Contract analysis

I. Introduction and Purpose of Notice Calderwood & Harkness LLP writes on behalf of its client, Lumos Analytics Inc. ("Lumos" or the "Company"), a Delaware corporation headquartered at 450 Folsom Street, Suite 1200, San Francisco, California 94105 (Employer Identification Number: 83-2197564). The purpose of this letter is to provide the Office of the Attorney General of [State] with formal notification of a data secu

II. Description of the Incident Between approximately 02:14 Coordinated Universal Time ("UTC") on June 12, 2024, and approximately 19:47 UTC on June 15, 2024 — a window of approximately sixty-five and one-half (65.5) hours — Lumos experienced a credential-stuffing attack directed at the login interface of its Lumos Insight Platform. A credential-stuffing attack is a type of automated cyberattack in which threat actor

III. Detection and Containment On June 15, 2024, at approximately 14:22 UTC, Lumos's security information and event management ("SIEM") system generated automated alerts based on anomalous login patterns detected across the Lumos Insight Platform. The anomalies included volumetric login irregularities — specifically, a significant increase in failed login attempts well above historical baselines — as well as geograph

1. Mandatory Global Password Reset. Lumos initiated a mandatory password reset for all approximately 286,000 registered user accounts on the Lumos Insight Platform. All existing sessions were terminated, and all users were required to create new passwords before regaining access to the platform. This measure was designed to ensure that any credentials compromised through the credential-stuffing attack — or potentiall

2. Attacker IP Address blocking. Lumos blocked all 1,247 unique source IP addresses that had been identified as originating points for the credential-stuffing attack. These IP addresses were added to a permanent relistlist maintained at the web application firewall and network perimeter levels. On June 16, 2024, Lumos took the additional step of permanently disabling a platform feature known as "Quick View." The Quic

IV. Investigation Findings The third-party forensic investigation was conducted over a period of approximately four weeks and was completed with the issuance of a final written report on July 15, 2024. For purposes of applicable state notification deadlines, July 15, 2024 constitutes the "determination date" — the date on which the nature, scope, and extent of the data security incident were reasonably determined wit

V. Categories of Personal Information Accessed Based on the forensic investigation, the following categories of personal information were accessible within the 11,438 compromised user accounts at the time of the unauthorized access:

1. User Profile Information. All 11,438 affected accounts contained user profile information, which included the individual's full name, email address, job title, and employer name. This information is entered by users during the account registration process and is displayed on the user's profile page within the Lumos Insight Platform.

2. Telephone Number. Approximately 7,820 of the 11,438 affected accounts (approximately 68.4%) had a telephone number populated in the user profile. The remaining approximately 3,618 accounts did not have a telephone number on file, as this field was optional during account registration.

3. Dashboard Configurations and Saved Analytics Queries. Affected accounts contained dashboard configurations and saved analytics queries created by the individual user. These items consist of proprietary business data belonging to the user's enterprise customer employer and are not categorized as individual personal information. However, they are noted here for completeness, as they were within the scope of data pot

4. Partial Financial Data (Quick View Feature). For 2,614 of the 11,438 affected accounts (approximately 22.9%), the individual user had enabled the optional "Quick View" feature, which cached partial portfolio data on the user's profile page. The data potentially exposed through the Quick View feature included: • Partial financial account numbers, consisting of the last four digits only; • Account balances; and • As

VI. Number of Affected Residents of [State] The number of residents of the State of [State] whose personal information was involved in this data security incident is: [Number]. This figure was determined through a multi-jurisdictional analysis conducted by Lumos, in coordination with Calderwood & Harkness LLP, using the residential address information on file for each affected user account, supplemented by additional

VII. Remediation Measures Taken by Lumos In addition to the immediate containment actions described in Section III above, Lumos has implemented the following remedial measures to strengthen the security of the Lumos Insight Platform and reduce the risk of similar incidents in the future:

1. Mandatory Multi-Factor Authentication ("MFA"). Lumos has deployed mandatory multi-factor authentication for all Lumos Insight Platform user accounts. Following implementation, all users are required to verify their identity using a second authentication factor (such as a one-time passcode sent via SMS or generated by an authenticator application) in addition to their password when logging in. This measure signific

2. Advanced Bot-Detection and CAPTCHA. Lumos has deployed advanced bot-detection and CAPTCHA challenge mechanisms on all Lumos Insight Platform login pages. These mechanisms are designed to distinguish between automated login attempts (such as those used in credential-stuffing attacks) and legitimate human login activity, and to block or challenge suspicious automated traffic. Deployment was completed on July 8, 2024

3. Authentication Rate-Limiting. Lumos has significantly reduced the authentication rate limit on the Lumos Insight Platform. The prior rate limit permitted up to 100 login attempts per minute from a single source IP address. The rate limit has been reduced to 10 login attempts per minute per source IP address. This tenfold reduction substantially limits the throughput of automated credential-stuffing tools and incre

4. Quick View Feature Permanently Disabled. As noted in Section III above, the Quick View feature was permanently disabled on June 16, 2024. Cached partial financial data is no longer accessible through user profile pages on the Lumos Insight Platform. Lumos does not intend to reinstate this feature.

5. Credential-Screening Service. Lumos has integrated a real-time credential-screening service into the Lumos Insight Platform's login and password-change workflows. This service checks user passwords against databases of credentials known to have been exposed in prior data breaches. If a user attempts to set or use a password that has been identified in a known breach database, the user is prompted to select a diffe

6. Global Password Reset. As described in Section III, a mandatory global password reset was initiated for all approximately 286,000 registered users on June 15, 2024. All users were required to create new passwords meeting enhanced complexity requirements before regaining access to the platform.

7. IP blocking. All 1,247 identified attacker source IP addresses were blocked immediately upon identification and have been added to a permanent relistlist. In addition, Lumos has enhanced its IP reputation monitoring capabilities to enable more rapid identification and blocking of suspicious IP addresses on an ongoing basis. Lumos continues to evaluate its security posture and is committed to implementing additiona

VIII. Notification to Affected Individuals Lumos is providing direct written notification to all 11,438 affected individuals concurrently with this Attorney General notification. Individual notifications are being sent via email on August 5, 2024, to the email address on file for each affected individual. For a subset of 1,612 individuals whose email notifications bounced back as undeliverable or whose email addresse

IX. Credit Monitoring and Identity Theft Protection Services Although the forensic investigation did not identify evidence of actual data exfiltration or misuse, and although the categories of data involved in this incident did not include Social Security numbers, full financial account numbers, or other categories of information most commonly associated with identity theft, Lumos has determined to offer all 11,438 a

X. Timing of Notification Lumos became aware of the data security incident on June 15, 2024, when its SIEM system detected anomalous login activity on the Lumos Insight Platform, as described in Section III above. Lumos immediately commenced an investigation and engaged outside forensic experts on June 18, 2024. The forensic investigation was completed on July 15, 2024, with the issuance of the final forensic report.

XI. Contact Information Any questions regarding this notification or the underlying data security incident may be directed to the following contacts: Legal Counsel for Lumos Analytics Inc.: Rachel Bernstein, Partner Calderwood & Harkness LLP One Embarcadero Center, Suite 3400 San Francisco, California 94111 Telephone: (415) 773-6244 Email: rbernstein@calderwoodharkness.com Lumos Analytics Inc.: Allison Cho, General C

XII. Closing Lumos takes the security of the personal information entrusted to it with the utmost seriousness and sincerely regrets any concern or inconvenience this incident may cause to affected individuals. The Company has acted swiftly to contain the incident, investigate its scope, and implement meaningful remedial measures designed to substantially reduce the risk of a similar incident occurring in the future.