Contract analysis

I. EXECUTIVE SUMMARY Calderwood & Harkness LLP ("C&H") was engaged on June 18, 2024, to serve as lead outside breach response counsel for Lumos Analytics Inc. ("Lumos" or the "Company") in connection with a credential-stuffing attack affecting the Company's Lumos Insight Platform. This memorandum provides our preliminary assessment of the incident based on the information available to date, including the preliminary

II. BACKGROUND A. Lumos Analytics Inc. — Company Overview Lumos Analytics Inc. is a Delaware corporation headquartered at 450 Folsom Street, Suite 1200, San Francisco, California 94105. The Company operates the Lumos Insight Platform, a software-as-a-service ("SaaS") fintech analytics platform that provides advanced data analytics, portfolio analytics, risk modeling, and reporting tools primarily to financial institu

III. FACTUAL SUMMARY OF THE INCIDENT A. Origin of Compromised Credentials — VaultSync Technologies, Inc. Breach On May 28, 2024, VaultSync Technologies, Inc. ("VaultSync"), a California-based consumer cloud storage provider, publicly disclosed that it had experienced a data breach resulting in the unauthorized access to and exfiltration of user credential data, including email addresses and hashed passwords, for a si

1. Forced Global Password Reset. A mandatory password reset was initiated for all approximately 286,000 registered user accounts on the Lumos Insight Platform. All active sessions were terminated, and all existing passwords were invalidated. Users were required to establish new passwords upon their next login attempt. This measure was designed to immediately invalidate any compromised credentials still in the possess

2. IP blocking. The 1,247 identified offending source IP addresses and their associated IP ranges were blocked at the network edge via updates to the Company's WAF rules and firewall access control lists. This blocking was applied at both the CDN layer and the origin server layer to ensure comprehensive coverage.

3. Incident Response Team Activation. Lumos's internal incident response team was formally activated and incident escalation procedures were initiated in accordance with the Company's written Incident Response Plan (last updated March 2024). The incident was assigned internal incident tracking number LUM-IR-2024-0047. Additional Immediate Remediation (June 16, 2024). On June 16, 2024, following further analysis by th

1. User Profile Information (All 11,438 Accessed Accounts). For all 11,438 accounts in which the threat actors successfully authenticated, the authenticated session would have provided access to the user profile information stored on the Lumos Insight Platform. The user profile page contains the following data elements: • Full name (first name and last name) • Email address (the email address used as the account user

2. Cached Partial Financial Data — Quick View Feature (2,614 Accounts). In 2,614 accounts (representing 22.9% of the 11,438 total accessed accounts), the individual user had enabled a feature designated "Quick View." The Quick View feature was an optional convenience feature that cached a summary snapshot of the user's portfolio data on the user profile page, allowing the user to view high-level portfolio information

3. Data Not Stored or Accessible. It is significant to note that the Lumos Insight Platform does not store the following data elements in user-facing profile pages or in any interface accessible through the authenticated user interface: • Social Security numbers or national identification numbers of any kind • Full financial account numbers, routing numbers, or IBAN numbers (only last-four-digit truncated numbers wer

1. No compromise of Lumos internal systems, databases, or infrastructure. The threat actors did not breach Lumos's network perimeter, exploit any software vulnerability in the Insight Platform codebase, gain access to backend databases, compromise any administrative account, or access any system or resource beyond what was available through the standard authenticated user interface. All unauthorized access was accomp

2. No malware or persistence mechanisms. No malware, backdoors, web shells, remote access tools, or other persistence mechanisms were deployed in or through any of the 11,438 accessed accounts. The threat actors did not modify any account settings, install any plugins or integrations, or take any action that would provide ongoing access beyond the individual authenticated session.

3. No lateral movement or privilege escalation. The accessed accounts were used only at the permission level of the individual user; no evidence was found that any account was used to escalate privileges, access administrative functions, view data belonging to other users, or move laterally to other accounts or systems within the Lumos Insight Platform or the broader Lumos corporate environment.

