1025-00006 · Graystone Forensics LLC · Vendor Accountability

revised-settlement-term-sheet.docx DOCUMENT Data Privacy

87 / 88 ← → ✕

Contract analysis Extract to table

REVISED SETTLEMENT TERM SHEET

Confidential — Subject to Rule 408 of the Federal Rules of Evidence and Applicable State Equivalents

October 15, 2023

REVISED DRAFT — Reflects negotiations between the Parties through October 14, 2023

Calderwood & Harkness LLP Matter No. 1025-00006

Section 1: Parties

1.1 Quorum Insurance Holdings Corp.

Quorum Insurance Holdings Corp. ("Quorum"), a corporation duly organized and existing under the laws of the State of Delaware, publicly traded on the Nasdaq Stock Market under the ticker symbol "QIHC," with its principal offices located at 400 Constitution Plaza, Suite 2200, Hartford, Connecticut 06103 (EIN: 06-4832197).

Quorum is represented in this matter by Calderwood & Harkness LLP, Kevin Ostrowski, Responsible Partner, 1700 K Street NW, Suite 900, Washington, D.C. 20006.

The principal contact for Quorum with respect to all matters arising under this Term Sheet and the proposed Definitive Agreement shall be Thomas R. Whitfield, General Counsel, who may be reached at the above-referenced headquarters address.

1.2 Palomar Data Solutions, Inc.

Palomar Data Solutions, Inc. ("Palomar"), a corporation duly organized and existing under the laws of the State of Texas, with its principal offices located at 7100 Greenville Avenue, Suite 450, Dallas, Texas 75231 (EIN: 75-3291048).

Palomar is represented in this matter by Mercer, Haight & Dunlop LLP, Catherine Langford, Partner, 2100 Ross Avenue, Suite 3600, Dallas, Texas 75201.

The principal contact for Palomar with respect to all matters arising under this Term Sheet and the proposed Definitive Agreement shall be Derek Copeland, General Counsel, who may be reached at the above-referenced headquarters address.

Quorum and Palomar are referred to herein individually as a "Party" and collectively as the "Parties."

Section 2: Recitals / Background

2.1 Master Services Agreement

The Parties entered into a Master Services Agreement dated November 12, 2019 (the "Original MSA"), pursuant to which Palomar agreed to provide claims data processing, document management, and analytics services to Quorum's personal lines division. The Original MSA has been amended on two occasions: by Amendment 1, dated March 3, 2021 (effective April 1, 2021), and by Amendment 2, dated September 15, 2022 (collectively, and together with all exhibits, schedules, statements of work, and attachments thereto, the "MSA").

Under the MSA, Palomar serves as a critical technology and data services vendor for Quorum's personal lines insurance operations, processing claims data, managing associated documentation, and providing data analytics capabilities that support Quorum's underwriting, claims adjudication, and regulatory reporting functions. The services provided by Palomar under the MSA necessarily involve the processing, storage, and transmission of significant volumes of personally identifiable information, financial data, and protected health information belonging to Quorum's policyholders and claimants.

The current Annual Contract Value ("ACV") under the MSA is Sixteen Million Three Hundred Thousand Dollars ($16,300,000), as adjusted by Amendment 1, which became effective on April 1, 2021. The MSA has a term of five (5) years from the date of execution, with a scheduled expiration date of November 11, 2024.

2.2 The Security Incident

On or about March 14, 2023, a threat actor exploited a known, unpatched remote code execution vulnerability designated CVE-2023-0669 in Palomar's GoAnywhere MFT file transfer appliance to gain unauthorized access to Palomar's network environment. The vulnerability in question had been publicly disclosed and a vendor-issued patch had been made available prior to the date of exploitation.

Following the initial compromise, the threat actor maintained unauthorized access to Palomar's network and conducted data exfiltration activities over an approximately thirty-five (35) day period, from on or about March 14, 2023, through on or about April 18, 2023. During this period, the threat actor accessed and exfiltrated data from systems within Palomar's environment that processed and stored Quorum data.

On April 18, 2023, Palomar's Security Operations Center ("SOC") detected anomalous outbound data transfers originating from systems within the scope of Palomar's services to Quorum. Upon detection, Palomar initiated its internal incident response protocols and commenced an investigation into the nature and scope of the unauthorized access.

Palomar notified Quorum of the security incident on April 21, 2023, via email communication from Derek Copeland, Palomar's General Counsel, to Thomas R. Whitfield, Quorum's General Counsel, and David Naranjo, Quorum's Chief Information Security Officer ("CISO"). The notification was provided approximately seventy-two (72) hours after Palomar's SOC initially discovered the anomalous activity on April 18, 2023.

2.3 Scope of Compromised Data

The forensic investigation conducted by Graystone Forensics LLC determined that the Security Incident resulted in the unauthorized access to and exfiltration of personally identifiable information ("PII"), financial information, and protected health information ("PHI") belonging to approximately 318,247 Quorum policyholders and claimants located across twenty-nine (29) states and the District of Columbia. The categories and scope of compromised data are summarized as follows:

• Personally Identifiable Information (PII): Approximately 318,247 individuals were affected by the exfiltration of PII, including full names, dates of birth, Social Security numbers, and driver's license numbers.

• Financial Information: A subset of approximately 84,619 individuals was affected by the exfiltration of financial information, including bank account numbers and payment card numbers.

• Protected Health Information (PHI): A subset of approximately 41,203 individuals was affected by the exfiltration of PHI, including health conditions, medical diagnosis codes, and treatment information derived from workers' compensation claims and health-related insurance claims processed by Palomar on behalf of Quorum.

The breadth and sensitivity of the compromised data triggered notification obligations under multiple state data breach notification statutes, the Health Insurance Portability and Accountability Act of 1996 ("HIPAA"), and applicable federal and state regulatory requirements.

2.4 Quorum's Claims Against Palomar

Quorum asserts the following claims against Palomar in connection with the Security Incident:

Breach of Data Security Exhibit (Exhibit D, as amended). Palomar failed to comply with the patch management requirements set forth in Exhibit D to the MSA (the "Data Security Exhibit"), as amended by Amendment 2. Specifically, Exhibit D required Palomar to apply vendor-issued patches for known critical vulnerabilities within thirty (30) days of the patch release date. The vendor patch for CVE-2023-0669 was released prior to the date of exploitation on March 14, 2023, and Palomar failed to apply the patch within the required thirty-day window. This failure constituted a direct and material breach of Palomar's obligations under the Data Security Exhibit and was the proximate cause of the unauthorized access that initiated the Security Incident.

Breach of Section 9.4 of the MSA (Incident Notification). Section 9.4 of the MSA requires Palomar to notify Quorum of any security incident affecting Quorum data within forty-eight (48) hours of discovery. Palomar's SOC discovered the anomalous outbound data transfers on April 18, 2023. The forty-eight (48) hour notification window expired on or about April 20, 2023. Palomar did not provide notification to Quorum until April 21, 2023, approximately twenty-four (24) hours after the expiration of the contractual notification deadline. This delay impaired Quorum's ability to initiate its own incident response procedures in a timely manner and contributed to the overall scope and cost of the incident response effort.

Indemnification under Section 12.2 of the MSA. Quorum asserts its right to indemnification under Section 12.2 of the MSA for all costs, expenses, losses, and liabilities incurred as a result of Palomar's breaches of the MSA and the Data Security Exhibit. Quorum acknowledges that Section 12.3 of the MSA contains a limitation of liability providing that, except in the case of willful misconduct or gross negligence, each Party's aggregate liability under the MSA shall not exceed two times (2×) the trailing twelve-month fees paid or payable. Based on the current ACV of $16,300,000, the applicable liability cap is $32,600,000. The total Incident Response Costs of $8,230,250 are within this contractual liability cap.

2.5 Prior Negotiations

The Parties have engaged in extensive good-faith negotiations regarding the resolution of Quorum's claims arising from the Security Incident. The key milestones in those negotiations are as follows:

• On June 20, 2023, Quorum, through Calderwood & Harkness LLP, transmitted a formal demand letter to Palomar demanding indemnification in the total amount of $8,230,250, representing all Incident Response Costs incurred by Quorum in connection with the Security Incident.

• On July 7, 2023, Palomar, through Mercer, Haight & Dunlop LLP, provided a written response to Quorum's demand, disputing certain elements of causation and the reasonableness of certain cost categories, and offering a goodwill credit of $1,500,000 against future service fees in lieu of a cash settlement payment.

• On July 25, 2023, Quorum transmitted a detailed rebuttal letter, supported by forensic and cost documentation, reaffirming its demand and rejecting Palomar's initial goodwill credit proposal as inadequate.

• On September 18, 2023, following several rounds of additional discussions between the Parties' respective general counsel and outside counsel, Calderwood & Harkness LLP circulated an initial draft term sheet setting forth proposed settlement terms.

• Between September 18, 2023 and October 14, 2023, the Parties and their respective counsel engaged in continued negotiations, resulting in revisions to the financial and non-financial terms reflected in this revised Term Sheet.

This revised Term Sheet reflects the outcome of those continued negotiations through October 14, 2023.

2.6 Total Incident Response Costs

Quorum has incurred total Incident Response Costs of $8,230,250 in connection with the Security Incident, consisting of the following categories:

A detailed breakdown of these costs, including sub-categories within each line item, is set forth in Schedule A attached hereto.

2.7 Purpose. The Parties desire to resolve all claims, disputes, and controversies arising from or related to the Security Incident on the terms and conditions set forth herein, without any admission of liability, fault, or wrongdoing by Palomar, and to preserve and continue their ongoing commercial relationship under the MSA. This Term Sheet sets forth the principal terms upon which the Parties have agreed to settle Quorum's claims, subject to the negotiation, execution, and delivery of a binding Definitive Agreement incorporating these terms.

