Contract analysis

I. Executive Summary The purpose of this memorandum is to provide a comprehensive closeout summary of all actions taken by Calderwood & Harkness LLP ("C&H") during the engagement opened on June 18, 2024, in response to the credential-stuffing incident affecting Lumos Analytics Inc.'s ("Lumos" or the "Company") Insight Platform (the "Incident"). This memorandum is intended to serve as a privileged record of the matter

II. Background: The Incident A. Attack Overview The Incident involved a credential-stuffing attack — the automated, high-volume injection of username and password pairs obtained from a data breach of an unrelated third-party service — against the authentication endpoints of the Lumos Insight Platform. Credential-stuffing attacks exploit the common practice of password reuse among individuals who use the same email ad

III. Engagement of Counsel and Key Advisors A. Calderwood & Harkness LLP (Lead Breach Response Counsel) C&H was engaged as lead breach response counsel on June 18, 2024, three days after Lumos confirmed the Incident. The engagement was opened under C&H Matter No. 1008-00009. The engagement team comprises the following attorneys, all of whom are members of the firm's Privacy & Data Security practice group in the San F

IV. Forensic Investigation Results and Timeline A. Preliminary Findings Palisade commenced its forensic investigation immediately upon retention on June 18, 2024. Palisade's investigators worked with Lumos's security and engineering teams to collect and preserve relevant log data, authentication records, session metadata, and system images. Palisade delivered a preliminary findings memorandum to C&H on June 26, 2024,

1. No Compromise of Internal Systems. There was no evidence of any compromise to Lumos's internal systems, databases, or infrastructure. All unauthorized access was accomplished exclusively through the use of valid user credentials obtained externally from the VaultSync breach. The threat actors did not exploit any vulnerability in the Insight Platform's code, infrastructure, or configurations; rather, they leveraged

2. No Malware or Persistence Mechanisms. No malware, backdoors, web shells, or other persistence mechanisms were deployed in or through any of the 11,438 accessed accounts. The threat actors did not install any software or modify any system files.

3. No Lateral Movement or Privilege Escalation. There was no evidence of lateral movement within the Insight Platform environment or of any privilege escalation beyond the permissions of the individual user accounts that were accessed. Each unauthorized session was confined to the scope of the individual user account that was authenticated.

4. No Evidence of Bulk Data Exfiltration. Critically, Palisade found no evidence of bulk data exfiltration from any accessed account. An analysis of session duration data revealed that the median session duration for the 11,438 unauthorized access events was 4.2 seconds per session. This extremely short session duration is consistent with automated credential validation — commonly referred to as "account checking" —

5. Accounts with Extended Session Duration. Palisade identified 137 accounts in which session durations exceeded 30 seconds, suggesting the possibility of manual review by the threat actor or a more deliberate interaction with the account contents. Palisade conducted an individual review of the server logs for each of these 137 accounts. Upon that review, no evidence of data download, export, or screenshot activity w

V. Multi-Jurisdictional Breach Notification Compliance A. United States — Individual Notifications

1. Notification Analysis Summary C&H conducted a comprehensive multi-jurisdictional breach notification analysis to determine which U.S. state statutes required individual notification to affected residents. Because the 11,438 affected individuals resided across all 50 states, the District of Columbia, and Puerto Rico, C&H analyzed the breach notification laws of each of these jurisdictions. The resulting analysis wa

2. Notification Execution The determination date — the date on which Lumos had sufficient information to determine the scope and nature of the exposure — was established as July 15, 2024, the date on which Palisade delivered its final forensic report. Based on this determination date, C&H calculated the applicable statutory deadlines across all relevant jurisdictions. The most restrictive deadlines were as follows: •

VI. Credit Monitoring and Identity Theft Protection As part of its remediation response, Lumos offered 24 months of complimentary credit monitoring and identity theft protection services to all 11,438 affected individuals. These services are being provided through Sentinel Identity Services, Inc. ("Sentinel"). The offering includes three-bureau credit monitoring, identity theft detection alerts, and identity restorat

VII. Technical Remediation Measures Implemented by Lumos In addition to the legal and notification workstreams managed by C&H, Lumos implemented a comprehensive set of technical remediation measures designed to address the specific attack vector exploited in the Incident and to reduce the risk of similar attacks in the future. These measures were overseen by Brian Kowalski, VP of Engineering, and Jason Haddad, VP of

1. Global Password Reset. A mandatory password reset was executed for all approximately 286,000 Insight Platform user accounts, invalidating all active sessions and requiring users to establish new credentials upon next login. This measure was completed by approximately 20:30 UTC on June 15, 2024.

2. IP Address blocking. A total of 1,247 unique source IP addresses associated with the credential-stuffing attack were identified through analysis of authentication logs and blocked at the platform's web application firewall and network perimeter. This measure was completed by approximately 20:30 UTC on June 15, 2024.

