1008-00009 · Lumos Analytics Inc · Advice & Analysis

multi-jurisdictional-notification-analysis-memo.docx DOCUMENT Data Privacy

2 / 12 ← → ✕

PRIVILEGED & CONFIDENTIAL — ATTORNEY-CLIENT PRIVILEGE / ATTORNEY WORK PRODUCT

DO NOT DISTRIBUTE WITHOUT PRIOR AUTHORIZATION OF COUNSEL

MEMORANDUM

TO: Allison Cho, General Counsel & Chief Privacy Officer, Lumos Analytics Inc.

FROM: Rachel Bernstein, Partner; Sara Hendricks, Associate; Priscilla Wynn, Associate — Calderwood & Harkness LLP, Privacy & Data Security Practice

DATE: July 18, 2024

RE: Multi-Jurisdictional Breach Notification Obligations Analysis — Credential-Stuffing Incident Affecting the Lumos Insight Platform (C&H Matter No. 1008-00009)

PRIVILEGED & CONFIDENTIAL: This memorandum is protected by the attorney-client privilege and the attorney work product doctrine. It has been prepared at the direction of and for the sole benefit of Lumos Analytics Inc. for the purpose of providing legal advice in connection with the above-referenced matter. This memorandum reflects attorney mental impressions, conclusions, opinions, and legal theories. It should not be disclosed to any third party without the prior written approval of counsel. Any inadvertent disclosure does not constitute a waiver of any applicable privilege or protection.

Right-click to update Table of Contents

I. Executive Summary

This memorandum analyzes the breach notification obligations of Lumos Analytics Inc. ("Lumos" or the "Company") arising from the credential-stuffing incident that affected the Lumos Insight Platform between approximately June 12 and June 15, 2024 (the "Incident"). The analysis encompasses the notification requirements of all 50 U.S. states, the District of Columbia, Puerto Rico, the United Kingdom (under the UK General Data Protection Regulation ("UK GDPR") and the supervisory authority of the Information Commissioner's Office ("ICO")), and the European Union (under the General Data Protection Regulation, Regulation (EU) 2016/679 ("GDPR")).

For purposes of calculating all statutory notification deadlines, we have identified July 15, 2024 as the determination date — the date on which Palisade Digital Forensics, Inc. ("Palisade") delivered its final forensic investigation report confirming the scope and nature of the unauthorized access. This date represents the point at which Lumos had sufficient information to determine that a breach of security had occurred, to identify the categories of data accessed, and to identify the population of affected individuals. Although Lumos's Security Operations Center ("SOC") confirmed the credential-stuffing attack on June 15, 2024, the investigation required to determine the scope of the breach, the identities of affected users, and the data elements exposed was not completed until the delivery of Palisade's final report. This distinction is significant because most state statutes tie notification deadlines to the conclusion of a reasonable investigation, rather than to the date of initial detection.

Our top-line conclusions are as follows:

• 42 U.S. states, the District of Columbia, and Puerto Rico require individual notification to affected residents under applicable breach notification statutes. The data elements exposed — including full name, email address, phone number, employer name, job title, and in a subset of accounts, partial financial account numbers (last four digits), account balances, and asset allocation summaries — meet the statutory definition of "personal information" (or equivalent) in these jurisdictions, either through specifically enumerated data element categories, through broader catch-all provisions, or through email/credential-based notification triggers.

• 34 U.S. states require notification to the state Attorney General or other designated state agency, subject to various numerical thresholds for the number of affected residents. Lumos meets or exceeds the applicable threshold in all 34 of these states.

• 8 U.S. states do not require notification because the data elements accessed in this Incident do not meet the statutory definition of "personal information" as defined under those states' breach notification statutes. In particular, no Social Security numbers, no driver's license or state identification numbers, and no full financial account numbers (with associated security codes or passwords) were accessed, and these eight states do not include the broader catch-all provisions, email/credential-based triggers, or expanded definitions that bring the exposed data elements within the notification requirements of the other 42 states.

• ICO 72-hour notification was already filed on June 18, 2024, within the required 72-hour window, by Harmon Watts & Kendrick LLP ("HWK") on behalf of Lumos with respect to 814 UK-resident affected users. The ICO has acknowledged the notification, and we are awaiting further communication from the ICO regarding whether any follow-up action will be required.

• 47 EU-resident users (non-UK) across Germany (19), France (14), the Netherlands (9), and Ireland (5) were among the affected accounts. Individual notices to these users are recommended as a precautionary measure, consistent with the conservative approach adopted for all other affected users, despite the de minimis number of affected individuals in each jurisdiction, the absence of special category data under Article 9 of the GDPR, and the absence of evidence of data exfiltration. Separate formal notifications to the relevant EU data protection authorities ("DPAs") are not recommended at this time, given the risk-based assessment described in Section VII below.

Based on our analysis, we recommend the following execution dates:

• Individual notifications (email and U.S. mail) to all 11,438 affected individuals: August 5, 2024

• AG filings with the 34 required state AG offices: August 1–5, 2024

• Enterprise customer notifications to the 847 affected enterprise customer tenants: August 5, 2024

These recommended dates fall comfortably within every applicable statutory deadline. The most restrictive U.S. deadlines are imposed by Colorado and Florida, each of which requires notification within 30 days from the date of determination, yielding a deadline of August 14, 2024. Maryland's 45-day deadline yields a deadline of August 29, 2024. States with 60-day deadlines yield a deadline of September 13, 2024. The many states that require notification "in the most expedient time possible and without unreasonable delay" (without specifying a numerical deadline) are generally interpreted to require notification within 30 to 60 days of determination. Our recommended August 5 date satisfies all of these requirements.

II. Background and Factual Summary

A. The Incident

The Incident involved a credential-stuffing attack against the Lumos Insight Platform, an enterprise analytics and portfolio intelligence platform operated by Lumos Analytics Inc. In a credential-stuffing attack, a threat actor uses automated tools to inject large volumes of username-and-password pairs — typically obtained from an unrelated data breach — into the login page of a target application, exploiting the common practice of password reuse across multiple online services.

In this case, the credentials used in the attack were obtained from an unrelated breach of VaultSync Technologies, Inc. ("VaultSync"), a consumer cloud storage provider headquartered in Austin, Texas. VaultSync publicly disclosed its own data breach on May 28, 2024, acknowledging that usernames and hashed passwords of approximately 23 million VaultSync users had been exfiltrated by a threat actor in a separate, unrelated incident. Certain of these credentials — or cracked versions derived from the hashed passwords — were subsequently used to target the Lumos Insight Platform.

The attack window spanned approximately 65.5 hours, from approximately 02:14 UTC on June 12, 2024 through approximately 19:47 UTC on June 15, 2024. During this period, the threat actor (or actors) used automated tools to submit approximately 2.16 million credential pairs to the Lumos Insight Platform's login endpoint.

Detection occurred at approximately 14:22 UTC on June 15, 2024, when Lumos's internal Security Information and Event Management ("SIEM") platform — WatchTower, provided by Aegis Security Solutions, Inc. — triggered anomaly alerts based on volumetric login patterns, geographic IP anomalies, and elevated authentication failure rates. The alerts identified a significant spike in login attempts originating from IP address ranges inconsistent with the typical geographic distribution of Lumos's user base, with a disproportionate concentration of attempts originating from IP addresses geolocated to Eastern Europe (primarily Romania, Ukraine, and Russia) and Southeast Asia (primarily Vietnam and Indonesia).

Lumos's SOC team initiated an investigation immediately upon receiving the WatchTower alerts and confirmed the credential-stuffing incident at approximately 16:08 UTC on June 15, 2024. This confirmation was based on the team's analysis of authentication logs, session metadata, and the correlation between the credential pairs used in the attack and known VaultSync-derived credential lists circulating on dark web forums.