Section 3: Defined Terms

As used in this Term Sheet, the following terms shall have the meanings set forth below. Capitalized terms used but not otherwise defined herein shall have the meanings ascribed to them in the MSA.

"Definitive Agreement" means the Settlement Agreement and Mutual Release to be executed by the Parties incorporating the terms set forth in this Term Sheet, together with all exhibits, schedules, and attachments thereto.

"Effective Date" means the date on which the Definitive Agreement has been duly executed and delivered by both Parties.

"Enhanced Security Measures" has the meaning set forth in Section 5.1 of this Term Sheet.

"Fee Reduction Period" has the meaning set forth in Section 4.2 of this Term Sheet.

"Incident Response Costs" means the total costs, fees, and expenses incurred by Quorum in connection with the investigation, remediation, notification, and response activities related to the Security Incident, totaling $8,230,250, as further detailed in Schedule A hereto.

"MSA" means the Master Services Agreement dated November 12, 2019, between Quorum and Palomar, as amended by Amendment 1 (dated March 3, 2021) and Amendment 2 (dated September 15, 2022), and as may be further amended by Amendment 3 as contemplated herein.

"Security Assessment" has the meaning set forth in Section 5.2 of this Term Sheet.

"Security Incident" means the unauthorized access to, and exfiltration of data from, Palomar's network environment that occurred between on or about March 14, 2023 and on or about April 18, 2023, as more fully described in Section 2.2 of this Term Sheet.

"Settlement Payment" has the meaning set forth in Section 4.1 of this Term Sheet.

Section 4: Financial Terms

4.1 Cash Payment

Palomar shall pay to Quorum the sum of Four Million Two Hundred Thousand Dollars ($4,200,000) (the "Settlement Payment") within thirty (30) calendar days of the Effective Date. Payment shall be made by wire transfer of immediately available funds to a bank account designated by Quorum in writing no later than ten (10) business days following the Effective Date.

The Settlement Payment represents a negotiated resolution of Quorum's indemnification claims under Section 12.2 of the MSA and shall not be characterized, construed, or interpreted by either Party as a penalty, a fine, or a liquidated damages payment. Neither Party shall represent to any third party that the Settlement Payment constitutes an admission of liability, fault, or wrongdoing by Palomar.

In the event that Palomar fails to remit the Settlement Payment within the thirty (30) day period specified above, interest shall accrue on the unpaid balance at the rate of one and one-half percent (1.5%) per month (or the maximum rate permitted by applicable law, whichever is less), calculated from the date payment was due until the date payment is received in full by Quorum.

4.2 Fee Reduction

Commencing on November 1, 2023, and continuing for a period of eighteen (18) consecutive months through and including April 30, 2025 (the "Fee Reduction Period"), Palomar shall reduce the monthly service fees payable by Quorum under the MSA by eight percent (8%).

Based on the current Annual Contract Value of $16,300,000, the monthly fee reduction shall equal approximately $108,667 per month ($16,300,000 × 8% ÷ 12 months). The aggregate value of the fee reduction over the eighteen (18) month Fee Reduction Period shall be approximately $1,956,000 ($16,300,000 × 8% × 1.5 years).

The fee reduction shall apply to all invoices issued by Palomar during the Fee Reduction Period, regardless of the billing period or service period to which such invoices relate. The fee reduction shall be reflected as a separate line-item credit on each monthly invoice issued during the Fee Reduction Period, clearly identified as "Settlement Fee Reduction — Amendment 3."

The fee reduction shall survive any renewal, extension, or renegotiation of the MSA that occurs during the Fee Reduction Period. In the event that the fee structure under the MSA is modified during the Fee Reduction Period (whether by renewal, amendment, or otherwise), the eight percent (8%) reduction shall be applied to the then-current fee structure.

The Parties acknowledge that the Fee Reduction Period extends beyond the current MSA expiration date of November 11, 2024. In the event that the MSA is not renewed or extended beyond its current expiration date, or in the event that the MSA is terminated for any reason prior to the expiration of the Fee Reduction Period, Palomar shall pay to Quorum, in a single lump sum, the remaining unpaid portion of the fee reduction within thirty (30) calendar days of the effective date of MSA expiration or termination. For the avoidance of doubt, such lump-sum payment shall be calculated based on the number of remaining months in the Fee Reduction Period multiplied by the monthly fee reduction amount of $108,667.

4.3 Total Effective Recovery

The total effective recovery to Quorum under this settlement shall consist of the following components:

The total effective recovery of $6,156,000 represents approximately 74.8% of Quorum's total Incident Response Costs of $8,230,250.

4.4 Tax Treatment

Each Party shall be solely responsible for its own tax obligations, if any, arising from or attributable to the settlement, including the Settlement Payment and the fee reduction. Neither Party makes any representation or warranty to the other regarding the tax treatment or tax consequences of any aspect of this settlement.

The Parties shall cooperate in good faith regarding any tax reporting requirements applicable to the settlement, including the preparation and timely issuance of any Internal Revenue Service forms (including, without limitation, IRS Form 1099) that may be required in connection with the Settlement Payment or the fee reduction. Each Party shall provide the other with such information as may be reasonably necessary to comply with applicable tax reporting obligations.

Section 5: Non-Financial Terms — Enhanced Security Obligations

5.1 Enhanced Patch Management and Endpoint Detection

Within ninety (90) calendar days of the Effective Date, Palomar shall implement the following enhanced security measures (collectively, the "Enhanced Security Measures") with respect to all systems, networks, and infrastructure that process, store, or transmit Quorum data:

Patch Management Enhancement. Palomar shall revise its patch management policies and procedures to require that critical vulnerability patches — defined as patches addressing vulnerabilities with a Common Vulnerability Scoring System ("CVSS") base score of 7.0 or above — be applied within fourteen (14) calendar days of the date on which the applicable vendor makes the patch available for download. This enhanced fourteen (14) day patching requirement replaces the prior thirty (30) day patching requirement set forth in Exhibit D to the MSA. For vulnerabilities with a CVSS base score below 7.0, the existing patching timelines under Exhibit D shall continue to apply. In the event that a critical patch cannot be applied within the fourteen (14) day window due to legitimate operational constraints (e.g., required testing in a staging environment to prevent service disruption), Palomar shall (i) implement compensating controls to mitigate the vulnerability within seven (7) calendar days of patch release, and (ii) apply the patch within thirty (30) calendar days of patch release.

Endpoint Detection and Response (EDR). Palomar shall deploy enterprise-grade endpoint detection and response ("EDR") technology across all endpoints, servers, and systems that process, store, or transmit Quorum data. The EDR solution shall provide, at a minimum, continuous monitoring, automated threat detection, behavioral analysis, and incident response capabilities. The EDR deployment shall be maintained and updated throughout the remaining term of the MSA and any renewal term. Palomar shall provide Quorum with documentation identifying the EDR solution deployed and confirming full deployment coverage upon request.

Quarterly Vulnerability Scanning. Palomar shall conduct comprehensive vulnerability scans of all systems, networks, and infrastructure within the scope of its services to Quorum on a quarterly basis (i.e., no less frequently than once every ninety (90) calendar days). The vulnerability scans shall be conducted using industry-standard vulnerability scanning tools and methodologies. Written reports summarizing the results of each quarterly vulnerability scan, including all identified vulnerabilities, their CVSS scores, and Palomar's planned remediation actions and timelines, shall be provided to David Naranjo, Quorum's CISO, and Priya Deshmukh, Quorum's Vice President, Vendor Risk Management, within ten (10) business days of the completion of each scan.

Palomar shall certify in writing to Thomas R. Whitfield, Quorum's General Counsel, within ninety (90) calendar days of the Effective Date that all of the foregoing Enhanced Security Measures have been fully implemented. Such certification shall be signed by Palomar's CISO or other duly authorized senior information security officer and shall describe the measures implemented in reasonable detail.

5.2 Independent Third-Party Security Assessment

Palomar shall, at its sole cost and expense, engage a qualified independent third-party security assessor (the "Assessor") to conduct comprehensive annual security assessments (each, a "Security Assessment") of Palomar's information security program as it relates to the processing, storage, and transmission of Quorum data. Each Security Assessment shall evaluate, at a minimum, Palomar's network security architecture, access controls, encryption practices, vulnerability management processes, incident response capabilities, and compliance with the Enhanced Security Measures set forth in Section 5.1.

The Assessor shall be mutually agreed upon by the Parties. In the event that the Parties are unable to reach agreement on the selection of the Assessor within twenty (20) business days of commencing discussions on the matter, each Party shall propose two (2) qualified candidates, and Quorum shall have the right to select the Assessor from among Palomar's two proposed candidates. In all cases, the selected Assessor must be independent of both Parties and must possess recognized credentials and experience in information security assessments (e.g., CISA, CISSP, or equivalent certifications, or accreditation as a PCI QSA or FedRAMP 3PAO).

The first Security Assessment shall be completed within one hundred twenty (120) calendar days of the Effective Date. Subsequent Security Assessments shall be conducted annually thereafter for the remaining term of the MSA and any renewal or extension term.

The Assessor's written report for each Security Assessment shall be provided to both Parties simultaneously within fifteen (15) business days of the completion of the assessment. Palomar shall remediate any findings rated "high" or "critical" by the Assessor within thirty (30) calendar days of Palomar's receipt of the applicable assessment report. Palomar shall remediate any findings rated "medium" within sixty (60) calendar days of receipt. Palomar shall provide written confirmation to Quorum of the completion of each remediation action within five (5) business days of completion.

For the avoidance of doubt, the independent Security Assessment required under this Section 5.2 is in addition to, and shall not replace or otherwise affect, the SOC 2 Type II audit requirement set forth in Amendment 2 to the MSA. Palomar's SOC 2 Type II audit is currently performed by Kessler, Park & Associates CPA, PLLC, and shall continue in accordance with the terms of Amendment 2.

