PRIVILEGED & CONFIDENTIAL ATTORNEY-CLIENT PRIVILEGED / ATTORNEY WORK PRODUCT

PRIVILEGED & CONFIDENTIAL ATTORNEY-CLIENT PRIVILEGED / ATTORNEY WORK PRODUCT
INTERNAL C&H ANNOTATED COPY — DO NOT DISTRIBUTE
Calderwood & Harkness Matter No. 1025-00006 Annotation Legend: KO = Kevin Ostrowski; AB = Alan Burke Date Annotations Added: July 10, 2023
MERCER, HAIGHT & DUNLOP LLP 2100 Ross Avenue, Suite 3600 Dallas, Texas 75201
Catherine Langford Partner Direct: (214) 555-8142
Email: clangford@mhdlaw.com
July 7, 2023
VIA EMAIL AND OVERNIGHT DELIVERY
Kevin Ostrowski, Esq. Partner Calderwood & Harkness LLP 1700 K Street NW, Suite 900 Washington, D.C. 20006
Re: Response to June 20, 2023 Demand Letter on Behalf of Quorum Insurance Holdings Corp. — Security Incident Involving Palomar Data Solutions, Inc.
Dear Mr. Ostrowski:
I. OPENING / INTRODUCTION
This firm represents Palomar Data Solutions, Inc. ("Palomar") in connection with the above-referenced matter. We write in response to your letter dated June 20, 2023, submitted on behalf of your client, Quorum Insurance Holdings Corp. ("Quorum"), regarding the data security incident that was first identified in April 2023 (the "Incident").
At the outset, Palomar expressly reserves all of its rights, defenses, and claims under the Master Services Agreement between Palomar and Quorum dated November 12, 2019, as amended by Amendment 1, dated June 3, 2021, and Amendment 2, dated September 15, 2022 (collectively, the "MSA"), as well as all rights, defenses, and claims available to Palomar at law and in equity. Nothing in this letter shall be construed as a waiver or relinquishment of any such right, defense, or claim, and Palomar's response herein is provided without prejudice to any of those rights.
Palomar takes the Incident seriously. Since the discovery of the anomalous activity described in further detail below, Palomar has cooperated fully and transparently with Quorum throughout the investigation process, including by providing timely access to its systems, logs, and personnel, and by coordinating closely with Quorum's information security team and the third-party forensic consultants retained by Quorum's counsel. Palomar deeply regrets any disruption or concern that the Incident has caused to Quorum, its policyholders, and other affected stakeholders.
However, while Palomar acknowledges the gravity of the situation, Palomar respectfully disagrees with a number of the factual characterizations and legal conclusions set forth in your June 20, 2023 demand letter. In particular, Palomar does not accept Quorum's characterization of Palomar's conduct as constituting a material breach of the MSA, and Palomar does not agree that Quorum's indemnification demand of $8,230,250 is supported by the terms of the agreement or by the facts as they have developed through the investigation. The grounds for these positions are set forth below.
> [C&H ANNOTATION – KO]: Note the reservation of rights language but also the cooperative posture. They are leaving the door open for negotiation. The "without prejudice" language is standard boilerplate and does not, by itself, strengthen any of their substantive defenses. However, their express acknowledgment of "full and transparent" cooperation during the investigation phase is noteworthy and potentially useful to us. If this matter proceeds to litigation or arbitration, Palomar will not be able to credibly argue that it was adversarial or that it withheld cooperation during the post-Incident investigation — they have now characterized themselves as having cooperated "fully." This admission should be preserved for potential use in establishing the factual timeline and in rebutting any future argument that Palomar lacked access to relevant information during the response period. Additionally, the fact that they have characterized the cooperation as "timely" should not be allowed to bleed into the separate question of whether the initial notification was timely under Section 9.4 of the MSA — those are distinct issues, and we should keep them distinct in our rebuttal.
II. FACTUAL BACKGROUND
A. Nature of the Attack
The Incident resulted from a sophisticated, state-of-the-art cyber-attack perpetrated by a highly capable and well-resourced threat actor. Based on the information developed through both Palomar's internal investigation and the forensic investigation conducted by Graystone Forensics LLC ("Graystone"), the threat actor exploited a critical remote code execution vulnerability identified as CVE-2023-0669, which affected the GoAnywhere MFT file transfer platform deployed within Palomar's managed file transfer environment.
CVE-2023-0669 was classified as a zero-day vulnerability at the time of its initial public disclosure. It is now widely recognized that this vulnerability was rapidly weaponized by advanced and persistent threat actors as part of a coordinated, large-scale campaign that affected hundreds of organizations worldwide, spanning diverse industries including financial services, healthcare, government, and technology. Palomar was one of many organizations targeted in this global campaign. The scope and scale of the attack — involving threat actors of considerable sophistication who demonstrated the ability to move quickly across compromised environments — is well-documented in public reporting by the Cybersecurity and Infrastructure Security Agency (CISA), the Federal Bureau of Investigation (FBI), and leading private-sector cybersecurity firms.
Palomar's information security team was actively monitoring vendor advisories and threat intelligence feeds during the relevant period. Upon the public disclosure of CVE-2023-0669 and the subsequent release of a vendor patch by Severin Corporation (the developer of GoAnywhere MFT), Palomar's security operations team promptly initiated its standard change management process for the evaluation, testing, and deployment of the patch across Palomar's production environment. This change management process is consistent with industry-standard practices for enterprise environments, which require testing of security patches in a controlled staging environment before deployment to production systems to avoid unintended disruptions to critical business operations. The exploitation of CVE-2023-0669 by the threat actor occurred while Palomar was actively engaged in this testing and deployment process.
The data exfiltration was conducted through encrypted channels specifically designed by the threat actor to evade standard network-based detection mechanisms, including Palomar's deployed intrusion detection and prevention systems. The use of encrypted exfiltration channels by advanced threat actors is a well-known tactic that poses significant detection challenges even for organizations with mature and well-funded security programs.
