Appendix 8.pdf

Binder

Beazley Breach Response 5.0

BINDERBBR5.0

022025 ed.

Beazley Breach Response 5.0 Cyber Insurance Policy - Binder

Binder issued: 22-Dec-2025 Renewal of: D38D02240101

Hub International Midwest Limited - Columbia, SC Thomas Suggs 1330 Lady Street Columbia, SC 29201

RE: SC Education Lottery CONDITIONAL BINDER OF INSURANCE: Beazley Breach Response 5.0

Dear Thomas, Thank you for purchasing insurance with Beazley. We are pleased to offer the following conditional Binder for the above-referenced account as per the quotation letter dated 22-Dec-2025.

This insurance is through a surplus lines insurer on whose behalf we are authorized to act. Compliance with applicable laws including filings and payment of taxes and fees is the responsibility of the insured, the insurance agent or insurance broker. Please advise the license number of the surplus lines broker or surplus agent making the filing.

A condition precedent to coverage afforded by this conditional Binder is that no material change in the risk occurs and no submission is made to the insurer of a claim, circumstances that might give rise to a claim or actual or potential requirement to incur notification costs between the date of this conditional Binder and the inception of the proposed policy period.

Premiums must be remitted by the due date on the invoice.

This conditional Binder is valid through ninety (90) days from the date of this document.

Please do not hesitate to reach out to me if you have any questions.

Thank you for purchasing insurance with us.

Best regards, Cory Yost Beazley Group 6 Concourse Parkway NE Atlanta, GA 30328 t: 770-351-1774 e: cory.yost@beazley.com

Beazley | Beazley Breach Response 5.0 | Binder | Page 2 of 4

INSURED: SC Education Lottery

BINDERBBR5.0

022025 ed.

Coverage Schedule (currency in USD)

Limit

Breach Response

Notified Individuals: 1,000,000

Legal, Forensic & Public Relations/Crisis Management: $1,000,000

THE BREACH RESPONSE LIMITS ABOVE ARE IN ADDITION TO

THE POLICY AGGREGATE LIMIT OF LIABILITY

Policy Aggregate Limit of Liability: $5,000,000

Additional Breach Response Limit

Additional Breach Response Limit: $5,000,000

First Party Loss

Business Interruption Loss

Resulting from Security Breach: $5,000,000

Resulting from System Failure: $5,000,000

Computer Bricking Loss: $5,000,000

Dependent Business Interruption Loss

Resulting from Dependent Security Breach: $5,000,000

Resulting from Dependent System Failure: $5,000,000

Cyber Extortion Loss: $5,000,000

Data Recovery Costs: $5,000,000

Reputation Loss: $5,000,000

Proof of Loss Expenses: $50,000

Liability

Data & Network Liability: $5,000,000

Regulatory Defense & Penalties: $5,000,000

Payment Card Liabilities & Costs: $5,000,000

Media Liability: $5,000,000

Contingent Bodily Injury: $250,000 eCrime

Fraudulent Instruction: $250,000

Funds Transfer Fraud: $250,000

Telephone Fraud: $250,000

Invoice Manipulation: $250,000

Supplemental First Party Loss

Cryptojacking: $5,000,000

Criminal Reward: $50,000

Beazley | Beazley Breach Response 5.0 | Binder | Page 3 of 4

BINDERBBR5.0

022025 ed.

Retained Risk

Breach Response Retentions

Forensic & Public Relations/Crisis Mgmt: $200,000

Legal: $150,000

Breach Response Threshold

Notified Individuals: 250

Waiting Periods

Business Interruption: 10 hours

Dependent Business Interruption: 10 hours

Retentions

Each Incident, Claim or Loss: $500,000

Premium $149,750

General Information

Broker: Thomas Suggs Hub International Midwest Limited - Columbia, SC 1330 Lady Street Columbia, SC 29201

CC: Hub International Midwest Limited, Dena Cusick

Named Insured: SC Education Lottery

1333 Main Street Suite 400 Columbia, SC 29201

Underwriters: Beazley Excess and Surplus Insurance, Inc. (Non-Admitted)

Policy Information Policy Number: D38D02250201

Policy Period: From: 31-Dec-2025 To: 31-Dec-2026 Both at 12:01 a.m. Local Time at the Named Insured Address

Commission: 11.00% of the Policy Premium

Optional Extension Period & Premium:

12 Months at 100% of the Annual Policy Premium

Continuity Date: 31-Dec-2024

Policy Form: Beazley Breach Response 5.0 (F00653 022025 ed.)