3. Permanent Disabling of "Quick View" Cached Data Feature. The Quick View feature, which had cached partial portfolio data (including partial financial account numbers, account balances, and asset allocation summaries) within the user dashboard for rapid retrieval, was permanently disabled. All cached data associated with the feature was purged from the platform. This measure was completed on June 16, 2024. B. Enhan

4. Advanced Bot-Detection and CAPTCHA Deployment. Advanced bot-detection technology and CAPTCHA challenges were deployed on all Insight Platform login endpoints to detect and block automated credential injection attempts. The CAPTCHA challenge presents an interactive verification step that is designed to distinguish between human users and automated scripts, thereby significantly increasing the difficulty and cost of

5. Mandatory Multi-Factor Authentication (MFA). Mandatory multi-factor authentication was rolled out for all Insight Platform user accounts. Users are now required to authenticate using a second factor — either a time-based one-time password ("TOTP") generated by an authenticator application, or a push notification to a registered mobile device — in addition to their username and password. MFA is now a mandatory requ

6. Rate-Limiting on Authentication Endpoints. The rate limit on the Insight Platform's authentication endpoints was reduced from 100 login attempts per minute per source IP address to 10 login attempts per minute per source IP address. This measure was implemented concurrently with the CAPTCHA deployment on July 8, 2024. The reduced rate limit significantly constrains the throughput of automated credential-stuffing t

7. Credential-Screening Service Integration. A credential-screening service was integrated into the Insight Platform's authentication and password-change workflows. This service checks user passwords against known breach databases (including the Hollowell Services Inc. API and proprietary breach intelligence feeds) at the time of login and at the time of password change events. Users whose passwords are found in know

VIII. Insurance Coverage and Cost Summary A. Policy Details Lumos maintains a cyber liability insurance policy with NexTier Cyber Insurance Group ("NexTier"), which provides coverage for costs incurred in connection with data security incidents, including forensic investigation, legal fees, notification costs, credit monitoring, crisis communications, and related expenses. The relevant policy details are as follows:

IX. Litigation Posture A. Filed Litigation As of the date of this memorandum, September 27, 2024, no lawsuits have been filed against Lumos Analytics Inc. in any jurisdiction in connection with the credential-stuffing incident. C&H has monitored federal and state court dockets and has not identified any complaints naming Lumos as a defendant in connection with the Incident. B. Pre-Litigation Demand On August 28, 2024

X. Key Enterprise Customer Communications Given that the Lumos Insight Platform serves enterprise customers, and that the Incident affected user accounts across 847 distinct enterprise customer tenants, enterprise customer communications were a critical component of the Incident response. Notification letters were sent to the designated security and compliance contacts at all 847 affected enterprise customer tenants

XI. 60-Day Post-Notification Monitoring Period Following the completion of individual and Attorney General notifications on August 5, 2024, C&H and Lumos jointly undertook a 60-day post-notification monitoring period. The full 60-day period extends through approximately October 4, 2024; however, the matter is being closed slightly ahead of the full 60-day mark given the satisfactory status across all monitoring dimen

XII. Matter Closure and Recommendations A. Confirmation of Matter Closure C&H Matter No. 1008-00009 is hereby closed effective September 27, 2024. All work within the defined scope of the engagement has been completed, as summarized below: • Forensic investigation coordinated (through Palisade Digital Forensics) and concluded, with final report delivered July 15, 2024; • Multi-jurisdictional breach notification analy

1. Litigation Hold. Lumos should maintain its internal litigation hold issued on June 18, 2024, covering all Incident-related records, logs, communications, and forensic images. The hold should remain in place until further notice from counsel. The outstanding Garrison & Oakley demand, combined with the general statute of limitations exposure for potential class action claims arising from the Incident (which extends

2. Regulatory Monitoring. Lumos should continue to monitor for any delayed regulatory inquiries or investigations, particularly from state Attorneys General who may conduct investigations on longer timelines. While the absence of any regulatory contact to date is favorable, certain states have historically initiated inquiries many months after receiving AG notification filings. Any communication from a regulatory bod

3. Insurance Coordination. Lumos should continue to coordinate with NexTier Cyber Insurance Group (Martin Okubo, Claims Adjuster) regarding the ongoing reconciliation of Incident-related costs. Final cost reconciliation will occur upon the expiration of the credit monitoring enrollment period and the completion of the 24-month monitoring program for enrolled individuals. Lumos should ensure that all Incident-related

4. Credential Monitoring and Security Posture. Lumos should maintain the credential-screening service and mandatory multi-factor authentication requirements implemented during remediation as permanent features of the Insight Platform's authentication infrastructure. Additionally, Lumos should consider engaging a third-party security firm to conduct periodic security audits and penetration testing of the Insight Platf

5. Future Engagement. Should any lawsuit be filed, regulatory inquiry or enforcement action be received, additional pre-litigation demand be received, or any other material development occur in connection with the Incident, Lumos should promptly contact Rachel Bernstein or Sara Hendricks at Calderwood & Harkness LLP. C&H is prepared to reopen the matter or open a successor engagement as appropriate to address any suc

XIII. Closing Calderwood & Harkness LLP appreciates the opportunity to have assisted Lumos Analytics Inc. in its response to this Incident. The prompt, thorough, and well-coordinated response across all workstreams — forensic investigation, notification compliance, regulatory communications, customer relations, remediation, and insurance — reflects a commitment to responsible incident management that positions Lumos