> [C&H ANNOTATION – AB]: Several factual weaknesses in this section require careful attention. > > First, and most critically, CVE-2023-0669 was publicly disclosed and a vendor patch was made available by Severin Corporation in early February 2023. The initial unauthorized access to Palomar's network — as confirmed by the Graystone forensic analysis — occurred on March 14, 2023. This means that approximately five to six weeks elapsed between the availability of the vendor patch and the date on which the threat actor first exploited the vulnerability in Palomar's environment. Under Exhibit D of the MSA (as specifically amended by Amendment 2, dated September 15, 2022), Palomar was contractually obligated to apply patches for critical vulnerabilities — defined as vulnerabilities with a CVSS score of 9.0 or above, which CVE-2023-0669 clearly meets — within thirty (30) calendar days of the vendor making a patch available. Even accepting Palomar's characterization of its "standard change management process" at face value, the patch window was exceeded by approximately one to two weeks before the exploitation occurred. This is a clear and documented MSA breach, and Palomar's narrative about its "active" testing process does not excuse the failure to meet the contractual deadline. > > Second, the characterization of CVE-2023-0669 as a "zero-day" requires qualification. While the vulnerability may have initially been exploited before public disclosure, by the time of the exploitation of Palomar's environment in mid-March 2023, both the vulnerability and the patch had been public for over a month. Referring to it as a zero-day in the context of this timeline is misleading. > > Third, the argument about "encrypted channels" designed to "evade standard detection mechanisms" may actually undercut Palomar's position rather than support it. If Palomar's detection mechanisms were unable to identify encrypted exfiltration, this raises questions about the adequacy of Palomar's network monitoring and data loss prevention capabilities relative to the "commercially reasonable" standard in Exhibit D. Modern DLP and network monitoring solutions are capable of detecting anomalous encrypted outbound traffic patterns even when the content itself is encrypted.
> [C&H ANNOTATION – KO]: The "sophisticated attack" and "hundreds of organizations worldwide" framing is a classic defense-side tactic designed to normalize the security failure and shift the narrative from Palomar's specific contractual obligations to a broader story about an industry-wide catastrophe. While it is true that CVE-2023-0669 was widely exploited across many organizations, the relevant question for purposes of this matter is not whether the attack was sophisticated in the abstract, but whether Palomar met its specific contractual security obligations under the MSA — in particular, the 30-day critical patching requirement in Exhibit D. The MSA does not contain a "sophisticated attacker" carve-out, a force majeure provision that covers cyber-attacks, or any other exception to the patching obligation based on the nature or capability of the threat actor. We should obtain the precise date on which Severin Corporation released the patch for CVE-2023-0669 — this is publicly available information, and we believe it was February 7, 2023 — and construct a clear, date-specific timeline showing the gap between patch availability, the contractual 30-day deadline, and the date of initial exploitation. This timeline will be the centerpiece of our rebuttal on this point.
B. Timeline of discovery and Notification
Palomar's Security Operations Center ("SOC") first identified anomalous outbound data transfer patterns on April 18, 2023, during the course of routine network monitoring. Upon detecting this activity, the SOC immediately initiated containment procedures, including isolation of the affected GoAnywhere MFT systems, revocation of compromised credentials, and blocking of the identified exfiltration endpoints at the network perimeter.
Palomar simultaneously engaged its internal incident response team and commenced a preliminary investigation to determine the nature, scope, and potential impact of the anomalous activity. This initial investigation was necessary to confirm that the activity constituted a security incident as defined under the MSA and to develop a preliminary understanding of the data sets potentially affected, so that Palomar could provide Quorum with actionable and accurate information upon notification rather than a premature and potentially misleading alert.
Palomar notified Quorum of the Incident on April 21, 2023, via email communication from Derek Copeland, General Counsel of Palomar, to Thomas R. Whitfield, General Counsel of Quorum, and David Naranjo, Chief Information Security Officer of Quorum. That notification identified the nature of the suspected security incident, the systems potentially affected, the preliminary scope of the data exposure, and the containment measures already undertaken by Palomar. Palomar submits that this notification was prompt and was provided within a commercially reasonable timeframe, taking into account the need to confirm the nature and scope of the Incident before providing notification to avoid causing unnecessary alarm or diverting resources based on unconfirmed or inaccurate information.
Following the initial notification, Palomar continued to provide Quorum with regular updates and access to its investigation findings, including daily status calls during the first two weeks following notification and weekly updates thereafter. Palomar has at all times acted in good faith and in the interest of both parties in managing the response to the Incident.
> [C&H ANNOTATION – AB]: The notification timeline is a second clear and independent breach of the MSA. Section 9.4 of the MSA states, in relevant part: > > "Service Provider shall notify Client in writing within forty-eight (48) hours of discovery of any Security Incident that affects or reasonably may affect Client Data. Such notification shall include, to the extent then known, the nature of the Security Incident, the categories and approximate number of data records affected, and the measures taken or proposed to be taken to address the Security Incident." > > Palomar discovered the anomalous activity on April 18, 2023. Under the plain language of Section 9.4, notification was due no later than April 20, 2023 (i.e., 48 hours after discovery). Palomar did not notify Quorum until April 21, 2023 — approximately seventy-two (72) hours after discovery, and approximately twenty-four (24) hours past the contractual deadline. > > Palomar's justification — that it needed to "confirm the nature and scope" of the Incident before notifying Quorum — is inconsistent with the contractual language. Section 9.4 requires notification upon "Discovery" of a Security Incident, not upon "confirmation" of the scope of a Security Incident. Moreover, the contractual provision expressly contemplates that the notification may be based on information that is preliminary and incomplete, as evidenced by the qualifying language "to the extent then known." This qualification demonstrates that the MSA drafters intended notification to occur promptly upon discovery, even if the full scope of the Incident was not yet understood. > > The practical consequence of this twenty-four-hour delay is significant. Had Quorum been notified within the contractual window, Quorum's own information security team and Quorum's counsel could have begun their own parallel response activities — including retention of Graystone Forensics — at an earlier stage, potentially reducing the scope of the data exposure and certainly enabling earlier regulatory notification preparation. The delay, even if characterized by Palomar as relatively modest, deprived Quorum of the ability to exercise its own judgment about the appropriate response at the earliest possible time.