Containment measures were implemented promptly. By approximately 20:30 UTC on June 15, 2024, Lumos had completed a global password reset for all approximately 286,000 registered users of the Lumos Insight Platform and had blocked 1,247 unique source IP addresses identified as having been used in the attack. In addition, Lumos implemented enhanced rate-limiting on its authentication endpoint, deployed CAPTCHA challenges for all login attempts, and initiated credential screening against known compromised credential databases.

On June 16, 2024, Lumos disabled the "Quick View" cached data feature, which had allowed users to view partial portfolio data (including partial financial account numbers, account balances, and asset allocation summaries) directly from their user profile page without navigating to the full analytics dashboard. This feature was identified as having broadened the scope of data accessible to the threat actor during the compromised sessions.

B. Scope of Unauthorized Access

Palisade's forensic investigation determined the following regarding the scope of unauthorized access:

• Total login attempts observed: Approximately 2.16 million distinct credential pairs were submitted to the Lumos Insight Platform login endpoint during the attack window.

• Total unique user accounts successfully accessed: 11,438 individual user accounts were authenticated using valid credentials during the attack window by the threat actor's automated tools. These 11,438 accounts represent distinct individual users whose credentials (obtained from the VaultSync breach) happened to match their Lumos Insight Platform login credentials due to password reuse.

• Success rate: The overall success rate of the credential-stuffing attack was approximately 0.53% (11,438 successful authentications divided by approximately 2,160,000 attempted credential pairs). This success rate is consistent with industry-observed credential-stuffing success rates, which typically range from 0.1% to 2.0%, depending on the target population's password hygiene practices.

• Enterprise customer tenant impact: The 11,438 affected user accounts belonged to users across 847 distinct enterprise customer tenants out of approximately 4,200 total Lumos enterprise customers. This means that approximately 20.2% of Lumos's enterprise customer base had at least one user account affected by the Incident.

• Session duration analysis: Of the 11,438 accounts that were successfully accessed, 137 accounts showed session durations exceeding 30 seconds, which Palisade assessed as suggestive of possible manual review by the threat actor (i.e., a human operator may have interacted with the account pages rather than relying solely on automated tools). The remaining 11,301 sessions had a median duration of 4.2 seconds, which is consistent with automated account checking and credential validation behavior — the automated tool logs in, confirms the credentials are valid, and immediately moves on to the next credential pair.

Palisade's analysis of the 137 accounts with extended session durations is discussed further in Section II.D below.

C. Data Elements Exposed

The identification of the specific data elements accessible within each compromised user account is critical to the notification analysis, as state breach notification statutes are triggered only when specific categories of "personal information" or "private information" (as each statute defines the term) are involved in the breach. The following data elements were accessible within each compromised user account during the period of unauthorized access:

1. User profile information: Full name (first name and last name), email address, job title, and employer name. These fields are populated by the user during account registration and are displayed on the user's account profile page within the Lumos Insight Platform.

2. Phone number: A telephone number was populated in approximately 7,820 of the 11,438 accessed accounts (approximately 68.4%). The phone number field is an optional field in the Lumos Insight Platform user profile and is not required for account registration. For the remaining approximately 3,618 accounts, no phone number was stored.

3. Dashboard configurations and saved analytics queries: Each user's account contained proprietary business data belonging to the enterprise customer, including customized dashboard configurations, saved analytics queries, and visualization settings. While this data is potentially commercially sensitive to the enterprise customer, it does not constitute "personal information" of the individual user for purposes of breach notification statutes and is not a triggering data element under any applicable state law.

4. Partial financial data via "Quick View" feature: In 2,614 accounts (representing 22.9% of the 11,438 affected accounts), the user had enabled the Quick View feature, which cached partial portfolio data on the user profile page for convenient reference. The data exposed through Quick View included:

(a) Partial financial account numbers — specifically, the last four digits only of linked financial account numbers;

(b) Account balances associated with the linked financial accounts; and

The following categories of data were not stored in user-facing profile pages and were not accessible via the Lumos Insight Platform user interface, and therefore were not exposed during the Incident:

• No Social Security numbers or taxpayer identification numbers

• No full financial account numbers (only the last four digits were displayed via Quick View)

• No payment card data, including credit card numbers, debit card numbers, CVV/CVC codes, or expiration dates

• No driver's license numbers or state identification numbers

• No medical or health information

• No health insurance information

• No biometric data (fingerprints, facial recognition data, retinal scans, etc.)

• No login credentials stored in cleartext — all user passwords are stored using bcrypt hashing with per-user salts, and the hashed passwords were not accessible through the user-facing account profile pages. The passwords were not exposed during the Incident; rather, the threat actor already possessed valid passwords (obtained from VaultSync) and used them to authenticate

The distinction between the data elements that were exposed and those that were not is a central factor in the state-by-state notification analysis that follows. In particular, the absence of Social Security numbers, full financial account numbers, payment card data, and driver's license numbers eliminates the most common triggering data elements found in many state breach notification statutes. The analysis turns primarily on whether the combination of name, email address, phone number, and partial financial data (last four digits of account numbers) meets the statutory definition of "personal information" in each jurisdiction.

D. Forensic Conclusions

Palisade Digital Forensics, Inc. was retained by Calderwood & Harkness LLP, at the direction of Lumos Analytics Inc., under the attorney-client privilege and work product protections. The engagement was led by Dr. Neil Frasier, Palisade's Managing Director of Incident Response and Digital Forensics. Palisade's final forensic investigation report was delivered on July 15, 2024 (the "Palisade Report"). The key conclusions of the Palisade Report are summarized below:

1. No compromise of Lumos internal systems: Palisade found no evidence that Lumos's internal systems, databases, servers, or infrastructure were compromised during the Incident. The threat actor did not exploit any vulnerability in Lumos's application code, network architecture, or server configuration. All unauthorized access was accomplished exclusively through the Lumos Insight Platform's standard user-facing login endpoint using valid credentials.

2. External credential source confirmed: All unauthorized access was accomplished using valid user credentials that were obtained externally, from the VaultSync breach. Palisade correlated the credential pairs used in the attack against known VaultSync credential dumps and confirmed a high degree of overlap, establishing the VaultSync breach as the source of the credentials used in this Incident.

3. No malware or persistence mechanisms: No malware, backdoors, web shells, remote access tools, or other persistence mechanisms were deployed in any of the 11,438 accessed accounts or on any Lumos infrastructure. The threat actor's access was limited to the authenticated user sessions and terminated when those sessions ended.

4. No lateral movement or privilege escalation: The threat actor did not attempt to move laterally within the Lumos Insight Platform or escalate privileges beyond the standard user-level access associated with each compromised account. No administrative accounts were compromised, and no attempt to access underlying databases, APIs, or administrative functions was detected.

5. No evidence of bulk data exfiltration: Palisade found no evidence of bulk data exfiltration. The access sessions were consistent with automated credential validation rather than data harvesting. The median session duration of 4.2 seconds for the vast majority of sessions (11,301 of 11,438) is insufficient for meaningful data extraction beyond what is immediately displayed on the account profile page upon login. There were no anomalous data transfer volumes, no evidence of file downloads, and no evidence of API calls or data export functions being invoked during any of the compromised sessions.

6. Extended-session accounts reviewed individually: Palisade individually reviewed the 137 accounts with session durations exceeding 30 seconds. For each of these accounts, Palisade examined server-side access logs, page navigation records, data transfer logs, and available network traffic metadata. No evidence of data download, screenshot capture, print-to-file activity, or any other affirmative data extraction mechanism was detected in the server-side logs. Palisade noted, however, that certain client-side data capture methods (such as screenshots taken on the threat actor's own device) would not be detectable through server-side logging. This limitation is inherent in all credential-stuffing incidents and is acknowledged in the Palisade Report.

