PRIVILEGED AND CONFIDENTIAL — ATTORNEY-CLIENT PRIVILEGED / ATTORNEY WORK PRODUCT
Prepared at the direction of counsel. Do not distribute without the express authorization of the General Counsel.
MEMORANDUM
TO: Board of Directors, Lumos Analytics Inc.; Ridgeline Capital Partners, LP (Attention: Vanessa Collier, Operating Partner (Technology) and Lumos Board Member; Theodore "Ted" Ridgeway, Managing Partner)
FROM: Allison Cho, General Counsel & Chief Privacy Officer, Lumos Analytics Inc.
DATE: July 22, 2024
RE: Credential-Stuffing Incident Affecting the Lumos Insight Platform — Incident Summary, Remediation Status, and Legal Posture
PREPARED WITH THE ASSISTANCE OF: Calderwood & Harkness LLP (Rachel Bernstein, Responsible Partner; Sara Hendricks, Lead Associate), Privacy & Data Security Practice, One Embarcadero Center, Suite 3400, San Francisco, CA 94111 — C&H Matter No. 1008-00009
Right-click to update Table of Contents
I. Purpose and Context
The purpose of this memorandum is to inform the Board of Directors of Lumos Analytics Inc. ("Lumos" or the "Company") and Ridgeline Capital Partners, LP ("Ridgeline"), in its capacity as majority equity holder and Series C lead investor since 2021, of a cybersecurity incident affecting the Lumos Insight Platform (the "Platform" or "Insight Platform"). This memorandum provides a comprehensive summary of the incident, the forensic investigation conducted in response, the remediation actions taken and ongoing, the Company's legal posture with respect to notification obligations and potential regulatory and litigation exposure, and the status of the Company's insurance coverage.
Notification to Ridgeline is being provided pursuant to the obligation set forth in Section 7.4(c) of the Amended and Restated Stockholders' Agreement, dated as of October 14, 2021, by and among Lumos Analytics Inc., Ridgeline Capital Partners, LP, and the other stockholders party thereto (the "Stockholders' Agreement"), which requires the Company to notify Ridgeline of any material security incident affecting the Company's technology platforms, products, or services within a reasonable time after discovery. Ridgeline holds board observer rights under the Stockholders' Agreement and the Investor Rights Agreement, dated as of the same date, and its representatives—Ms. Collier and Mr. Ridgeway—have been kept apprised of the incident on an informal basis since June 16, 2024. This memorandum formalizes that notification and provides a consolidated record for Ridgeline's and the Board's review.
Calderwood & Harkness LLP ("C&H") was engaged on June 18, 2024, as outside breach response counsel to advise the Company in connection with the incident. C&H is pre-approved panel counsel under the Company's cyber liability insurance policy with NexTier Cyber Insurance Group ("NexTier"), Policy No. NXT-CYB-2024-07812, and its retention was coordinated with NexTier in accordance with the policy's panel counsel provisions. C&H has supervised and directed the forensic investigation, coordinated with UK/EU counsel, advised on notification obligations, and is assisting with the Company's overall legal response strategy.
This memorandum, together with all attachments, exhibits, and referenced reports, is intended to be and should be treated as protected by the attorney-client privilege, the work product doctrine, and any other applicable privileges. It was prepared at the direction of counsel for the purpose of providing legal advice to the Company and its Board. Recipients are instructed not to forward, copy, or distribute this memorandum, or disclose its contents, to any person not identified in the "TO" line above, without the express prior written authorization of the undersigned General Counsel.
II. Executive Summary
Between June 12 and June 15, 2024, Lumos Analytics Inc. experienced a credential-stuffing attack directed against the Lumos Insight Platform (version v4.7.2, build 4.7.2-rel-20240601). The attack involved the automated injection of compromised username and password pairs against the Platform's authentication endpoint. The credential pairs used in the attack originated from an unrelated data breach suffered by VaultSync Technologies, Inc. ("VaultSync"), a California-based consumer cloud storage provider that publicly disclosed its own breach on May 28, 2024. In its public disclosure, VaultSync indicated that approximately 48 million user records, including email addresses and hashed passwords, were compromised.
The threat actors leveraged the fact that a subset of Lumos Insight Platform users had reused their VaultSync credentials—or substantially similar credentials—for their Lumos accounts. Through this credential reuse, the attackers successfully accessed 11,438 individual user accounts out of approximately 2.16 million total login attempts, representing an approximate success rate of 0.53%. The affected accounts spanned 847 distinct enterprise customer tenants out of the Company's total base of approximately 4,200 enterprise customers and approximately 286,000 total registered platform users.
Palisade Digital Forensics, Inc. ("Palisade"), an independent digital forensics firm retained at the direction of C&H to preserve attorney-client privilege over the forensic investigation, conducted a comprehensive forensic analysis of the incident. Palisade's final report, delivered on July 15, 2024, concluded the following:
• There is no evidence of compromise to Lumos's internal systems, databases, or infrastructure beyond the user-facing Platform interface;
• All unauthorized access was accomplished through the use of valid user credentials obtained from the external VaultSync breach;
• No malware or persistence mechanisms were deployed in any accessed account;
• There is no evidence of lateral movement or privilege escalation within the Platform;
• There is no evidence of bulk data exfiltration, and session durations were consistent with automated credential validation rather than data harvesting.
The Company has undertaken comprehensive and timely remediation measures. Immediate containment actions—including a global password reset for all 286,000 registered users, blocking of all identified attacker IP addresses, and permanent disablement of the Quick View cached data feature—were executed within hours of incident confirmation. Since that time, the Company has deployed advanced bot-detection and CAPTCHA on all login endpoints, integrated a credential-screening service that checks user passwords against known breach databases, and reduced rate limits on authentication endpoints. Most significantly, mandatory multi-factor authentication (MFA) has been rolled out to all Insight Platform accounts, with that rollout completed as of the date of this memorandum, July 22, 2024.
