Contract analysis

PRIVILEGED AND CONFIDENTIAL — ATTORNEY-CLIENT COMMUNICATION / ATTORNEY WORK PRODUCT. This email and any attachments are protected by the attorney-client privilege and/or the work product doctrine. Do not forward or distribute without the express permission of Calderwood & Harkness LLP.

From: Sara Hendricks To: Allison Cho Cc: Rachel Bernstein ; Priscilla Wynn ; Fiona Albrecht ; Jason Haddad Date: Thursday, July 25, 2024, 3:47 PM PDT Subject: Lumos Credential-Stuffing Incident — Notification Timeline and Coordination [C&H Matter No. 1008-00009]

I hope this note finds you well. Following our call earlier this week and the multi-jurisdictional breach notification analysis memo we delivered on July 18, I wanted to lay out the operational plan and timeline for executing all individual breach notifications, state Attorney General filings, enterprise customer notifications, and coordinated UK/EU notifications in connection with the credential-stuffing incident af

As a baseline reference, the determination date for notification-deadline purposes is **July 15, 2024** — the date Palisade Digital Forensics, Inc. delivered its final forensic investigation report. All statutory clocks run from that date.

The most restrictive U.S. deadlines are as follows:

- **Colorado and Florida:** 30 days from the July 15 determination date → **August 14, 2024** - **Maryland and similar states:** 45 days from determination → **August 29, 2024** - Most remaining states fall within 30- to 60-day windows, all of which close after August 14.

The notification schedule outlined below is designed to satisfy all applicable deadlines with a comfortable margin. Individual notifications to all 42 states plus the District of Columbia and Puerto Rico that require them will go out well ahead of even the most aggressive Colorado and Florida deadlines.

**2. Individual Notification Plan (U.S.)**

- **Target send date: August 5, 2024** - **Total affected individuals: 11,438** (out of approximately 286,000 total registered Lumos users) - **Primary delivery method:** Email to all 11,438 individuals using the approved individual notification letter template. - **U.S. mail follow-up:** For the approximately **1,612 individuals** whose email addresses bounce or have been flagged as potentially compromised, hard-cop

The individual notification letter includes the following elements:

- Description of the incident (credential-stuffing attack, June 12–15, 2024) - Categories of personal information involved: full name, email address, job title, employer name, and phone number (approximately 7,820 accounts); and for certain accounts, partial financial account numbers and account balance summaries accessed via the Quick View feature (2,614 accounts) - Offer of **24 months of complimentary credit monit

**Allison — I would appreciate your final sign-off on the individual notification letter template by July 31, 2024**, so that Sentinel has adequate lead time for production and code generation ahead of the August 5 send date.

**3. State Attorney General Notification Filings**

- **Filing window: August 1–5, 2024** (staggered by state based on filing method — some states accept online submissions, others require mail or email to specific AG offices) - **Total states requiring AG notification: 34** - The AG notification letter template attaches a sample of the individual notification letter.

Key state-specific resident counts to be included in the filings:

- California: 3,412 affected accounts - New York: 2,107 affected accounts - Texas: 1,843 affected accounts - All other state-level counts are detailed in the jurisdiction-by-jurisdiction analysis in the July 18 memo.

**Priscilla** is finalizing the state-specific appendices and filing logistics and will circulate a filing tracker to the full team by **July 29**.

For reference, the 8 states where notification was determined unnecessary — because the data elements accessed did not meet the statutory definition of "personal information" in those jurisdictions (no SSN, no driver's license number, no full financial account number was involved) — will not receive AG filings or individual notifications.

**4. Enterprise Customer Notifications (B2B)**

- **Target send date: August 5, 2024** — concurrent with individual notifications. - **Total affected enterprise customer tenants: 847** (out of approximately 4,200 total Lumos customers). - The enterprise customer notification letter template includes bracketed fields for customer name and the number of affected user accounts within that customer's tenant.