Significance for notification analysis: The absence of confirmed data exfiltration is relevant to the notification analysis because several state breach notification statutes distinguish between the "acquisition" of personal information by an unauthorized person and the mere "access to" personal information. In states that require "acquisition" as the triggering event, the absence of exfiltration could theoretically support a conclusion that no reportable breach has occurred, because the threat actor accessed the data (i.e., it was displayed on-screen during the authenticated session) but may not have affirmatively taken or copied the data. This distinction is discussed in detail in Section III.B.2 below. As a practical matter, however, and for the reasons set forth in this memorandum, we recommend treating access as presumptive acquisition for all states, adopting a conservative notification posture.

III. Analytical Framework

A. Overview of U.S. State Breach Notification Statutes

All 50 U.S. states, the District of Columbia, Guam, Puerto Rico, and the U.S. Virgin Islands have enacted breach notification statutes that impose obligations on entities that own, license, or maintain computerized data containing personal information of residents of those jurisdictions. These statutes collectively form a patchwork of overlapping but non-uniform requirements that must be analyzed individually for each jurisdiction in the event of a data security incident.

The key dimensions along which state breach notification statutes vary are as follows:

Definition of "personal information." Each state defines the categories of data that constitute "personal information" (or, in some states, "private information," "sensitive personal information," or similar terminology) for purposes of triggering the notification obligation. The most common formulation requires a person's name (first name or first initial, plus last name) in combination with one or more specified data elements, typically including: (a) Social Security number; (b) driver's license number or state identification card number; (c) financial account number, credit card number, or debit card number, in combination with any required security code, access code, or password that would permit access to the financial account. A growing number of states have expanded their definitions beyond these traditional categories to include email addresses in combination with passwords or security questions/answers, biometric data, medical or health information, health insurance information, taxpayer identification numbers, passport numbers, and other data elements. Several states have also adopted broader "catch-all" provisions that capture any information that could, alone or in combination, be used to commit identity theft or fraud.

Triggering event. Statutes vary in their description of the operative event that triggers the notification obligation. Some statutes are triggered when personal information is "acquired by" an unauthorized person (an "acquisition" trigger). Others are triggered when there is "access to" personal information by an unauthorized person (an "access" trigger). Still others use formulations such as "unauthorized acquisition of" or "unauthorized access to and acquisition of" or "unauthorized disclosure of" personal information. The distinction between "acquisition" and "access" is legally significant: "acquisition" generally requires that the unauthorized person obtained or took the data, whereas "access" is satisfied by the mere viewing of or interaction with the data, even without evidence that the data was copied, downloaded, or removed. Some statutes include safe harbor provisions that exempt a notifying entity from the notification obligation if the entity determines, after an appropriate investigation or consultation with relevant law enforcement, that the breach is not reasonably likely to result in misuse of the affected information, harm to the individuals, or identity theft.

Notification to state officials. Many states require that the entity provide concurrent or advance notification to the state Attorney General, the state consumer protection agency, or another designated state official, in addition to providing individual notification to affected residents. The requirements for state-level notification vary significantly, with some states requiring notification regardless of the number of affected residents, others imposing numerical thresholds (e.g., 250, 500, or 1,000 affected residents), and some requiring notification only when notification is also provided to consumer reporting agencies.

Timing requirements. Notification timing requirements range from "the most expedient time possible and without unreasonable delay" (the most common formulation, which lacks a specific numerical deadline) to specific numerical deadlines of 30 days (Colorado, Florida), 45 days (Maryland, Washington, Oregon), 60 days (Connecticut, Delaware, Rhode Island, Vermont, and others), or 90 days (a small number of states). Several states toll the deadline during law enforcement investigations upon a request from law enforcement that notification be delayed to avoid compromising an ongoing investigation.

This memorandum analyzes each applicable jurisdiction based on the specific data elements at issue in this Incident and the nature of the unauthorized access, taking into account the forensic conclusions regarding the absence of evidence of data exfiltration.

B. Key Analytical Questions for This Incident

The Incident presents several recurring analytical questions that arise across multiple jurisdictions. We address these questions here as a framework for the jurisdiction-specific analysis that follows.

1. Definition of "Personal Information" — Do the Exposed Data Elements Meet the Statutory Threshold?

The central question in determining whether notification is required in each jurisdiction is whether the data elements exposed in the Incident meet that jurisdiction's statutory definition of "personal information" (or equivalent). The data elements at issue fall into two categories:

For all 11,438 affected accounts: Full name, email address, job title, and employer name. For approximately 7,820 of these accounts, a phone number was also accessible.

For the 2,614 accounts with Quick View enabled: In addition to the above, partial financial account numbers (last four digits only), account balances, and asset allocation summaries.

These data elements present the following analytical considerations:

Name plus email address: Most state breach notification statutes do not, by themselves, treat a person's name in combination with an email address as triggering "personal information" — unless the email address is combined with a password, security question and answer, or other credential that would permit access to an online account. The Incident, however, involves a credential-stuffing attack in which the threat actor possessed and used valid email/username and password combinations (obtained from VaultSync) to access Lumos accounts. In states that include "email address in combination with a password or security question and answer" within their definition of personal information — such as New York (SHIELD Act), California (as amended), North Dakota, and others — the Incident may trigger the notification obligation on this basis alone, because the threat actor possessed the combination of email address and password, and that combination was used to access the Lumos account.

Name plus phone number: Telephone numbers are generally not enumerated as a triggering data element under most state breach notification statutes. While phone numbers can facilitate social engineering and SIM-swapping attacks, and while the exposure of phone numbers in combination with other identifying information is a legitimate privacy concern, the phone number alone does not satisfy the statutory trigger in the vast majority of jurisdictions. Several states with broader catch-all provisions may reach a different conclusion, as discussed below.

Name plus partial financial account numbers (last four digits): This is the closest question presented by the Incident. Many statutes define "financial account number" as a full account number, or an account number in combination with any required security code, access code, or password that would permit access to the financial account. Last-four-digit truncations are the standard masking technique used throughout the financial services industry precisely because the last four digits alone are generally insufficient to permit account access. Under a strict reading of most statutes, the exposure of the last four digits of an account number, without the full account number and without an associated security code or password, would not satisfy the statutory definition of "financial account number." However, several factors counsel in favor of a broader reading in certain jurisdictions: (a) some statutes refer more broadly to "financial information" or "account information" without specifying that a full account number is required; (b) partial account numbers, when combined with name, email, employer, and other identifying information, could facilitate social engineering attacks against financial institutions; and (c) the exposure of account balances and asset allocation summaries, while not themselves enumerated data elements, provide financially sensitive information that could be exploited.

Catch-all provisions: Several states (including Texas, as discussed below) have enacted broader catch-all provisions that define "personal information" to include any information that, alone or in combination with other information, could be used to commit identity theft or identity fraud. Under these provisions, the combination of full name, email address, employer, job title, phone number, and partial financial data could potentially meet the statutory threshold, even though no single data element falls squarely within the traditional enumerated categories.

2. "Acquisition" Versus "Access" Distinction

The distinction between "acquisition" and "access" as the triggering event for notification is a material issue in this Incident because Palisade's forensic investigation found no evidence of bulk data exfiltration, but confirmed that the threat actor's automated tools successfully authenticated to 11,438 user accounts and that data was displayed on the account profile pages during the authenticated sessions.

In states that use an "acquisition" trigger — such as California (Cal. Civ. Code § 1798.82, which requires that personal information "was, or is reasonably believed to have been, acquired by an unauthorized person") — an argument could be made that the threat actor accessed the data but did not acquire it, because there is no affirmative evidence that the data was copied, downloaded, or removed from the Lumos Insight Platform. Under this argument, the mere display of data on a screen during an automated credential-checking session does not constitute "acquisition."

In states that use an "access" trigger — such as New York (N.Y. Gen. Bus. Law § 899-aa (SHIELD Act)) — the analysis is more straightforward, because the unauthorized authentication to user accounts and the display of personal data on the account pages clearly constitutes "access to" personal information, regardless of whether the data was exfiltrated.