Beazley | Beazley Breach Response 5.0 | Binder | Page 4 of 4

BINDERBBR5.0

022025 ed.

This policy provides coverage, for no additional charge, for loss arising out of “Certified Acts of Terrorism”, as that term is defined in The Terrorism Risk Insurance Act of 2002, as amended. See your policy for complete information regarding this coverage.

Endorsements Effective at Inception

1. E11122 012018 ed. Cap on Losses Arising Out of Certified Acts of Terrorism

2. E10596 022025 ed. Choice of Law and Service of Suit

• Service of suit: CT Corporation System, 67 Burnside Ave, East Hartford, CT 06108-3408

• Choice of law: New York

3. A01863 012024 ed. Nuclear Incident Exclusion Clause-Liability-Direct (Broad) (U.S.A.)

4. E17263 022025 ed. Policyholder Disclosure Notice of Terrorism Insurance Coverage

5. A01864 012024 ed. Radioactive Contamination Exclusion Clause-Liability-Direct (U.S.A.)

6. E16415 012024 ed. Sanction Limitation Clause

7. E15626 022025 ed. War and Cyber War Exclusion

8. E15876 022025 ed. Catastrophic First Party Loss Amendatory Endorsement (Full Limits)

9. E11290 072025 ed. GDPR Cyber Endorsement

10. E17278 022025 ed. Liberalization Endorsement

11. E10944 022025 ed. Post Breach Remedial Services Endorsement

12. E13372 022025 ed. State Consumer Privacy Statutes Endorsement

13. E12037 022025 ed. Amend Other Insurance Endorsement

• BICI or BUSA: TBD

• Policy number: TBD

14. E16588 022025 ed. Money Custodian Amendatory Endorsement

15. E14971 022025 ed. Music Copyright Exclusion

E11122

012018 ed.

Effective date of this Endorsement: 31-Dec-2025 This Endorsement is attached to and forms a part of Policy Number: D38D02250201 Beazley Excess and Surplus Insurance, Inc. Referred to in this endorsement as either the “Insurer” or the “Underwriters”

CAP ON LOSSES ARISING OUT OF CERTIFIED ACT OF TERRORISM

This endorsement modifies insurance provided under the following:

Beazley Breach Response 5.0

A. If aggregate insured losses attributable to “Certified Acts of Terrorism” exceed $100,000,000,000 in a calendar year and the Underwriters meet the applicable insurer deductible under the Terrorism Risk Insurance Act, the Underwriters are not liable for the payment of any portion of the amount of the losses exceeding $100,000,000,000. Insured losses up to that amount are subject to pro rata allocation in accordance with procedures established by the Secretary of the Treasury.

B. As used in this endorsement, “Certified Act of Terrorism” means any act that is certified by the Secretary of the Treasury, in consultation with the Secretary of Homeland Security and the Attorney General of the United States, to be an act of terrorism; to be a violent act or an act that is dangerous to human life, property, or infrastructure; to have resulted in damage within the United States, or outside the United States in the case of an air carrier or vessel or the premises of a United States mission; and to have been committed by an individual or individuals, as part of an effort to coerce the civilian population of the United States or to influence the policy or affect the conduct of the United States Government by coercion.

C. Terrorism exclusions, or the inapplicability or omission of a terrorism exclusion, do not create coverage for injury or damage otherwise excluded under this Policy.

All other terms, exclusions and conditions of the policy remain unchanged.

Authorized Representative

E10596

Effective date of this Endorsement: 31-Dec-2025 This Endorsement is attached to and forms a part of Policy Number: D38D02250201 Beazley Excess and Surplus Insurance, Inc. referred to in this endorsement as either the “Insurer” or the “Underwriters”

CHOICE OF LAW AND SERVICE OF SUIT

This endorsement modifies insurance provided under the following:

Beazley Breach Response 5.0

In consideration of the premium charged for the Policy, it is hereby understood and agreed that General Conditions is amended to include:

Service of Suit

It is agreed that in the event of the Underwriters’ failure to pay any amount claimed to be due under this Policy, the Underwriters will, at the Insured’s request, submit to the jurisdiction of a court of competent jurisdiction within the United States. Nothing in this provision constitutes or should be understood to constitute a waiver of the Underwriters’ rights to commence an action in any court of competent jurisdiction in the United States, to remove an action to a United States District Court, or seek a transfer of a case to another court as permitted by the laws of the United States or any state in the United States. It is further agreed that service of processing such suit may be made upon the Underwriters’ representative:

CT Corporation System, 67 Burnside Ave, East Hartford, CT 06108-3408 and that in any suit instituted against any one of them upon this contract, the Underwriters will abide by the final decision of such court or of any appellate court in the event of an appeal.

