Contract analysis

I. Policy Information The relevant Policy information is as follows: The Policy provides coverage for, among other things, incident response costs, breach notification expenses, credit monitoring and identity theft protection services, forensic investigation costs, legal fees and expenses, regulatory defense and penalty sub-limits, crisis communications, and related first-party and third-party coverages, all as more

II. Description of the Insured Lumos Analytics Inc. is a software-as-a-service ("SaaS") and financial technology analytics platform provider incorporated in the State of Delaware and headquartered in San Francisco, California. Founded in 2017, Lumos develops, operates, and maintains the "Lumos Insight Platform" — a proprietary cloud-based analytics tool used by financial institutions, insurance companies, wealth mana

III. Description of the Incident Lumos has experienced a cybersecurity incident involving unauthorized access to user accounts on the Lumos Insight Platform through a credential-stuffing attack. The material facts presently known regarding the incident are as follows: Nature of the Attack. The incident involved a credential-stuffing attack — the automated, high-volume injection of previously compromised username and

IV. Data Categories Potentially Exposed Based on Lumos's preliminary assessment of the data accessible within the Lumos Insight Platform's user interface for authenticated users, the following categories of data were potentially exposed for the 11,438 user accounts that were accessed during the attack: Data Accessible for All 11,438 Accessed Accounts. For each of the 11,438 accounts to which unauthorized access was o

V. Forensic Investigation At the direction of Calderwood & Harkness LLP, and in a manner designed to preserve attorney-client privilege and work product protections to the greatest extent possible, Lumos has retained Palisade Digital Forensics, Inc. ("Palisade"), headquartered in Seattle, Washington, as an independent third-party digital forensics and incident response firm to conduct a comprehensive forensic investi

1. No compromise of internal systems. There is currently no evidence of compromise of Lumos's internal systems, databases, infrastructure, source code repositories, or credential stores. All unauthorized access to the 11,438 user accounts was accomplished using valid user credentials that were obtained externally (i.e., from the VaultSync breach or related credential dumps) and submitted through Lumos's standard auth

2. No evidence of bulk data exfiltration. There is currently no evidence that bulk data exfiltration occurred during the attack. The overwhelming majority of unauthorized access sessions were of short duration, consistent with automated credential validation (i.e., confirming the validity of a username/password pair) rather than systematic data harvesting. As noted above, 137 accounts exhibited session durations exce

3. No evidence of malware deployment. There is currently no evidence that malware, ransomware, backdoors, web shells, or any other form of malicious software was deployed within the Lumos environment as a result of the incident.

4. No evidence of lateral movement or privilege escalation. There is currently no evidence that the threat actor(s) achieved lateral movement within the Lumos environment, escalated privileges beyond those associated with the compromised user accounts, or accessed any systems, databases, or resources beyond those available to an authenticated standard-tier user through the Lumos Insight Platform's user interface. Pal

VI. Breach Response Counsel Calderwood & Harkness LLP was retained by Lumos Analytics Inc. on June 18, 2024, as lead outside counsel for all aspects of the incident response, including but not limited to breach notification analysis, multi-jurisdictional regulatory engagement, customer and individual communications, litigation readiness and defense, and coordination with the forensic investigation. Calderwood & Harkn

VII. Immediate Containment and Remediation Steps Taken In addition to the containment measures described in Section III above, Lumos has taken the following steps in response to the incident:

1. Global password reset — All approximately 286,000 registered user accounts on the Lumos Insight Platform were subject to a mandatory password reset. Affected users were required to establish new credentials upon their next login. This measure was completed on June 15, 2024.

2. IP blocking — The 1,247 source IP address ranges identified as associated with the credential-stuffing attack were blocked at the network perimeter. This measure was completed on June 15, 2024.

3. Disabling of "Quick View" feature — The Quick View cached data feature, which cached partial portfolio data on user profile pages for the 2,614 accounts that had enabled the feature, was disabled platform-wide. This measure was completed on June 16, 2024.

4. Litigation hold — A comprehensive internal litigation hold was issued covering all incident-related records, system and application logs, security event data, communications, forensic images, and related materials. The litigation hold was issued on June 18, 2024, and has been distributed to all relevant custodians within the organization.

5. ICO 72-hour notification — In coordination with Harmon Watts & Kendrick LLP, Lumos filed a 72-hour breach notification with the United Kingdom Information Commissioner's Office on June 18, 2024, with respect to 814 UK-resident individuals whose accounts were among the 11,438 accounts accessed during the incident. This filing was made within the 72-hour notification window prescribed by Article 33 of the UK GDPR.

6. Additional remediation measures — Lumos is currently planning and implementing additional remediation measures to harden the Lumos Insight Platform's authentication infrastructure and reduce the risk of future credential-stuffing attacks. These measures include, but are not limited to: • Mandatory multi-factor authentication ("MFA") rollout for all user accounts • Deployment of advanced bot-detection and CAPTCHA m

VIII. Anticipated Costs and Expenses While it is premature to provide a final or comprehensive estimate of total incident response costs, and while costs will continue to accrue as the investigation and response progress, Lumos anticipates that the following categories of costs and expenses will be incurred in connection with the incident and for which coverage under the Policy is expected: • Legal fees and expenses

IX. Notification Obligations — Preliminary Assessment The 11,438 individuals whose accounts were accessed during the incident reside across all 50 United States, the District of Columbia, Puerto Rico, and the United Kingdom. Accordingly, Lumos anticipates that multi-jurisdictional individual and regulatory breach notification obligations will apply under the various state breach notification statutes, as well as unde

X. Significant Enterprise Customers Affected Among the 847 enterprise customer tenants affected by the incident, certain high-profile enterprise customers have been identified. These customers are entities with significant market presence and regulatory profiles, and the impact of the incident on their user accounts warrants particular attention in the context of Lumos's notification and communications strategy. The

XI. Requests In light of the foregoing, Lumos respectfully requests that NexTier take the following actions:

1. Acknowledge receipt of this notice of claim in writing at your earliest convenience.

2. Confirm coverage under Policy Number NXT-CYB-2024-07812 for the incident described herein, subject to the terms, conditions, exclusions, and limitations of the Policy.

3. Assign a dedicated claims handler for this matter to facilitate ongoing coordination between NexTier, Calderwood & Harkness LLP, and Lumos.

4. Confirm approval of breach response counsel — specifically, confirm that Calderwood & Harkness LLP is approved as breach response counsel under the Policy in its capacity as pre-approved panel counsel.

5. Advise of any additional information or documentation required by NexTier to process this claim, including any specific forms, authorizations, or supplemental materials. Lumos will cooperate fully with NexTier throughout the claims process and will provide regular updates on the status of the forensic investigation, the breach notification process, the engagement of vendors and service providers, and the tracking

XII. Reservation of Rights This notice of claim is provided for the purpose of preserving all of Lumos's rights, remedies, and entitlements under the Policy and applicable law. Nothing in this letter is intended to, nor shall it be construed to, limit, waive, modify, or relinquish any coverage, rights, or defenses available to Lumos under the Policy or otherwise. Lumos expressly reserves the right to supplement, amen

XIII. Contact Information All communications regarding this claim should be directed to the following: Primary Contact — Outside Counsel: Rachel Bernstein, Partner Calderwood & Harkness LLP One Embarcadero Center, Suite 3400 San Francisco, California 94111 Telephone: (415) 392-7418 Email: rbernstein@calderwoodharkness.com With a copy to — Insured's In-House Counsel: Allison Cho, General Counsel & Chief Privacy Office