> [C&H ANNOTATION – KO]: Fully agreed with AB's analysis. I would add one additional observation: Palomar's letter does not dispute the factual predicate of our late-notification argument. Palomar does not claim that it discovered the anomalous activity on a date later than April 18, 2023, or that it notified Quorum on a date earlier than April 21, 2023. Palomar accepts the dates but attempts to recharacterize the significance of the timeline. This is, in effect, an implicit admission of the factual basis for our argument that notification was untimely under Section 9.4. We should pin this admission down firmly in our rebuttal by noting that Palomar's own letter acknowledges the April 18 discovery date and the April 21 notification date, and by demonstrating that the 72-hour gap exceeds the 48-hour contractual requirement by a full day. This point should be stated plainly and without embellishment — the facts speak for themselves.
C. Palomar's Remediation Efforts
Following the Incident, Palomar took immediate and comprehensive remediation measures to address the vulnerability, contain the impact, and strengthen its security posture. These measures include, but are not limited to, the following:
1.  Patching of the GoAnywhere MFT Vulnerability. Palomar immediately applied the vendor patch for CVE-2023-0669 across all GoAnywhere MFT instances in Palomar's production, staging, and development environments. The patch was fully deployed within twenty-four (24) hours of the SOC's initial detection of the anomalous activity.
2.  Network Segmentation Enhancements. Palomar implemented enhanced network segmentation controls to isolate its managed file transfer environment from other segments of its internal network, reducing the potential blast radius of any future security incident affecting file transfer systems.
3.  Deployment of Additional Endpoint Detection and Response (EDR) Tools. Palomar deployed additional EDR capabilities across its server infrastructure, including enhanced behavioral analysis and real-time threat detection on all systems involved in the processing, storage, or transmission of client data.
4.  Independent Security Assessment. Palomar engaged an independent cybersecurity firm to conduct a comprehensive security assessment of Palomar's infrastructure, controls, and processes, including a focused review of the managed file transfer environment and related data handling workflows.
5.  Enhanced Monitoring and Logging. Palomar implemented enhanced monitoring and logging for all file transfer activities, including real-time alerting on anomalous data transfer volumes, unusual destination endpoints, and encrypted outbound connections to unrecognized external addresses.
6.  Patch Management Program Review. Palomar initiated a comprehensive review and update of its enterprise-wide patch management program, including the development of accelerated patching procedures for critical and high-severity vulnerabilities in internet-facing and data-handling systems.
Palomar wishes to emphasize the extent of its cooperation with Quorum and with Graystone Forensics LLC, the forensic investigation firm retained by Quorum's counsel, throughout the investigation. Palomar has provided full and timely access to its systems, network logs, security event data, personnel, and documentation. Palomar has also cooperated with the regulatory notification and compliance processes undertaken by Quorum.
In addition to its cooperation with Quorum, Palomar has invested significant internal resources in responding to the Incident, including the dedication of substantial engineering, information security, legal, and executive time to containment, investigation, remediation, and coordination efforts. Palomar estimates that its own internal costs in responding to the Incident exceed $2,000,000 to date, exclusive of the costs of the independent security assessment and other third-party engagements. Palomar notes these costs not to diminish the impact on Quorum, but to underscore the seriousness with which Palomar has treated this matter and the extent of its commitment to remediation.
> [C&H ANNOTATION – AB]: The remediation measures described in this section are helpful context, but they do not address the core liability question — and in several respects, they actually undermine Palomar's defense. The fact that Palomar found it necessary to (a) implement enhanced network segmentation, (b) deploy additional EDR tools, (c) conduct a comprehensive review of its patch management program, and (d) enhance its monitoring and logging capabilities is, if anything, an implicit acknowledgment that these measures were inadequate or incomplete before the breach occurred. If Palomar's pre-Incident security posture had been sufficient — i.e., if it had met the "commercially reasonable safeguards" standard required under Exhibit D and the specific control requirements set forth therein — these post-Incident remediation measures would not have been necessary. We should use Palomar's own remediation list affirmatively in our rebuttal to bolster our argument that Palomar's pre-Incident security posture was deficient. Each remediation item can be mapped to a corresponding pre-Incident deficiency.
> [C&H ANNOTATION – KO]: Two additional observations. First, Palomar references the engagement of "an independent cybersecurity firm" but conspicuously does not identify the firm by name, nor does it describe the scope or conclusions of the assessment. We should formally request the identity of this firm and the scope of the engagement, as well as any resulting report or findings, in connection with the indemnification negotiation. If Palomar resists disclosure, the engagement and any resulting report may be discoverable in litigation or arbitration. Second, the reference to $2,000,000 in Palomar's own internal costs is noteworthy. This is almost certainly an attempt to position Palomar as a fellow victim of the attack and to generate sympathy in the context of settlement negotiations. However, Palomar's own remediation costs are irrelevant to the contractual indemnification analysis under Section 12.2 of the MSA. The indemnification obligation is not reduced by the indemnitor's own costs in addressing the breach. We should not engage with this point in our rebuttal except to note its irrelevance, and we should not allow it to influence the settlement calculus.
III. LEGAL DEFENSES
A. Causation
Palomar respectfully submits that the proximate cause of the data exfiltration was the criminal conduct of the threat actor, not any act or omission by Palomar. The threat actor deliberately targeted Palomar's GoAnywhere MFT environment using a sophisticated exploit that was specifically designed to bypass security controls. The criminal and intentional nature of the attack was the predominant causal factor in the Incident.
Moreover, Palomar contends that even had the vendor patch for CVE-2023-0669 been applied within the thirty-day window referenced in Exhibit D of the MSA, there is no assurance that the threat actor would not have exploited alternative attack vectors to achieve its objectives. Advanced persistent threat actors of the type responsible for this campaign are known to maintain multiple exploitation capabilities and to pivot to alternative methods when their primary attack vector is unavailable. The assumption that patching CVE-2023-0669 alone would have prevented the Incident is speculative and unsupported by the available forensic evidence.
