Contract analysis

I. Purpose and Context The purpose of this memorandum is to inform the Board of Directors of Lumos Analytics Inc. ("Lumos" or the "Company") and Ridgeline Capital Partners, LP ("Ridgeline"), in its capacity as majority equity holder and Series C lead investor since 2021, of a cybersecurity incident affecting the Lumos Insight Platform (the "Platform" or "Insight Platform"). This memorandum provides a comprehensive su

II. Executive Summary Between June 12 and June 15, 2024, Lumos Analytics Inc. experienced a credential-stuffing attack directed against the Lumos Insight Platform (version v4.7.2, build 4.7.2-rel-20240601). The attack involved the automated injection of compromised username and password pairs against the Platform's authentication endpoint. The credential pairs used in the attack originated from an unrelated data brea

III. Detailed Incident Description A. Attack Vector and Origin The incident involved a credential-stuffing attack, a well-known and increasingly common attack methodology in which a threat actor obtains a large set of compromised username and password pairs—typically from a prior, unrelated data breach—and uses automated tools to systematically inject those credentials against the login endpoint of a target applicati

IV. Forensic Investigation A. Retention and Privilege Palisade Digital Forensics, Inc. ("Palisade"), a nationally recognized digital forensics and incident response firm headquartered in Seattle, Washington, was retained on June 18, 2024, to conduct an independent forensic investigation of the credential-stuffing incident. The engagement lead for Palisade is Dr. Neil Frasier, Principal Consultant, who has over twenty

1. No evidence of compromise of Lumos's internal systems, databases, or infrastructure. Palisade examined system logs, file integrity monitoring data, and network traffic captures and found no evidence that the threat actors gained access to any Lumos system, server, database, or infrastructure component beyond the user-facing Insight Platform interface. The attack was confined entirely to the authentication layer an

2. All unauthorized access was accomplished using valid user credentials obtained externally. Palisade's analysis of the authentication logs confirmed that every successful unauthorized login was accomplished by presenting a valid username and password combination. No authentication bypass, brute-force attack, or exploitation of any software vulnerability was involved. The credential pairs match those known to have b

3. No malware or persistence mechanisms were deployed in any accessed account. Palisade examined the session data, browser artifacts (where available), and server-side state associated with the 11,438 unauthorized sessions and found no evidence that any malware, backdoor, web shell, or other persistence mechanism was deployed. There is no indication that the attackers attempted to establish ongoing access to any acco

4. No evidence of lateral movement or privilege escalation. The threat actors did not attempt to escalate privileges within the Insight Platform (e.g., by attempting to access administrative functions or other users' accounts) and did not attempt to move laterally from the user-facing Platform to other Lumos systems. Each unauthorized session was confined to the individual user account that was logged into.

5. No evidence of bulk data exfiltration. Palisade analyzed server-side network traffic logs and application-layer access logs and found no evidence of bulk data download, API-level data extraction, or other forms of data exfiltration during the unauthorized sessions. The access sessions were overwhelmingly short in duration—the median session duration was 4.2 seconds—consistent with automated credential validation o

6. Extended session analysis. Of the 11,438 unauthorized sessions, 137 accounts (approximately 1.2%) exhibited session durations exceeding 30 seconds, suggesting possible manual review by the threat actor (i.e., a human operator may have interacted with the session rather than relying solely on automated tools). Palisade conducted an individual review of each of these 137 sessions, examining server-side access logs f

V. Remediation Actions A. Immediate Containment (Completed) The following containment measures were executed on June 15–16, 2024, within hours of incident confirmation: Global Password Reset (June 15, 2024). A mandatory global password reset was initiated for all 286,000 registered Insight Platform users at approximately 20:30 UTC on June 15, 2024. All active sessions were terminated, and all users were required to c

VI. Notification Obligations and Timeline A. U.S. Multi-Jurisdictional Analysis Calderwood & Harkness LLP has completed a comprehensive analysis of the Company's notification obligations under the breach notification statutes of all 50 U.S. states, the District of Columbia, and the territories (with Puerto Rico being the only territory with affected residents). This analysis considered the categories of personal info

VII. Insurance Coverage The Company maintains a cyber liability insurance policy with NexTier Cyber Insurance Group ("NexTier"), headquartered in Chicago, Illinois. The material terms of the policy are as follows: • Carrier: NexTier Cyber Insurance Group • Policy Number: NXT-CYB-2024-07812 • Policy Period: January 1, 2024 – January 1, 2025 • Coverage Limit: $15,000,000 per occurrence / $30,000,000 aggregate • Retenti

VIII. Litigation and Regulatory Posture A. Regulatory Status As of the date of this memorandum, the Company has not received any enforcement action, formal or informal inquiry, civil investigative demand, or other communication from any state Attorney General, the Federal Trade Commission, or any other U.S. federal or state regulatory authority in connection with this incident. The Company's proactive AG notification

IX. Enterprise Customer Impact and Communications A total of 847 enterprise customer tenants had at least one affected user account among the 11,438 total accounts accessed during the incident. The impact varies significantly across the customer base, ranging from customers with a single affected account to Cascadia National Bancorp with 312 affected accounts. Many of the Company's enterprise customer agreements cont

X. Key Personnel Involved The following individuals have been materially involved in the Company's incident response and are the primary contacts for their respective organizations: Lumos Analytics Inc. • Marcus Tan — Chief Executive Officer • Deepika Narayanan — Chief Technology Officer • Allison Cho — General Counsel & Chief Privacy Officer • Brian Kowalski — Vice President of Engineering • Jason Haddad — Vice Pres

XI. Recommendations and Next Steps Based on the foregoing summary and in consultation with Calderwood & Harkness LLP, the undersigned recommends that the Board and Ridgeline consider and approve the following actions:

1. Approve the Notification Plan and Timeline. The Board should approve the Company's plan to file Attorney General notifications with 34 state AG offices between August 1 and August 5, 2024, and to deliver individual notifications to all 11,438 affected individuals on or about August 5, 2024, with concurrent enterprise customer notifications and UK/EU individual notifications on the same date. The notification plan

2. Authorize Continued Engagement of Outside Advisors. The Board should authorize the continued engagement of Calderwood & Harkness LLP (as breach response counsel), Palisade Digital Forensics, Inc. (for any supplemental forensic work if needed), Threshold Public Relations LLC (for ongoing crisis communications support), and Harmon Watts & Kendrick LLP (for UK/EU data protection matters) through the completion of the

3. Maintain Litigation Hold and Document Preservation. The Board should note and support the continuation of the internal litigation hold issued on June 18, 2024. All custodians and relevant personnel should continue to comply with the hold, and any questions regarding the scope of the hold should be directed to the undersigned General Counsel. The litigation hold will remain in effect until further notice.

4. Continue Monitoring for Regulatory Inquiries and Potential Litigation. The Company should continue to actively monitor for any regulatory inquiries, enforcement actions, or litigation filings arising from the incident. C&H has implemented automated monitoring for the Company's name in connection with data breach filings in federal and state courts. The undersigned will provide immediate notice to the Board and Rid

5. Evaluate Broader Security Posture. The Board should consider directing management to conduct a comprehensive evaluation of the Company's broader cybersecurity and data protection posture, with a view toward identifying and implementing long-term enhancements beyond the immediate remediation steps ta