Conservative recommendation: We recommend treating access as presumptive acquisition for all states, including those with an "acquisition" trigger, for the following reasons:

(a) Difficulty of proving a negative. While Palisade found no evidence of data exfiltration, this conclusion is based on the absence of detectable exfiltration indicators in server-side logs. Client-side data capture methods (e.g., screenshots, screen recordings, or local caching by the threat actor's browser) would not be detectable through server-side logging. It is therefore impossible to affirmatively rule out that data was captured during the 11,438 authenticated sessions.

(b) Regulatory expectations. State regulators, including Attorneys General, consistently favor over-notification and take a dim view of entities that rely on narrow statutory interpretations to avoid notification obligations. Relying on the acquisition/access distinction to avoid notification in a subset of states, while simultaneously notifying in other states, could be perceived as inconsistent and could invite regulatory scrutiny.

(c) 137 extended sessions. The 137 accounts with session durations exceeding 30 seconds present a heightened risk that data was manually reviewed and potentially captured by the threat actor. While Palisade found no server-side evidence of data download or screenshot activity for these accounts, the extended session durations are suggestive of human interaction with the account pages, making it more difficult to argue that data was not acquired.

(d) Operational consistency. Adopting a uniform notification approach across all jurisdictions simplifies the notification process, reduces the risk of administrative error, and avoids the need to make individualized residency-based determinations about which affected individuals do and do not receive notification based on subtle differences in statutory language.

3. Notification Timing and Deadlines

State notification deadlines range from specific numerical requirements (30, 45, 60, or 90 days from the date of determination or discovery) to general standards such as "the most expedient time possible and without unreasonable delay." The determination date for deadline calculation purposes is July 15, 2024, as discussed in Section I above. Our recommended notification execution date of August 5, 2024 — 21 days after the determination date — satisfies all applicable deadlines, including the most restrictive.

4. Attorney General and Agency Notification Requirements

Among the 50 states, the District of Columbia, and the U.S. territories, 34 states require notification to the state Attorney General or other designated state agency in connection with a breach notification. These requirements are subject to varying numerical thresholds — for example, some states require AG notification only when notification is provided to 250, 500, or 1,000 or more residents of the state. Based on the affected account data provided by Lumos, the Company meets or exceeds the applicable threshold in all 34 states requiring AG notification. Calderwood & Harkness will prepare and file the AG notifications for each such jurisdiction.

IV. State-by-State Analysis — Key Jurisdictions

This section provides detailed analysis for the states with the largest numbers of affected residents, the most restrictive notification deadlines, or the most complex analytical issues. A comprehensive summary of all 50 states, the District of Columbia, and U.S. territories is provided in Appendix A.

A. California

Statute: Cal. Civ. Code § 1798.82 (general breach notification); Cal. Civ. Code § 1798.29 (applicable to state agencies; not applicable here as Lumos is a private entity).

CCPA/CPRA considerations: The California Consumer Privacy Act, as amended by the California Privacy Rights Act ("CCPA/CPRA"), includes a private right of action under Cal. Civ. Code § 1798.150 for data breaches involving nonencrypted and nonredacted personal information — as defined in Cal. Civ. Code § 1798.81.5(d)(1)(A) — resulting from a business's failure to implement and maintain reasonable security procedures and practices appropriate to the nature of the information. The § 1798.150 private right of action carries statutory damages of not less than $100 and not greater than $750 per consumer per incident, or actual damages, whichever is greater. This private right of action is the subject of a separate analysis that is beyond the scope of this notification-focused memorandum, but we flag it here for completeness and note that the notification letters should be carefully drafted with awareness of the litigation exposure discussed in Section XII below.

Affected accounts: 3,412 California-resident users, making California the state with the largest number of affected residents.

Definition of "personal information" (§ 1798.82(h)): An individual's first name or first initial and last name, in combination with any one or more of the following data elements, when either the name or the data element is not encrypted or redacted:

(1) Social Security number;

(2) Driver's license number or California identification card number;

(3) Account number or credit or debit card number, in combination with any required security code, access code, or password that would permit access to an individual's financial account;

(4) Medical information;

(5) Health insurance information;

(6) Unique biometric data generated from measurements or technical analysis of human body characteristics;

(7) Information or data collected through the operation or use of an automated license plate recognition system;

(8) Genetic data;

(9) A tax identification number.

In addition, the statute also defines "personal information" to include an individual's username or email address, in combination with a password or security question and answer, that would permit access to an online account.

Analysis of data elements at issue:

Name + email address (without associated password): An email address without an associated password or security credential does not independently trigger § 1798.82 under the enumerated data element categories (items (1)–(9) above). However, the email/credential-based prong (username or email address in combination with a password or security question and answer that would permit access to an online account) requires closer analysis. In this Incident, the threat actor possessed valid email/username and password combinations (obtained from VaultSync) that permitted access to Lumos accounts. The email addresses are now confirmed as valid and associated with active Lumos accounts, and the associated passwords (from VaultSync) are known to the threat actor. This arguably constitutes information that could facilitate further account compromise, particularly for users who have not yet changed their credentials on other platforms where the same email/password combination may be reused. Under the email/credential prong, the combination of email address plus password is "personal information," and the Incident involved the use of this combination to access accounts. However, the passwords were not stored on or obtained from Lumos — they were obtained from VaultSync. The question is whether § 1798.82's email/credential prong applies when the passwords were not maintained by the notifying entity. We believe the better reading is that the prong is triggered where the combination of email and password permits access to the notifying entity's platform, regardless of the source of the password, because the statutory purpose is to protect individuals whose online accounts have been accessed through compromised credentials.

Name + phone number: Phone number is not a specifically enumerated data element under § 1798.82. The exposure of phone numbers does not independently trigger the notification obligation under California law.

Name + partial financial account numbers (last four digits): For the subset of 2,614 accounts with Quick View data, the analysis turns on whether the last four digits of a financial account number, without the full account number and without an associated security code or password, meets the definition of "account number" in § 1798.82(h)(3). The statute refers to an "account number or credit or debit card number, in combination with any required security code, access code, or password that would permit access to an individual's financial account." The last four digits of an account number, standing alone, are generally insufficient to permit access to a financial account and are the industry-standard form of masking or truncation. We believe that last-four-digit truncated account numbers likely do not meet the statutory definition in California. However, the combined exposure of partial account numbers with account balances and asset allocation data provides a more complete financial profile that could be used for social engineering purposes, and a regulator could take a broader view.

"Acquisition" requirement: Section 1798.82(a) provides that notification is required when an entity that "owns or licenses computerized data that includes personal information" Discovers or is notified that the personal information "was, or is reasonably believed to have been, acquired by an unauthorized person." California's statute uses an "acquisition" trigger, which is a higher threshold than mere "access." As discussed in Section III.B.2, Palisade found no evidence of bulk data exfiltration, which could support a conclusion that data was not "acquired." However, the distinction between viewing data on a screen and acquiring it is difficult to enforce as a practical matter. Given the 137 sessions exceeding 30 seconds, the inherent limitations of server-side logging in detecting client-side data capture, and the "reasonably believed to have been acquired" standard (which incorporates a reasonableness analysis rather than requiring affirmative proof of acquisition), we believe there is a reasonable basis to conclude that data displayed on screen during the authenticated sessions was, or is reasonably believed to have been, acquired.

Recommendation: Notify. A conservative approach is warranted given: (a) the volume of affected California residents (3,412 — the largest single-state population); (b) the applicability of the email/credential prong to this Incident; (c) the 2,614 accounts with partial financial data; (d) the strong regulatory expectations in California favoring over-notification; (e) the difficulty of proving that data was not acquired; and (f) the CCPA/CPRA private right of action exposure, which makes it particularly important to demonstrate a good-faith notification posture.

AG notification: Required under Cal. Civ. Code § 1798.82(f) when notification is provided to more than 500 California residents. With 3,412 affected California residents, AG notification is required. The entity must submit a sample copy of the notification letter to the AG electronically, using the AG's online reporting form.