Palomar further notes that the "commercially reasonable" security safeguards standard set forth in Exhibit D of the MSA does not require absolute security and cannot be construed as a guarantee that all cyber-attacks will be prevented. No security program, regardless of its sophistication or investment level, can guarantee the prevention of all unauthorized access. Industry statistics consistently demonstrate that organizations with mature, well-funded, and highly regarded security programs are nevertheless victimized by successful cyber-attacks on a regular basis. The occurrence of a security incident, standing alone, does not establish that the affected organization's security controls were inadequate.
In this regard, Palomar notes that the indemnification provision set forth in Section 12.2 of the MSA requires Quorum to establish that its claimed losses "arose from" Palomar's breach of its data security obligations under Exhibit D. Palomar submits that Quorum has not established, and cannot establish, the necessary causal nexus between any alleged deviation from the Exhibit D requirements and the losses claimed by Quorum. The Incident was caused by a criminal actor, not by Palomar.
> [C&H ANNOTATION – KO]: This is the weakest section of Palomar's entire response, and it should be the primary focus of our rebuttal. > > The causation argument essentially concedes the underlying patching failure while attempting to sever the causal link between that failure and the resulting breach. This concession-by-implication is significant. Palomar does not argue that it met the 30-day patching requirement — it argues instead that even if it did not, the failure did not "cause" the breach. This is an untenable position on the facts. > > The Graystone Final Forensic Report, which we expect to receive in final form around July 14, 2023, will confirm — as Graystone's preliminary findings have already indicated — that the threat actor exploited CVE-2023-0669 as the initial access vector into Palomar's environment. This was the entry point. It was not one of several potential entry points; it was the entry point. If the vulnerability had been patched within 30 days of vendor patch availability, as required by Exhibit D, the specific exploit used by the threat actor would not have been available. The threat actor would have been unable to gain initial access through this vector. Full stop. > > The "alternative attack vector" argument is entirely speculative. There is no forensic evidence that the threat actor had or used any alternative means of access to Palomar's environment. Palomar is asking Quorum — and, implicitly, any future arbitrator or court — to speculate that the threat actor might have found another way in. This is not a legally cognizable defense. Under well-established principles of causation, a defendant cannot defeat a but-for causation showing by speculating about hypothetical alternative causes that were not, in fact, operative.
> [C&H ANNOTATION – AB]: On the "commercially reasonable" standard: Palomar is attempting to conflate the general security standard with the specific patching obligation in Exhibit D. These are distinct requirements. Exhibit D (as amended by Amendment 2, dated September 15, 2022) contains both (a) a general requirement to maintain "commercially reasonable administrative, technical, and physical safeguards" for the protection of Quorum data, and (b) a series of specific, enumerated security requirements, including the requirement to apply patches for critical vulnerabilities (CVSS 9.0+) within thirty (30) calendar days of vendor patch availability. The specific patching obligation is not merely an illustration or exemplification of the general "commercially reasonable" standard — it is a separate, specific contractual requirement with a defined compliance timeline. The relevant standard for the patching claim is the specific 30-day requirement, not the general "commercially reasonable" standard. Palomar's argument about the impossibility of "absolute security" is a straw man: Quorum is not claiming that Palomar guaranteed absolute security; Quorum is claiming that Palomar failed to meet a specific, defined patching obligation within a specific, defined timeframe. The MSA drafters anticipated exactly this scenario by including the specific patching timeline requirement, which was added in Amendment 2 in September 2022 — notably, just six months before the vulnerability was disclosed.
> [C&H ANNOTATION – KO]: On the "arose from" causation language in Section 12.2: Palomar's attempt to impose a strict proximate causation requirement is inconsistent with the governing law. Under Delaware law — which governs the MSA pursuant to the choice-of-law provision in Section 18.1 — the phrase "arising from" is broadly construed and encompasses a wider range of causal relationships than phrases such as "caused by," "resulting directly from," or "proximately caused by." Delaware courts have consistently held that "arising from" requires only that the claimed loss have a substantial nexus to or connection with the referenced event or obligation, rather than a strict proximate causal relationship. See, e.g., Certain Underwriters at Lloyd's, London v. Chemtura Corp., 160 A.3d 457 (Del. 2017) (discussing the breadth of "arising out of" language in indemnification contexts). Palomar's failure to apply the CVE-2023-0669 patch within 30 days was, at a minimum, a but-for cause of the breach through the specific vulnerability — the threat actor exploited the unpatched vulnerability to gain initial access. This but-for causal relationship more than satisfies the "arising from" standard. We should cite the relevant Delaware case law prominently in our rebuttal and draw the distinction between "arising from" and stricter causation formulations.
B. Scope of Liability and Damages
Even assuming, arguendo, that some degree of liability could be attributed to Palomar in connection with the Incident, Palomar respectfully submits that the total damages claimed by Quorum — $8,230,250 in aggregate incident response costs — are excessive and are not all properly attributable to Palomar under the indemnification provision of Section 12.2 of the MSA. Palomar's specific objections to the claimed cost categories are as follows.
Calderwood & Harkness Legal Fees ($2,163,750). Palomar objects to the inclusion of Quorum's outside counsel fees in the indemnification demand. The retention of Calderwood & Harkness LLP was Quorum's own business decision, made for Quorum's own benefit and at Quorum's own discretion. These are Quorum's own counsel costs incurred in connection with Quorum's own legal response to the Incident, and they are not properly characterized as losses "arising from" any act or omission of Palomar. To the extent Quorum seeks to recover the costs of legal counsel, such costs should be limited to legal fees directly related to the forensic investigation and regulatory notification process, not the costs of pursuing an adversarial indemnification claim against Palomar.
BrightPath Consulting Group Crisis Communications Fees ($385,000). Palomar similarly objects to the inclusion of crisis communications consulting fees. The retention of BrightPath Consulting Group was a discretionary business decision by Quorum, driven by Quorum's own assessment of its reputational and stakeholder-management needs. While Palomar understands that public companies may choose to engage crisis communications consultants in connection with security incidents, such engagements are not a necessary or required element of incident response, and the costs thereof should not be shifted to Palomar through the indemnification provision.