As of the date of this memorandum, no regulatory enforcement actions or inquiries have been received from any U.S. or non-U.S. regulatory authority, and no lawsuits have been filed. Notification obligations are being addressed on a multi-jurisdictional basis, with individual and attorney general notifications targeted for early August 2024, comfortably within the most restrictive applicable statutory deadlines. The Company's cyber liability insurance carrier, NexTier, has acknowledged coverage, and total estimated incident costs of approximately $5,165,732 are well within the $15 million per-occurrence policy limit.
The balance of this memorandum provides a detailed discussion of the incident, the forensic investigation, remediation actions, notification obligations and timelines, insurance coverage, litigation and regulatory posture, enterprise customer impact, and recommended next steps.
III. Detailed Incident Description
A. Attack Vector and Origin
The incident involved a credential-stuffing attack, a well-known and increasingly common attack methodology in which a threat actor obtains a large set of compromised username and password pairs—typically from a prior, unrelated data breach—and uses automated tools to systematically inject those credentials against the login endpoint of a target application. The attack relies on the widespread phenomenon of credential reuse: users who employ the same email address and password combination across multiple online services are vulnerable when any one of those services suffers a breach.
In this case, the compromised credential pairs used in the attack originated from the data breach suffered by VaultSync Technologies, Inc. VaultSync is a California corporation headquartered in Palo Alto, California, that operates a consumer cloud storage platform. On May 28, 2024, VaultSync publicly disclosed that it had experienced a data breach in which threat actors gained unauthorized access to a database containing approximately 48 million user records. The compromised records included email addresses, bcrypt-hashed passwords, and certain user profile metadata. Although the passwords were stored in hashed form, security researchers reported within days of the VaultSync disclosure that a substantial number of the hashed passwords had been cracked and that credential lists derived from the breach were circulating on dark web forums and credential-sharing marketplaces by early June 2024.
The threat actors directed the compromised VaultSync credential pairs against the Lumos Insight Platform's primary login endpoint, located at `https://insight.lumosanalytics.com/api/v2/auth/login`. At the time of the attack, the Insight Platform (version v4.7.2, build 4.7.2-rel-20240601) did not require multi-factor authentication by default—MFA was available as an optional, user-configurable setting, but was not enforced at the platform or tenant-administrator level. Rate limiting on the authentication endpoint was configured at 100 login attempts per minute per source IP address, a threshold that, while consistent with industry norms at the time of deployment, proved insufficient to impede the distributed, high-volume nature of the credential-stuffing attack.
It is important to emphasize that this incident did not involve any exploitation of a vulnerability in Lumos's own systems, applications, or infrastructure. The Lumos Insight Platform was not "hacked" in the conventional sense; rather, the attackers were able to log in to user accounts by presenting the correct username and password combination—credentials that the affected users had reused from their VaultSync accounts. The root cause of the successful accesses was credential reuse by individual users, compounded by the absence of mandatory MFA on the Lumos platform at the time of the attack.
B. Attack Timeline
The following timeline sets forth the key events of the incident in chronological order. All times are stated in Coordinated Universal Time (UTC) unless otherwise indicated.
June 12, 2024, approximately 02:14 UTC — Attack Commences. Automated login attempts begin against the Lumos Insight Platform's authentication endpoint. The initial wave of attempts originates from a cluster of IP addresses geolocated to Romania and Ukraine. Login attempts are distributed across a large number of source IP addresses to evade per-IP rate limits.
June 12–15, 2024 — Sustained Attack Window. Over the course of approximately 65.5 hours, the threat actors direct approximately 2.16 million login attempts against the Platform from 1,247 unique source IP addresses. The source IPs are primarily geolocated to Eastern Europe (Romania, Ukraine, Moldova, and Bulgaria) and Southeast Asia (Vietnam, Indonesia, and the Philippines), consistent with the use of residential proxy networks and compromised infrastructure commonly employed in credential-stuffing campaigns. The vast majority of login attempts fail—approximately 99.47% of the attempts result in an authentication failure because the VaultSync credentials do not match any Lumos account or because the user had a different password on the Lumos platform. However, 11,438 attempts succeed, resulting in unauthorized access to 11,438 distinct user accounts.
June 15, 2024, approximately 14:22 UTC — SIEM Alert Triggered. The WatchTower Security Information and Event Management (SIEM) platform, provided by Aegis Security Solutions, Inc. ("Aegis") under the Company's managed security services agreement, triggers anomaly alerts. The alerts are based on a combination of factors: volumetric anomalies in login attempt patterns (a sustained elevation in failed login rates well above historical baselines), geographic IP anomalies (a disproportionate concentration of login attempts from regions where Lumos has minimal user presence), and temporal anomalies (a sustained 24/7 pattern inconsistent with normal business-hours login activity). The SIEM alert was generated pursuant to WatchTower's automated threat-detection rules, which had been most recently tuned during a quarterly review in April 2024.
June 15, 2024, approximately 16:08 UTC — Incident Confirmed. The Lumos Security Operations Center (SOC) team, under the direction of Jason Haddad, Vice President of Information Security and Chief Information Security Officer, reviews the WatchTower alerts, correlates the anomalous login patterns with the recently disclosed VaultSync breach, and confirms that the Company is experiencing a credential-stuffing incident. Mr. Haddad immediately activates the Company's Incident Response Plan (IRP) and notifies the undersigned General Counsel, CEO Marcus Tan, and CTO Deepika Narayanan.
June 15, 2024, approximately 19:47 UTC — Last Unauthorized Login. The last successful unauthorized login attributable to the credential-stuffing campaign is recorded. At this point, the SOC team has identified the pattern and is in the process of executing containment measures. The total attack window from first unauthorized access to last unauthorized access is approximately 65 hours and 33 minutes.
