September 20, 2017

[9/20/17, 10:38:37 AM] Jared Isaacman: Any luck?
[9/20/17, 10:38:44 AM] Jared Isaacman: Those backups I'm told are the real deal
[9/20/17, 10:41:03 AM] Randy Temming: Getting firewall changed now.
[9/20/17, 10:46:17 AM] Jared Isaacman: Excellent. Thank you
[9/20/17, 10:46:25 AM] Jared Isaacman: We're good people to take care of that entire family
[9/20/17, 10:47:38 AM] Randy Temming: We are good.  All traffic now on hold.
[9/20/17, 10:47:43 AM] Randy Temming: Thank you.
[9/20/17, 10:47:52 AM] Jared Isaacman: You guys are awesome
[9/20/17, 11:52:24 AM] Jared Isaacman: Firewall is rock solid now. Great job. A few requests.
[9/20/17, 11:52:50 AM] Jared Isaacman: Can we get some port forwards through that firewall, vpn, rdp
[9/20/17, 11:53:27 AM] Jared Isaacman: We got some very smart people in the LV office that I'm sure can make it very easy
[9/20/17, 11:53:44 AM] Jared Isaacman: Also, do we pwn their external DNS now?

September 20, 2017

[9/20/17, 11:59:00 AM] Jared Isaacman: Btw, CardConnect is still on auto-pilot and flying
[9/20/17, 11:59:21 AM] Jared Isaacman: So despite going Defcon 1, and capturing those backups, customer impact is zero
[9/20/17, 12:08:10 PM] Randy Temming: Correct.  No impact.  Just holding all changes so no risk.  Good.
[9/20/17, 12:16:21 PM] Jared Isaacman: So let's maybe think about where do we go from here
[9/20/17, 12:16:39 PM] Jared Isaacman: We caught the backups red handed. So we won that battle
[9/20/17, 12:17:02 PM] Jared Isaacman: We have the firewall on lockdown. So that battle is won too
[9/20/17, 12:18:07 PM] Jared Isaacman: But we need to keep things going as customers expect high availability and service levels from CC/we not constant service interruptions b/c of these battles
[9/20/17, 12:20:38 PM] Jared Isaacman: I do not want the next battle to use customer service against us. Get my point?
[9/20/17, 12:21:03 PM] Jared Isaacman: We need to look and feel like their IT support going forward and that's through being helpful.  I'm sure the LV staff can help punch the right holes in that firewall too
[9/20/17, 12:22:29 PM] Randy Temming: I agree.  I'm sure there are some easy wins here.  LV team needs to be engaged but they are all on site here till Friday.  I can have them get you the firewall rules
[9/20/17, 12:22:49 PM] Randy Temming: I do not own their DNS.  We need to get that.  Can we?
[9/20/17, 12:23:03 PM] Jared Isaacman: Ok. I'm sure they can VPN in (pun intended) to get the firewall rules
[9/20/17, 12:23:15 PM] Jared Isaacman: Yes we can get the DNS. Don (redacted) can do

September 18, 2017
[9/18/17, 1:48:07 PM] John Badovinac: The backups have been turned off

client
dev tun
proto tcp
sndbuf 524288
rcvbuf 524288
remote 107.23.79.90 1194
;remote my-server-2 1194
resolv-retry infinite
nobind
persist-key
persist-tun
;http-proxy-retry # retry on connection failures
;http-proxy [proxy server] [proxy port #]
mute-replay-warnings
ca /etc/openvpn/cardconnect/ca.crt
cert /etc/openvpn/cardconnect/cco-fw-keystone_keystone.crt
key /etc/openvpn/cardconnect/cco-fw-keystone_keystone.key
remote-cert-tls server
tls-auth /etc/openvpn/cardconnect/ta.key 1
;ns-cert-type server
cipher AES-256-CBC
keysize 256
comp-lzo
verb 3
keepalive 5 45
mute 10
route 10.20.2.0 255.255.255.0
route 10.20.12.0 255.255.255.0
route 10.20.5.0 255.255.255.0
route 10.20.15.0 255.255.255.0
route 10.20.16.0 255.255.255.0

mssfix 0

client
dev tun
proto tcp
sndbuf 524288
rcvbuf 524288
remote 69.197.48.138 1194
;remote my-server-2 1194
resolv-retry infinite
nobind
persist-key
persist-tun
;http-proxy-retry # retry on connection failures
;http-proxy [proxy server] [proxy port #]
mute-replay-warnings
ca /etc/openvpn/cardconnect/ca.crt
cert /etc/openvpn/cardconnect/cco-fw-king_king.crt
key /etc/openvpn/cardconnect/cco-fw-king_king.key
remote-cert-tls server
tls-auth /etc/openvpn/cardconnect/ta.key 1
;ns-cert-type server
cipher AES-256-CBC
keysize 256
comp-lzo
verb 3
keepalive 5 45
mute 10
route 10.17.1.0 255.255.255.0
route 10.17.2.0 255.255.255.0
route 10.17.3.0 255.255.255.0
route 10.17.4.0 255.255.255.0
route 10.17.15.0 255.255.255.0
route 10.17.11.0 255.255.255.0
route 10.17.12.0 255.255.255.0
route 10.17.16.0 255.255.255.0
route 10.17.14.0 255.255.254.0
mssfix 0

client
dev tun
proto tcp
sndbuf 524288
rcvbuf 524288
remote 69.197.48.146 1194
;remote my-server-2 1194
resolv-retry infinite
nobind
persist-key
persist-tun
;http-proxy-retry # retry on connection failures
;http-proxy [proxy server] [proxy port #]
mute-replay-warnings
ca /etc/openvpn/cardconnect/ca.crt
cert /etc/openvpn/cardconnect/cco-fw-doral_doral.crt
key /etc/openvpn/cardconnect/cco-fw-doral_doral.key
remote-cert-tls server
tls-auth /etc/openvpn/cardconnect/ta.key 1
;ns-cert-type server
cipher AES-256-CBC
keysize 256
comp-lzo
verb 3
keepalive 5 45
mute 10