Timing: Section 1798.82(a) requires notification "in the most expedient time possible and without unreasonable delay." The statute does not impose a specific numerical deadline but provides that notification may be delayed if a law enforcement agency determines that notification will impede a criminal investigation (no such request has been made here). California law is generally interpreted to require notification within 30 to 60 days of determination.

Recommended action: File AG notification and send individual notices by August 5, 2024.

B. New York

Statute: N.Y. Gen. Bus. Law § 899-aa, as amended by the Stop Hacks and Improve Electronic Data Security Act (the "SHIELD Act"), effective March 21, 2020.

Affected accounts: 2,107 New York-resident users.

Definition of "private information" (§ 899-aa(1)(b)): The SHIELD Act defines "private information" through two independent prongs:

Prong 1 (Name plus data element): Personal information consisting of any information in combination with any one or more of the following data elements, when either the data element or the combination of personal information plus the data element is not encrypted, or is encrypted with an encryption key that has also been accessed or acquired: (i) Social Security number; (ii) driver's license number or non-driver identification card number; (iii) account number, credit or debit card number, in combination with any required security code, access code, password, or other information that would permit access to an individual's financial account; (iv) account number, or credit or debit card number, if circumstances exist wherein such number could be used to access an individual's financial account without additional identifying information, security code, access code, or password; (v) biometric information (fingerprints, voice prints, retina or iris images, or other unique physical representations or digital representations of biometric data used to authenticate or ascertain the individual's identity).

Prong 2 (Username/email plus credential): A username or email address in combination with a password or security question and answer that would permit access to an online account.

Notably, the SHIELD Act's Prong 2 does not require that the affected individual's name be part of the compromised information — the combination of username or email address plus password alone constitutes "private information."

Analysis:

The SHIELD Act's Prong 2 is directly applicable to this Incident. The threat actor possessed and used valid username/email address and password combinations to access Lumos accounts. Even though these credentials were obtained from VaultSync rather than from Lumos, the fact that the credential combinations permitted access to the Lumos Insight Platform means that "private information" under the SHIELD Act was compromised. The Prong 2 trigger is met regardless of the source of the compromised credentials, because the statutory definition focuses on the nature of the information (username/email + password permitting online account access) rather than the source from which the information was obtained.

Separately, under Prong 1, the combination of name plus email address plus employer/job title does not independently trigger the notification obligation without an additional specifically enumerated data element (SSN, driver's license, financial account number with security code, or biometric data). For the accounts with Quick View data, the partial financial account numbers (last four digits) present the same analytical question discussed in the California analysis. Section 899-aa(1)(b)(iii) refers to an "account number, credit or debit card number, in combination with any required security code, access code, password, or other information that would permit access to an individual's financial account," and subsection (iv) refers to an "account number, or credit or debit card number, if circumstances exist wherein such number could be used to access an individual's financial account without additional identifying information." The last four digits alone would likely not meet either formulation, as they are insufficient to access a financial account. However, this analysis is academic in this case because Prong 2 provides an independent and clearly satisfied basis for notification.

"Access" trigger: The SHIELD Act is triggered by "access to" private information, in contrast to the "acquisition" trigger used by California and certain other states. Under § 899-aa(1)(c), a "breach of the security of the system" includes "unauthorized access to or acquisition of, or access to or acquisition of without valid authorization, computerized data that compromises the security, confidentiality, or integrity of private information maintained by a business." The access trigger is a materially lower threshold than an acquisition trigger. The unauthorized authentication to 2,107 New York-resident user accounts and the display of private information (username/email + password combinations) clearly satisfies the access trigger. No evidence of data exfiltration is required.

Recommendation: Notification required. The SHIELD Act's Prong 2 (username/email + password) is directly applicable, and the access trigger is clearly met. Notification to all 2,107 New York-resident affected users is required.

AG notification: Required under § 899-aa(8). The entity must notify: (a) the New York State Attorney General; (b) the New York State Department of State; and (c) the New York State Division of State Police. In addition, if notification is provided to more than 5,000 New York residents, the entity must also notify consumer reporting agencies. Here, with 2,107 affected New York residents, AG/Department of State/State Police notification is required, but the consumer reporting agency notification threshold (5,000) is not triggered.

Timing: Section 899-aa(2) requires notification "in the most expedient time possible and without unreasonable delay." No specific numerical deadline is imposed, consistent with the pre-SHIELD Act notification timing requirement. The statute provides for delay at the request of law enforcement if notification would interfere with a criminal investigation (no such request has been made here).

Recommended action: File notifications with the AG, Department of State, and Division of State Police, and send individual notices by August 5, 2024.

C. Texas

Statute: Tex. Bus. & Com. Code § 521.053.

Affected accounts: 1,843 Texas-resident users.

Definition of "sensitive personal information" (§ 521.002(a)(2)): An individual's first name or first initial and last name in combination with any one or more of the following items, if the name and the items are not encrypted:

(i) Social Security number;

(ii) Driver's license number or government-issued identification number;

(iii) Account number or credit or debit card number in combination with any required security code, access code, or password that would permit access to an individual's financial account;

(iv) Information that identifies an individual and relates to (a) the physical or mental health or condition of the individual, (b) the provision of health care to the individual, or (c) payment for the provision of health care to the individual.

In addition, Texas law provides a broader definition that includes "information regarding an individual that, alone or in combination with other information, including information that is not sensitive personal information, could reasonably be used to identify the individual, and that, alone or in combination with other information, could be used to commit identity fraud." Tex. Bus. & Com. Code § 521.002(a)(2).

Analysis:

Under the specifically enumerated data elements, the combination of name plus email plus phone number does not satisfy the statutory threshold — neither email nor phone number is a specifically enumerated element. For the Quick View accounts, partial financial account numbers (last four digits) without a security code or password likely do not meet the statutory definition in § 521.002(a)(2)(iii).

However, Texas's broader catch-all provision — which defines "sensitive personal information" to include information that "alone or in combination with other information ... could be used to commit identity fraud" — provides an independent basis for notification. The combination of full name, email address, employer name, job title, and phone number provides sufficient information to facilitate identity fraud through social engineering, phishing, spear-phishing, or business email compromise attacks. A threat actor armed with an individual's full name, employer, job title, email address, and phone number could craft highly targeted phishing communications, impersonate the individual in communications with colleagues or financial institutions, or use the information to answer security questions or reset account credentials on other platforms. These risks are amplified by the fact that the affected individuals are professionals (given that Lumos Insight Platform is an enterprise analytics tool), and their professional contact information and employer affiliation could be leveraged in business email compromise schemes.

Additionally, for the 2,614 accounts with Quick View data, the combination of name, email, employer, phone number, and partial financial data (account balances and asset allocation summaries, in addition to last-four-digit account numbers) provides a substantial financial profile that could be used to impersonate the individual in interactions with financial institutions or to facilitate targeted spear-phishing attacks.

Recommendation: Notification required. A conservative approach is recommended under the catch-all provision, particularly given: (a) the volume of Texas-resident users (1,843); (b) the nature of the exposed data elements (professional profile information that could be used for social engineering and identity fraud); (c) the Texas Attorney General's historically aggressive enforcement posture; and (d) the low cost and low risk of over-notification compared to the regulatory and litigation risk of under-notification.

AG notification: Required under § 521.053(i) when notification is provided to 250 or more Texas residents at one time. With 1,843 affected Texas residents, AG notification is required.

Timing: Section 521.053(b) requires notification "as quickly as possible." No specific numerical deadline is imposed, but the statute requires that notification be made without unreasonable delay.

Recommended action: File AG notification and send individual notices by August 5, 2024.

D. Colorado

Statute: C.R.S. § 6-1-716.

Affected accounts: To be populated from final Lumos residency records. Colorado is identified here as a priority jurisdiction because it imposes one of the most restrictive notification deadlines in the country.