5.3 Enhanced Incident Notification

Section 9.4 of the MSA shall be amended to require Palomar to notify Quorum of any security incident (as defined in the MSA) affecting Quorum data within twenty-four (24) hours of discovery, replacing the current forty-eight (48) hour notification requirement. For purposes of this provision, "Discovery" shall mean the point at which Palomar has a reasonable basis to believe that a security incident has occurred that may affect the confidentiality, integrity, or availability of Quorum data.

Notification shall be provided simultaneously to the following Quorum personnel via both email and telephone:

• Thomas R. Whitfield, General Counsel

• David Naranjo, Chief Information Security Officer (CISO)

• Jennifer Liang, Chief Privacy Officer (CPO)

The initial notification shall include, at a minimum, the date and time of discovery, a preliminary description of the nature of the incident, the systems and data believed to be affected, and the steps Palomar is taking to contain and investigate the incident. Palomar shall provide supplemental written updates to the foregoing Quorum contacts at least every twenty-four (24) hours thereafter until the incident has been fully contained and remediated.

5.4 MSA Amendment

The Parties shall negotiate, finalize, and execute a Third Amendment to the MSA ("Amendment 3") concurrently with the execution and delivery of the Definitive Agreement. Amendment 3 shall incorporate the following provisions into the MSA:

• The Enhanced Security Measures set forth in Section 5.1 of this Term Sheet, to be incorporated as amendments to Exhibit D (Data Security) of the MSA;

• The independent third-party Security Assessment requirements set forth in Section 5.2 of this Term Sheet, to be incorporated as additional provisions of Exhibit D;

• The enhanced incident notification requirements set forth in Section 5.3 of this Term Sheet, to be incorporated as an amendment to Section 9.4 of the MSA; and

• The fee reduction provisions set forth in Section 4.2 of this Term Sheet, to be incorporated as a pricing amendment to the applicable fee schedule under the MSA.

Amendment 3 shall be in form and substance reasonably satisfactory to both Parties and their respective counsel, and shall be consistent in all material respects with the terms set forth in this Term Sheet.

Section 6: Mutual Release

6.1 Quorum Release

Effective upon the Effective Date and Quorum's receipt of the Settlement Payment in full, Quorum, on behalf of itself and its subsidiaries, affiliates, parent companies, successors, assigns, officers, directors, employees, agents, and representatives, hereby releases and forever discharges Palomar, together with its officers, directors, employees, agents, representatives, successors, assigns, and affiliates (collectively, the "Palomar Released Parties"), from any and all claims, demands, actions, causes of action, suits, debts, dues, sums of money, accounts, reckonings, bonds, bills, specialties, covenants, contracts, controversies, agreements, promises, variances, trespasses, damages, judgments, extents, executions, liabilities, costs, expenses, losses, and obligations of every kind and nature whatsoever, whether at law or in equity, whether known or unknown, suspected or unsuspected, matured or unmatured, contingent or fixed, liquidated or unliquidated, which Quorum has had, now has, or may hereafter have against the Palomar Released Parties, arising from, related to, or in connection with the Security Incident.

Notwithstanding the foregoing, the release set forth in this Section 6.1 shall not extend to, and shall expressly exclude, the following: (a) Palomar's ongoing obligations under the MSA (as amended by Amendment 3) arising after the Effective Date; (b) any claims arising from any future security incident or data breach occurring after the Effective Date; and (c) Palomar's obligations under the Definitive Agreement itself, including without limitation the obligation to make the Settlement Payment, the fee reduction commitments, and the Enhanced Security Measures.

6.2 Palomar Release

Effective upon the Effective Date, Palomar, on behalf of itself and its subsidiaries, affiliates, parent companies, successors, assigns, officers, directors, employees, agents, and representatives, hereby releases and forever discharges Quorum, together with its officers, directors, employees, agents, representatives, successors, assigns, subsidiaries, and affiliates (collectively, the "Quorum Released Parties"), from any and all claims, demands, actions, causes of action, suits, debts, dues, sums of money, accounts, reckonings, bonds, bills, specialties, covenants, contracts, controversies, agreements, promises, variances, trespasses, damages, judgments, extents, executions, liabilities, costs, expenses, losses, and obligations of every kind and nature whatsoever, whether at law or in equity, whether known or unknown, suspected or unsuspected, matured or unmatured, contingent or fixed, liquidated or unliquidated, which Palomar has had, now has, or may hereafter have against the Quorum Released Parties, arising from, related to, or in connection with the Security Incident, including without limitation any claims related to Quorum's indemnification demand, Quorum's public disclosures or communications regarding the Security Incident, or regulatory notifications made by Quorum in connection with the Security Incident.

6.3 No Admission of Liability

The settlement contemplated by this Term Sheet and the Definitive Agreement does not constitute, and shall not be construed or interpreted as, an admission of liability, fault, wrongdoing, or responsibility by either Party. Palomar specifically denies that it breached the MSA, the Data Security Exhibit, or any applicable law or regulation, and enters into this settlement solely for the purpose of resolving disputed claims and preserving the Parties' ongoing commercial relationship.

Neither Party shall characterize, represent, or describe the settlement, the Settlement Payment, the fee reduction, or any other term of this Term Sheet or the Definitive Agreement as an admission of liability, fault, or wrongdoing by the other Party in any judicial, administrative, regulatory, or other proceeding, or in any public statement, press release, or communication.

Section 7: Confidentiality

7.1 Confidential Treatment

The terms and conditions of this Term Sheet and the Definitive Agreement, including without limitation the financial terms, the existence of the settlement, the amount of the Settlement Payment, and the fee reduction, shall be treated as strictly confidential by both Parties and shall not be disclosed to any third party except as expressly permitted herein or as required by applicable law, regulation, or legal process.

Notwithstanding the foregoing, each Party may disclose the terms of this Term Sheet and the Definitive Agreement to its respective officers, directors, employees, auditors, insurers, insurance brokers, and legal advisors who have a reasonable need to know such information and who are bound by obligations of confidentiality.

In addition, Quorum may disclose settlement terms to the following parties:

• Atlas Mutual Insurance Company, Quorum's primary cyber-liability insurer;

• Pinnacle Surplus Lines Insurance Corp., Quorum's excess cyber-liability insurer;

• Whitmore Risk Advisors Inc., Quorum's cyber-insurance broker;

• Halstead & Monroe LLP, Quorum's external auditor; and

• Regulatory authorities, to the extent required or reasonably appropriate in connection with ongoing regulatory inquiries related to the Security Incident.

Any third party to whom confidential settlement terms are disclosed pursuant to this Section 7.1 shall be informed of the confidential nature of the information and shall be directed to maintain its confidentiality.

7.2 Regulatory Disclosure Carve-Out

Notwithstanding the confidentiality obligations set forth in Section 7.1, Quorum may disclose the existence and general terms of the settlement — without disclosing specific dollar amounts unless specifically required by applicable law, regulation, or regulatory demand — to the following regulatory authorities in connection with ongoing or future regulatory inquiries, examinations, or proceedings related to the Security Incident:

• The multistate attorney general coalition investigating the Security Incident;

• The Connecticut Insurance Department;

• The United States Department of Health and Human Services, Office for Civil Rights ("HHS-OCR"); and

• The United States Securities and Exchange Commission ("SEC").

In the event that any such regulatory authority specifically requires or compels the disclosure of dollar amounts or other specific financial terms, Quorum shall, to the extent practicable and not prohibited by law, provide Palomar with reasonable advance notice of such required disclosure and shall limit the disclosure to the minimum information necessary to comply with the applicable legal or regulatory requirement.

7.3 Board and SEC Disclosure

Quorum may disclose the terms of this Term Sheet and the Definitive Agreement to its Board of Directors and the Audit Committee of its Board of Directors, including Audit Committee Chair Franklin Reeves, as necessary or appropriate for Quorum's corporate governance purposes.

Additionally, Quorum may disclose settlement terms in its filings with the SEC, including without limitation on Forms 8-K, 10-Q, and 10-K, to the extent required by the Securities Act of 1933, the Securities Exchange Act of 1934, and the rules and regulations promulgated thereunder. Quorum shall use commercially reasonable efforts to provide Palomar with advance notice of any SEC filing that will include specific settlement terms and shall consider in good faith any comments or requests from Palomar regarding the scope of such disclosure, provided that Quorum's disclosure obligations under applicable securities laws shall take precedence.

Section 8: Representations and Warranties

8.1 Palomar Representations

Palomar hereby represents and warrants to Quorum as follows:

(a) Palomar has the full corporate power and authority to enter into this Term Sheet and the Definitive Agreement, and to perform its obligations hereunder and thereunder. The execution, delivery, and performance of the Definitive Agreement and Amendment 3 have been, or will be, duly authorized by all necessary corporate action on the part of Palomar.

(b) The execution and performance of the Definitive Agreement and Amendment 3 by Palomar will not conflict with, result in a breach of, or constitute a default under any agreement, contract, instrument, order, judgment, decree, or other obligation to which Palomar is a party or by which it is bound.

(c) Palomar has not assigned, transferred, conveyed, or otherwise disposed of, in whole or in part, any of the claims, demands, or causes of action released by Palomar pursuant to Section 6.2 of this Term Sheet.

(d) The Settlement Payment will be made from available, unrestricted funds, and Palomar has, or will have at the time of payment, sufficient financial resources to satisfy the Settlement Payment obligation in full without the need for third-party financing or approval.

8.2 Quorum Representations

Quorum hereby represents and warrants to Palomar as follows:

(a) Quorum has the full corporate power and authority to enter into this Term Sheet and the Definitive Agreement, and to perform its obligations hereunder and thereunder. The execution, delivery, and performance of the Definitive Agreement and Amendment 3 have been, or will be, duly authorized by all necessary corporate action on the part of Quorum.