June 15, 2024, approximately 20:30 UTC — Containment Measures Executed. Under the direction of Mr. Haddad and Ms. Narayanan, the engineering and security teams execute the following containment measures: (a) a global password reset is initiated for all 286,000 registered Insight Platform users, requiring every user to create a new password upon next login; (b) all 1,247 unique source IP addresses and associated IP ranges identified as associated with the attack are blocked at the network perimeter and in the Platform's web application firewall (WAF); and (c) an elevated monitoring posture is implemented across all authentication and access-control systems.
June 16, 2024 — Quick View Feature Disabled. Upon preliminary analysis indicating that the Quick View cached data feature had exposed partial financial data for a subset of the accessed accounts, the engineering team, under the direction of Brian Kowalski, VP of Engineering, permanently disables the Quick View feature. The feature had allowed users to view a cached summary of their most recent portfolio analytics directly on their user profile page without navigating to the full analytics dashboard. This feature had been introduced in Platform version 4.5.0 (released November 2023) as a convenience feature for frequent users and was not subject to a separate security review at the time of deployment—a gap that has been identified and addressed in the Company's revised software development lifecycle (SDLC) procedures.
C. Scope of Unauthorized Access
The scope of unauthorized access has been determined through forensic analysis of Platform authentication logs, session logs, and application-layer access logs. The following summarizes the key metrics:
• Total unique user accounts successfully accessed: 11,438
• Total login attempts observed: Approximately 2.16 million
• Success rate: Approximately 0.53%
• Enterprise customer tenants affected: 847 (out of approximately 4,200 total enterprise customers)
• Total registered Platform users: Approximately 286,000
The affected accounts were distributed across the Company's enterprise customer base, with no single customer accounting for a disproportionate share of the total. However, several notable enterprise customers had a significant number of affected accounts, which may bear on customer relationship management and contractual notification obligations:
• Cascadia National Bancorp: 312 accounts accessed out of 1,247 total Lumos accounts held by Cascadia employees. Cascadia is a top-10 Lumos customer by annual contract value, with a current annual contract value in excess of $2.4 million. The Company has a dedicated customer success manager assigned to the Cascadia relationship, and the Cascadia account team has been briefed on the incident.
• Ironbridge Insurance Holdings, Inc.: 204 accounts accessed. Ironbridge is a mid-tier enterprise customer with an annual contract value of approximately $680,000.
• Monarch Wealth Advisors, LLC: 89 accounts accessed. Monarch is a registered investment adviser and is subject to SEC cybersecurity disclosure requirements under its own regulatory framework, which may affect the timing and content of our communications to Monarch.
Enterprise customer-specific notification and communication planning is discussed further in Section IX of this memorandum.
D. Data Categories Exposed
The forensic investigation identified the following categories of data that were viewable to the threat actors upon successful login to an affected account. It is important to note that "exposure" in this context means that the data was present on pages rendered during the unauthorized session; the investigation did not find evidence that the data was downloaded, copied, or exfiltrated, but the possibility that the threat actor viewed or captured the data by other means (e.g., screenshots or visual inspection) cannot be conclusively ruled out.
User Profile Information (All 11,438 Accounts). Upon successful login, the user profile page of the Lumos Insight Platform displays the following fields: full name, email address, job title, and employer name. These fields were populated for all 11,438 accessed accounts and were therefore exposed in every instance of unauthorized access.
Phone Number (Approximately 7,820 Accounts). The user profile page also includes a phone number field, which is optional at the time of account registration. This field was populated for approximately 7,820 of the 11,438 accessed accounts, representing approximately 68.4% of the affected users. For the remaining approximately 3,618 accounts, the phone number field was blank.
Dashboard Configurations and Saved Analytics Queries (All 11,438 Accounts). The Insight Platform allows users to configure custom dashboards and save analytics queries. These configurations and queries constitute proprietary business data belonging to the enterprise customer and may contain information about the customer's analytical priorities, investment strategies, and areas of focus. While not "personal information" within the meaning of most breach notification statutes, the exposure of this data has commercial sensitivity implications and is relevant to the Company's enterprise customer notification obligations and customer relationship management.
Quick View Cached Partial Portfolio Data (2,614 Accounts). For 2,614 of the 11,438 accessed accounts (approximately 22.9%), the Quick View feature had cached partial portfolio data on the user profile page. The Quick View display included partial financial account numbers (last four digits only), account balances (as of the most recent data refresh prior to the unauthorized session), and asset allocation summaries. The Quick View feature refreshed its cached data every 24 hours from the underlying portfolio analytics engine, and the data displayed was therefore current as of the most recent daily refresh cycle prior to the unauthorized access.
The exposure of partial financial account numbers (last four digits) and account balances for this subset of 2,614 users is the most sensitive element of the data exposure and is the primary driver of the Company's notification obligations in many jurisdictions. The partial financial account numbers, standing alone, are not sufficient to access or transact on the underlying financial accounts, but when combined with other user profile information (full name, email, employer), they may constitute "personal information" under applicable breach notification statutes.
Data Categories Not Exposed. The following categories of data were not stored in user-facing profile pages or otherwise accessible via the Insight Platform user interface, and therefore were not exposed in connection with this incident: Social Security numbers (SSNs), full financial account numbers, payment card data (credit or debit card numbers, CVVs, or expiration dates), health information, biometric data, and government-issued identification numbers (other than SSNs). The absence of these highly sensitive data elements significantly mitigates the potential harm to affected individuals and favorably affects the Company's legal posture.
IV. Forensic Investigation
A. Retention and Privilege
Palisade Digital Forensics, Inc. ("Palisade"), a nationally recognized digital forensics and incident response firm headquartered in Seattle, Washington, was retained on June 18, 2024, to conduct an independent forensic investigation of the credential-stuffing incident. The engagement lead for Palisade is Dr. Neil Frasier, Principal Consultant, who has over twenty years of experience in digital forensics and incident response and has served as an expert witness in numerous data breach matters.
