Contract analysis

I. Purpose and Background This memorandum establishes the privilege protocol and communication framework governing the retention and direction of a third-party digital forensics firm in connection with the credential-stuffing incident detected on June 15, 2024, affecting the Lumos Insight Platform (the "Incident"). The protocols set forth herein are designed to ensure the integrity of the attorney-client privilege an

II. Summary of the Incident The following factual summary is provided for context and to establish the basis for the privilege protocol and forensic engagement structure described herein. This summary is based on information provided to C&H by Lumos personnel as of the date of this memorandum and is subject to revision as the forensic investigation progresses. Between approximately 02:14 UTC on June 12, 2024, and app

III. Retention of Palisade Digital Forensics, Inc. at the Direction of Counsel A. Identification of Forensic Vendor Palisade Digital Forensics, Inc. ("Palisade"), a Washington corporation headquartered at 999 Third Avenue, Suite 2800, Seattle, WA 98104, has been selected as the third-party digital forensics and incident response firm for the Incident. Palisade was selected based on its demonstrated expertise in crede

1. Attack vector confirmation. Detailed forensic analysis of the credential-stuffing attack, including confirmation of the attack vector (i.e., automated credential injection against the Platform's authentication endpoint), the precise timeline of the attack, and the source of the credential pairs used (including any linkage to the VaultSync Technologies breach).

2. Account enumeration. Complete identification and enumeration of all user accounts accessed during the attack window, including verification of the preliminary count of 11,438 compromised accounts and the 847 affected enterprise customer tenants.

3. Session activity analysis. Granular analysis of session activity for each compromised account, with particular attention to the 137 accounts with session durations exceeding thirty (30) seconds. This analysis should include review of page access logs, API call logs, and any available clickstream data to determine what information the threat actor(s) accessed or attempted to access within each session.

4. Data exfiltration assessment. Determination of whether any data exfiltration, download, export, or screenshot activity occurred during any of the compromised sessions. This is a critical question for breach notification analysis and litigation exposure assessment.

5. Malware and persistence analysis. Assessment of whether any malware, persistence mechanisms, backdoors, web shells, or other unauthorized code was deployed on the Platform's infrastructure during or as a result of the attack.

6. Lateral movement and privilege escalation. Evaluation of whether any lateral movement or privilege escalation occurred—i.e., whether the threat actor(s) moved from compromised user accounts to other systems, administrative accounts, or infrastructure components.

7. Log preservation and analysis. Preservation and analysis of all relevant server logs, authentication logs, API gateway logs, network traffic data, firewall logs, and forensic images. Palisade will create forensic images of affected systems as necessary to preserve evidence in a forensically sound manner.

8. Quick View data exposure assessment. Targeted assessment of the 2,614 Quick View-enabled accounts to determine the extent of partial financial data exposure, including whether cached financial data was accessed, viewed, or potentially exfiltrated during the compromised sessions. Palisade is expected to deliver the following work product to C&H: • Preliminary findings memorandum — A preliminary memorandum summarizi

IV. Privilege Protocol — Communications and Reporting A. Fundamental Principle All communications between Palisade, C&H, and Lumos personnel regarding the forensic investigation are to be treated as privileged attorney-client communications and/or attorney work product. This includes, without limitation, all oral communications (in-person meetings, telephone calls, videoconferences), written communications (emails, m

1. All Palisade reports, findings, memoranda, interim updates, and communications concerning the forensic investigation must be directed to C&H in the first instance. The designated C&H recipients are: • Rachel Bernstein, Partner (rachel.bernstein@calderwoodharkness.com) • Sara Hendricks, Associate (sara.hendricks@calderwoodharkness.com) • Kevin Ostrowski, Senior Counsel (kevin.ostrowski@calderwoodharkness.com) — as

2. Palisade is not to deliver reports, findings, analysis, or any substantive work product directly to Lumos business teams, engineering teams, or any Lumos personnel other than the three designated recipients of this memorandum—namely, Allison Cho (General Counsel & CPO), Jason Haddad (CISO), and Deepika Narayanan (CTO). Even those individuals should receive Palisade's substantive work product only through or with t