(b) The execution and performance of the Definitive Agreement and Amendment 3 by Quorum will not conflict with, result in a breach of, or constitute a default under any agreement, contract, instrument, order, judgment, decree, or other obligation to which Quorum is a party or by which it is bound.

(c) Quorum has not assigned, transferred, conveyed, or otherwise disposed of, in whole or in part, any of the claims, demands, or causes of action released by Quorum pursuant to Section 6.1 of this Term Sheet.

Section 9: Conditions Precedent to Definitive Agreement

The obligation of each Party to execute and deliver the Definitive Agreement shall be subject to the satisfaction (or written waiver by the applicable Party) of the following conditions precedent:

1. Quorum Internal Approval. Approval of the settlement terms set forth in this Term Sheet by Quorum's General Counsel, Thomas R. Whitfield, and Quorum's Chief Executive Officer, Margaret D. Calloway.

2. Palomar Internal Approval. Approval of the settlement terms set forth in this Term Sheet by Palomar's General Counsel, Derek Copeland, and Palomar's Chief Executive Officer, Marcus J. Trevino.

3. Execution of Definitive Agreement and Amendment 3. Negotiation, finalization, execution, and delivery of the Definitive Agreement (Settlement Agreement and Mutual Release) and MSA Amendment 3, both of which shall be in form and substance reasonably satisfactory to both Parties and their respective counsel and shall be consistent in all material respects with the terms set forth in this Term Sheet.

4. Target Execution Date. The Parties shall use commercially reasonable efforts to finalize and execute the Definitive Agreement and Amendment 3 on or before October 27, 2023. The failure to meet this target date shall not, in and of itself, constitute a termination or abandonment of the settlement negotiations, and the Parties may mutually agree in writing to extend such date.

Section 10: Governing Law and Dispute Resolution

The Definitive Agreement shall be governed by and construed in accordance with the laws of the State of Delaware, without regard to its conflicts of law principles, consistent with the governing law provision set forth in Section 17.1 of the MSA.

Any dispute, controversy, or claim arising out of or relating to the Definitive Agreement, or the breach, termination, or invalidity thereof, shall be resolved in accordance with the dispute resolution provisions set forth in Section 17.3 of the MSA, including any applicable requirements for negotiation, mediation, or binding arbitration as specified therein. To the extent any dispute arises that is not within the scope of the MSA's dispute resolution provisions, the Parties agree to submit such dispute to the exclusive jurisdiction of the state and federal courts located in Wilmington, Delaware.

Section 11: Preservation of MSA

Except as expressly modified by Amendment 3 and the Definitive Agreement, the MSA shall remain in full force and effect in accordance with its terms. Nothing in this Term Sheet or the Definitive Agreement shall be construed as a termination, rescission, or material modification of the MSA, except to the extent specifically set forth in Amendment 3.

The Parties hereby affirm their intention to continue the commercial relationship established under the MSA through its current term, which expires on November 11, 2024, and to negotiate in good faith regarding any renewal, extension, or successor agreement. The settlement of the claims arising from the Security Incident is intended to facilitate the preservation and continuation of this commercial relationship.

Nothing in this Term Sheet, the Definitive Agreement, or Amendment 3 shall be construed as a waiver, limitation, or modification of Quorum's right to terminate the MSA for cause under Section 14.2 of the MSA in the event of any future material breach by Palomar. All of Quorum's rights and remedies under the MSA, as amended, are expressly preserved and reserved, except as specifically released in Section 6.1 of this Term Sheet.

Section 12: Binding Effect / Non-Binding Nature of Term Sheet

This Term Sheet sets forth the principal terms and conditions upon which the Parties have agreed to resolve Quorum's claims arising from the Security Incident. This Term Sheet is intended to facilitate the preparation, negotiation, and execution of a binding Definitive Agreement (Settlement Agreement and Mutual Release) and MSA Amendment 3.

This Term Sheet is non-binding, except that the following provisions shall be binding upon execution by the Parties' authorized representatives and shall survive until the earlier of (i) the execution of the Definitive Agreement, or (ii) the written termination of settlement negotiations by either Party:

• Section 7 (Confidentiality), including Sections 7.1, 7.2, and 7.3;

• Section 6.3 (No Admission of Liability); and

• This Section 12 (Binding Effect / Non-Binding Nature of Term Sheet).

Except as expressly provided in the immediately preceding paragraph, neither Party shall have any binding obligation with respect to the proposed settlement unless and until a Definitive Agreement is duly executed and delivered by both Parties. No course of dealing, negotiation, or exchange of drafts between the Parties or their counsel shall give rise to any binding obligation or enforceable expectation absent execution of the Definitive Agreement.

Section 13: Counterparts and Execution

This Term Sheet may be executed in one or more counterparts, each of which shall be deemed an original and all of which together shall constitute one and the same instrument. Delivery of an executed counterpart of this Term Sheet by facsimile, electronic mail (including PDF), or other electronic transmission shall be equally effective as delivery of an original executed counterpart.

Execution of this Term Sheet by electronic signature (including via Brightwater Software, Ashford Health IT, or similar electronic signature platforms) shall be valid and binding for all purposes and shall have the same legal force and effect as a manual signature.

SIGNATURE PAGE

IN WITNESS WHEREOF, the undersigned authorized representatives of the Parties have executed this Revised Settlement Term Sheet as of the date first written above.

QUORUM INSURANCE HOLDINGS CORP.

By: ________

Name: Thomas R. Whitfield

Title: General Counsel

Date: ________

PALOMAR DATA SOLUTIONS, INC.

By: ________

Name: Derek Copeland

Title: General Counsel

Date: ________

ACKNOWLEDGED BY COUNSEL:

CALDERWOOD & HARKNESS LLP Counsel to Quorum Insurance Holdings Corp.

By: ________

Name: Kevin Ostrowski

Title: Partner

1700 K Street NW, Suite 900 Washington, D.C. 20006

MERCER, HAIGHT & DUNLOP LLP Counsel to Palomar Data Solutions, Inc.

By: ________

Name: Catherine Langford

Title: Partner

2100 Ross Avenue, Suite 3600 Dallas, TX 75201

SCHEDULE A

Summary of Incident Response Costs

The following table sets forth a detailed summary of the Incident Response Costs incurred by Quorum Insurance Holdings Corp. in connection with the Security Incident, as referenced in Section 2.6 of the Term Sheet.

Note: The internal cost figure of $620,000 is an estimate based on tracked hours and direct expenditures through October 1, 2023. Final internal cost figures will be reconciled and documented in the Definitive Agreement.

SCHEDULE B

MSA Amendment 3 — Summary of Key Provisions

The following is a summary of the key provisions to be incorporated into Amendment 3 to the Master Services Agreement, as referenced in Section 5.4 of the Term Sheet. Amendment 3 shall be negotiated, finalized, and executed concurrently with the Definitive Agreement, and shall be in form and substance reasonably satisfactory to both Parties and their respective counsel.

B.1 Revised Exhibit D — Patch Management (Section 5.1 of Term Sheet)

Exhibit D (Data Security) shall be amended to require that critical vulnerability patches — defined as those addressing vulnerabilities with a CVSS base score of 7.0 or above — be applied within fourteen (14) calendar days of vendor patch release. This replaces the prior requirement of thirty (30) calendar days for critical patches. Compensating controls must be implemented within seven (7) calendar days for any critical patch that cannot be applied within the fourteen (14) day window due to legitimate operational constraints, with full patching required within thirty (30) calendar days.