Critically, Palisade was retained at the direction of Calderwood & Harkness LLP, acting as breach response counsel, for the express purpose of assisting C&H in providing legal advice to the Company. The Palisade engagement letter is addressed to C&H and identifies Palisade as a consulting expert retained by counsel. All Palisade reports, findings, and communications have been directed through C&H, and none have been shared directly with the Company's operational or engineering teams without first being reviewed and transmitted by C&H. This engagement structure was established to preserve the attorney-client privilege and work product doctrine protections over the forensic investigation and its findings, consistent with the framework approved by courts in the Ninth Circuit and elsewhere. The Company should continue to maintain this privilege structure and should not share Palisade's reports or findings outside the scope of this privileged communication without consulting C&H.
B. Findings Timeline
Palisade's investigation proceeded in two phases. In the first phase, Palisade conducted an initial triage and rapid assessment of the incident, reviewing Platform authentication logs, session logs, network traffic captures, and system integrity data. On June 26, 2024, Palisade delivered a preliminary forensic findings memorandum to C&H, which was subsequently shared with the undersigned. The preliminary findings were consistent with a credential-stuffing attack and did not identify any evidence of deeper system compromise, malware, or data exfiltration.
In the second phase, Palisade conducted a comprehensive forensic examination, including analysis of the 137 accounts that exhibited extended session durations (discussed below), review of server-side application logs for evidence of data download or API-level data access, and analysis of the Quick View feature's data caching mechanism. On July 15, 2024, Palisade delivered its final forensic investigation report to C&H. The final report confirmed and expanded upon the preliminary findings and serves as the definitive record of the forensic investigation.
For purposes of calculating notification deadlines under applicable breach notification statutes, the Company is treating July 15, 2024—the date of Palisade's final forensic report—as the "determination date," i.e., the date on which the investigation was reasonably concluded and the Company determined the scope of the data exposure. This is a defensible and conservative approach. Several statutes define the trigger as the date on which the entity "determines" or "Discovers" that a breach has occurred and personal information was or is reasonably believed to have been accessed; by using the date of the final forensic report rather than the earlier date of the preliminary findings, the Company is ensuring that the determination date reflects the completion of a thorough investigation.
C. Key Forensic Conclusions
The following are the key conclusions set forth in Palisade's final forensic investigation report dated July 15, 2024:
1. No evidence of compromise of Lumos's internal systems, databases, or infrastructure. Palisade examined system logs, file integrity monitoring data, and network traffic captures and found no evidence that the threat actors gained access to any Lumos system, server, database, or infrastructure component beyond the user-facing Insight Platform interface. The attack was confined entirely to the authentication layer and the user-facing application tier. There is no evidence that the attackers accessed the underlying data warehouse, the analytics processing engine, the administrative console, or any internal corporate system.
2. All unauthorized access was accomplished using valid user credentials obtained externally. Palisade's analysis of the authentication logs confirmed that every successful unauthorized login was accomplished by presenting a valid username and password combination. No authentication bypass, brute-force attack, or exploitation of any software vulnerability was involved. The credential pairs match those known to have been compromised in the VaultSync breach, as corroborated by comparison with credential samples circulating on known dark web forums (comparison performed by Palisade's threat intelligence team in coordination with its dark web monitoring partners).
3. No malware or persistence mechanisms were deployed in any accessed account. Palisade examined the session data, browser artifacts (where available), and server-side state associated with the 11,438 unauthorized sessions and found no evidence that any malware, backdoor, web shell, or other persistence mechanism was deployed. There is no indication that the attackers attempted to establish ongoing access to any account beyond the initial unauthorized session.
4. No evidence of lateral movement or privilege escalation. The threat actors did not attempt to escalate privileges within the Insight Platform (e.g., by attempting to access administrative functions or other users' accounts) and did not attempt to move laterally from the user-facing Platform to other Lumos systems. Each unauthorized session was confined to the individual user account that was logged into.
5. No evidence of bulk data exfiltration. Palisade analyzed server-side network traffic logs and application-layer access logs and found no evidence of bulk data download, API-level data extraction, or other forms of data exfiltration during the unauthorized sessions. The access sessions were overwhelmingly short in duration—the median session duration was 4.2 seconds—consistent with automated credential validation or "account checking" behavior, in which the threat actor's automated tool logs in, confirms the credentials are valid, and immediately logs out without further interaction.
6. Extended session analysis. Of the 11,438 unauthorized sessions, 137 accounts (approximately 1.2%) exhibited session durations exceeding 30 seconds, suggesting possible manual review by the threat actor (i.e., a human operator may have interacted with the session rather than relying solely on automated tools). Palisade conducted an individual review of each of these 137 sessions, examining server-side access logs for evidence of page navigation, data requests, file downloads, or other activity that would indicate data harvesting. No evidence of data download, API data requests, or screenshot activity was detected in the server logs for any of these 137 sessions. However, Palisade notes—and the Company acknowledges—that the absence of server-side evidence of data capture does not conclusively rule out the possibility that the threat actor visually inspected or captured screen-level data during these sessions using client-side methods (e.g., screenshots or screen recording on the attacker's device), which would not be reflected in server-side logs.
V. Remediation Actions
A. Immediate Containment (Completed)
The following containment measures were executed on June 15–16, 2024, within hours of incident confirmation:
Global Password Reset (June 15, 2024). A mandatory global password reset was initiated for all 286,000 registered Insight Platform users at approximately 20:30 UTC on June 15, 2024. All active sessions were terminated, and all users were required to create a new password upon next login. The password reset was implemented with enhanced password complexity requirements (minimum 12 characters, including uppercase, lowercase, numeric, and special characters) and was accompanied by a general notification to all users advising that the reset was being performed "as part of a security enhancement." The notification did not disclose the nature or details of the incident, consistent with C&H's advice to defer substantive disclosure until the forensic investigation was sufficiently advanced to support accurate and complete notification.
IP blocking (June 15, 2024). All 1,247 unique source IP addresses and their associated CIDR ranges identified as associated with the attack were blocked at both the network perimeter firewall and the Platform's Cloudfront-based web application firewall (WAF). These IP blocks remain in place.