3. C&H will, after review, share relevant findings with the Lumos incident response team as appropriate and in a manner consistent with maintaining privilege. All materials shared by C&H with Lumos personnel will bear applicable privilege markings and will be accompanied by instructions regarding their confidential and privileged nature. This reporting structure ensures that C&H maintains direction and control over t

V. Document Labeling and Handling Requirements A. Privilege Markings All documents, reports, memoranda, emails, presentations, spreadsheets, and other materials prepared by Palisade in connection with this engagement must bear the following legend prominently on each page: "PRIVILEGED AND CONFIDENTIAL — PREPARED AT THE DIRECTION OF COUNSEL — ATTORNEY-CLIENT PRIVILEGE / ATTORNEY WORK PRODUCT — CALDERWOOD & HARKNESS LL

VI. Separation of Forensic Investigation from Lumos Internal IT Remediation A. Distinction Between Privileged Forensic Work and Business Remediation It is essential to maintain a clear and demonstrable distinction between the following two categories of activity:

1. Palisade's privileged forensic investigation — This investigation is being conducted at the direction of C&H, as outside counsel to Lumos, for the primary purpose of assisting counsel in providing legal advice to Lumos. The investigation is undertaken in anticipation of litigation and regulatory proceedings. Palisade's work product, findings, reports, analyses, and related communications are covered by the attorne

2. Lumos's internal IT remediation and security improvement efforts — These activities are being conducted by Lumos's engineering and information security teams (under the direction of Jason Haddad, CISO, and Brian Kowalski, VP of Engineering) for business purposes—specifically, to remediate the vulnerabilities exploited in the Incident and to strengthen the Platform's security posture. These activities include, with

VII. Litigation Hold A. Issuance. Concurrent with this memorandum, C&H has directed and Lumos Analytics Inc. has issued an internal litigation hold notice dated June 18, 2024 (the "Litigation Hold"), directing the preservation of all records, data, and materials related to the credential-stuffing Incident. The Litigation Hold has been distributed to all identified custodians and relevant personnel. The issuance of th

VIII. Coordination with Insurance Carrier A notice of claim was submitted to NexTier Cyber Insurance Group ("NexTier" or the "Carrier") on June 20, 2024, under Policy No. NXT-CYB-2024-07812. The relevant policy parameters are as follows: • Policy period: January 1, 2024 – January 1, 2025 • Per-occurrence limit: $15,000,000 • Aggregate limit: $30,000,000 • Per-claim retention (deductible): $500,000 • Claims adjuster:

IX. Coordination with UK/EU Counsel Harmon Watts & Kendrick LLP ("HWK"), led by Catherine Wye in their London office at 30 Finsbury Square, London EC2A 1AG, United Kingdom, has been engaged as coordinating counsel for UK Information Commissioner's Office ("ICO") notification and EU General Data Protection Regulation ("GDPR") analysis relating to Lumos's UK-based operations and the affected user accounts of UK- and EU

X. Crisis Communications Coordination Threshold Public Relations LLC ("Threshold PR"), with account lead Janelle Morse, located at 375 Park Avenue, Suite 1410, New York, NY 10152, has been engaged by Lumos for crisis communications support and customer messaging in connection with the Incident. Threshold PR is assisting Lumos with the development of public statements, customer notifications, FAQs, media responses, an

XI. Consequences of Non-Compliance Failure to adhere to the privilege protocol set forth in this memorandum may result in waiver of the attorney-client privilege and/or work product protection over the forensic investigation and related communications. The consequences of such a waiver could be severe and far-reaching. In the event of regulatory investigations by state attorneys general, the Federal Trade Commission,

XII. Acknowledgment By signing below, each undersigned acknowledges that they have read, understand, and agree to comply with the Forensic Vendor Retention Protocol and Privilege Framework set forth in this memorandum. LUMOS ANALYTICS INC. By: ________ Name: Allison Cho Title: General Counsel & Chief Privacy Officer Date: ________ LUMOS ANALYTICS INC. By: ________ Name: Jason Haddad Title: VP of Information Security