REVISED SETTLEMENT TERM SHEET
Confidential — Subject to Rule 408 of the Federal Rules of Evidence and Applicable State Equivalents
October 15, 2023
REVISED DRAFT — Reflects negotiations between the Parties through October 14, 2023
Calderwood & Harkness LLP Matter No. 1025-00006
Section 1: Parties
1.1 Quorum Insurance Holdings Corp.
Quorum Insurance Holdings Corp. ("Quorum"), a corporation duly organized and existing under the laws of the State of Delaware, publicly traded on the Nasdaq Stock Market under the ticker symbol "QIHC," with its principal offices located at 400 Constitution Plaza, Suite 2200, Hartford, Connecticut 06103 (EIN: 06-4832197).
Quorum is represented in this matter by Calderwood & Harkness LLP, Kevin Ostrowski, Responsible Partner, 1700 K Street NW, Suite 900, Washington, D.C. 20006.
The principal contact for Quorum with respect to all matters arising under this Term Sheet and the proposed Definitive Agreement shall be Thomas R. Whitfield, General Counsel, who may be reached at the above-referenced headquarters address.
1.2 Palomar Data Solutions, Inc.
Palomar Data Solutions, Inc. ("Palomar"), a corporation duly organized and existing under the laws of the State of Texas, with its principal offices located at 7100 Greenville Avenue, Suite 450, Dallas, Texas 75231 (EIN: 75-3291048).
Palomar is represented in this matter by Mercer, Haight & Dunlop LLP, Catherine Langford, Partner, 2100 Ross Avenue, Suite 3600, Dallas, Texas 75201.
The principal contact for Palomar with respect to all matters arising under this Term Sheet and the proposed Definitive Agreement shall be Derek Copeland, General Counsel, who may be reached at the above-referenced headquarters address.
Quorum and Palomar are referred to herein individually as a "Party" and collectively as the "Parties."
Section 2: Recitals / Background
2.1 Master Services Agreement
The Parties entered into a Master Services Agreement dated November 12, 2019 (the "Original MSA"), pursuant to which Palomar agreed to provide claims data processing, document management, and analytics services to Quorum's personal lines division. The Original MSA has been amended on two occasions: by Amendment 1, dated March 3, 2021 (effective April 1, 2021), and by Amendment 2, dated September 15, 2022 (collectively, and together with all exhibits, schedules, statements of work, and attachments thereto, the "MSA").
Under the MSA, Palomar serves as a critical technology and data services vendor for Quorum's personal lines insurance operations, processing claims data, managing associated documentation, and providing data analytics capabilities that support Quorum's underwriting, claims adjudication, and regulatory reporting functions. The services provided by Palomar under the MSA necessarily involve the processing, storage, and transmission of significant volumes of personally identifiable information, financial data, and protected health information belonging to Quorum's policyholders and claimants.
The current Annual Contract Value ("ACV") under the MSA is Sixteen Million Three Hundred Thousand Dollars ($16,300,000), as adjusted by Amendment 1, which became effective on April 1, 2021. The MSA has a term of five (5) years from the date of execution, with a scheduled expiration date of November 11, 2024.
2.2 The Security Incident
On or about March 14, 2023, a threat actor exploited a known, unpatched remote code execution vulnerability designated CVE-2023-0669 in Palomar's GoAnywhere MFT file transfer appliance to gain unauthorized access to Palomar's network environment. The vulnerability in question had been publicly disclosed and a vendor-issued patch had been made available prior to the date of exploitation.
Following the initial compromise, the threat actor maintained unauthorized access to Palomar's network and conducted data exfiltration activities over an approximately thirty-five (35) day period, from on or about March 14, 2023, through on or about April 18, 2023. During this period, the threat actor accessed and exfiltrated data from systems within Palomar's environment that processed and stored Quorum data.
On April 18, 2023, Palomar's Security Operations Center ("SOC") detected anomalous outbound data transfers originating from systems within the scope of Palomar's services to Quorum. Upon detection, Palomar initiated its internal incident response protocols and commenced an investigation into the nature and scope of the unauthorized access.
Palomar notified Quorum of the security incident on April 21, 2023, via email communication from Derek Copeland, Palomar's General Counsel, to Thomas R. Whitfield, Quorum's General Counsel, and David Naranjo, Quorum's Chief Information Security Officer ("CISO"). The notification was provided approximately seventy-two (72) hours after Palomar's SOC initially discovered the anomalous activity on April 18, 2023.
2.3 Scope of Compromised Data
The forensic investigation conducted by Graystone Forensics LLC determined that the Security Incident resulted in the unauthorized access to and exfiltration of personally identifiable information ("PII"), financial information, and protected health information ("PHI") belonging to approximately 318,247 Quorum policyholders and claimants located across twenty-nine (29) states and the District of Columbia. The categories and scope of compromised data are summarized as follows:
•  Personally Identifiable Information (PII): Approximately 318,247 individuals were affected by the exfiltration of PII, including full names, dates of birth, Social Security numbers, and driver's license numbers.
•  Financial Information: A subset of approximately 84,619 individuals was affected by the exfiltration of financial information, including bank account numbers and payment card numbers.
•  Protected Health Information (PHI): A subset of approximately 41,203 individuals was affected by the exfiltration of PHI, including health conditions, medical diagnosis codes, and treatment information derived from workers' compensation claims and health-related insurance claims processed by Palomar on behalf of Quorum.
The breadth and sensitivity of the compromised data triggered notification obligations under multiple state data breach notification statutes, the Health Insurance Portability and Accountability Act of 1996 ("HIPAA"), and applicable federal and state regulatory requirements.
2.4 Quorum's Claims Against Palomar
Quorum asserts the following claims against Palomar in connection with the Security Incident:
Breach of Data Security Exhibit (Exhibit D, as amended). Palomar failed to comply with the patch management requirements set forth in Exhibit D to the MSA (the "Data Security Exhibit"), as amended by Amendment 2. Specifically, Exhibit D required Palomar to apply vendor-issued patches for known critical vulnerabilities within thirty (30) days of the patch release date. The vendor patch for CVE-2023-0669 was released prior to the date of exploitation on March 14, 2023, and Palomar failed to apply the patch within the required thirty-day window. This failure constituted a direct and material breach of Palomar's obligations under the Data Security Exhibit and was the proximate cause of the unauthorized access that initiated the Security Incident.
Breach of Section 9.4 of the MSA (Incident Notification). Section 9.4 of the MSA requires Palomar to notify Quorum of any security incident affecting Quorum data within forty-eight (48) hours of discovery. Palomar's SOC discovered the anomalous outbound data transfers on April 18, 2023. The forty-eight (48) hour notification window expired on or about April 20, 2023. Palomar did not provide notification to Quorum until April 21, 2023, approximately twenty-four (24) hours after the expiration of the contractual notification deadline. This delay impaired Quorum's ability to initiate its own incident response procedures in a timely manner and contributed to the overall scope and cost of the incident response effort.
Indemnification under Section 12.2 of the MSA. Quorum asserts its right to indemnification under Section 12.2 of the MSA for all costs, expenses, losses, and liabilities incurred as a result of Palomar's breaches of the MSA and the Data Security Exhibit. Quorum acknowledges that Section 12.3 of the MSA contains a limitation of liability providing that, except in the case of willful misconduct or gross negligence, each Party's aggregate liability under the MSA shall not exceed two times (2×) the trailing twelve-month fees paid or payable. Based on the current ACV of $16,300,000, the applicable liability cap is $32,600,000. The total Incident Response Costs of $8,230,250 are within this contractual liability cap.
2.5 Prior Negotiations
The Parties have engaged in extensive good-faith negotiations regarding the resolution of Quorum's claims arising from the Security Incident. The key milestones in those negotiations are as follows:
•  On June 20, 2023, Quorum, through Calderwood & Harkness LLP, transmitted a formal demand letter to Palomar demanding indemnification in the total amount of $8,230,250, representing all Incident Response Costs incurred by Quorum in connection with the Security Incident.
•  On July 7, 2023, Palomar, through Mercer, Haight & Dunlop LLP, provided a written response to Quorum's demand, disputing certain elements of causation and the reasonableness of certain cost categories, and offering a goodwill credit of $1,500,000 against future service fees in lieu of a cash settlement payment.
•  On July 25, 2023, Quorum transmitted a detailed rebuttal letter, supported by forensic and cost documentation, reaffirming its demand and rejecting Palomar's initial goodwill credit proposal as inadequate.
•  On September 18, 2023, following several rounds of additional discussions between the Parties' respective general counsel and outside counsel, Calderwood & Harkness LLP circulated an initial draft term sheet setting forth proposed settlement terms.
•  Between September 18, 2023 and October 14, 2023, the Parties and their respective counsel engaged in continued negotiations, resulting in revisions to the financial and non-financial terms reflected in this revised Term Sheet.
This revised Term Sheet reflects the outcome of those continued negotiations through October 14, 2023.
2.6 Total Incident Response Costs
Quorum has incurred total Incident Response Costs of $8,230,250 in connection with the Security Incident, consisting of the following categories:
A detailed breakdown of these costs, including sub-categories within each line item, is set forth in Schedule A attached hereto.
2.7 Purpose.  The Parties desire to resolve all claims, disputes, and controversies arising from or related to the Security Incident on the terms and conditions set forth herein, without any admission of liability, fault, or wrongdoing by Palomar, and to preserve and continue their ongoing commercial relationship under the MSA. This Term Sheet sets forth the principal terms upon which the Parties have agreed to settle Quorum's claims, subject to the negotiation, execution, and delivery of a binding Definitive Agreement incorporating these terms.
Section 3: Defined Terms
As used in this Term Sheet, the following terms shall have the meanings set forth below. Capitalized terms used but not otherwise defined herein shall have the meanings ascribed to them in the MSA.
"Definitive Agreement" means the Settlement Agreement and Mutual Release to be executed by the Parties incorporating the terms set forth in this Term Sheet, together with all exhibits, schedules, and attachments thereto.
"Effective Date" means the date on which the Definitive Agreement has been duly executed and delivered by both Parties.
"Enhanced Security Measures" has the meaning set forth in Section 5.1 of this Term Sheet.
"Fee Reduction Period" has the meaning set forth in Section 4.2 of this Term Sheet.
"Incident Response Costs" means the total costs, fees, and expenses incurred by Quorum in connection with the investigation, remediation, notification, and response activities related to the Security Incident, totaling $8,230,250, as further detailed in Schedule A hereto.