Quorum Internal Costs ($620,000). Palomar objects to the inclusion of Quorum's claimed internal costs, which appear to consist primarily of employee overtime, IT remediation efforts, and internal resource allocation. These are general overhead and operating costs of a type that Quorum would bear in any event in the ordinary course of its business operations. The MSA indemnification provision does not contemplate the recovery of a party's own internal operating costs.
With respect to the Graystone Forensics LLC fees ($1,847,000) and the Clearfield Notification Services fees ($3,214,500), Palomar does not at this time dispute the reasonableness of retaining these service providers or the general categories of services provided. However, Palomar reserves the right to challenge the specific amounts claimed upon further review of the supporting documentation.
Finally, Palomar notes that Quorum maintains cyber-insurance coverage through its insurer, Atlas Mutual Insurance Company. To the extent Quorum recovers any portion of its claimed costs from Atlas Mutual under its cyber-insurance policy, Quorum's indemnification claim against Palomar should be reduced by the amount of any such insurance recovery to avoid an impermissible double recovery. It would be inequitable for Quorum to recover the same losses from both its insurer and from Palomar.
> [C&H ANNOTATION – AB]: Palomar's damages arguments are unpersuasive across the board. Addressing each in turn: > > 1. Legal fees. Section 12.2 of the MSA provides, in relevant part, that Palomar shall indemnify and hold harmless Quorum from and against "all losses, damages, costs, and expenses (including reasonable attorneys' fees and costs of investigation) arising from Service Provider's breach of its obligations under this Agreement, including without limitation its data security obligations set forth in Exhibit D." The parenthetical "including reasonable attorneys' fees and costs of investigation" expressly and unambiguously includes attorneys' fees within the scope of indemnifiable losses. Calderwood & Harkness's fees — incurred in connection with investigation, regulatory compliance, forensic coordination, vendor management, and the pursuit of Quorum's contractual remedies — fall squarely within this language. Palomar's attempt to distinguish between "investigation" fees and "adversarial" fees has no basis in the text of the provision. The MSA makes no such distinction. > > 2. Crisis communications. The BrightPath Consulting Group engagement is a reasonable and foreseeable cost of responding to a data breach of this magnitude. The Incident affected 318,247 individuals across 29 states. Quorum is a publicly traded company (Nasdaq: QIHC) with an approximate market capitalization of $6.1 billion. A company of this size, operating in the heavily regulated insurance industry and subject to securities disclosure obligations, would be expected — indeed, in many respects required — to retain professional crisis communications support to manage stakeholder communications, policyholder inquiries, and regulatory interactions. These are not "discretionary" costs in any meaningful sense; they are reasonable mitigation damages that any similarly situated company would incur. Palomar's argument to the contrary reflects a fundamental misunderstanding of the obligations and expectations facing a public insurance holding company in the wake of a significant data breach. > > 3. Internal costs. Quorum's $620,000 in documented internal costs — consisting of IT staff overtime dedicated to remediation and containment, reallocation of engineering resources from other projects, and internal coordination expenses — are directly and exclusively attributable to the Incident. These are not "general overhead" costs that Quorum would have incurred in the ordinary course; they are incremental costs caused specifically by the breach. They are recoverable as "costs and expenses" under the broad language of Section 12.2. > > 4. Double recovery / insurance offset. This argument fails for multiple independent reasons. First, the MSA contains no offset provision requiring Quorum to credit insurance recoveries against Palomar's indemnification obligation. The absence of such a provision is telling — the MSA drafters were sophisticated parties represented by counsel, and if they had intended insurance recoveries to reduce the indemnitor's obligations, they would have included express language to that effect. Second, Quorum's decision to purchase cyber-insurance from Atlas Mutual was made for Quorum's own protection and at Quorum's own expense. Palomar is not a named insured, an additional insured, or a beneficiary under Quorum's cyber-insurance policy. Palomar has no equitable claim to the benefit of insurance coverage that it did not purchase and does not fund. Third, to the extent Atlas Mutual pays on Quorum's claim, Atlas Mutual may — and likely will — pursue subrogation rights against Palomar independently. An insurance offset would effectively allow Palomar to benefit from Quorum's insurance while still being exposed to the insurer's subrogation claim, which is an inequitable result for all parties. Fourth, the "double recovery" characterization is misleading: Quorum's recovery from its insurer and its recovery from Palomar arise from different contractual relationships and serve different purposes.
> [C&H ANNOTATION – KO]: I agree with AB's analysis on all four points. The insurance offset argument is a common negotiating tactic, but it has no foundation in the MSA and is legally unfounded. That said, from a strategic perspective, we should be aware that the insurance recovery question may influence the settlement calculus. Quorum's net out-of-pocket financial exposure after any insurance recovery from Atlas Mutual will affect Quorum's appetite for a protracted negotiation or litigation, and Palomar's counsel may attempt to frame the discussion in terms of Quorum's net exposure rather than Palomar's full indemnification obligation. We should keep the details of Quorum's insurance claim and any Atlas Mutual recovery confidential from Palomar and Mercer, Haight & Dunlop to the maximum extent possible. I recommend reviewing the common interest agreement between Calderwood & Harkness (on behalf of Quorum) and Atlas Mutual to confirm that there are no disclosure obligations or information-sharing requirements that would require Quorum to share insurance recovery information with Palomar. This is a potential vulnerability that we should close.
C. Contributory Negligence and Shared Responsibility
Palomar further submits that, to the extent any liability is attributed to Palomar in connection with the Incident, Quorum bears a share of responsibility for the Incident and its consequences. In particular:
First, Quorum provided certain categories of data to Palomar in formats that were not encrypted at rest at the time of transmission. Palomar contends that the transmission of unencrypted data by Quorum contributed to the scope and severity of the data exfiltration, as the unencrypted data was more readily accessible to the threat actor following the initial compromise of the file transfer environment.
