Contract analysis

I. Executive Summary This memorandum analyzes the breach notification obligations of Lumos Analytics Inc. ("Lumos" or the "Company") arising from the credential-stuffing incident that affected the Lumos Insight Platform between approximately June 12 and June 15, 2024 (the "Incident"). The analysis encompasses the notification requirements of all 50 U.S. states, the District of Columbia, Puerto Rico, the United Kingdo

II. Background and Factual Summary A. The Incident The Incident involved a credential-stuffing attack against the Lumos Insight Platform, an enterprise analytics and portfolio intelligence platform operated by Lumos Analytics Inc. In a credential-stuffing attack, a threat actor uses automated tools to inject large volumes of username-and-password pairs — typically obtained from an unrelated data breach — into the log

1. User profile information: Full name (first name and last name), email address, job title, and employer name. These fields are populated by the user during account registration and are displayed on the user's account profile page within the Lumos Insight Platform.

2. Phone number: A telephone number was populated in approximately 7,820 of the 11,438 accessed accounts (approximately 68.4%). The phone number field is an optional field in the Lumos Insight Platform user profile and is not required for account registration. For the remaining approximately 3,618 accounts, no phone number was stored.

3. Dashboard configurations and saved analytics queries: Each user's account contained proprietary business data belonging to the enterprise customer, including customized dashboard configurations, saved analytics queries, and visualization settings. While this data is potentially commercially sensitive to the enterprise customer, it does not constitute "personal information" of the individual user for purposes of br

4. Partial financial data via "Quick View" feature: In 2,614 accounts (representing 22.9% of the 11,438 affected accounts), the user had enabled the Quick View feature, which cached partial portfolio data on the user profile page for convenient reference. The data exposed through Quick View included: (a) Partial financial account numbers — specifically, the last four digits only of linked financial account numbers; (

1. No compromise of Lumos internal systems: Palisade found no evidence that Lumos's internal systems, databases, servers, or infrastructure were compromised during the Incident. The threat actor did not exploit any vulnerability in Lumos's application code, network architecture, or server configuration. All unauthorized access was accomplished exclusively through the Lumos Insight Platform's standard user-facing logi

2. External credential source confirmed: All unauthorized access was accomplished using valid user credentials that were obtained externally, from the VaultSync breach. Palisade correlated the credential pairs used in the attack against known VaultSync credential dumps and confirmed a high degree of overlap, establishing the VaultSync breach as the source of the credentials used in this Incident.

3. No malware or persistence mechanisms: No malware, backdoors, web shells, remote access tools, or other persistence mechanisms were deployed in any of the 11,438 accessed accounts or on any Lumos infrastructure. The threat actor's access was limited to the authenticated user sessions and terminated when those sessions ended.

4. No lateral movement or privilege escalation: The threat actor did not attempt to move laterally within the Lumos Insight Platform or escalate privileges beyond the standard user-level access associated with each compromised account. No administrative accounts were compromised, and no attempt to access underlying databases, APIs, or administrative functions was detected.

5. No evidence of bulk data exfiltration: Palisade found no evidence of bulk data exfiltration. The access sessions were consistent with automated credential validation rather than data harvesting. The median session duration of 4.2 seconds for the vast majority of sessions (11,301 of 11,438) is insufficient for meaningful data extraction beyond what is immediately displayed on the account profile page upon login. Th

6. Extended-session accounts reviewed individually: Palisade individually reviewed the 137 accounts with session durations exceeding 30 seconds. For each of these accounts, Palisade examined server-side access logs, page navigation records, data transfer logs, and available network traffic metadata. No evidence of data download, screenshot capture, print-to-file activity, or any other affirmative data extraction mech

III. Analytical Framework A. Overview of U.S. State Breach Notification Statutes All 50 U.S. states, the District of Columbia, Guam, Puerto Rico, and the U.S. Virgin Islands have enacted breach notification statutes that impose obligations on entities that own, license, or maintain computerized data containing personal information of residents of those jurisdictions. These statutes collectively form a patchwork of ov

1. Definition of "Personal Information" — Do the Exposed Data Elements Meet the Statutory Threshold? The central question in determining whether notification is required in each jurisdiction is whether the data elements exposed in the Incident meet that jurisdiction's statutory definition of "personal information" (or equivalent). The data elements at issue fall into two categories: For all 11,438 affected accounts:

3. Notification Timing and Deadlines State notification deadlines range from specific numerical requirements (30, 45, 60, or 90 days from the date of determination or discovery) to general standards such as "the most expedient time possible and without unreasonable delay." The determination date for deadline calculation purposes is July 15, 2024, as discussed in Section I above. Our recommended notification execution

4. Attorney General and Agency Notification Requirements Among the 50 states, the District of Columbia, and the U.S. territories, 34 states require notification to the state Attorney General or other designated state agency in connection with a breach notification. These requirements are subject to varying numerical thresholds — for example, some states require AG notification only when notification is provided to 25

IV. State-by-State Analysis — Key Jurisdictions This section provides detailed analysis for the states with the largest numbers of affected residents, the most restrictive notification deadlines, or the most complex analytical issues. A comprehensive summary of all 50 states, the District of Columbia, and U.S. territories is provided in Appendix A. A. California Statute: Cal. Civ. Code § 1798.82 (general breach notif