"MSA" means the Master Services Agreement dated November 12, 2019, between Quorum and Palomar, as amended by Amendment 1 (dated March 3, 2021) and Amendment 2 (dated September 15, 2022), and as may be further amended by Amendment 3 as contemplated herein.
"Security Assessment" has the meaning set forth in Section 5.2 of this Term Sheet.
"Security Incident" means the unauthorized access to, and exfiltration of data from, Palomar's network environment that occurred between on or about March 14, 2023 and on or about April 18, 2023, as more fully described in Section 2.2 of this Term Sheet.
"Settlement Payment" has the meaning set forth in Section 4.1 of this Term Sheet.
Section 4: Financial Terms
4.1 Cash Payment
Palomar shall pay to Quorum the sum of Four Million Two Hundred Thousand Dollars ($4,200,000) (the "Settlement Payment") within thirty (30) calendar days of the Effective Date. Payment shall be made by wire transfer of immediately available funds to a bank account designated by Quorum in writing no later than ten (10) business days following the Effective Date.
The Settlement Payment represents a negotiated resolution of Quorum's indemnification claims under Section 12.2 of the MSA and shall not be characterized, construed, or interpreted by either Party as a penalty, a fine, or a liquidated damages payment. Neither Party shall represent to any third party that the Settlement Payment constitutes an admission of liability, fault, or wrongdoing by Palomar.
In the event that Palomar fails to remit the Settlement Payment within the thirty (30) day period specified above, interest shall accrue on the unpaid balance at the rate of one and one-half percent (1.5%) per month (or the maximum rate permitted by applicable law, whichever is less), calculated from the date payment was due until the date payment is received in full by Quorum.
4.2 Fee Reduction
Commencing on November 1, 2023, and continuing for a period of eighteen (18) consecutive months through and including April 30, 2025 (the "Fee Reduction Period"), Palomar shall reduce the monthly service fees payable by Quorum under the MSA by eight percent (8%).
Based on the current Annual Contract Value of $16,300,000, the monthly fee reduction shall equal approximately $108,667 per month ($16,300,000 × 8% ÷ 12 months). The aggregate value of the fee reduction over the eighteen (18) month Fee Reduction Period shall be approximately $1,956,000 ($16,300,000 × 8% × 1.5 years).
The fee reduction shall apply to all invoices issued by Palomar during the Fee Reduction Period, regardless of the billing period or service period to which such invoices relate. The fee reduction shall be reflected as a separate line-item credit on each monthly invoice issued during the Fee Reduction Period, clearly identified as "Settlement Fee Reduction — Amendment 3."
The fee reduction shall survive any renewal, extension, or renegotiation of the MSA that occurs during the Fee Reduction Period. In the event that the fee structure under the MSA is modified during the Fee Reduction Period (whether by renewal, amendment, or otherwise), the eight percent (8%) reduction shall be applied to the then-current fee structure.
The Parties acknowledge that the Fee Reduction Period extends beyond the current MSA expiration date of November 11, 2024. In the event that the MSA is not renewed or extended beyond its current expiration date, or in the event that the MSA is terminated for any reason prior to the expiration of the Fee Reduction Period, Palomar shall pay to Quorum, in a single lump sum, the remaining unpaid portion of the fee reduction within thirty (30) calendar days of the effective date of MSA expiration or termination. For the avoidance of doubt, such lump-sum payment shall be calculated based on the number of remaining months in the Fee Reduction Period multiplied by the monthly fee reduction amount of $108,667.
4.3 Total Effective Recovery
The total effective recovery to Quorum under this settlement shall consist of the following components:
The total effective recovery of $6,156,000 represents approximately 74.8% of Quorum's total Incident Response Costs of $8,230,250.
4.4 Tax Treatment
Each Party shall be solely responsible for its own tax obligations, if any, arising from or attributable to the settlement, including the Settlement Payment and the fee reduction. Neither Party makes any representation or warranty to the other regarding the tax treatment or tax consequences of any aspect of this settlement.
The Parties shall cooperate in good faith regarding any tax reporting requirements applicable to the settlement, including the preparation and timely issuance of any Internal Revenue Service forms (including, without limitation, IRS Form 1099) that may be required in connection with the Settlement Payment or the fee reduction. Each Party shall provide the other with such information as may be reasonably necessary to comply with applicable tax reporting obligations.
Section 5: Non-Financial Terms — Enhanced Security Obligations
5.1 Enhanced Patch Management and Endpoint Detection
Within ninety (90) calendar days of the Effective Date, Palomar shall implement the following enhanced security measures (collectively, the "Enhanced Security Measures") with respect to all systems, networks, and infrastructure that process, store, or transmit Quorum data:
Patch Management Enhancement. Palomar shall revise its patch management policies and procedures to require that critical vulnerability patches — defined as patches addressing vulnerabilities with a Common Vulnerability Scoring System ("CVSS") base score of 7.0 or above — be applied within fourteen (14) calendar days of the date on which the applicable vendor makes the patch available for download. This enhanced fourteen (14) day patching requirement replaces the prior thirty (30) day patching requirement set forth in Exhibit D to the MSA. For vulnerabilities with a CVSS base score below 7.0, the existing patching timelines under Exhibit D shall continue to apply. In the event that a critical patch cannot be applied within the fourteen (14) day window due to legitimate operational constraints (e.g., required testing in a staging environment to prevent service disruption), Palomar shall (i) implement compensating controls to mitigate the vulnerability within seven (7) calendar days of patch release, and (ii) apply the patch within thirty (30) calendar days of patch release.
Endpoint Detection and Response (EDR). Palomar shall deploy enterprise-grade endpoint detection and response ("EDR") technology across all endpoints, servers, and systems that process, store, or transmit Quorum data. The EDR solution shall provide, at a minimum, continuous monitoring, automated threat detection, behavioral analysis, and incident response capabilities. The EDR deployment shall be maintained and updated throughout the remaining term of the MSA and any renewal term. Palomar shall provide Quorum with documentation identifying the EDR solution deployed and confirming full deployment coverage upon request.
Quarterly Vulnerability Scanning. Palomar shall conduct comprehensive vulnerability scans of all systems, networks, and infrastructure within the scope of its services to Quorum on a quarterly basis (i.e., no less frequently than once every ninety (90) calendar days). The vulnerability scans shall be conducted using industry-standard vulnerability scanning tools and methodologies. Written reports summarizing the results of each quarterly vulnerability scan, including all identified vulnerabilities, their CVSS scores, and Palomar's planned remediation actions and timelines, shall be provided to David Naranjo, Quorum's CISO, and Priya Deshmukh, Quorum's Vice President, Vendor Risk Management, within ten (10) business days of the completion of each scan.
Palomar shall certify in writing to Thomas R. Whitfield, Quorum's General Counsel, within ninety (90) calendar days of the Effective Date that all of the foregoing Enhanced Security Measures have been fully implemented. Such certification shall be signed by Palomar's CISO or other duly authorized senior information security officer and shall describe the measures implemented in reasonable detail.
5.2 Independent Third-Party Security Assessment
Palomar shall, at its sole cost and expense, engage a qualified independent third-party security assessor (the "Assessor") to conduct comprehensive annual security assessments (each, a "Security Assessment") of Palomar's information security program as it relates to the processing, storage, and transmission of Quorum data. Each Security Assessment shall evaluate, at a minimum, Palomar's network security architecture, access controls, encryption practices, vulnerability management processes, incident response capabilities, and compliance with the Enhanced Security Measures set forth in Section 5.1.
The Assessor shall be mutually agreed upon by the Parties. In the event that the Parties are unable to reach agreement on the selection of the Assessor within twenty (20) business days of commencing discussions on the matter, each Party shall propose two (2) qualified candidates, and Quorum shall have the right to select the Assessor from among Palomar's two proposed candidates. In all cases, the selected Assessor must be independent of both Parties and must possess recognized credentials and experience in information security assessments (e.g., CISA, CISSP, or equivalent certifications, or accreditation as a PCI QSA or FedRAMP 3PAO).
The first Security Assessment shall be completed within one hundred twenty (120) calendar days of the Effective Date. Subsequent Security Assessments shall be conducted annually thereafter for the remaining term of the MSA and any renewal or extension term.
The Assessor's written report for each Security Assessment shall be provided to both Parties simultaneously within fifteen (15) business days of the completion of the assessment. Palomar shall remediate any findings rated "high" or "critical" by the Assessor within thirty (30) calendar days of Palomar's receipt of the applicable assessment report. Palomar shall remediate any findings rated "medium" within sixty (60) calendar days of receipt. Palomar shall provide written confirmation to Quorum of the completion of each remediation action within five (5) business days of completion.
For the avoidance of doubt, the independent Security Assessment required under this Section 5.2 is in addition to, and shall not replace or otherwise affect, the SOC 2 Type II audit requirement set forth in Amendment 2 to the MSA. Palomar's SOC 2 Type II audit is currently performed by Kessler, Park & Associates CPA, PLLC, and shall continue in accordance with the terms of Amendment 2.
5.3 Enhanced Incident Notification
Section 9.4 of the MSA shall be amended to require Palomar to notify Quorum of any security incident (as defined in the MSA) affecting Quorum data within twenty-four (24) hours of discovery, replacing the current forty-eight (48) hour notification requirement. For purposes of this provision, "Discovery" shall mean the point at which Palomar has a reasonable basis to believe that a security incident has occurred that may affect the confidentiality, integrity, or availability of Quorum data.
Notification shall be provided simultaneously to the following Quorum personnel via both email and telephone:
•  Thomas R. Whitfield, General Counsel
•  David Naranjo, Chief Information Security Officer (CISO)
•  Jennifer Liang, Chief Privacy Officer (CPO)
The initial notification shall include, at a minimum, the date and time of discovery, a preliminary description of the nature of the incident, the systems and data believed to be affected, and the steps Palomar is taking to contain and investigate the incident. Palomar shall provide supplemental written updates to the foregoing Quorum contacts at least every twenty-four (24) hours thereafter until the incident has been fully contained and remediated.