Quick View Feature Disabled (June 16, 2024). The Quick View cached data feature was permanently disabled on June 16, 2024. The feature has been removed from the Platform codebase, and the cached data previously stored in the Quick View module has been purged from all application servers and CDN caches. The Company has no plans to reintroduce this feature.
B. Security Enhancements (Completed)
In addition to the immediate containment measures, the Company has implemented the following security enhancements to harden the Platform against future credential-stuffing and similar attacks:
Advanced Bot-Detection and CAPTCHA (Completed July 8, 2024). The Company deployed an advanced bot-detection and CAPTCHA solution (provided by ShieldBot, Inc.) on all Lumos Insight Platform login endpoints. The solution employs behavioral analysis, device fingerprinting, and adaptive CAPTCHA challenges to distinguish between legitimate human users and automated bot traffic. The deployment was completed on July 8, 2024, and has been operational since that date. In the two weeks since deployment, the solution has blocked approximately 340,000 automated login attempts, confirming that credential-stuffing activity targeting the Platform is ongoing (though at substantially reduced volume) and validating the need for this control.
Mandatory Multi-Factor Authentication (Completed July 22, 2024). Mandatory multi-factor authentication (MFA) has been rolled out to all Insight Platform accounts. As of the date of this memorandum, July 22, 2024, all 286,000 registered users are required to enroll in MFA using either an authenticator application (TOTP-based), SMS-based verification, or a hardware security key. This is the single most impactful security enhancement arising from this incident, as MFA would have rendered the credential-stuffing attack entirely ineffective regardless of whether the attacker possessed valid username/password pairs. The Company acknowledges that the absence of mandatory MFA prior to this incident was a significant gap in the Platform's security posture and that this enhancement should have been prioritized earlier. The Board should be aware that C&H advises that this acknowledgment, if disclosed, could potentially be used adversely in litigation; however, in C&H's judgment, the proactive implementation of MFA is a net positive for the Company's overall legal posture and demonstrates good faith and diligence.
Rate-Limiting on Authentication Endpoints. The per-source-IP rate limit on authentication endpoints has been reduced from 100 attempts per minute to 10 attempts per minute. This tenfold reduction, combined with the bot-detection solution, substantially limits the throughput available to an attacker conducting a credential-stuffing campaign against the Platform. The rate limit adjustment was implemented on June 17, 2024.
Credential-Screening Service. The Company has integrated a credential-screening service into the Insight Platform that checks user passwords against known breach databases (including the widely used Hollowell Services Inc. database and proprietary threat intelligence feeds maintained by Aegis Security Solutions, Inc.) at both login and password change events. Users whose passwords are found to match credentials from known breaches are required to change their password immediately. This service was deployed on July 1, 2024.
C. Ongoing Measures
Litigation Hold. An internal litigation hold was issued on June 18, 2024, under the direction of the undersigned General Counsel and in coordination with C&H. The litigation hold covers all incident-related records, logs, communications (including emails, Meridian Solutions messages, and other internal communications), forensic images, and any other documents or data potentially relevant to the incident or any subsequent investigation, claim, or litigation. The litigation hold has been communicated to all relevant custodians, including members of the engineering, security, product, customer success, legal, and executive teams. Compliance with the litigation hold is being monitored on an ongoing basis.
Continued Monitoring. The Company's SOC team, in coordination with Aegis Security Solutions, is maintaining an elevated monitoring posture across all Platform authentication and access-control systems. Threat intelligence feeds are being monitored for any indications that the data exposed in this incident is being circulated, sold, or exploited on dark web forums or elsewhere.
Crisis Communications. Threshold Public Relations LLC ("Threshold") has been engaged (account lead: Janelle Morse) to assist with crisis communications and customer messaging support. Threshold is coordinating with the Company's marketing and communications team and with the customer success team to prepare customer-facing materials, including a customer FAQ, a public statement (to be released concurrently with the notification process), and internal talking points for customer-facing personnel.
VI. Notification Obligations and Timeline
A. U.S. Multi-Jurisdictional Analysis
Calderwood & Harkness LLP has completed a comprehensive analysis of the Company's notification obligations under the breach notification statutes of all 50 U.S. states, the District of Columbia, and the territories (with Puerto Rico being the only territory with affected residents). This analysis considered the categories of personal information exposed, the residency of the affected individuals (as determined by the mailing address or, where unavailable, the IP geolocation associated with the user's last known legitimate login), and the specific statutory definitions, triggers, and safe harbors applicable in each jurisdiction.
Affected individuals reside in all 50 states, the District of Columbia, and Puerto Rico. The distribution is approximately proportional to the general population distribution of the Company's user base, with the largest concentrations in California, New York, Texas, Florida, and Illinois.
The following key jurisdictions have been analyzed in detail:
California (Cal. Civ. Code § 1798.82; CCPA/CPRA). There are 3,412 affected accounts associated with California-resident users. Under California's breach notification statute, notification is required when an unauthorized person "acquires" computerized data that includes personal information. Whether credential-stuffing access—without affirmative evidence of exfiltration—constitutes "acquisition" within the meaning of the statute is a close question that has not been definitively resolved by California courts. The California Attorney General's office has taken the position in published guidance that unauthorized access to personal information may constitute acquisition in some circumstances, particularly where the personal information was viewable to the unauthorized accessor. In light of this uncertainty and the conservative approach we are recommending, C&H and the Company have determined that notification to California residents is warranted. Additionally, the CCPA/CPRA provides a private right of action for certain data breaches involving nonencrypted and nonredacted personal information, though the data elements at issue in this incident (name, email, phone number, partial financial account numbers) present a debatable question as to whether they fall within the scope of the private right of action. C&H is continuing to evaluate this exposure and will address it in a supplemental litigation risk assessment.