The person or entity named above is authorized and directed to accept service of process on the Underwriters’ behalf in any such suit and/or upon the Insured’s request to give a written undertaking to the Insured that they will enter a general appearance upon the Underwriters’ behalf in the event such a suit shall be instituted.

Pursuant to any statute of any state, territory, or district of the United States which makes provision therefore, the Underwriters hereby designate the Superintendent, Commissioner, or Director of Insurance or other officer specified for that purpose in the statute, or his successor in office, as their true and lawful attorney upon whom may be served any lawful process in any action, suit, or proceeding instituted by or on the Insured’s behalf or any beneficiary hereunder arising out of this Policy, and hereby designate the person or entity named above as the persons to whom said officer is authorized to mail such process or a true copy thereof.

Choice of Law

Any disputes involving this Policy will be resolved applying the law of the state of New York.

E10596

All other terms and conditions of this Policy remain unchanged.

A01863

012024 ed.

Effective date of this Endorsement: 31-Dec-2025 This Endorsement is attached to and forms a part of Policy Number: D38D02250201 Beazley Excess and Surplus Insurance, Inc. referred to in this endorsement as either the “Insurer” or the “Underwriters”

NUCLEAR INCIDENT EXCLUSION CLAUSE-LIABILITY-DIRECT (BROAD) (U.S.A.)

This endorsement modifies insurance provided under the following:

Beazley Breach Response 5.0

In consideration of the premium charged for the Policy, it is hereby understood and agreed that:

For attachment to insurances of the following classifications in the U.S.A., its Territories and Possessions, Puerto Rico and the Canal Zone:

Owners, Landlords and Tenants Liability, Contractual Liability, Elevator Liability, Owners or Contractors (including railroad) Protective Liability, Manufacturers and Contractors Liability, Product Liability, Professional and Malpractice Liability, Storekeepers Liability, Garage Liability, Automobile Liability (including Massachusetts Motor Vehicle or Garage Liability), not being insurances of the classifications to which the Nuclear Incident Exclusion Clause-Liability-Direct (Limited) applies.

This Policy* does not apply:

1. Under any Liability Coverage, to injury, sickness, disease, death or destruction:

(a) with respect to which an insured under the Policy is also an insured under a nuclear energy liability policy issued by Nuclear Energy Liability Insurance Association, Mutual Atomic Energy Liability Underwriters or Nuclear Insurance Association of Canada, or would be an insured under any such policy but for its termination upon exhaustion of its limit of liability; or

(b) resulting from the hazardous properties of nuclear material and with respect to which (1) any person or organization is required to maintain financial protection pursuant to the Atomic Energy Act of 1954, or any law amendatory thereof, or (2) the insured is, or had this Policy not been issued would be, entitled to indemnity from the United States of America, or any agency thereof, under any agreement entered into by the United States of America, or any agency thereof, with any person or organization.

2. Under any Medical Payments Coverage, or under any Supplementary Payments Provision relating to immediate medical or surgical relief, to expenses incurred with respect to bodily injury, sickness, disease or death resulting from the hazardous properties of nuclear material and arising out of the operation of a nuclear facility by any person or organization.

3. Under any Liability Coverage, to injury, sickness, disease, death or destruction resulting from the hazardous properties of nuclear material, if:

(a) the nuclear material (1) is at any nuclear facility owned by, or operated by or on behalf of, an insured or (2) has been discharged or dispersed therefrom;

(b) the nuclear material is contained in spent fuel or waste at any time possessed, handled, used, processed, stored, transported or disposed of by or on behalf of an insured; or

(c) the injury, sickness, disease, death or destruction arises out of the furnishing by an insured of services, materials, parts or equipment in connection with the planning, construction, maintenance, operation or use of any nuclear facility, but if such facility is located within the United States of America, its territories or possessions or Canada, this exclusion (c) applies only to injury to or destruction of property at such nuclear facility.