4. No evidence of bulk data exfiltration. As described above in Section III.E, session duration patterns are consistent with automated credential validation rather than data harvesting, and no server-side evidence of data export activity was detected. 5. 137 extended-session accounts require further review. These accounts will be the subject of individual, detailed analysis in Palisade's final investigation report, w

IV. PRELIMINARY LEGAL ANALYSIS — U.S. BREACH NOTIFICATION OBLIGATIONS A. General Framework All 50 U.S. states, the District of Columbia, and the U.S. territories (including Puerto Rico, Guam, and the U.S. Virgin Islands) have enacted data breach notification statutes that impose obligations on entities that experience a breach of security involving the personal information of residents of those jurisdictions. While t

V. UK AND EU DATA PROTECTION CONSIDERATIONS A. ICO Notification Lumos maintains a London office located at 25 Worship Street, 4th Floor, London EC2A 2DX, and provides services to UK and EU-based enterprise clients through its Lumos Insight Platform. Based on user registration address data, approximately 814 UK-resident user accounts were among the 11,438 accounts accessed during the credential-stuffing attack. Under

VI. INSURANCE COVERAGE STATUS Lumos maintains a cyber liability and technology errors and omissions insurance policy issued by NexTier Cyber Insurance Group. The key terms of the policy are as follows: • Insurer: NexTier Cyber Insurance Group • Policy Number: NXT-CYB-2024-07812 • Policy Period: January 1, 2024 through January 1, 2025 • Coverage Limit: $15,000,000 per occurrence / $30,000,000 aggregate • Self-Insured

VII. IMMEDIATE REMEDIATION ACTIONS TAKEN BY LUMOS The following remediation actions have been completed by Lumos's engineering and security teams as of the date of this memorandum:

1. Global Password Reset. A mandatory password reset was executed for all approximately 286,000 registered user accounts on the Lumos Insight Platform. This action was completed on June 15, 2024, at approximately 20:30 UTC. All active sessions were terminated, all existing passwords were invalidated, and all users were required to establish new credentials upon their next login attempt.

2. IP blocking. The 1,247 identified source IP addresses associated with the credential-stuffing attack, along with associated IP ranges identified through CIDR analysis, were blocked at the network edge through WAF rule updates and firewall access control list modifications. This action was completed on June 15, 2024.

3. Quick View Feature Permanently Disabled. The Quick View feature, which had cached partial portfolio data (including partial financial account numbers, account balances, and asset allocation summaries) on user profile pages, was permanently disabled across the Lumos Insight Platform. This action was completed on June 16, 2024. The cached data associated with Quick View has been purged from the application layer. Th

4. Internal Litigation Hold. A comprehensive internal litigation hold was issued on June 18, 2024. The hold covers all incident-related records, system logs, access logs, authentication logs, network traffic captures, communications (including email, Meridian Solutions, and instant messaging), forensic images, backup media, and any other documents or electronically stored information relating to the credential-stuffi

VIII. RECOMMENDATIONS AND NEXT STEPS Based on the preliminary forensic findings and legal analysis set forth above, C&H recommends the following actions and next steps:

1. Await Palisade Final Forensic Report. Palisade anticipates delivering its final investigation report in mid-July 2024. The final report will include: (a) an individual, account-level review of the 137 extended-session accounts identified in the preliminary findings; (b) a definitive assessment of exfiltration risk across all 11,438 accessed accounts; (c) a comprehensive scope confirmation, including final affected

2. Comprehensive Multi-Jurisdictional Notification Analysis. C&H will prepare and deliver a comprehensive 50-state + D.C. + territories + UK/EU notification obligations analysis memorandum promptly following receipt of the final forensic report. As described in Section IV.D above, this analysis will identify all jurisdictions in which notification is required, the applicable deadlines, content and formatting requirem

3. Notification Preparation. Lumos should begin the process of engaging a notification vendor for the logistics of individual and Attorney General notifications. C&H recommends coordinating with Sentinel Identity Services, Inc. for both notification mailing and email logistics and the provision of credit monitoring and identity theft protection services to affected individuals. Sentinel is a well-regarded provider in

4. Credit Monitoring. C&H recommends that Lumos offer 24 months of complimentary credit monitoring and identity theft protection services to all 11,438 affected individuals, regardless of whether the specific data elements accessed in a given individual's account technically trigger a notification obligation in their state of residence. While this approach may result in providing credit monitoring to individuals who

5. Enterprise Customer Communications. Lumos should begin preparing customer-facing communications for the 847 affected enterprise customer tenants whose individual users were among the 11,438 accessed accounts. These communications should inform each affected enterprise customer of the incident, describe the nature and scope of the unauthorized access affecting their users, summarize the containment and remediation

6. Board and Investor Notification. Under the Stockholders' Agreement between Lumos and Ridgeline Capital Partners, LP, the Company is required to notify Ridgeline of material security incidents that may affect the Company's operations, financial condition, or legal posture. C&H recommends that General Counsel Allison Cho prepare a formal memorandum to the Lumos Board of Directors and to Ridgeline Capital Partners, L

7. Preserve Litigation Readiness. Although no litigation has been filed or threatened as of the date of this memorandum, credential-stuffing and data breach incidents of this nature and scale — particularly those involving financial data elements and affecting a significant number of individuals — frequently result in putative class action complaints alleging negligence, breach of contract, violations of state consum