New York (SHIELD Act, N.Y. Gen. Bus. Law § 899-aa). There are 2,107 affected accounts associated with New York-resident users. New York's SHIELD Act defines a "breach of the security of the system" to include unauthorized "access" to private information, not requiring acquisition. Accordingly, the mere unauthorized access to the affected accounts—regardless of whether the data was actually exfiltrated—is sufficient to trigger the notification obligation. Notification is required.
Texas (Tex. Bus. & Com. Code § 521.053). There are 1,843 affected accounts associated with Texas-resident users. Texas's breach notification statute requires notification when sensitive personal information "was, or is reasonably believed to have been, acquired by an unauthorized person." Similar to California, the Texas statute uses an "acquisition" trigger, but C&H recommends notification in light of the accessibility of the data during the unauthorized sessions and the conservative approach being taken company-wide.
Based on C&H's comprehensive analysis:
• Individual notification is required in 42 states, the District of Columbia, and Puerto Rico.
• Attorney General notification is required in 34 states (in addition to any individual notification obligations).
• Notification has been determined to be unnecessary in 8 states, where the data elements accessed do not meet the statutory definition of "personal information" in those jurisdictions. In these states, the statutory triggers generally require exposure of Social Security numbers, driver's license numbers, or full financial account numbers—none of which were exposed in this incident.
B. Most Restrictive Deadlines
For purposes of calculating notification deadlines, the Company is using July 15, 2024—the date of Palisade's final forensic investigation report—as the determination date.
The most restrictive notification deadlines are as follows:
• Colorado (C.R.S. § 6-1-716) and Florida (Fla. Stat. § 501.171): 30 days from the date of determination. Deadline: August 14, 2024.
• Maryland (Md. Code, Com. Law § 14-3504) and similar states: 45 days from the date of determination. Deadline: August 29, 2024.
• Most remaining states: 30-to-60-day notification windows, with the majority providing 60 days from the date of determination.
The Company's planned notification timeline (described below) is comfortably within the most restrictive of these deadlines.
C. Planned Notification Actions
Attorney General Notifications. Notifications to the 34 state Attorneys General offices that require separate AG notification will be filed between August 1 and August 5, 2024. C&H is preparing the individual AG notification submissions, which vary in format and content requirements by jurisdiction. Certain states (including California, New York, Maryland, and Indiana) require submission of a copy of the notification letter sent to affected individuals, which will be included in the filing.
Individual Notifications. Individual notification letters will be sent to all 11,438 affected individuals on or about August 5, 2024. The primary notification method will be email, sent to the email address associated with the affected Lumos Insight Platform account. The notification letter will describe the nature of the incident, the categories of personal information involved, the steps the Company has taken in response, and the availability of 24 months of complimentary credit monitoring and identity theft protection services through Sentinel Identity Services, Inc. For approximately 1,612 individuals whose email addresses are bounced, flagged as invalid, or otherwise undeliverable, a follow-up notification will be sent via U.S. first-class mail to the most recent mailing address on file for the affected user. The notification letter has been reviewed and approved by C&H and is being finalized for distribution.
All planned notifications are comfortably within the most restrictive statutory deadlines. The August 5 individual notification date is 21 days from the determination date of July 15, well within the 30-day Colorado and Florida deadlines.
D. UK and EU Notifications
United Kingdom. There are 814 UK-resident users among the 11,438 affected individuals. Under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018, a personal data breach must be reported to the Information Commissioner's Office (ICO) within 72 hours of the controller becoming aware of the breach, unless the breach is unlikely to result in a risk to the rights and freedoms of natural persons. Given the categories of data exposed and the number of affected individuals, the Company determined that notification to the ICO was required.
The ICO notification was filed on June 18, 2024, within the required 72-hour window from the Company's awareness of the incident on June 15, 2024. The notification was coordinated and submitted by Harmon Watts & Kendrick LLP ("HWK"), a London-based law firm engaged as the Company's UK/EU data protection counsel (lead partner: Catherine Wye). The ICO has acknowledged receipt of the notification. As of the date of this memorandum, the ICO has not initiated any further inquiry or investigation in connection with the notification.
Individual notifications to UK-resident data subjects are planned for August 5, 2024, concurrent with the U.S. individual notifications. The UK individual notification will be tailored to comply with the requirements of Article 34 of the UK GDPR and will include the information required by that Article, including a description of the nature of the breach, the name and contact details of the Company's data protection officer, a description of the likely consequences of the breach, and a description of the measures taken or proposed to address the breach.
European Union. There are 47 EU-resident affected users distributed across four member states: Germany (19 users), France (14 users), the Netherlands (9 users), and Ireland (5 users). C&H and HWK have assessed whether separate notifications to the relevant national data protection authorities (DPAs) are required under the EU GDPR. Given the de minimis number of affected individuals in each member state, the nature of the data exposed (which does not include any special categories of personal data within the meaning of Article 9 of the GDPR), and the absence of evidence of data exfiltration or harm, C&H and HWK have concluded that separate DPA notification is not required under the applicable risk threshold. However, as a matter of caution and good practice, individual notices will be sent to all 47 EU-resident affected users on August 5, 2024, concurrent with the U.S. and UK notifications. The individual notices will comply with Article 34 of the EU GDPR and will be provided in the official language of each user's member state of residence.
E. Credit Monitoring
The Company will offer 24 months of complimentary credit monitoring and identity theft protection services to all 11,438 affected individuals, regardless of whether the individual's account included Quick View cached financial data. This decision was made in consultation with C&H and reflects a conservative and consumer-friendly approach intended to demonstrate good faith and to mitigate potential harm and regulatory criticism. The credit monitoring services will be provided through Sentinel Identity Services, Inc. ("Sentinel"), headquartered in Atlanta, Georgia, a nationally recognized provider of post-breach identity protection services.
The estimated cost of the credit monitoring program is calculated as follows:
11,438 individuals × $14.50 per person per month × 24 months = $3,978,432
This figure represents the maximum cost assuming 100% enrollment. Based on industry data, actual enrollment rates for post-breach credit monitoring programs typically range from 5% to 15%, meaning the actual cost may be substantially lower. However, the Company is budgeting for and the insurance carrier has been advised of the full 100% enrollment estimate.