Definition of "personal information" (§ 6-1-716(1)(g)): A Colorado resident's first name or first initial and last name in combination with one or more of the following: (i) Social Security number; (ii) student, military, or passport identification number; (iii) driver's license number or identification card number; (iv) medical information; (v) health insurance identification number; (vi) biometric data; (vii) an account number or credit or debit card number in combination with any required security code, access code, or password that would permit access to a resident's financial account; or (viii) a username, email address, or any other account holder identifying information, in combination with a password, security question/answer, or other authentication credential, for an online account.

Analysis: Colorado's definition includes the email/credential prong (subsection (viii)), which is directly applicable to this Incident for the same reasons discussed in the California and New York analyses. Notification is required.

Timing: 30 days from the date of determination that a security breach occurred. This is among the most restrictive deadlines in the country. With a determination date of July 15, 2024, the Colorado deadline is August 14, 2024.

AG notification: Required under § 6-1-716(2)(e) when notification is provided to 500 or more Colorado residents. Whether the 500-resident threshold is met will depend on the final residency data, but given the overall distribution of affected users, it is likely that the threshold is met.

Recommendation: Notify. This jurisdiction, along with Florida, drives the overall timeline urgency for the notification plan.

Recommended action: File AG notification and send individual notices by August 5, 2024, well in advance of the August 14 deadline.

E. Florida

Statute: Fla. Stat. § 501.171 (the Florida Information Protection Act of 2014, "FIPA").

Affected accounts: To be populated from final Lumos residency records. Florida is identified as a priority jurisdiction due to its 30-day notification deadline.

Definition of "personal information" (§ 501.171(1)(g)): An individual's first name or first initial and last name in combination with one or more of the following: (i) Social Security number; (ii) driver's license or identification card number, passport number, military identification number, or other similar number issued on a government document used to verify identity; (iii) a financial account number or credit or debit card number, in combination with any required security code, access code, or password that is necessary to permit access to an individual's financial account; (iv) any information regarding an individual's medical history, mental or physical condition, or medical treatment or diagnosis by a health care professional; or (v) an individual's health insurance policy number or subscriber identification number and any unique identifier used by a health insurer to identify the individual. Florida also includes username or email address in combination with a password or security question and answer that would permit access to an online account.

Analysis: Florida's definition includes the email/credential prong, which is applicable to this Incident. Notification is required.

Timing: 30 days from determination of the breach or reason to believe a breach occurred. Fla. Stat. § 501.171(4)(a). With a determination date of July 15, 2024, the Florida deadline is August 14, 2024, co-driving the most restrictive timeline with Colorado.

AG notification: Required under § 501.171(3) when notification is provided to 500 or more Florida residents. The entity must provide notice to the Florida Department of Legal Affairs (AG). If notification is provided to more than 1,000 individuals, the entity must also notify consumer reporting agencies.

Recommendation: Notify. This jurisdiction co-drives the most restrictive deadline with Colorado.

Recommended action: File AG notification and send individual notices by August 5, 2024, well in advance of the August 14 deadline.

F. Maryland

Statute: Md. Code, Com. Law § 14-3504.

Affected accounts: To be populated from final Lumos residency records.

Definition of "personal information": An individual's first name or first initial and last name in combination with one or more of the following: (i) Social Security number; (ii) driver's license number or state identification card number; (iii) account number, credit card number, or debit card number, in combination with any required security code, access code, or password that permits access to an individual's financial account; (iv) individual taxpayer identification number; (v) passport number or other identification number issued by the United States; (vi) health information; (vii) biometric data; (viii) username or email address in combination with a password or security question and answer that would permit access to an individual's email account.

Analysis: Maryland's definition includes the email/credential prong. The analysis is substantively the same as for California, New York, Colorado, and Florida: the threat actor possessed valid email/username and password combinations that permitted access to Lumos accounts, triggering the notification obligation.

Timing: 45 days from the date the business conducts in good faith an investigation and determines that a breach of the security of a system has occurred. Md. Code, Com. Law § 14-3504(e)(1). With a determination date of July 15, 2024, the Maryland deadline is August 29, 2024.

AG notification: Required under § 14-3504(i). The business must notify the AG before providing notice to affected individuals. The AG notification must include the scope of the breach, the steps taken to restore the security of the system, and a copy of the individual notification.

Recommendation: Notify.

Recommended action: File AG notification and send individual notices by August 5, 2024, well in advance of the August 29 deadline.

G. Additional States — Summary Table

A detailed analysis of each of the remaining states, the District of Columbia, Puerto Rico, Guam, and the U.S. Virgin Islands is provided in Appendix A. For each jurisdiction, Appendix A identifies the applicable statute, the definition of personal information, the triggering event (access, acquisition, or other), whether notification is required based on the data elements involved in this Incident, whether AG notification is required and at what threshold, the timing requirement, the number of affected residents (where available), and our recommendation.

The following is a summary of the conclusions set forth in Appendix A:

States requiring notification (42 states plus D.C. and Puerto Rico): Alabama, Alaska, Arizona, Arkansas, California, Colorado, Connecticut, Delaware, Florida, Georgia, Hawaii, Idaho, Illinois, Indiana, Iowa, Kansas, Louisiana, Maine, Maryland, Massachusetts, Michigan, Minnesota, Missouri, Montana, Nebraska, Nevada, Ne