4. As used in this endorsement:

"hazardous properties" include radioactive, toxic or explosive properties;

"nuclear material" means source material, special nuclear material or by-product material;

"source material", "special nuclear material", and "by-product material" have the meanings given them in the Atomic Energy Act 1954 or in any law amendatory thereof;

"spent fuel" means any fuel element or fuel component, solid or liquid, which has been used or exposed to radiation in a nuclear reactor;

"waste" means any waste material (1) containing by-product material and (2) resulting from the operation by any person or organization of any nuclear facility included within the definition of nuclear facility under paragraph (a) or (b) thereof;

"nuclear facility" means:

(a) any nuclear reactor,

(b) any equipment or device designed or used for (1) separating the isotopes of uranium or plutonium, (2) processing or utilizing spent fuel, or (3) handling, processing or packaging waste,

(c) any equipment or device used for the processing, fabricating or alloying of special nuclear material if at any time the total amount of such material in the custody of the insured at the premises where such equipment or device is located consists of or contains more than 25 grams of plutonium or uranium 233 or any combination thereof, or more than 250 grams of uranium 235,

(d) any structure, basin, excavation, premises or place prepared or used for the storage or disposal of waste, and includes the site on which any of the foregoing is located, all operations conducted on such site and all premises used for such operations; "nuclear reactor" means any apparatus designed or used to sustain nuclear fission in a self-supporting chain reaction or to contain a critical mass of fissionable material. With respect to injury to or destruction of property, the word "injury" or "destruction" includes all forms of radioactive contamination of property.

It is understood and agreed that, except as specifically provided in the foregoing to the contrary, this clause is subject to the terms, exclusions, conditions and limitations of the Policy to which it is attached.

* NOTE: As respects policies which afford liability coverages and other forms of coverage in addition, the words underlined should be amended to designate the liability coverage to which this clause is to apply.

All other terms and conditions of this Policy remain unchanged.

E17263

Effective date of this Endorsement: 31-Dec-2025 This Endorsement is attached to and forms a part of Policy Number: D38D02250201 Beazley Excess and Surplus Insurance, Inc. referred to in this endorsement as either the “Insurer” or the “Underwriters”

POLICYHOLDER DISCLOSURE NOTICE OF

TERRORISM INSURANCE COVERAGE

You are hereby notified that under the Terrorism Risk Insurance Act of 2002, as amended ("TRIA"), insurance coverage provided by this Policy includes losses arising out of acts of terrorism, as defined in Section 102(1) of the Act, as amended: The term “act of terrorism” means any act that is certified by the Secretary of the Treasury, in consultation with the Secretary of Homeland Security and the Attorney General of the United States, to be an act of terrorism; to be a violent act or an act that is dangerous to human life, property, or infrastructure; to have resulted in damage within the United States, or outside the United States in the case of an air carrier or vessel or the premises of a United States mission; and to have been committed by an individual or individuals, as part of an effort to coerce the civilian population of the United States or to influence the policy or affect the conduct of the United States Government by coercion. Any coverage you purchase for "acts of terrorism" shall expire at 12:00 midnight December 31, 2027, the date on which the TRIA Program is scheduled to terminate, or the expiry date of the policy whichever occurs first, and shall not cover any losses or events which arise after the earlier of these dates.

YOU SHOULD KNOW THAT COVERAGE PROVIDED BY THIS POLICY FOR LOSSES CAUSED BY

CERTIFIED ACTS OF TERRORISM IS PARTIALLY REIMBURSED BY THE UNITED STATES UNDER

A FORMULA ESTABLISHED BY FEDERAL LAW. HOWEVER, YOUR POLICY MAY CONTAIN OTHER

EXCLUSIONS WHICH MIGHT AFFECT YOUR COVERAGE, SUCH AS AN EXCLUSION FOR

NUCLEAR EVENTS. UNDER THIS FORMULA, THE UNITED STATES PAYS 80%; OF COVERED

TERRORISM LOSSES EXCEEDING THE STATUTORILY ESTABLISHED DEDUCTIBLE PAID BY THE

INSURER(S) PROVIDING THE COVERAGE. YOU SHOULD ALSO KNOW THAT THE TERRORISM

RISK INSURANCE ACT, AS AMENDED, CONTAINS A USD100 BILLION CAP THAT LIMITS U.S.

GOVERNMENT REIMBURSEMENT AS WELL AS INSURERS' LIABILITY FOR LOSSES RESULTING

FROM CERTIFIED ACTS OF TERRORISM WHEN THE AMOUNT OF SUCH LOSSES IN ANY ONE

CALENDAR YEAR EXCEEDS USD100 BILLION. IF THE AGGREGATE INSURED LOSSES FOR ALL

INSURERS EXCEED USD100 BILLION, YOUR COVERAGE MAY BE REDUCED.

The portion of your annual premium that is attributable to coverage for certified acts of terrorism as defined in the Terrorism Risk Insurance Act of 2002, as amended, is $0.

A01864

Effective date of this Endorsement: 31-Dec-2025 This Endorsement is attached to and forms a part of Policy Number: D38D02250201 Beazley Excess and Surplus Insurance, Inc. referred to in this endorsement as either the “Insurer” or the “Underwriters”

RADIOACTIVE CONTAMINATION EXCLUSION CLAUSE-LIABILITY-DIRECT (U.S.A.)