5.4 MSA Amendment
The Parties shall negotiate, finalize, and execute a Third Amendment to the MSA ("Amendment 3") concurrently with the execution and delivery of the Definitive Agreement. Amendment 3 shall incorporate the following provisions into the MSA:
•  The Enhanced Security Measures set forth in Section 5.1 of this Term Sheet, to be incorporated as amendments to Exhibit D (Data Security) of the MSA;
•  The independent third-party Security Assessment requirements set forth in Section 5.2 of this Term Sheet, to be incorporated as additional provisions of Exhibit D;
•  The enhanced incident notification requirements set forth in Section 5.3 of this Term Sheet, to be incorporated as an amendment to Section 9.4 of the MSA; and
•  The fee reduction provisions set forth in Section 4.2 of this Term Sheet, to be incorporated as a pricing amendment to the applicable fee schedule under the MSA.
Amendment 3 shall be in form and substance reasonably satisfactory to both Parties and their respective counsel, and shall be consistent in all material respects with the terms set forth in this Term Sheet.
Section 6: Mutual Release
6.1 Quorum Release
Effective upon the Effective Date and Quorum's receipt of the Settlement Payment in full, Quorum, on behalf of itself and its subsidiaries, affiliates, parent companies, successors, assigns, officers, directors, employees, agents, and representatives, hereby releases and forever discharges Palomar, together with its officers, directors, employees, agents, representatives, successors, assigns, and affiliates (collectively, the "Palomar Released Parties"), from any and all claims, demands, actions, causes of action, suits, debts, dues, sums of money, accounts, reckonings, bonds, bills, specialties, covenants, contracts, controversies, agreements, promises, variances, trespasses, damages, judgments, extents, executions, liabilities, costs, expenses, losses, and obligations of every kind and nature whatsoever, whether at law or in equity, whether known or unknown, suspected or unsuspected, matured or unmatured, contingent or fixed, liquidated or unliquidated, which Quorum has had, now has, or may hereafter have against the Palomar Released Parties, arising from, related to, or in connection with the Security Incident.
Notwithstanding the foregoing, the release set forth in this Section 6.1 shall not extend to, and shall expressly exclude, the following: (a) Palomar's ongoing obligations under the MSA (as amended by Amendment 3) arising after the Effective Date; (b) any claims arising from any future security incident or data breach occurring after the Effective Date; and (c) Palomar's obligations under the Definitive Agreement itself, including without limitation the obligation to make the Settlement Payment, the fee reduction commitments, and the Enhanced Security Measures.
6.2 Palomar Release
Effective upon the Effective Date, Palomar, on behalf of itself and its subsidiaries, affiliates, parent companies, successors, assigns, officers, directors, employees, agents, and representatives, hereby releases and forever discharges Quorum, together with its officers, directors, employees, agents, representatives, successors, assigns, subsidiaries, and affiliates (collectively, the "Quorum Released Parties"), from any and all claims, demands, actions, causes of action, suits, debts, dues, sums of money, accounts, reckonings, bonds, bills, specialties, covenants, contracts, controversies, agreements, promises, variances, trespasses, damages, judgments, extents, executions, liabilities, costs, expenses, losses, and obligations of every kind and nature whatsoever, whether at law or in equity, whether known or unknown, suspected or unsuspected, matured or unmatured, contingent or fixed, liquidated or unliquidated, which Palomar has had, now has, or may hereafter have against the Quorum Released Parties, arising from, related to, or in connection with the Security Incident, including without limitation any claims related to Quorum's indemnification demand, Quorum's public disclosures or communications regarding the Security Incident, or regulatory notifications made by Quorum in connection with the Security Incident.
6.3 No Admission of Liability
The settlement contemplated by this Term Sheet and the Definitive Agreement does not constitute, and shall not be construed or interpreted as, an admission of liability, fault, wrongdoing, or responsibility by either Party. Palomar specifically denies that it breached the MSA, the Data Security Exhibit, or any applicable law or regulation, and enters into this settlement solely for the purpose of resolving disputed claims and preserving the Parties' ongoing commercial relationship.
Neither Party shall characterize, represent, or describe the settlement, the Settlement Payment, the fee reduction, or any other term of this Term Sheet or the Definitive Agreement as an admission of liability, fault, or wrongdoing by the other Party in any judicial, administrative, regulatory, or other proceeding, or in any public statement, press release, or communication.
Section 7: Confidentiality
7.1 Confidential Treatment
The terms and conditions of this Term Sheet and the Definitive Agreement, including without limitation the financial terms, the existence of the settlement, the amount of the Settlement Payment, and the fee reduction, shall be treated as strictly confidential by both Parties and shall not be disclosed to any third party except as expressly permitted herein or as required by applicable law, regulation, or legal process.
Notwithstanding the foregoing, each Party may disclose the terms of this Term Sheet and the Definitive Agreement to its respective officers, directors, employees, auditors, insurers, insurance brokers, and legal advisors who have a reasonable need to know such information and who are bound by obligations of confidentiality.
In addition, Quorum may disclose settlement terms to the following parties:
•  Atlas Mutual Insurance Company, Quorum's primary cyber-liability insurer;
•  Pinnacle Surplus Lines Insurance Corp., Quorum's excess cyber-liability insurer;
•  Whitmore Risk Advisors Inc., Quorum's cyber-insurance broker;
•  Halstead & Monroe LLP, Quorum's external auditor; and
•  Regulatory authorities, to the extent required or reasonably appropriate in connection with ongoing regulatory inquiries related to the Security Incident.
Any third party to whom confidential settlement terms are disclosed pursuant to this Section 7.1 shall be informed of the confidential nature of the information and shall be directed to maintain its confidentiality.
7.2 Regulatory Disclosure Carve-Out
Notwithstanding the confidentiality obligations set forth in Section 7.1, Quorum may disclose the existence and general terms of the settlement — without disclosing specific dollar amounts unless specifically required by applicable law, regulation, or regulatory demand — to the following regulatory authorities in connection with ongoing or future regulatory inquiries, examinations, or proceedings related to the Security Incident:
•  The multistate attorney general coalition investigating the Security Incident;
•  The Connecticut Insurance Department;
•  The United States Department of Health and Human Services, Office for Civil Rights ("HHS-OCR"); and
•  The United States Securities and Exchange Commission ("SEC").
In the event that any such regulatory authority specifically requires or compels the disclosure of dollar amounts or other specific financial terms, Quorum shall, to the extent practicable and not prohibited by law, provide Palomar with reasonable advance notice of such required disclosure and shall limit the disclosure to the minimum information necessary to comply with the applicable legal or regulatory requirement.
7.3 Board and SEC Disclosure
Quorum may disclose the terms of this Term Sheet and the Definitive Agreement to its Board of Directors and the Audit Committee of its Board of Directors, including Audit Committee Chair Franklin Reeves, as necessary or appropriate for Quorum's corporate governance purposes.
Additionally, Quorum may disclose settlement terms in its filings with the SEC, including without limitation on Forms 8-K, 10-Q, and 10-K, to the extent required by the Securities Act of 1933, the Securities Exchange Act of 1934, and the rules and regulations promulgated thereunder. Quorum shall use commercially reasonable efforts to provide Palomar with advance notice of any SEC filing that will include specific settlement terms and shall consider in good faith any comments or requests from Palomar regarding the scope of such disclosure, provided that Quorum's disclosure obligations under applicable securities laws shall take precedence.
Section 8: Representations and Warranties
8.1 Palomar Representations
Palomar hereby represents and warrants to Quorum as follows:
(a) Palomar has the full corporate power and authority to enter into this Term Sheet and the Definitive Agreement, and to perform its obligations hereunder and thereunder. The execution, delivery, and performance of the Definitive Agreement and Amendment 3 have been, or will be, duly authorized by all necessary corporate action on the part of Palomar.
(b) The execution and performance of the Definitive Agreement and Amendment 3 by Palomar will not conflict with, result in a breach of, or constitute a default under any agreement, contract, instrument, order, judgment, decree, or other obligation to which Palomar is a party or by which it is bound.
(c) Palomar has not assigned, transferred, conveyed, or otherwise disposed of, in whole or in part, any of the claims, demands, or causes of action released by Palomar pursuant to Section 6.2 of this Term Sheet.
(d) The Settlement Payment will be made from available, unrestricted funds, and Palomar has, or will have at the time of payment, sufficient financial resources to satisfy the Settlement Payment obligation in full without the need for third-party financing or approval.
8.2 Quorum Representations
Quorum hereby represents and warrants to Palomar as follows:
(a) Quorum has the full corporate power and authority to enter into this Term Sheet and the Definitive Agreement, and to perform its obligations hereunder and thereunder. The execution, delivery, and performance of the Definitive Agreement and Amendment 3 have been, or will be, duly authorized by all necessary corporate action on the part of Quorum.
(b) The execution and performance of the Definitive Agreement and Amendment 3 by Quorum will not conflict with, result in a breach of, or constitute a default under any agreement, contract, instrument, order, judgment, decree, or other obligation to which Quorum is a party or by which it is bound.
(c) Quorum has not assigned, transferred, conveyed, or otherwise disposed of, in whole or in part, any of the claims, demands, or causes of action released by Quorum pursuant to Section 6.1 of this Term Sheet.
Section 9: Conditions Precedent to Definitive Agreement
The obligation of each Party to execute and deliver the Definitive Agreement shall be subject to the satisfaction (or written waiver by the applicable Party) of the following conditions precedent:
1.  Quorum Internal Approval. Approval of the settlement terms set forth in this Term Sheet by Quorum's General Counsel, Thomas R. Whitfield, and Quorum's Chief Executive Officer, Margaret D. Calloway.
2.  Palomar Internal Approval. Approval of the settlement terms set forth in this Term Sheet by Palomar's General Counsel, Derek Copeland, and Palomar's Chief Executive Officer, Marcus J. Trevino.
3.  Execution of Definitive Agreement and Amendment 3. Negotiation, finalization, execution, and delivery of the Definitive Agreement (Settlement Agreement and Mutual Release) and MSA Amendment 3, both of which shall be in form and substance reasonably satisfactory to both Parties and their respective counsel and shall be consistent in all material respects with the terms set forth in this Term Sheet.
