Contract analysis

1. Introduction and Purpose of This Letter We are writing to inform you about a data security incident involving the Lumos Insight Platform, a product of Lumos Analytics Inc. ("Lumos," "we," "us," or "our"). At Lumos, we take the privacy and security of the personal information entrusted to us seriously, and we deeply value the trust you place in our platform and our team. We are providing this notice to explain what

2. What Happened Between approximately June 12, 2024, and June 15, 2024, Lumos experienced what is known as a "credential-stuffing" attack targeting the Lumos Insight Platform. In a credential-stuffing attack, unauthorized actors obtain username and password combinations that were exposed in unrelated, third-party data breaches, and then use automated tools to attempt to log in to other online services where individu

3. What Information Was Involved Based on the findings of the forensic investigation, the following categories of personal information were accessible within your Lumos Insight Platform account and may have been viewable by the unauthorized actors during the period of unauthorized access: • Your full name; • Your email address; • Your job title; • Your employer name; and • Your phone number (if a phone number was pop

4. What We Are Doing Lumos has taken the following steps in response to the incident to contain the unauthorized activity, remediate vulnerabilities, enhance the security of the Lumos Insight Platform, and reduce the risk of similar incidents in the future:

1. Immediate Containment (June 15, 2024). Upon confirming the unauthorized activity, Lumos forced a global password reset for all approximately 286,000 registered users of the Lumos Insight Platform. All active sessions were terminated, and all IP addresses associated with the unauthorized activity were immediately blocked at the network level to prevent further unauthorized access attempts from those sources.

2. Quick View Feature Disabled (June 16, 2024). Lumos permanently disabled the Quick View cached data feature across the entire Lumos Insight Platform. The Quick View feature had displayed summarized financial information, including partial account numbers, account balances, and asset allocation summaries, on user profile pages. By permanently disabling this feature, Lumos has eliminated the possibility of similar ex

3. Advanced Bot Detection (July 8, 2024). Lumos deployed advanced bot-detection and CAPTCHA technology on the Lumos Insight Platform login page to identify and prevent automated login attempts. These technologies are designed to distinguish between legitimate human users and automated scripts or bots, significantly reducing the effectiveness of credential-stuffing and other automated attack techniques.

4. Mandatory Multi-Factor Authentication (July 22, 2024). Lumos implemented mandatory multi-factor authentication ("MFA") for all Lumos Insight Platform accounts. MFA adds an additional layer of security beyond passwords by requiring users to verify their identity through a second factor, such as a one-time code sent to a registered mobile device or generated by an authenticator application, each time they log in. Th

5. Rate Limiting. Lumos reduced the permitted rate of login attempts per source IP address on the Lumos Insight Platform to further limit the effectiveness of automated credential-stuffing attacks. This rate-limiting measure ensures that high-volume login attempts from a single source are automatically throttled and blocked before they can succeed at scale.

6. Credential Screening. Lumos integrated a credential-screening service into the Lumos Insight Platform's authentication workflow. This service checks user passwords against databases of credentials known to have been compromised in third-party breaches at the time of login and at the time of any password change. If a user's credentials are found in a known breach database, the user is immediately alerted and prompt

7. Forensic Investigation. Lumos engaged a leading independent digital forensics firm, under the direction of outside legal counsel, to conduct a thorough and comprehensive investigation of the incident, including its scope, origin, timeline, and impact. The findings of that investigation have informed the remediation measures described in this letter and Lumos's broader security enhancement efforts.

8. Law Enforcement and Regulatory Notifications. Lumos has notified applicable regulatory authorities as required by law and has cooperated with those authorities in connection with their review of the incident. Lumos has also reported the incident to the Federal Bureau of Investigation's Internet Crime Complaint Center. [INSERT STATE-SPECIFIC AG CONTACT INFORMATION: The Attorney General of [State] can be contacted a

5. What You Can Do Although no action on your part is required, we strongly recommend that you take the following steps to help protect yourself and your personal information:

1. Change Passwords. Although Lumos has already reset your Lumos Insight Platform password, we recommend that you change the passwords on any other online accounts or services where you may have used the same or a similar username and password combination. When creating new passwords, use unique, strong passwords that include a combination of uppercase and lowercase letters, numbers, and special characters. Avoid reu

2. Enable Multi-Factor Authentication. We encourage you to enable multi-factor authentication ("MFA") wherever it is available on your online accounts, including email, banking, social media, and other services. MFA provides an important additional layer of security by requiring a second form of verification beyond your password, making it significantly more difficult for unauthorized actors to access your accounts e

3. Monitor Financial Accounts. We recommend that you regularly review your bank statements, credit card statements, and other financial account statements for any unauthorized transactions or suspicious activity. If you identify any transactions or activity that you did not authorize, report them to your financial institution immediately. Prompt reporting of unauthorized activity can help minimize any potential harm

4. Review Credit Reports. We encourage you to obtain free copies of your credit reports from each of the three major nationwide credit reporting agencies — Harborview Enterprises, Penrose Group, and Penmark Enterprises — and to review them carefully for any accounts or inquiries that you do not recognize. Under federal law, you are entitled to one free credit report per year from each of the three agencies. You may o