Several high-profile customers will need particular attention:

- **Cascadia National Bancorp** — 312 accounts accessed (out of 1,247 total Lumos accounts held by Cascadia employees) - **Ironbridge Insurance Holdings, Inc.** — 204 accounts accessed - **Monarch Wealth Advisors, LLC** — 89 accounts accessed

**Fiona** — you will serve as the dedicated customer-facing point of contact for inbound inquiries from enterprise customers. Could you please confirm that your team is ready and that the customer success team has been briefed on the approved talking points?

The enterprise notification letter will confirm that individual notifications and credit monitoring offers are being sent directly to affected end users, and will describe the remediation measures Lumos has implemented, including: mandatory MFA rollout (completed July 22), Quick View feature disabled (June 16), bot-detection/CAPTCHA deployed (July 8), rate-limiting thresholds reduced, and credential-screening service

I also recommend that Fiona and her team **proactively reach out to the top 20 enterprise customers by ACV** on or shortly before August 5 with a personal call or email ahead of the formal letter, to manage the relationship and avoid any surprises. **Allison, I'd welcome your view on this approach.**

- **UK-resident affected users: 814 accounts** - The ICO 72-hour notification was already filed on **June 18, 2024** by Harmon Watts & Kendrick LLP (Catherine Wye's team in London). - Individual notification to UK data subjects: I am coordinating with Catherine Wye to send UK individual notices on **August 5, 2024**, concurrent with U.S. notifications. The UK letter will be adapted for UK data protection language and

- **EU-resident affected users (non-UK): 47 accounts** (Germany — 19, France — 14, Netherlands — 9, Ireland — 5). As discussed in the July 18 memo, these are assessed as not requiring separate DPA notification given the de minimis exposure and absence of special category data, but individual notices will be sent to these users as a precaution. Catherine Wye's team is handling the EU-specific language adaptations.

**Allison — could you please confirm whether Lumos's London office team needs any separate internal briefing ahead of August 5?**

- Sentinel Identity Services, Inc. is the vendor for both notification mailing/email and credit monitoring enrollment. - 24 months of credit monitoring and identity theft protection will be offered to all 11,438 affected individuals. - Sentinel is on track to have the enrollment portal live and activation codes generated by **August 1, 2024**. I spoke with Sentinel's project manager earlier this week, and they confir

**7. Crisis Communications / PR Coordination**

**Threshold Public Relations LLC** (Janelle Morse, Account Lead) is preparing the following materials:

- A **customer FAQ** document for use by Fiona's customer success team in fielding enterprise customer inquiries - A **press holding statement** in the event of media inquiries

These are being developed in parallel, and Janelle expects drafts for review by **July 30, 2024**. I will circulate the drafts to you and Rachel for review and approval before they are finalized.

Please note: **no proactive press release is currently planned** — the holding statement is reactive only. **Allison, could you confirm this remains Lumos's preference?**

For ease of reference, here is a consolidated list of open items:

- **Allison:** Final sign-off on individual notification letter template by July 31 - **Allison:** Confirm approach to proactive outreach to top 20 enterprise customers (by ACV) - **Allison:** Confirm London office internal briefing needs - **Allison:** Confirm no proactive press release (reactive holding statement only) - **Fiona:** Confirm customer success team readiness and briefing on approved talking points - **

Rachel Bernstein is available if you or any of the team members wish to discuss any of the above in more detail. I'd also like to propose scheduling a coordination call early next week — Monday, July 29 or Tuesday, July 30 — to finalize all open items before the August 1 filing start date. Please let me know what works best for your calendar and I'll send an invitation.

Thank you, Allison. We're in good shape on timing and I want to make sure we keep the momentum going through execution.

Sara Hendricks Calderwood & Harkness LLP One Embarcadero Center, Suite 3400 San Francisco, CA 94111 T: (415) 555-7823 E: shendricks@calderwoodharkness.com