This endorsement modifies insurance provided under the following:

Beazley Breach Response 5.0

In consideration of the premium charged for the Policy, it is hereby understood and agreed that:

For attachment (in addition to the appropriate Nuclear Incident Exclusion Clause-Liability-Direct) to liability insurances affording worldwide coverage.

In relation to liability arising outside the U.S.A., its Territories or Possessions, Puerto Rico or the Canal Zone, this Policy does not cover any liability of whatsoever nature directly or indirectly caused by or contributed to by or arising from ionising radiations or contamination by radioactivity from any nuclear fuel or from any nuclear waste from the combustion of nuclear fuel.

All other terms and conditions of this Policy remain unchanged.

E16415

Effective date of this Endorsement: 31-Dec-2025 This Endorsement is attached to and forms a part of Policy Number: D38D02250201 Beazley Excess and Surplus Insurance, Inc. Referred to in this endorsement as either the “Insurer” or the “Underwriters”

SANCTION LIMITATION CLAUSE

This endorsement modifies insurance provided under the following:

Beazley Breach Response 5.0

No (re)insurer shall be deemed to provide cover and no (re)insurer shall be liable to pay any claim or provide any benefit hereunder to the extent that the provision of such cover, payment of such claim or provision of such benefit would expose that (re)insurer to any sanction, prohibition or restriction under United Nations resolutions or the trade or economic sanctions, law or regulations of the European Union, United Kingdom or United States of America.

All other terms and conditions of this Policy remain unchanged.

E15626

Effective date of this Endorsement: 31-Dec-2025 This Endorsement is attached to and forms a part of Policy Number: D38D02250201 Beazley Excess and Surplus Insurance, Inc. referred to in this endorsement as either the “Insurer” or the “Underwriters”

WAR AND CYBER WAR EXCLUSION

This endorsement modifies insurance provided under the following:

Beazley Breach Response 5.0

In consideration of the premium charged for this Policy, it is hereby understood and agreed that:

1. Exclusions is amended to include:

War and Cyber War

The coverage under this Policy will not apply to any Loss arising:

1. directly or indirectly out of War; or

2. from a Cyber War.

This exclusion applies notwithstanding anything to the contrary in this Policy or any appendix or endorsement added to this Policy.

2. For the purposes of this endorsement only:

Cyber War means any harmful act, conducted using a Computer System (or series of related, repeated or continuing harmful acts conducted using one or more Computer System), directed against one or more Computer System that is committed by, or at the direction or under the control of, a sovereign state, and which:

1. is conducted as part of a War; or

2. causes a major detrimental impact on:

(i) the functioning of another sovereign state due to disruption to the availability, delivery or integrity of any Essential Service in that other sovereign state; and/or

(ii) the security or defense of another sovereign state, provided however that Cyber War shall not mean the direct or indirect effect of such harmful act(s) which causes a major detrimental impact on a sovereign state as described in parts 2.(i).

and/or 2.(ii) above, on a Computer System operated by and either owned by or leased to the Insured Organization or operated by a Dependent Business, that is not physically located in a sovereign state which has suffered such major detrimental impact described in parts 2.(i). and/or 2.(ii) above.

Computer System means computers, any software residing on such computers, and any associated devices or equipment.

E15626

Essential Service means a service that is essential for the maintenance of vital functions of a sovereign state, including but not limited to financial institutions and associated financial market infrastructure, emergency services, health services, utility services and/or services that are essential for the maintenance of the food, energy and/or transportation sector.

War means the use of physical force by a sovereign state against another sovereign state (whether war be declared or not) or as part of a civil war, rebellion, revolution, insurrection and/or military or usurped power.

All other terms and conditions of this Policy remain unchanged.

E15876

Effective date of this Endorsement: 31-Dec-2025 This Endorsement is attached to and forms a part of Policy Number: D38D02250201 Beazley Excess and Surplus Insurance, Inc. referred to in this endorsement as either the “Insurer” or the “Underwriters”

CATASTROPHIC FIRST PARTY LOSS AMENDATORY ENDORSEMENT (FULL LIMITS)

This endorsement modifies insurance provided under the following:

Beazley Breach Response 5.0

In consideration of the premium charged for this Policy, it is hereby understood and agreed that:

1. The following sections are added to the Coverage Schedule in the Declarations:

Catastrophic First Party Loss Aggregate Limit of Liability:

100% of the Policy Aggregate Limit of Liability

Catastrophic First Party Loss Sub-Limits:

Business Interruption Loss:

Resulting from Security Breach: 100% of applicable limit of liability set forth in the First Party Loss section

Resulting from System Failure: 100% of applicable limit of liability set forth in the First Party Loss section

Dependent Business Loss:

Resulting from Dependent Security Breach: 100% of applicable limit of liability set forth in the First Party Loss section

Resulting from Dependent System Failure: 100% of applicable limit of liability set forth in the First Party Loss section

Cyber Extortion Loss: 100% of applicable limit of liability set forth in the First Party Loss section

Data Recovery Costs: 100% of applicable limit of liability set forth in the First Party Loss section

2. The Limit of Liability and Coverage section is amended to include:

Catastrophic First Party Loss Limits

All Business Interruption Loss, Dependent Business Loss, Cyber Extortion Loss, and/or Data Recovery Costs that the Insured Organization sustains or incurs as a result of a Catastrophic Cyber Event will be subject to the applicable sub-limits of liability set forth in the Catastrophic First Party Loss Sub-Limits section of the Coverage Schedule in the Declarations.

Such sub-limits are in the aggregate, and are part of, and not in addition to, the applicable limits of liability set forth in the First Party Loss section of the Coverage Schedule in the Declarations.

Provided however that the Underwriter’s combined total limit of liability for all Business Interruption Loss, Dependent Business Loss, Cyber Extortion Loss, and/or Data Recovery Costs that the Insured Organization sustains or incurs as a result of a Catastrophic Cyber Event will be the Catastrophic First Party Loss Aggregate Limit of Liability set forth in the Coverage Schedule in the Declarations. Such limit shall be part of, and not in addition to, the Policy Aggregate Limit of Liability.

All Business Interruption Loss, Dependent Business Loss, Cyber Extortion Loss, and/or Data Recovery Costs that the Insured Organization sustains or incurs that is not as a result of a Catastrophic Cyber Event will remain subject to the limits of liability set forth in the First Party Loss section of the Coverage Schedule in the Declarations.

3. The Definitions section is amended to include:

Affiliate means any entity directly or indirectly controlled by, or under common control with, a Scheduled Cloud Service Provider (or any successor of such entity).

Application Program means any computer software program that performs a particular function or task within the Computer Operating System for the end-user, including but not limited to database programs, web browsers, enterprise software, word processors, graphics software and media players.

Catastrophic Cyber Event means any Security Breach, System Failure, Dependent Security Breach, Dependent System Failure or Extortion Threat arising out of a Cloud Services Provider Event or Operating System Event.

Cloud Services Provider Event means a single partial or complete failure, interruption or malfunction of (or series of related, repeated or continuing partial or complete failures, interruptions or malfunctions of) cloud services provided by a Scheduled Cloud Service Provider that exceeds 72 consecutive hours.

Computer Operating System means computer system software that manages or administers computer hardware, software resources, or provides common services to run an Application Program. For the avoidance of doubt, Computer Operating System shall not mean Application Program.

Essential Service means a service that is essential for the maintenance of vital functions of a sovereign state, including but not limited to financial institutions and associated financial market infrastructure, emergency services, health services, utility services and/or services that are essential for the maintenance of the food, energy and/or transportation sector.

Operating System Event means a single act of exploitation of (or series of related, repeated or continuing acts of exploitation of) software vulnerabilities in a Computer Operating System, including but not limited to ransomware, wiper malware, computer worms, and computer viruses, which causes a major detrimental impact on the functioning of a sovereign state due to disruption of the availability, delivery, or integrity of any Essential Service in that sovereign state.

Scheduled Cloud Service Provider means Amazon Web Services, Inc., Microsoft Corporation, Google LLC, or International Business Machines Corporation (or any successor of any of the foregoing) and any Affiliate of any of the foregoing that provides cloud services.

4. The General Conditions is amended to include:

First Party Loss Adjustment

The Underwriters may rely on any available evidence which is reasonable in determining whether any Business Interruption Loss, Dependent Business Interruption Loss, Cyber Extortion Loss and/or Data Recovery Costs arises from a Catastrophic Cyber Event or not. Such available evidence may include information from governments, computer forensics experts, or any other credible sources as to the nature, circumstances, or causes of the event. The Underwriters may also rely on available evidence gathered from any proof of loss provided by the Named Insured.

All other terms and conditions of this Policy remain unchanged.

E11290

072025 ed.