PRIVILEGED & CONFIDENTIAL — ATTORNEY-CLIENT PRIVILEGE / ATTORNEY WORK PRODUCT
DO NOT DISTRIBUTE WITHOUT PRIOR AUTHORIZATION OF COUNSEL
MEMORANDUM
TO: Allison Cho, General Counsel & Chief Privacy Officer, Lumos Analytics Inc.
FROM: Rachel Bernstein, Partner; Sara Hendricks, Associate; Priscilla Wynn, Associate — Calderwood & Harkness LLP, Privacy & Data Security Practice
DATE: July 18, 2024
RE: Multi-Jurisdictional Breach Notification Obligations Analysis — Credential-Stuffing Incident Affecting the Lumos Insight Platform (C&H Matter No. 1008-00009)
PRIVILEGED & CONFIDENTIAL: This memorandum is protected by the attorney-client privilege and the attorney work product doctrine. It has been prepared at the direction of and for the sole benefit of Lumos Analytics Inc. for the purpose of providing legal advice in connection with the above-referenced matter. This memorandum reflects attorney mental impressions, conclusions, opinions, and legal theories. It should not be disclosed to any third party without the prior written approval of counsel. Any inadvertent disclosure does not constitute a waiver of any applicable privilege or protection.
Right-click to update Table of Contents
I. Executive Summary
This memorandum analyzes the breach notification obligations of Lumos Analytics Inc. ("Lumos" or the "Company") arising from the credential-stuffing incident that affected the Lumos Insight Platform between approximately June 12 and June 15, 2024 (the "Incident"). The analysis encompasses the notification requirements of all 50 U.S. states, the District of Columbia, Puerto Rico, the United Kingdom (under the UK General Data Protection Regulation ("UK GDPR") and the supervisory authority of the Information Commissioner's Office ("ICO")), and the European Union (under the General Data Protection Regulation, Regulation (EU) 2016/679 ("GDPR")).
For purposes of calculating all statutory notification deadlines, we have identified July 15, 2024 as the determination date — the date on which Palisade Digital Forensics, Inc. ("Palisade") delivered its final forensic investigation report confirming the scope and nature of the unauthorized access. This date represents the point at which Lumos had sufficient information to determine that a breach of security had occurred, to identify the categories of data accessed, and to identify the population of affected individuals. Although Lumos's Security Operations Center ("SOC") confirmed the credential-stuffing attack on June 15, 2024, the investigation required to determine the scope of the breach, the identities of affected users, and the data elements exposed was not completed until the delivery of Palisade's final report. This distinction is significant because most state statutes tie notification deadlines to the conclusion of a reasonable investigation, rather than to the date of initial detection.
Our top-line conclusions are as follows:
• 42 U.S. states, the District of Columbia, and Puerto Rico require individual notification to affected residents under applicable breach notification statutes. The data elements exposed — including full name, email address, phone number, employer name, job title, and in a subset of accounts, partial financial account numbers (last four digits), account balances, and asset allocation summaries — meet the statutory definition of "personal information" (or equivalent) in these jurisdictions, either through specifically enumerated data element categories, through broader catch-all provisions, or through email/credential-based notification triggers.
• 34 U.S. states require notification to the state Attorney General or other designated state agency, subject to various numerical thresholds for the number of affected residents. Lumos meets or exceeds the applicable threshold in all 34 of these states.
• 8 U.S. states do not require notification because the data elements accessed in this Incident do not meet the statutory definition of "personal information" as defined under those states' breach notification statutes. In particular, no Social Security numbers, no driver's license or state identification numbers, and no full financial account numbers (with associated security codes or passwords) were accessed, and these eight states do not include the broader catch-all provisions, email/credential-based triggers, or expanded definitions that bring the exposed data elements within the notification requirements of the other 42 states.
• ICO 72-hour notification was already filed on June 18, 2024, within the required 72-hour window, by Harmon Watts & Kendrick LLP ("HWK") on behalf of Lumos with respect to 814 UK-resident affected users. The ICO has acknowledged the notification, and we are awaiting further communication from the ICO regarding whether any follow-up action will be required.
• 47 EU-resident users (non-UK) across Germany (19), France (14), the Netherlands (9), and Ireland (5) were among the affected accounts. Individual notices to these users are recommended as a precautionary measure, consistent with the conservative approach adopted for all other affected users, despite the de minimis number of affected individuals in each jurisdiction, the absence of special category data under Article 9 of the GDPR, and the absence of evidence of data exfiltration. Separate formal notifications to the relevant EU data protection authorities ("DPAs") are not recommended at this time, given the risk-based assessment described in Section VII below.
Based on our analysis, we recommend the following execution dates:
• Individual notifications (email and U.S. mail) to all 11,438 affected individuals: August 5, 2024
• AG filings with the 34 required state AG offices: August 1–5, 2024
• Enterprise customer notifications to the 847 affected enterprise customer tenants: August 5, 2024
These recommended dates fall comfortably within every applicable statutory deadline. The most restrictive U.S. deadlines are imposed by Colorado and Florida, each of which requires notification within 30 days from the date of determination, yielding a deadline of August 14, 2024. Maryland's 45-day deadline yields a deadline of August 29, 2024. States with 60-day deadlines yield a deadline of September 13, 2024. The many states that require notification "in the most expedient time possible and without unreasonable delay" (without specifying a numerical deadline) are generally interpreted to require notification within 30 to 60 days of determination. Our recommended August 5 date satisfies all of these requirements.
II. Background and Factual Summary
A. The Incident
The Incident involved a credential-stuffing attack against the Lumos Insight Platform, an enterprise analytics and portfolio intelligence platform operated by Lumos Analytics Inc. In a credential-stuffing attack, a threat actor uses automated tools to inject large volumes of username-and-password pairs — typically obtained from an unrelated data breach — into the login page of a target application, exploiting the common practice of password reuse across multiple online services.
In this case, the credentials used in the attack were obtained from an unrelated breach of VaultSync Technologies, Inc. ("VaultSync"), a consumer cloud storage provider headquartered in Austin, Texas. VaultSync publicly disclosed its own data breach on May 28, 2024, acknowledging that usernames and hashed passwords of approximately 23 million VaultSync users had been exfiltrated by a threat actor in a separate, unrelated incident. Certain of these credentials — or cracked versions derived from the hashed passwords — were subsequently used to target the Lumos Insight Platform.
The attack window spanned approximately 65.5 hours, from approximately 02:14 UTC on June 12, 2024 through approximately 19:47 UTC on June 15, 2024. During this period, the threat actor (or actors) used automated tools to submit approximately 2.16 million credential pairs to the Lumos Insight Platform's login endpoint.
Detection occurred at approximately 14:22 UTC on June 15, 2024, when Lumos's internal Security Information and Event Management ("SIEM") platform — WatchTower, provided by Aegis Security Solutions, Inc. — triggered anomaly alerts based on volumetric login patterns, geographic IP anomalies, and elevated authentication failure rates. The alerts identified a significant spike in login attempts originating from IP address ranges inconsistent with the typical geographic distribution of Lumos's user base, with a disproportionate concentration of attempts originating from IP addresses geolocated to Eastern Europe (primarily Romania, Ukraine, and Russia) and Southeast Asia (primarily Vietnam and Indonesia).
Lumos's SOC team initiated an investigation immediately upon receiving the WatchTower alerts and confirmed the credential-stuffing incident at approximately 16:08 UTC on June 15, 2024. This confirmation was based on the team's analysis of authentication logs, session metadata, and the correlation between the credential pairs used in the attack and known VaultSync-derived credential lists circulating on dark web forums.
Containment measures were implemented promptly. By approximately 20:30 UTC on June 15, 2024, Lumos had completed a global password reset for all approximately 286,000 registered users of the Lumos Insight Platform and had blocked 1,247 unique source IP addresses identified as having been used in the attack. In addition, Lumos implemented enhanced rate-limiting on its authentication endpoint, deployed CAPTCHA challenges for all login attempts, and initiated credential screening against known compromised credential databases.
On June 16, 2024, Lumos disabled the "Quick View" cached data feature, which had allowed users to view partial portfolio data (including partial financial account numbers, account balances, and asset allocation summaries) directly from their user profile page without navigating to the full analytics dashboard. This feature was identified as having broadened the scope of data accessible to the threat actor during the compromised sessions.
B. Scope of Unauthorized Access
Palisade's forensic investigation determined the following regarding the scope of unauthorized access:
• Total login attempts observed: Approximately 2.16 million distinct credential pairs were submitted to the Lumos Insight Platform login endpoint during the attack window.
• Total unique user accounts successfully accessed: 11,438 individual user accounts were authenticated using valid credentials during the attack window by the threat actor's automated tools. These 11,438 accounts represent distinct individual users whose credentials (obtained from the VaultSync breach) happened to match their Lumos Insight Platform login credentials due to password reuse.
• Success rate: The overall success rate of the credential-stuffing attack was approximately 0.53% (11,438 successful authentications divided by approximately 2,160,000 attempted credential pairs). This success rate is consistent with industry-observed credential-stuffing success rates, which typically range from 0.1% to 2.0%, depending on the target population's password hygiene practices.
• Enterprise customer tenant impact: The 11,438 affected user accounts belonged to users across 847 distinct enterprise customer tenants out of approximately 4,200 total Lumos enterprise customers. This means that approximately 20.2% of Lumos's enterprise customer base had at least one user account affected by the Incident.
• Session duration analysis: Of the 11,438 accounts that were successfully accessed, 137 accounts showed session durations exceeding 30 seconds, which Palisade assessed as suggestive of possible manual review by the threat actor (i.e., a human operator may have interacted with the account pages rather than relying solely on automated tools). The remaining 11,301 sessions had a median duration of 4.2 seconds, which is consistent with automated account checking and credential validation behavior — the automated tool logs in, confirms the credentials are valid, and immediately moves on to the next credential pair.