4.  Target Execution Date. The Parties shall use commercially reasonable efforts to finalize and execute the Definitive Agreement and Amendment 3 on or before October 27, 2023. The failure to meet this target date shall not, in and of itself, constitute a termination or abandonment of the settlement negotiations, and the Parties may mutually agree in writing to extend such date.
Section 10: Governing Law and Dispute Resolution
The Definitive Agreement shall be governed by and construed in accordance with the laws of the State of Delaware, without regard to its conflicts of law principles, consistent with the governing law provision set forth in Section 17.1 of the MSA.
Any dispute, controversy, or claim arising out of or relating to the Definitive Agreement, or the breach, termination, or invalidity thereof, shall be resolved in accordance with the dispute resolution provisions set forth in Section 17.3 of the MSA, including any applicable requirements for negotiation, mediation, or binding arbitration as specified therein. To the extent any dispute arises that is not within the scope of the MSA's dispute resolution provisions, the Parties agree to submit such dispute to the exclusive jurisdiction of the state and federal courts located in Wilmington, Delaware.
Section 11: Preservation of MSA
Except as expressly modified by Amendment 3 and the Definitive Agreement, the MSA shall remain in full force and effect in accordance with its terms. Nothing in this Term Sheet or the Definitive Agreement shall be construed as a termination, rescission, or material modification of the MSA, except to the extent specifically set forth in Amendment 3.
The Parties hereby affirm their intention to continue the commercial relationship established under the MSA through its current term, which expires on November 11, 2024, and to negotiate in good faith regarding any renewal, extension, or successor agreement. The settlement of the claims arising from the Security Incident is intended to facilitate the preservation and continuation of this commercial relationship.
Nothing in this Term Sheet, the Definitive Agreement, or Amendment 3 shall be construed as a waiver, limitation, or modification of Quorum's right to terminate the MSA for cause under Section 14.2 of the MSA in the event of any future material breach by Palomar. All of Quorum's rights and remedies under the MSA, as amended, are expressly preserved and reserved, except as specifically released in Section 6.1 of this Term Sheet.
Section 12: Binding Effect / Non-Binding Nature of Term Sheet
This Term Sheet sets forth the principal terms and conditions upon which the Parties have agreed to resolve Quorum's claims arising from the Security Incident. This Term Sheet is intended to facilitate the preparation, negotiation, and execution of a binding Definitive Agreement (Settlement Agreement and Mutual Release) and MSA Amendment 3.
This Term Sheet is non-binding, except that the following provisions shall be binding upon execution by the Parties' authorized representatives and shall survive until the earlier of (i) the execution of the Definitive Agreement, or (ii) the written termination of settlement negotiations by either Party:
•  Section 7 (Confidentiality), including Sections 7.1, 7.2, and 7.3;
•  Section 6.3 (No Admission of Liability); and
•  This Section 12 (Binding Effect / Non-Binding Nature of Term Sheet).
Except as expressly provided in the immediately preceding paragraph, neither Party shall have any binding obligation with respect to the proposed settlement unless and until a Definitive Agreement is duly executed and delivered by both Parties. No course of dealing, negotiation, or exchange of drafts between the Parties or their counsel shall give rise to any binding obligation or enforceable expectation absent execution of the Definitive Agreement.
Section 13: Counterparts and Execution
This Term Sheet may be executed in one or more counterparts, each of which shall be deemed an original and all of which together shall constitute one and the same instrument. Delivery of an executed counterpart of this Term Sheet by facsimile, electronic mail (including PDF), or other electronic transmission shall be equally effective as delivery of an original executed counterpart.
Execution of this Term Sheet by electronic signature (including via Brightwater Software, Ashford Health IT, or similar electronic signature platforms) shall be valid and binding for all purposes and shall have the same legal force and effect as a manual signature.
SIGNATURE PAGE
IN WITNESS WHEREOF, the undersigned authorized representatives of the Parties have executed this Revised Settlement Term Sheet as of the date first written above.
QUORUM INSURANCE HOLDINGS CORP.
By: ________
Name: Thomas R. Whitfield
Title: General Counsel
Date: ________
PALOMAR DATA SOLUTIONS, INC.
By: ________
Name: Derek Copeland
Title: General Counsel
Date: ________
ACKNOWLEDGED BY COUNSEL:
CALDERWOOD & HARKNESS LLP Counsel to Quorum Insurance Holdings Corp.
By: ________
Name: Kevin Ostrowski
Title: Partner
1700 K Street NW, Suite 900 Washington, D.C. 20006
MERCER, HAIGHT & DUNLOP LLP Counsel to Palomar Data Solutions, Inc.
By: ________
Name: Catherine Langford
Title: Partner
2100 Ross Avenue, Suite 3600 Dallas, TX 75201
SCHEDULE A
Summary of Incident Response Costs
The following table sets forth a detailed summary of the Incident Response Costs incurred by Quorum Insurance Holdings Corp. in connection with the Security Incident, as referenced in Section 2.6 of the Term Sheet.
Note: The internal cost figure of $620,000 is an estimate based on tracked hours and direct expenditures through October 1, 2023. Final internal cost figures will be reconciled and documented in the Definitive Agreement.
SCHEDULE B
MSA Amendment 3 — Summary of Key Provisions
The following is a summary of the key provisions to be incorporated into Amendment 3 to the Master Services Agreement, as referenced in Section 5.4 of the Term Sheet. Amendment 3 shall be negotiated, finalized, and executed concurrently with the Definitive Agreement, and shall be in form and substance reasonably satisfactory to both Parties and their respective counsel.
B.1 Revised Exhibit D — Patch Management (Section 5.1 of Term Sheet)
Exhibit D (Data Security) shall be amended to require that critical vulnerability patches — defined as those addressing vulnerabilities with a CVSS base score of 7.0 or above — be applied within fourteen (14) calendar days of vendor patch release. This replaces the prior requirement of thirty (30) calendar days for critical patches. Compensating controls must be implemented within seven (7) calendar days for any critical patch that cannot be applied within the fourteen (14) day window due to legitimate operational constraints, with full patching required within thirty (30) calendar days.
B.2 Mandatory EDR Deployment (Section 5.1 of Term Sheet)
Exhibit D shall be amended to require Palomar to deploy and maintain enterprise-grade endpoint detection and response ("EDR") technology across all systems, endpoints, and servers that process, store, or transmit Quorum data. The EDR solution shall provide continuous monitoring, automated threat detection, behavioral analysis, and incident response capabilities.
B.3 Quarterly Vulnerability Scanning (Section 5.1 of Term Sheet)
Exhibit D shall be amended to require Palomar to conduct quarterly vulnerability scans of all in-scope systems and to provide written reports summarizing scan results to Quorum's CISO (David Naranjo) and VP, Vendor Risk Management (Priya Deshmukh) within ten (10) business days of each scan.
B.4 Annual Independent Third-Party Security Assessment (Section 5.2 of Term Sheet)
Exhibit D shall be amended to require Palomar to engage, at its sole expense, a mutually agreed-upon independent third-party security assessor to conduct annual comprehensive security assessments of Palomar's information security program as it relates to Quorum data. This requirement is in addition to, and does not replace, the existing SOC 2 Type II audit requirement under Amendment 2 (currently audited by Kessler, Park & Associates CPA, PLLC). Assessment reports shall be provided to both Parties simultaneously.
B.5 Remediation Timelines (Section 5.2 of Term Sheet)
Palomar shall remediate any findings rated "high" or "critical" by the independent Assessor within thirty (30) calendar days of receipt of the assessment report. Findings rated "medium" shall be remediated within sixty (60) calendar days of receipt. Written confirmation of remediation shall be provided to Quorum within five (5) business days of completion.
B.6 Revised Section 9.4 — Incident Notification (Section 5.3 of Term Sheet)
Section 9.4 of the MSA shall be amended to require Palomar to notify Quorum of any security incident affecting Quorum data within twenty-four (24) hours of discovery, replacing the current forty-eight (48) hour requirement. Notification shall be provided simultaneously via email and telephone to Quorum's General Counsel, CISO, and CPO.
B.7 Fee Reduction (Section 4.2 of Term Sheet)
Amendment 3 shall incorporate the eight percent (8%) fee reduction to Quorum's monthly service fees for a period of eighteen (18) months, commencing November 1, 2023 and continuing through April 30, 2025 (the "Fee Reduction Period"). The fee reduction shall be reflected as a line-item credit on each monthly invoice and shall survive any renewal or extension of the MSA during the Fee Reduction Period.
END OF REVISED SETTLEMENT TERM SHEET
Calderwood & Harkness LLP — Matter No. 1025-00006
CONFIDENTIAL — Subject to Rule 408 of the Federal Rules of Evidence and Applicable State Equivalents
Cost Category | Vendor / Description | Amount
Forensic Investigation | Graystone Forensics LLC | $1,847,000
Consumer Notification, Call Center, and Credit Monitoring | Clearfield Notification Services LLC | $3,214,500
Crisis Communications | BrightPath Consulting Group Inc. | $385,000
Outside Legal Counsel | Calderwood & Harkness LLP | $2,163,750
Internal Costs (IT Remediation, Employee Overtime) | Quorum Internal | $620,000 (est.)
Total Incident Response Costs | $8,230,250
Component | Amount
Cash Settlement Payment (Section 4.1) | $4,200,000
Aggregate Fee Reduction Value (Section 4.2) | $1,956,000
Total Effective Recovery | $6,156,000
Line Item | Vendor / Source | Description | Amount
1 | Graystone Forensics LLC | Forensic investigation, including network forensics, malware analysis, log review, data exfiltration scoping, and preparation of forensic investigation report | $1,847,000
2 | Clearfield Notification Services LLC | Consumer notification, call center operations, and credit monitoring services (detailed below) | $3,214,500
2a | — Clearfield (sub-item) | Notification printing and mailing (318,247 individualized notification letters across 29 states and D.C.) | $636,000
2b | — Clearfield (sub-item) | Call center operations (12-week operational window, staffed by trained representatives to handle consumer inquiries) | $478,500
2c | — Clearfield (sub-item) | Credit monitoring and identity theft protection services (24 months, negotiated flat fee covering all 318,247 affected individuals) | $2,100,000
3 | BrightPath Consulting Group Inc. | Crisis communications consulting, including media strategy, stakeholder communications, and policyholder messaging | $385,000
4 | Calderwood & Harkness LLP | Outside legal counsel fees, including regulatory compliance advice, state breach notification analysis (29 states + D.C.), HIPAA/HHS-OCR guidance, indemnification demand preparation, and settlement negotiations | $2,163,750
5 | Quorum Internal | Internal costs, including IT remediation (system hardening, credential rotation, network segmentation review), and employee overtime for incident response team members | $620,000 (est.)
TOTAL INCIDENT RESPONSE COSTS | $8,230,250

REVISED SETTLEMENT TERM SHEET

SIGNATURE PAGE

QUORUM INSURANCE HOLDINGS CORP.

PALOMAR DATA SOLUTIONS, INC.

ACKNOWLEDGED BY COUNSEL:

SCHEDULE A

SCHEDULE B

Record

Parties

Dates

Amounts