The credit monitoring offer will be communicated in the individual notification letters and will include a unique enrollment code and instructions for activating the service through Sentinel's online portal. Sentinel will provide a dedicated call center for affected individuals with questions about the program.
VII. Insurance Coverage
The Company maintains a cyber liability insurance policy with NexTier Cyber Insurance Group ("NexTier"), headquartered in Chicago, Illinois. The material terms of the policy are as follows:
• Carrier: NexTier Cyber Insurance Group
• Policy Number: NXT-CYB-2024-07812
• Policy Period: January 1, 2024 – January 1, 2025
• Coverage Limit: $15,000,000 per occurrence / $30,000,000 aggregate
• Retention (Self-Insured Retention / SIR): $500,000 per claim
• Coverage Type: First-party and third-party cyber liability coverage, including breach response costs, notification costs, credit monitoring costs, forensic investigation costs, crisis management/public relations costs, legal fees (panel counsel), and regulatory defense costs
The Company submitted a claim to NexTier on June 20, 2024, five days after the incident was confirmed. On July 3, 2024, NexTier acknowledged coverage for the claim through its designated claims adjuster, Martin Okubo. Mr. Okubo confirmed that the incident falls within the scope of the policy's first-party breach response coverage and that the enumerated cost categories—including legal fees for C&H (as pre-approved panel counsel), forensic investigation costs, notification costs, credit monitoring costs, and crisis communications costs—are covered under the policy, subject to the $500,000 per-claim self-insured retention.
The following table summarizes the estimated costs of the incident response as of the date of this memorandum:
NexTier coverage, after application of the $500,000 self-insured retention, is estimated at:
$5,165,732 − $500,000 = approximately $4,665,732 estimated covered amount (subject to final adjustment and NexTier's review of individual cost items)
The total estimated incident cost of $5,165,732 is well within the $15 million per-occurrence policy limit, and the Company does not anticipate any coverage disputes with NexTier based on the facts as currently understood. The Company has been and will continue to submit invoices and cost documentation to NexTier for review and reimbursement on a rolling basis. The Lumos internal costs of approximately $310,000 may or may not be covered under the policy, depending on NexTier's interpretation of the "internal costs" provisions; C&H is in dialogue with NexTier on this point.
If the incident gives rise to regulatory proceedings or litigation, the policy's third-party coverage provisions would apply to defense costs and, subject to the terms and conditions of the policy, potential settlements or judgments. The third-party coverage is subject to the same $15 million per-occurrence and $30 million aggregate limits.
VIII. Litigation and Regulatory Posture
A. Regulatory Status
As of the date of this memorandum, the Company has not received any enforcement action, formal or informal inquiry, civil investigative demand, or other communication from any state Attorney General, the Federal Trade Commission, or any other U.S. federal or state regulatory authority in connection with this incident. The Company's proactive AG notification filings, scheduled for August 1–5, 2024, will be the first formal communications with state regulators regarding the incident.
With respect to the United Kingdom, the Information Commissioner's Office acknowledged receipt of the Company's notification filed on June 18, 2024. As of the date of this memorandum, the ICO has not initiated any further inquiry, investigation, or enforcement action. The Company will continue to monitor for any further ICO correspondence and will respond promptly to any inquiry.
No communications have been received from any EU data protection authority.
B. Litigation Status
As of the date of this memorandum, no lawsuits, demands, or pre-litigation claims have been filed or communicated to the Company in connection with this incident. The Company is not aware of any attorney demand letters, class action investigation announcements, or other pre-litigation activity related to the incident. However, the Company recognizes that litigation risk may increase following the public disclosure of the incident through the notification process in early August, and the Company is prepared for that possibility.
As noted above, the Company issued an internal litigation hold on June 18, 2024, as a prophylactic measure to ensure the preservation of all potentially relevant evidence. The litigation hold covers all incident-related records, logs, communications (including emails, Meridian Solutions messages, and other internal messaging), forensic images, and any other documents or data that may be relevant to the incident or any subsequent regulatory inquiry, claim, or litigation. The litigation hold will remain in effect until affirmatively released by the undersigned General Counsel in consultation with C&H.
C. Pre-Litigation Risk Assessment
Calderwood & Harkness LLP has prepared a preliminary assessment of the Company's litigation and regulatory risk profile based on the facts as currently understood. The full assessment is being provided under separate cover as a standalone privileged memorandum; the following summarizes the key conclusions.
Nature of the Attack Supports a Defensible Posture. The credential-stuffing nature of the attack—in which the threat actors used externally sourced credentials from the VaultSync breach to log into Lumos accounts, without exploiting any vulnerability in the Lumos platform—supports a defensible posture. The Company was not the source of the compromised credentials, and the root cause of the successful accesses was credential reuse by individual users. While the absence of mandatory MFA at the time of the attack is a potential vulnerability in the Company's position, the fact that MFA was available as an optional feature, and that the Company implemented mandatory MFA promptly following the incident, mitigates this concern. Courts evaluating data breach claims have generally recognized that companies are not strictly liable for credential-stuffing attacks and have focused on whether the company maintained reasonable security measures. C&H's assessment is that the Company's overall security posture, including the post-incident enhancements, supports a finding of reasonable security.
Absence of Highly Sensitive Data Mitigates Standing and Damages. The absence of Social Security numbers, full financial account numbers, and payment card data from the exposed data categories significantly mitigates the risk of class action standing and damages claims. In the Ninth Circuit and many other federal circuits, plaintiffs in data breach class actions must demonstrate Article III standing by showing a concrete injury-in-fact. Courts have increasingly distinguished between breaches involving highly sensitive data (e.g., SSNs, financial account numbers, health data) and those involving less sensitive data (e.g., names, email addresses, phone numbers), with the latter presenting substantially weaker standing arguments. The exposure of partial financial account numbers (last four digits) for the 2,614 Quick View users presents a somewhat stronger standing argument but is still distinguishable from exposure of full account numbers, as the last four digits alone are insufficient to access or transact on the underlying accounts.
