Contract analysis

I. Lumos's Prompt and Comprehensive Response to the Incident Without waiving any privilege, objection, or defense, and without conceding any of the characterizations, assertions, or legal conclusions set forth in the Demand Letter, we provide the following factual context. The information set forth below is based solely on information that has already been made publicly available through Lumos's breach notification p

II. Full Compliance with All Applicable Breach Notification Obligations Notwithstanding the limited nature of the Incident and the absence of evidence of data exfiltration, Lumos has fully complied with all applicable federal, state, and territorial breach notification statutes. Lumos undertook an expansive notification program that exceeded the requirements of the most restrictive jurisdictions implicated by the Inc

III. Remediation Measures and Credit Monitoring In addition to its prompt containment and notification efforts, Lumos has undertaken comprehensive remediation measures designed to strengthen the security of the Platform and to reduce the risk of similar incidents in the future. These measures include, but are not limited to, the following: • Mandatory Multi-Factor Authentication. Lumos has implemented mandatory multi

IV. Declination of Pre-Suit Settlement Discussions In light of the foregoing — including Lumos's prompt detection and containment of the Incident, the forensic finding of no evidence of data exfiltration from any accessed account, Lumos's full compliance with all applicable notification obligations across thirty-four states and international jurisdictions, and the comprehensive remediation and credit monitoring measu

V. Reservation of Rights This letter is provided for informational purposes only and in direct response to the Demand Letter. Nothing in this letter constitutes, nor shall it be construed as constituting, an admission of any liability, fault, wrongdoing, or violation of any statute, regulation, contractual provision, common law duty, or other legal obligation by Lumos Analytics Inc. or any of its past or present offi

VI. Future Communications We respectfully request that any and all future correspondence, communications, or service of process regarding this matter or any related matter be directed solely to the undersigned at the address below, and not to Lumos Analytics Inc. or any of its officers, directors, or employees directly: Rachel Bernstein, Partner Privacy & Data Security Practice Group Calderwood & Harkness LLP One Emb