway confirming the terms of the settlement and requesting final executive authorization for execution;
(d) Updated Board Audit Committee briefing for Franklin Reeves, summarizing the settlement terms and the rationale for the recommended resolution.
IX. Conclusion
Quorum Insurance Holdings Corp. holds a strong legal position in its indemnification claim against Palomar Data Solutions, Inc. The claim rests on documented breaches of the MSA — specifically, Palomar's failure to patch CVE-2023-0669 within the thirt

PRIVILEGED AND CONFIDENTIAL ATTORNEY-CLIENT COMMUNICATION ATTORNEY WORK PRODUCT PREPARED IN ANTICIPATION OF LITIGATION

MEMORANDUM

MATTER NO.: 1025-00006

Record

Parties

Dates

Amounts