Second, Quorum's own vendor oversight and risk management program did not identify the patching gap during the relevant period between the release of the vendor patch and the exploitation of CVE-2023-0669 in Palomar's environment. Quorum's vendor risk management framework, as described in the MSA, contemplates ongoing monitoring and oversight of Palomar's security practices. Had Quorum exercised its oversight rights more diligently, the patching delay could potentially have been identified and remediated before the exploitation occurred.
Third, Quorum did not conduct its own independent security audit or technical assessment of Palomar's GoAnywhere MFT environment prior to the Incident, despite having the right to do so under the MSA's audit provisions. An independent technical audit might have identified the unpatched vulnerability as a significant risk.
Palomar submits that these factors should be considered in any apportionment of responsibility for the Incident and its consequences, and that Quorum's own actions and omissions contributed to the conditions that made the Incident possible.
> [C&H ANNOTATION – KO]: This contributory negligence / shared responsibility argument is legally and factually unfounded and should be addressed firmly and comprehensively in our rebuttal. Taking each point in order: > > First — data format / encryption. The MSA places the obligation to maintain data security squarely on Palomar as the data processor and service provider. Exhibit D expressly requires Palomar to maintain safeguards including encryption of client data at rest and in transit. This obligation is imposed on Palomar — not on Quorum. Palomar cannot shift its own contractual security obligations to Quorum by arguing that Quorum should have encrypted data before transmitting it to Palomar for processing. The entire purpose of the MSA's data security provisions is to impose security obligations on the party that receives and processes the data. If Palomar received data from Quorum in an unencrypted format, Palomar's contractual obligation under Exhibit D was to encrypt that data upon receipt and maintain encryption at rest and in transit thereafter. Palomar's failure to do so — if that is indeed what occurred — would constitute an additional breach of Exhibit D, not a defense to the existing breach. > > Second — vendor oversight. Quorum's vendor risk management program relies, in significant part, on the SOC 2 Type II audit requirement that was added to the MSA by Amendment 2 (September 15, 2022). Under that amendment, Palomar was required to obtain and maintain a SOC 2 Type II audit report from an independent auditing firm — specifically, Kessler, Park & Associates CPA, PLLC was identified as the initial auditor — covering the security, availability, and confidentiality trust services criteria. Quorum is entitled to rely on this contractual audit mechanism as its primary means of verifying Palomar's security controls. The MSA does not require Quorum to independently audit Palomar's specific technical configurations or patch status on a real-time basis — that is precisely the purpose of the SOC 2 audit requirement and Palomar's own internal security obligations. Placing the burden on the client to continuously monitor the vendor's patching compliance would render the vendor's contractual patching obligation meaningless. > > Third — independent audit of GoAnywhere MFT. While the MSA does contain audit rights in Section 11.3, these rights are permissive, not mandatory. Quorum may conduct audits; it is not required to do so. The existence of a permissive audit right does not create an affirmative obligation on Quorum's part, and Quorum's decision not to exercise that right with respect to a specific technology platform does not constitute contributory negligence or shared responsibility. To accept Palomar's argument on this point would be to hold that a client is partially responsible for a vendor's security failures whenever the client does not exercise every available audit right — a result that would fundamentally distort the risk allocation framework of the MSA. > > Finally — MSA framework. The MSA does not contain a comparative or contributory negligence provision. The indemnification obligation in Section 12.2 is triggered by Palomar's breach of its data security obligations under Exhibit D. The provision does not include any language permitting reduction of the indemnification obligation based on the indemnified party's alleged comparative fault. If the MSA drafters had intended to include a comparative fault mechanism, they would have done so expressly.
> [C&H ANNOTATION – AB]: Building on KO's analysis of the first point — the data format / encryption argument is not only legally unfounded but is actually affirmatively harmful to Palomar's position. If we review the MSA's data handling specifications in Exhibit D, Section 3 (Data Handling and Storage Requirements), Palomar was contractually required to encrypt all Quorum data at rest using AES-256 or equivalent encryption and in transit using TLS 1.2 or higher. If Palomar received data from Quorum in an unencrypted format and failed to encrypt it upon ingestion into Palomar's systems, that failure would constitute a separate and independent breach of Exhibit D, Section 3. Far from establishing a defense, this argument actually highlights another potential avenue of Palomar liability. We should note this in our rebuttal, but we may also want to hold this point in reserve as additional leverage in the negotiation rather than raising it prominently at this stage.
IV. SETTLEMENT PROPOSAL
In the spirit of the parties' longstanding and valued commercial relationship — which spans nearly four years and has generated significant mutual value — Palomar is prepared to offer Quorum a goodwill credit in the amount of One Million Five Hundred Thousand Dollars ($1,500,000.00), to be applied as a reduction against Quorum's monthly service fee invoices under the MSA over the remaining term of the agreement (through November 11, 2024).
Palomar wishes to emphasize that this offer is made without any admission of liability, fault, or breach of contract on the part of Palomar. It is made solely as a gesture of good faith and in recognition of the disruption and inconvenience that the Incident has caused to Quorum.
This goodwill credit offer is subject to the following conditions:
(a) Quorum shall execute a full and final release of all claims, demands, causes of action, and rights of recovery arising from or related to the Incident, including but not limited to any claims for indemnification under Section 12.2 of the MSA, any claims for breach of contract, negligence, or any other legal theory;
(b) Quorum shall confirm in writing that it will not seek to terminate the MSA for cause based on the Incident or any facts or circumstances related thereto, and that the Incident shall not be deemed a "material breach" for purposes of Section 14.2 of the MSA;
(c) The terms of the settlement, including the existence and amount of the goodwill credit, shall be subject to mutual confidentiality obligations, and neither party shall disclose the terms of the settlement to any third party except as required by law, regulation, or applicable securities disclosure obligations.
This offer shall remain open for a period of thirty (30) calendar days from the date of this letter — i.e., through and including August 6, 2023. If this offer is not accepted by Quorum within that period, it shall be deemed withdrawn and shall not be used or referenced in any subsequent proceeding.
