Contract analysis

1. Purpose and Overview of Notification Lumos Analytics Inc. ("Lumos" or the "Company") is writing to notify [Customer Legal Name] ("[Customer Legal Name]" or "Customer") of a security incident involving unauthorized access to certain user accounts on the Lumos Insight Platform (the "Platform" or "Insight Platform"). Lumos deeply values its relationship with [Customer Legal Name] and is committed to full transparency

2. Description of the Incident Nature of the Attack Between approximately June 12, 2024, at 02:14 UTC, and June 15, 2024, at 19:47 UTC, one or more threat actors conducted a credential-stuffing attack against the Lumos Insight Platform. A credential-stuffing attack is a form of cyberattack in which an adversary uses automated tools to inject large volumes of username-and-password pairs — typically obtained from unrel

3. Forensic Investigation Findings As noted above, Lumos retained Palisade Digital Forensics, Inc. to conduct a comprehensive, independent forensic investigation of the security incident. Palisade is a nationally recognized digital forensics and incident response firm with extensive experience investigating cybersecurity incidents across the financial services, technology, and healthcare sectors. Palisade's investiga

4. Information Potentially Accessed Although the forensic investigation found no evidence of data exfiltration, Lumos recognizes that each account that was accessed was potentially viewable to the unauthorized party during the duration of the session. For each accessed account, the following categories of information were potentially viewable: • User Profile Information: The user's full name, email address, job title

5. Remediation Measures Taken by Lumos In response to this incident, Lumos has implemented a comprehensive set of security enhancements and remediation measures designed to prevent the recurrence of a credential-stuffing attack and to substantially strengthen the authentication and access security controls on the Insight Platform. These measures are described below. Immediate Actions (June 15–16, 2024) • Global Passw

6. Individual Notifications and Credit Monitoring Lumos is sending individual breach notification letters directly to all 11,438 affected individual users, including all users affiliated with [Customer Legal Name] whose accounts were accessed during the incident. These individual notifications are being sent concurrently with this enterprise customer notification, on August 5, 2024. Individual notification letters ar

7. Regulatory and Compliance Notifications Lumos is filing breach notification reports with the Attorneys General of 34 U.S. states and territories in accordance with applicable state breach notification statutes. These filings have been prepared with the assistance of outside counsel, Calderwood & Harkness LLP, and are being submitted on a rolling basis between August 1, 2024, and August 5, 2024. Lumos has made thes

8. Commitment to Data Security and Ongoing Monitoring Lumos takes the security of its customers' data with the utmost seriousness and recognizes the trust that [Customer Legal Name] places in the Insight Platform as a critical component of your business operations. Protecting the confidentiality, integrity, and availability of customer data is foundational to Lumos's mission and to the value we strive to deliver to e

9. Dedicated Point of Contact For any questions, concerns, or requests for additional information regarding this incident and its impact on [Customer Legal Name]'s users, please do not hesitate to contact the following dedicated point of contact: Fiona Albrecht Director of Customer Success Lumos Analytics Inc. 450 Folsom Street, Suite 1200 San Francisco, CA 94105 Phone: [Direct Phone Number] Email: [Email Address] Fi