5. Consider a Fraud Alert or Credit Freeze. You may wish to consider placing an initial fraud alert or a security freeze (also known as a credit freeze) on your credit file with each of the three major credit reporting agencies. An initial fraud alert is free and lasts for one year (or seven years for identity theft victims who provide a valid identity theft report). When a fraud alert is in place, potential creditor

6. Be Vigilant Against Phishing. Be cautious of unsolicited emails, text messages, phone calls, or other communications that request your personal information or direct you to a website that asks for personal information. Phishing attacks may attempt to exploit public awareness of a data security incident to trick individuals into divulging sensitive information. Lumos will never ask you for your password via email,

7. File a Report with the FTC. If you believe you are a victim of identity theft or if you wish to obtain additional guidance on steps you can take to protect yourself, you may contact the Federal Trade Commission ("FTC") at: Federal Trade Commission 600 Pennsylvania Avenue NW Washington, DC 20580 Website: www.identitytheft.gov Phone: 1-877-438-4338 (1-877-ID-THEFT) The FTC's website provides comprehensive resources

6. Complimentary Credit Monitoring and Identity Theft Protection Services To help protect you and provide you with additional peace of mind, Lumos is offering you twenty-four (24) months of complimentary credit monitoring and identity theft protection services through Sentinel Identity Services, Inc. ("Sentinel"), at no cost to you. These services are being provided at Lumos's expense and include the following: • Cre

7. For More Information If you have questions about this incident, need assistance enrolling in the complimentary credit monitoring and identity theft protection services, or would like to speak with a member of our team, please contact us through any of the following dedicated resources: Dedicated Toll-Free Number: [Phone number] Available Monday through Friday, 6:00 AM to 6:00 PM Pacific Time Dedicated Email Addres

8. Closing We sincerely regret any inconvenience or concern this incident may cause you. Protecting the security and privacy of your personal information is a responsibility we take seriously, and we recognize that this incident may have caused you worry or frustration. We want you to know that we are committed to earning and maintaining your trust, and we are taking meaningful, concrete steps to strengthen the secur

1. State-Specific Bracketed Fields. Bracketed fields appear throughout the body of the letter and are marked with the prefix "[INSERT" or "[FOR." Each bracketed field must be populated with the applicable state-specific statutory language, Attorney General contact information, and any additional disclosures required under the law of the recipient's state of residence before the letter is sent. Refer to the Calderwood

2. Jurisdictional Coverage. Customized versions of this letter must be prepared for all 42 states plus the District of Columbia and Puerto Rico that require individual notification. Each jurisdiction's version must incorporate all mandatory elements identified in the Jurisdictional Notification Matrix, including but not limited to: statutory citations in the introduction; Attorney General contact information in Secti

3. Quick View Conditional Paragraph (Section 3). For the 2,614 recipients whose Lumos Insight Platform accounts had the Quick View feature enabled and whose accounts therefore contained cached dashboard data including partial financial account numbers (last four digits only), account balance information, and asset allocation summaries, the conditional paragraph in Section 3 marked "[FOR ACCOUNTS WITH QUICK VIEW FEATU

4. Delivery Method. The primary delivery method for this notification is email. For the 1,612 individuals whose email addresses bounced during the initial test send or were flagged as potentially compromised during the forensic investigation, this letter must be sent via U.S. first-class mail to the recipient's last known mailing address. The U.S. mail version includes the addressee block at the top of the letter; th

5. Total Notification Population. The total notification population is 11,438 individuals.

6. Target Send Date and Statutory Deadlines. The target send date for all notifications is August 5, 2024. This date falls within all applicable statutory deadlines based on the determination date of July 15, 2024: • Most restrictive deadlines: Colorado (C.R.S. § 6-1-716(2): 30 days from determination) = August 14, 2024; Florida (Fla. Stat. § 501.171(4)(a): 30 days from determination) = August 14, 2024. • Maryland: (

7. Enterprise Customer Notifications. Separate business-to-business notification letters to enterprise customers whose end users were affected by the incident are being sent concurrently under a separate template (Document No. SC-2024-04187-B2B). The enterprise customer notification template has been reviewed and approved separately.

8. Enterprise Contact Reference (Section 7). The reference to Fiona Albrecht, Director of Customer Success, in Section 7 should be included only for recipients who are associated with an enterprise customer account, as identified in the enterprise customer user mapping (Document No. SC-2024-04187-ECM, dated July 28, 2024). For recipients who are individual (non-enterprise) users of the Lumos Insight Platform, the Fio

9. International Notifications — Coordination. • United Kingdom (814 UK-resident affected users): Individual notification letters for UK-resident users are being sent concurrently under a separate UK-specific template that complies with the requirements of the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. The UK notifications have been prepared in coordination with Harmon Watts & K

10. Quality Control. Before any version of this letter is sent, it must be reviewed by a member of the Calderwood & Harkness team to confirm that all bracketed fields have been properly populated, the Quick View conditional paragraph has been correctly included or omitted as applicable, the correct delivery method has been selected, and the unique Activation Code has been properly generated and inserted. END OF TEMPL