> [C&H ANNOTATION – KO]: The $1,500,000 goodwill credit offer is plainly inadequate by any reasonable measure. It represents approximately 18.2% of the $8,230,250 in total incident response costs that we have documented and demanded. The offer does not constitute a serious attempt to resolve the matter; rather, it is a predictable opening position designed to anchor the negotiation at a low level. > > Beyond the inadequacy of the amount, the structure of the offer is problematic. Structuring the credit as a reduction against future monthly service fee invoices — rather than as a cash payment — reduces its present value in two important ways. First, the credit is spread over the remaining approximately sixteen (16) months of the MSA term, meaning Quorum would receive the benefit of the credit incrementally over time rather than as a lump sum. Second, and more importantly, the credit is explicitly tied to the continuation of the MSA. If Quorum were to exercise its termination rights under Section 14.2 of the MSA — which Quorum has the right to do based on Palomar's material breach — the credit would presumably be forfeited in whole or in part, depending on the timing of termination. This structure is transparently designed to lock Quorum into continuing the vendor relationship by making the credit contingent on Quorum's waiver of its termination rights.
> [C&H ANNOTATION – AB]: Expanding on KO's analysis, the three conditions attached to the offer present independent problems: > > 1. Full release. The demand for a full and final release of all claims at this stage is premature and unacceptable. Multiple regulatory proceedings are still pending or anticipated — including potential investigations by state insurance regulators and state attorneys general in connection with the notification obligations applicable to the 318,247 affected individuals across 29 states. The full scope of Quorum's damages, including potential regulatory fines, penalties, and costs of compliance, is not yet known and may not be fully ascertainable for months or even years. Executing a full release at this stage would foreclose Quorum's ability to recover losses that have not yet materialized. > > 2. Termination rights waiver. The condition requiring Quorum to waive its right to terminate the MSA for cause is a non-starter. The right to terminate for material breach under Section 14.2 is a critical piece of strategic leverage in this negotiation. Waiving this right would eliminate one of Quorum's most powerful bargaining tools and would signal to Palomar that Quorum has no credible alternative to continuing the vendor relationship. We should never agree to this condition. > > 3. The $1,500,000 amount. The offered amount has no apparent analytical basis. It does not correspond to any identifiable cost category (e.g., it is less than the Graystone fees alone). It does not correspond to a meaningful percentage of the indemnification cap under Section 12.2, which is capped at the greater of (i) the aggregate fees paid by Quorum under the MSA during the twelve (12) months preceding the claim, or (ii) $10,000,000. Based on the fee schedule in Exhibit C and the actual invoices for the twelve months preceding April 2023, the aggregate fees were approximately $32,600,000, which means the indemnification cap under Section 12.2 is $32,600,000. The $1,500,000 offer represents approximately 4.6% of the cap — a trivial fraction. > > 4. The 30-day deadline. The August 6, 2023 deadline is a routine pressure tactic. We are under no legal or contractual obligation to respond within this window, and the deadline does not create any enforceable rights in Palomar's favor. That said, as a matter of professional courtesy and to maintain the negotiation momentum, we should acknowledge receipt of the offer and indicate that it is under review. We should not, however, feel compelled to counter within the 30-day window if our own preparation timeline requires additional time. > > 5. Overall strategic read. The $1,500,000 offer, while inadequate, does tell us something important: Palomar is prepared to negotiate, and Palomar recognizes that it has exposure. An opening offer of $1.5M against a cap of $32.6M and a demand of $8.23M means there is very significant room between the parties' positions. Our recommendation to Quorum should be to reject this offer and counter with a demand at or near the full $8,230,250 amount, while signaling willingness to discuss both cash and non-monetary resolution components (including enhanced security requirements, independent audit rights, accelerated patching obligations, and potentially an MSA amendment addressing go-forward security governance).
> [C&H ANNOTATION – KO]: I agree with AB's strategic assessment. We should also separately consider whether the enhanced security requirements and audit provisions that we would seek as part of any settlement should be negotiated as a standalone MSA amendment — an "Amendment 3" — to address the go-forward security posture, structurally separate from the cash recovery component. This approach has the advantage of ensuring that the enhanced security provisions survive regardless of whether the underlying settlement agreement is governed by confidentiality restrictions, and it positions Quorum well regardless of whether the MSA ultimately continues through its natural term or is terminated. The Amendment 3 concept should be included in the negotiation strategy memo for Tom Whitfield.
V. CLOSING
Palomar values its relationship with Quorum and remains committed to providing Quorum with the high-quality data processing and claims administration services that have characterized the parties' commercial relationship since the inception of the MSA in November 2019. Palomar is Quorum's second-largest claims processing vendor by volume, handling approximately 34% of Quorum's total claims data processing workflow, and Palomar believes that the parties' mutual investment in this relationship — including the integration of systems, the development of customized data workflows, and the training of dedicated personnel — represents significant value that would be difficult and costly to replicate with an alternative vendor.
In that regard, Palomar respectfully notes that any disruption to the MSA — whether through termination, suspension, or a transition to alternative service providers — would entail significant operational risk for Quorum, including the potential for delays in claims processing, data migration challenges, and interruption to Quorum's policyholder service commitments. Palomar is confident that a seamless transition to any alternative vendor would be extremely difficult to achieve in the timeframe contemplated by the MSA's termination provisions, and that such a transition would impose substantial costs and operational burdens on Quorum.
Palomar believes that the constructive resolution of this matter — one that addresses Quorum's legitimate concerns while preserving the commercial relationship — is in the best interest of both parties. To that end, Marcus J. Trevino, Chief Executive Officer of Palomar, would welcome the opportunity to speak directly with Margaret D. Calloway, Chief Executive Officer of Quorum, or Thomas R. Whitfield, General Counsel of Quorum, to discuss a constructive path forward. Palomar believes that a candid, business-level conversation between the parties' principals, supplemented by the ongoing dialogue between counsel, may facilitate a more efficient and mutually beneficial resolution than a purely adversarial process.
We look forward to hearing from you and to working toward a resolution of this matter.