Effective date of this Endorsement: 31-Dec-2025 This Endorsement is attached to and forms a part of Policy Number: D38D02250201 Beazley Excess and Surplus Insurance, Inc. referred to in this endorsement as either the “Insurer” or the “Underwriters”

GDPR CYBER ENDORSEMENT

This endorsement modifies insurance provided under the following:

Beazley Breach Response 5.0

In consideration of the premium charged for the Policy, it is hereby understood and agreed that the Data & Network Liability insuring agreement is amended by the addition of:

5. non-compliance with the following obligations under the EU General Data Protection Regulation (or legislation in the relevant jurisdiction implementing this Regulation):

(i) Article 5.1(f), also known as the Security Principle;

(ii) Article 32, Security of Processing;

(iii) Article 33, Communication of a Personal Data Breach to the Supervisory Authority; or

(iv) Article 34, Communication of a Personal Data Breach to the Data Subject.

All other terms and conditions of this Policy remain unchanged.

E17278

Effective date of this Endorsement: 31-Dec-2025 This Endorsement is attached to and forms a part of Policy Number: D38D02250201 Beazley Excess and Surplus Insurance, Inc. referred to in this endorsement as either the “Insurer” or the “Underwriters”

LIBERALIZATION ENDORSEMENT

This endorsement modifies insurance provided under the following:

Beazley Breach Response 5.0

In consideration of the premium charged for the Policy, it is hereby understood and agreed that the Insured shall receive the benefit of the broader terms and conditions of this Policy or the expiring Beazley Breach Response Policy, except in relation to the Policy Period, the Optional Extension Period, the Limit of Liability and the Retentions of this Policy or with respect to any limitation in any Endorsement attaching to this Policy.

The Underwriters will not be obligated to issue this Endorsement on any renewal of this Policy.

All other terms and conditions of this Policy remain unchanged.

E10944

Effective date of this Endorsement: 31-Dec-2025 This Endorsement is attached to and forms a part of Policy Number: D38D02250201 Beazley Excess and Surplus Insurance, Inc. referred to in this endorsement as either the “Insurer” or the “Underwriters”

POST BREACH REMEDIAL SERVICES ENDORSEMENT

This endorsement modifies insurance provided under the following:

Beazley Breach Response 5.0

In consideration of the premium charged for the Policy, it is hereby understood and agreed that:

1. Following a covered Data Breach or Security Breach involving the actual Unauthorized Access or Use of the Insured Organization’s Computer Systems, the Insured Organization is eligible to receive Post Breach Remedial Services.

Post Breach Remedial Services means up to 100 hours per Policy Period of post-breach computer security consultation and remedial services to be provided by Beazley Security. Such services will be provided at the Insured Organization’s request as per the description of services attached to this endorsement. Post Breach Remedial Services will be considered Breach Response Services and will be available in response to incidents in which forensic services and costs covered under parts 2. and 3. of the definition of Breach Response Services have been provided, subject to the applicable Retention. Post Breach Remedial Services will not include any costs to purchase or upgrade any hardware or software.

To access Post Breach Remedial Services, the Insured Organization must:

1. notify the Underwriters that they desire to receive such services; and

2. enter into an engagement agreement with Beazley Security to receive such services, within sixty (60) days following a determination of the actual Unauthorized Access or Use of the Insured Organization’s Computer Systems.

All other terms and conditions of this Policy remain unchanged.

E13372

Effective date of this Endorsement: 31-Dec-2025 This Endorsement is attached to and forms a part of Policy Number: D38D02250201 Beazley Excess and Surplus Insurance, Inc. referred to in this endorsement as either the “Insurer” or the “Underwriters”

STATE CONSUMER PRIVACY STATUTES ENDORSEMENT

This endorsement modifies insurance provided under the following:

Beazley Breach Response 5.0

In consideration of the premium charged for the Policy, it is hereby understood and agreed that:

1. The Policy is amended to include the following State Consumer Privacy Statutes insuring agreement:

State Consumer Privacy Statutes

To pay Penalties and Claims Expenses which the Insured is legally obligated to pay because of any Regulatory Proceeding first made against any Insured during the Policy Period for a violation of the California Consumer Privacy Act or any similar state statutes or state regulations specifically governing the Insured Organization’s collection, use, disclosure, sale, processing, profiling, acquisition, sharing, maintenance, retention or storage of or provision of access to personal information or personal data as defined under the California Consumer Privacy Act or similar state statutes or state regulations.

2. The definition of Claim is amended to include the following:

4. institution of a Regulatory Proceeding against any Insured under the State Consumer Privacy Statutes insuring agreement for a violation of the California Consumer Privacy Act or any similar state statutes or state regulations specifically governing the Insured Organization’s collection, use, disclosure, sale, processing, profiling, acquisition, sharing, maintenance, retention or storage of or provision of access to personal information or personal data as defined under the California Consumer Privacy Act or similar state statutes or state regulations.