Proactive Remediation and Timely Notification. The Company's proactive remediation measures—including the global password reset, MFA rollout, bot-detection deployment, feature disablement, and credential screening—and the Company's intention to complete all notifications within statutory deadlines, further support a strong compliance and good-faith posture. Regulators and courts have consistently recognized proactive and timely breach response as a mitigating factor.
C&H's overall assessment, as of the date of this memorandum, is that while the Company cannot eliminate the risk of future regulatory inquiry or litigation, the current posture is favorable, and any claims that may arise are defensible on the merits.
IX. Enterprise Customer Impact and Communications
A total of 847 enterprise customer tenants had at least one affected user account among the 11,438 total accounts accessed during the incident. The impact varies significantly across the customer base, ranging from customers with a single affected account to Cascadia National Bancorp with 312 affected accounts. Many of the Company's enterprise customer agreements contain contractual provisions requiring notification to the customer in the event of a security incident affecting the customer's data, typically within defined timeframes. The Company's standard Master Services Agreement (MSA) and Data Processing Addendum (DPA) contain such provisions.
Dedicated enterprise customer notifications are being prepared under the direction of Fiona Albrecht, Director of Customer Success, with input from the legal team and Threshold Public Relations LLC. The enterprise customer notifications will be delivered concurrently with the individual notifications on or about August 5, 2024. The enterprise customer notifications will be tailored to each customer's specific circumstances (including the number of affected accounts, the categories of data exposed, and whether any Quick View data was involved) and will be delivered to the designated security or privacy contact at each enterprise customer organization, or to the primary contractual contact where no security/privacy contact has been designated.
Ms. Albrecht has been designated as the primary customer-facing point of contact for incident-related inquiries from enterprise customers. A dedicated email alias (security-incident@lumosanalytics.com) and phone line have been established to handle inbound customer inquiries. Threshold Public Relations LLC is assisting with the preparation of a customer FAQ document and pre-approved messaging for use by the customer success team in responding to customer inquiries.
The Company anticipates that certain enterprise customers—particularly those in regulated industries such as financial services and insurance, including Cascadia National Bancorp, Ironbridge Insurance Holdings, and Monarch Wealth Advisors—may require additional information or documentation to fulfill their own regulatory reporting obligations. The Company is prepared to cooperate with such requests within the bounds of appropriate information sharing and consistent with the preservation of attorney-client privilege over the forensic investigation.
X. Key Personnel Involved
The following individuals have been materially involved in the Company's incident response and are the primary contacts for their respective organizations:
Lumos Analytics Inc.
• Marcus Tan — Chief Executive Officer
• Deepika Narayanan — Chief Technology Officer
• Allison Cho — General Counsel & Chief Privacy Officer
• Brian Kowalski — Vice President of Engineering
• Jason Haddad — Vice President of Information Security / Chief Information Security Officer
• Fiona Albrecht — Director of Customer Success
Calderwood & Harkness LLP — Outside Breach Response Counsel
• Rachel Bernstein — Responsible Partner, Privacy & Data Security Practice
• Kevin Ostrowski — Billing Partner
• Sara Hendricks — Lead Associate
• Priscilla Wynn — Working Associate
Palisade Digital Forensics, Inc. — Forensic Investigators
• Dr. Neil Frasier — Principal Consultant, Engagement Lead
Harmon Watts & Kendrick LLP — UK/EU Data Protection Counsel
• Catherine Wye — Lead Partner, London Office
Threshold Public Relations LLC — Crisis Communications
• Janelle Morse — Account Lead
NexTier Cyber Insurance Group — Insurance Carrier
• Martin Okubo — Claims Adjuster
XI. Recommendations and Next Steps
Based on the foregoing summary and in consultation with Calderwood & Harkness LLP, the undersigned recommends that the Board and Ridgeline consider and approve the following actions:
1. Approve the Notification Plan and Timeline. The Board should approve the Company's plan to file Attorney General notifications with 34 state AG offices between August 1 and August 5, 2024, and to deliver individual notifications to all 11,438 affected individuals on or about August 5, 2024, with concurrent enterprise customer notifications and UK/EU individual notifications on the same date. The notification plan has been designed to comply with all applicable statutory deadlines, with the most restrictive deadline being August 14, 2024 (Colorado and Florida).
2. Authorize Continued Engagement of Outside Advisors. The Board should authorize the continued engagement of Calderwood & Harkness LLP (as breach response counsel), Palisade Digital Forensics, Inc. (for any supplemental forensic work if needed), Threshold Public Relations LLC (for ongoing crisis communications support), and Harmon Watts & Kendrick LLP (for UK/EU data protection matters) through the completion of the notification process and a subsequent monitoring period of no less than 90 days. All engagements are subject to NexTier insurance coverage as outlined in Section VII above.
3. Maintain Litigation Hold and Document Preservation. The Board should note and support the continuation of the internal litigation hold issued on June 18, 2024. All custodians and relevant personnel should continue to comply with the hold, and any questions regarding the scope of the hold should be directed to the undersigned General Counsel. The litigation hold will remain in effect until further notice.
4. Continue Monitoring for Regulatory Inquiries and Potential Litigation. The Company should continue to actively monitor for any regulatory inquiries, enforcement actions, or litigation filings arising from the incident. C&H has implemented automated monitoring for the Company's name in connection with data breach filings in federal and state courts. The undersigned will provide immediate notice to the Board and Ridgeline of any regulatory or litigation development.
5. Evaluate Broader Security Posture. The Board should consider directing management to conduct a comprehensive evaluation of the Company's broader cybersecurity and data protection posture, with a view toward identifying and implementing long-term enhancements beyond the immediate remediation steps ta