Respectfully,
MERCER, HAIGHT & DUNLOP LLP
By: ________
Catherine Langford Partner
cc: Derek Copeland, General Counsel, Palomar Data Solutions, Inc. Brian Soto, Associate, Mercer, Haight & Dunlop LLP
> [C&H ANNOTATION – KO]: The closing paragraphs contain two significant strategic signals that we need to address. > > First, the extended discussion of Palomar's role as Quorum's "second-largest claims processing vendor" handling "approximately 34% of Quorum's total claims data processing workflow," coupled with the reference to the difficulty of a "seamless transition" and the associated "operational risk," is a thinly veiled threat. Palomar is signaling that if Quorum pushes too hard or exercises its termination rights, the transition will be disruptive and costly for Quorum. This is a leverage play designed to constrain Quorum's negotiating position by emphasizing Quorum's operational dependence on Palomar. > > This signal actually reinforces the importance of Quorum developing a credible transition plan and identifying alternative vendors — not necessarily with the intent of immediately terminating the MSA, but to demonstrate to Palomar that Quorum has alternatives and that the threat of operational disruption will not deter Quorum from pursuing its full contractual remedies. We should advise Priya Deshmukh (VP, Vendor Risk Management) and Robert Wentworth (SVP, Claims Operations) to begin preliminary transition planning, including identification of potential alternative claims processing vendors, assessment of data migration requirements, and development of a high-level transition timeline. This planning exercise serves dual purposes: it prepares Quorum operationally in the event that termination becomes necessary, and it strengthens Quorum's negotiating position by providing a credible alternative to continued dependence on Palomar.
> [C&H ANNOTATION – AB]: On the proposed principal-to-principal call: We should decline this invitation at this stage. There is meaningful risk that an informal conversation between Trevino and Calloway (or Trevino and Whitfield) could create disputed accounts of what was said or agreed, could result in inadvertent concessions or admissions, or could undermine the negotiating framework that we are developing through the counsel-to-counsel channel. Negotiations should continue through counsel until we have aligned with the Quorum team on a comprehensive strategy, developed our rebuttal, and established clear parameters for any settlement discussions. If and when a principal-to-principal conversation becomes appropriate — for example, to finalize a settlement in principle after the key terms have been negotiated through counsel — we can arrange it at that time with appropriate preparation, including detailed talking points and a clear mandate from the Quorum Board or executive team.
CALDERWOOD & HARKNESS LLP INTERNAL SUMMARY ANNOTATION Matter No. 1025-00006
PRIVILEGED & CONFIDENTIAL — ATTORNEY WORK PRODUCT
> [C&H ANNOTATION – KO/AB — SUMMARY]:
Overall Assessment of Palomar's Response
Having reviewed and analyzed Palomar's response in detail, our overall assessment is that Palomar's legal defenses are largely unpersuasive on the merits. The following summarizes the key conclusions from our analysis:
1. "Sophisticated Attack" Defense. Palomar's characterization of the Incident as a "sophisticated, state-of-the-art cyber-attack" does not negate the specific contractual patching obligation under Exhibit D (as amended by Amendment 2). The MSA imposes a defined 30-day patching window for critical vulnerabilities. The sophistication of the threat actor is irrelevant to the question of whether Palomar met this obligation. It did not.
2. Causation Defense. The causation defense is Palomar's weakest argument. The Graystone forensic investigation confirms that CVE-2023-0669 was the sole initial access vector exploited by the threat actor. If the vulnerability had been patched within the contractual window, the specific exploit would not have been available. The "alternative attack vector" argument is speculative and unsupported by any forensic evidence. Under the "arising from" standard in Section 12.2, as interpreted under Delaware law, a but-for causal relationship is sufficient.
3. Late Notification. The notification delay — approximately 72 hours from discovery versus the 48-hour contractual requirement in Section 9.4 — is an additional, independent breach. Palomar does not dispute the factual dates (Discovery on April 18; notification on April 21); it only recharacterizes the delay as "prompt" and "commercially reasonable." The MSA language is clear and does not permit extension of the notification window based on the service provider's desire to "confirm" the scope of the incident before reporting.
4. Contributory Negligence / Shared Responsibility. These arguments lack contractual support and are factually weak. The MSA places data security obligations on Palomar as the service provider. The MSA does not contain comparative fault provisions. Quorum's reliance on contractual audit mechanisms (including the SOC 2 Type II requirement) is reasonable and appropriate. The data format / encryption argument is affirmatively harmful to Palomar because it highlights a potential additional breach of Exhibit D's encryption requirements.
5. Scope of Damages. Palomar's arguments regarding the recoverability of legal fees, crisis communications costs, and internal costs are contradicted by the express language of Section 12.2, which covers "all losses, damages, costs, and expenses (including reasonable attorneys' fees and costs of investigation)." Each disputed cost category falls within this language.
6. Insurance Offset. The double recovery / insurance offset argument has no basis in the MSA, which contains no offset provision. Quorum's cyber-insurance coverage is a separate entitlement obtained at Quorum's own expense, and Palomar has no claim to the benefit of that coverage.
Palomar's Leverage Points (to be addressed in strategy)
Notwithstanding the weakness of Palomar's legal defenses, Palomar does possess certain practical leverage points that must be factored into our strategic analysis:
•  Operational Dependence. Quorum is currently dependent on Palomar for approximately 34% of its claims data processing volume. A mid-contract transition to an alternative vendor would entail significant cost, operational risk, and potential service disruption. This dependence gives Palomar a degree of practical leverage that is independent of the merits of its legal position.
•  Transition Cost and Timeline. Even if Quorum exercises its termination rights under Section 14.2, the MSA's transition assistance provisions in Section 14.5 contemplate a transition period of up to 180 days. During this period, Quorum would need to identify, contract with, and onboard an alternative vendor — a process that could take longer than 180 days depending on the complexity of the data workflows and system integrations involved.
•  Settlement Willingness. Palomar's $1.5M opening offer, while inadequate, signals that Palomar recognizes its exposure and is willing to negotiate. The gap between $1.5M and the indemnification cap of $32.6M provides significant room for negotiation. Our assessment is that the realistic settlement range, based on the streng