3. The Governmental Actions exclusion and part 1. of the Gathering or Distribution of Information exclusion will not apply to the State Consumer Privacy Statutes insuring agreement.

4. Solely with respect to the State Consumer Privacy Statutes insuring agreement, the Trade Practices and Antitrust exclusion is deleted in its entirety and replaced with the following:

Trade Practices any actual or alleged false, deceptive or unfair trade practices or unfair competition; but this exclusion will not apply to coverage under the State Consumer Privacy Statutes insuring agreement, provided no member of the Control Group participated in or colluded in the activities or incidents giving rise to coverage under such insuring agreement;

Antitrust any actual or alleged antitrust violation, restraint of trade, false, deceptive or misleading advertising or violation of the Sherman Antitrust Act, the Clayton Act, or the Robinson- Patman Act;

E13372

All other terms and conditions of this Policy remain unchanged.

E12037

Effective date of this Endorsement: 31-Dec-2025 This Endorsement is attached to and forms a part of Policy Number: D38D02250201 Beazley Excess and Surplus Insurance, Inc. referred to in this endorsement as either the “Insurer” or the “Underwriters”

AMEND OTHER INSURANCE ENDORSEMENT

This endorsement modifies insurance provided under the following:

Beazley Breach Response 5.0

In consideration of the premium charged for the Policy, it is hereby understood and agreed that Other Insurance under General Conditions is deleted in its entirety and replaced with the following:

Other Insurance

The insurance under this Policy will apply in excess over the commercial crime insurance policy issued by TBD Policy Number: TBD, and any other valid and collectible insurance available to any Insured unless such other insurance is written only as specific excess insurance over this Policy.

All other terms and conditions of this Policy remain unchanged.

E16588

Effective date of this Endorsement: 31-Dec-2025 This Endorsement is attached to and forms a part of Policy Number: D38D02250201 Beazley Excess and Surplus Insurance, Inc. referred to in this endorsement as either the “Insurer” or the “Underwriters”

MONEY CUSTODIAN AMENDATORY ENDORSEMENT

This endorsement modifies insurance provided under the following:

Beazley Breach Response 5.0

In consideration of the premium charged for the Policy, it is hereby understood and agreed that:

1. The eCrime insuring Agreement is amended to include the following at the end thereof:

It is understood and agreed that coverage under the eCrime insuring agreement does not extend to any loss, transfer or theft of Money or Securities of others in the care, custody or control of the Insured, or in the event of Invoice Manipulation, the inability to collect Money or Securities on behalf of others.

2. The Trading Losses, Loss of Money & Discounts Exclusion is deleted in its entirety and replaced with the following:

Trading Losses, Loss of Money & Discounts

1. any trading losses, trading liabilities or change in value of accounts;

2. any loss, transfer or theft of monies, securities or tangible property of the Insured; or

3. any loss, transfer or theft of monies, securities, or tangible property of others in the care, custody, or control of the Insured;

4. the monetary value of any transactions or electronic fund transfers by or on behalf of the Insured which is lost, diminished, or damaged during transfer from, into or between accounts; or

5. the value of coupons, price discounts, prizes, awards, or any other valuable consideration given in excess of the total contracted or expected amount;

but this exclusion will not apply to coverage under the eCrime insuring agreement for any direct financial loss sustained by the Insured.

All other terms and conditions of this Policy remain unchanged.

E14971

Effective date of this Endorsement: 31-Dec-2025 This Endorsement is attached to and forms a part of Policy Number: D38D02250201 Beazley Excess and Surplus Insurance, Inc. referred to in this endorsement as either the “Insurer” or the “Underwriters”

MUSIC COPYRIGHT EXCLUSION

This endorsement modifies insurance provided under the following:

Beazley Breach Response 5.0

In consideration of the premium charged for the Policy, it is hereby understood and agreed that:

1. The Exclusions section is amended to include the following exclusion:

Music Copyright infringement, directly or indirectly, of the copyright of any musical work (including any accompanying words), audiovisual work, or sound recording, by the Insured Organization or anyone acting on behalf of the Insured Organization, on (a) the Insured Organization’s websites or social media accounts; or (b) the websites or social media accounts of anyone receiving compensation from the Insured Organization. For purposes of this endorsement, social media includes but is not limited to YouTube, Twitter, Facebook, Instagram, and TikTok;

All other terms and conditions of this Policy remain unchanged.