route 10.99.14.0 255.255.255.0
route 10.99.4.0 255.255.255.0
route 10.99.3.0 255.255.255.0
route 10.99.16.0 255.255.255.0
route 10.99.15.0 255.255.255.0
route 10.99.2.0 255.255.255.0
route 10.99.5.0 255.255.255.0
route 10.99.11.0 255.255.255.0
route 10.99.12.0 255.255.255.0

mssfix 0

From:   Randy Temming
Sent:   Wednesday, September 20, 2017 11:30 AM
To: Jared Isaacman
Cc: Taylor Lavery; Kyle Kemberling; Charles Kallen
Subject:    FW: Card Connect Firewall

Jared

Here is the firewall info:

    • King of Prussia
o Public IP: 69.197.48.138:1194
o internal ip: 10.17.2.200
• Keystone
o Public IP: 1 07.23.79.90:1194
o Internal IP: 1 0.20.2.200

• Doral

    • Public IP: 69.197.48.146:1194

o Internal IP 10.99.2.200

From: Randy Temming
Sent: Wednesday, September 20, 2017 11:19 AM
To: Taylor Lavery; Kyle Kemberling; Charles Kallen
Subject: Card Connect Firewall
Importance: High

Team,

As per call, we need to add a block all rule on King of Prussia, Keystone and Doral firewalls ASAP.

No traffic should be allowed unless we allow it.

Thanks

Randy Temrning
Chief Operating Officer
Shift4 Corporation
Office: 702 597 2480 Ext. 43214
Mobile: (redacted)

From:   Jared Isaacman
Sent:   Sunday, September 17, 2017 8:26 PM
To: 'Chris Fox'; 'rfox@foxrothschild.com'
Cc: 'bruce.mann@wellsfargo.com'; 'John Badovinac'; 'JeffreyR. Nicholas'; Daniel Kallen; patti.eavey@cardconnect.com;
'abrunetti@firstdata.com'; 'jbrunst@firstdata.com'; 'kyle.baker@cardconnect.com'
Subject:    Card Connect

Chris,
Following up on my message from earlier today and in preparation of our call tomorrow, there are a number of additional
developments I wanted to share. Please keep in mind, that my intention throughout this entire transaction was to get to a
successful close so all parties ended up in a good and fair place and to put everyone at ease for the balance of our
escrow follow-on period. Nevertheless, regardless of the considerable restraint that Shift4 has exercised to date, there are
developments planned for this week that could impact that balanced approach. I believe these should all be discussed
openly.

I. First, please see the below message indicating Card Connect will be restoring production systems to the
Keystone environment this week. This clearly indicates an intention to migrate the environment.

From: Kyle Baker [mailto:kyle.baker@cardconnect.com]
Sent: Sunday, September 17, 2017 7:37 PM
To: Nick Schrock<nschrock@shift4.com>
Subject: Data Center question

Nick,

We need to restore our production systems back at Keystone this week.

Our prod VMs are not at a state at doral or king of Prussia were (sic) we can utilize them.
I need to verify before we start copying thing this week if that is an issue.

Thanks,
Kyle Baker | Director, IT Operations. | CardConnect
Direct +1.484.581.22751 Mobile (redacted)

II. Second, as you are aware, the Card Connect production systems were recently shutdown on short notice to
support the transition activities with First Data. As a result, a disaster recovery was initiated at the Keystone
data center. On or about last Wednesday evening, there was a total storage failure within, I believe, the
production Oracle environment at Keystone and it was not recoverable. I was informed of this event on
Thursday. Within hours Card Connect had requested the assistance of a former IT employee (redacted contact info on
document) who has been engaged with First Data since March to assist in restoring the
environment. It has since been communicated to Shift4 that it took a very long time to rebuild the Oracle
databases at Keystone. The reason provided was due to some unknown Linux issues and the inability to
restore from production database backups generated 24 hours prior to the transition. This matter was mentioned
on our Saturday morning call.

The explanation does not seem consistent with Shift4's technical experience. Restoring from Oracle RMAN
backups from 24 hours earlier should have been possible, especially in a disaster recovery scenario. This would
likely have taken only a number of hours, not days. Inconsistencies in Card Connect's actions and explanations
have raised concerns. These concerns were shared with Card Connect management throughout the weekend and
it was requested to keep backups available for Shift4s review.

III.    Third, and most importantly, as you are aware we have been operating under a Transition Services Agreement
since the closing on July 1. This agreement requires, an:1ongst other obligations, the non-solicitation of
employees. As we all recognized at the onset of the agreement, the period following the transaction was a
sensitive time for the overall Card Connect organization. This morning I was made aware that a Sr. Vice
President within the Card Connect organization, who provides leadership across the customer service and
technical support teams, provided notice of her resignation. I later learned through informal channels that the
same employee was entertaining offers from First Data, which is a violation of the Transition Services
Agreement. I mention this as it is only a single employee, although in a critical leadership role, and should this
occur with increasing frequency throughout the week, or within our planned customer follow-up/survey efforts
mentioned on our call of this past Saturday, we could be compelled to respond in all necessary and appropriate
ways.

In summary, I am very hopeful we can reach an agreement with the assistance of counsel and without outside action.
We do remain patient, committed to the process and confident in the quality of the people throughout both the
Shift4 and Card Connect organizations. I apologize for sending a message like this again on a Sunday evening but feel,
in light of recent events, it is best to get everyone on the phone as soon as possible early this week.