Palisade's analysis of the 137 accounts with extended session durations is discussed further in Section II.D below.
C. Data Elements Exposed
The identification of the specific data elements accessible within each compromised user account is critical to the notification analysis, as state breach notification statutes are triggered only when specific categories of "personal information" or "private information" (as each statute defines the term) are involved in the breach. The following data elements were accessible within each compromised user account during the period of unauthorized access:
1. User profile information: Full name (first name and last name), email address, job title, and employer name. These fields are populated by the user during account registration and are displayed on the user's account profile page within the Lumos Insight Platform.
2. Phone number: A telephone number was populated in approximately 7,820 of the 11,438 accessed accounts (approximately 68.4%). The phone number field is an optional field in the Lumos Insight Platform user profile and is not required for account registration. For the remaining approximately 3,618 accounts, no phone number was stored.
3. Dashboard configurations and saved analytics queries: Each user's account contained proprietary business data belonging to the enterprise customer, including customized dashboard configurations, saved analytics queries, and visualization settings. While this data is potentially commercially sensitive to the enterprise customer, it does not constitute "personal information" of the individual user for purposes of breach notification statutes and is not a triggering data element under any applicable state law.
4. Partial financial data via "Quick View" feature: In 2,614 accounts (representing 22.9% of the 11,438 affected accounts), the user had enabled the Quick View feature, which cached partial portfolio data on the user profile page for convenient reference. The data exposed through Quick View included:
(a) Partial financial account numbers — specifically, the last four digits only of linked financial account numbers;
(b) Account balances associated with the linked financial accounts; and
(c) Asset allocation summaries (e.g., percentage breakdown across equities, fixed income, alternatives, and cash).
The following categories of data were not stored in user-facing profile pages and were not accessible via the Lumos Insight Platform user interface, and therefore were not exposed during the Incident:
• No Social Security numbers or taxpayer identification numbers
• No full financial account numbers (only the last four digits were displayed via Quick View)
• No payment card data, including credit card numbers, debit card numbers, CVV/CVC codes, or expiration dates
• No driver's license numbers or state identification numbers
• No medical or health information
• No health insurance information
• No biometric data (fingerprints, facial recognition data, retinal scans, etc.)
• No login credentials stored in cleartext — all user passwords are stored using bcrypt hashing with per-user salts, and the hashed passwords were not accessible through the user-facing account profile pages. The passwords were not exposed during the Incident; rather, the threat actor already possessed valid passwords (obtained from VaultSync) and used them to authenticate
The distinction between the data elements that were exposed and those that were not is a central factor in the state-by-state notification analysis that follows. In particular, the absence of Social Security numbers, full financial account numbers, payment card data, and driver's license numbers eliminates the most common triggering data elements found in many state breach notification statutes. The analysis turns primarily on whether the combination of name, email address, phone number, and partial financial data (last four digits of account numbers) meets the statutory definition of "personal information" in each jurisdiction.
D. Forensic Conclusions
Palisade Digital Forensics, Inc. was retained by Calderwood & Harkness LLP, at the direction of Lumos Analytics Inc., under the attorney-client privilege and work product protections. The engagement was led by Dr. Neil Frasier, Palisade's Managing Director of Incident Response and Digital Forensics. Palisade's final forensic investigation report was delivered on July 15, 2024 (the "Palisade Report"). The key conclusions of the Palisade Report are summarized below:
1. No compromise of Lumos internal systems: Palisade found no evidence that Lumos's internal systems, databases, servers, or infrastructure were compromised during the Incident. The threat actor did not exploit any vulnerability in Lumos's application code, network architecture, or server configuration. All unauthorized access was accomplished exclusively through the Lumos Insight Platform's standard user-facing login endpoint using valid credentials.
2. External credential source confirmed: All unauthorized access was accomplished using valid user credentials that were obtained externally, from the VaultSync breach. Palisade correlated the credential pairs used in the attack against known VaultSync credential dumps and confirmed a high degree of overlap, establishing the VaultSync breach as the source of the credentials used in this Incident.
3. No malware or persistence mechanisms: No malware, backdoors, web shells, remote access tools, or other persistence mechanisms were deployed in any of the 11,438 accessed accounts or on any Lumos infrastructure. The threat actor's access was limited to the authenticated user sessions and terminated when those sessions ended.
4. No lateral movement or privilege escalation: The threat actor did not attempt to move laterally within the Lumos Insight Platform or escalate privileges beyond the standard user-level access associated with each compromised account. No administrative accounts were compromised, and no attempt to access underlying databases, APIs, or administrative functions was detected.
5. No evidence of bulk data exfiltration: Palisade found no evidence of bulk data exfiltration. The access sessions were consistent with automated credential validation rather than data harvesting. The median session duration of 4.2 seconds for the vast majority of sessions (11,301 of 11,438) is insufficient for meaningful data extraction beyond what is immediately displayed on the account profile page upon login. There were no anomalous data transfer volumes, no evidence of file downloads, and no evidence of API calls or data export functions being invoked during any of the compromised sessions.
6. Extended-session accounts reviewed individually: Palisade individually reviewed the 137 accounts with session durations exceeding 30 seconds. For each of these accounts, Palisade examined server-side access logs, page navigation records, data transfer logs, and available network traffic metadata. No evidence of data download, screenshot capture, print-to-file activity, or any other affirmative data extraction mechanism was detected in the server-side logs. Palisade noted, however, that certain client-side data capture methods (such as screenshots taken on the threat actor's own device) would not be detectable through server-side logging. This limitation is inherent in all credential-stuffing incidents and is acknowledged in the Palisade Report.
Significance for notification analysis: The absence of confirmed data exfiltration is relevant to the notification analysis because several state breach notification statutes distinguish between the "acquisition" of personal information by an unauthorized person and the mere "access to" personal information. In states that require "acquisition" as the triggering event, the absence of exfiltration could theoretically support a conclusion that no reportable breach has occurred, because the threat actor accessed the data (i.e., it was displayed on-screen during the authenticated session) but may not have affirmatively taken or copied the data. This distinction is discussed in detail in Section III.B.2 below. As a practical matter, however, and for the reasons set forth in this memorandum, we recommend treating access as presumptive acquisition for all states, adopting a conservative notification posture.
III. Analytical Framework
A. Overview of U.S. State Breach Notification Statutes
All 50 U.S. states, the District of Columbia, Guam, Puerto Rico, and the U.S. Virgin Islands have enacted breach notification statutes that impose obligations on entities that own, license, or maintain computerized data containing personal information of residents of those jurisdictions. These statutes collectively form a patchwork of overlapping but non-uniform requirements that must be analyzed individually for each jurisdiction in the event of a data security incident.
The key dimensions along which state breach notification statutes vary are as follows:
Definition of "personal information." Each state defines the categories of data that constitute "personal information" (or, in some states, "private information," "sensitive personal information," or similar terminology) for purposes of triggering the notification obligation. The most common formulation requires a person's name (first name or first initial, plus last name) in combination with one or more specified data elements, typically including: (a) Social Security number; (b) driver's license number or state identification card number; (c) financial account number, credit card number, or debit card number, in combination with any required security code, access code, or password that would permit access to the financial account. A growing number of states have expanded their definitions beyond these traditional categories to include email addresses in combination with passwords or security questions/answers, biometric data, medical or health information, health insurance information, taxpayer identification numbers, passport numbers, and other data elements. Several states have also adopted broader "catch-all" provisions that capture any information that could, alone or in combination, be used to commit identity theft or fraud.
Triggering event. Statutes vary in their description of the operative event that triggers the notification obligation. Some statutes are triggered when personal information is "acquired by" an unauthorized person (an "acquisition" trigger). Others are triggered when there is "access to" personal information by an unauthorized person (an "access" trigger). Still others use formulations such as "unauthorized acquisition of" or "unauthorized access to and acquisition of" or "unauthorized disclosure of" personal information. The distinction between "acquisition" and "access" is legally significant: "acquisition" generally requires that the unauthorized person obtained or took the data, whereas "access" is satisfied by the mere viewing of or interaction with the data, even without evidence that the data was copied, downloaded, or removed. Some statutes include safe harbor provisions that exempt a notifying entity from the notification obligation if the entity determines, after an appropriate investigation or consultation with relevant law enforcement, that the breach is not reasonably likely to result in misuse of the affected information, harm to the individuals, or identity theft.
Notification to state officials. Many states require that the entity provide concurrent or advance notification to the state Attorney General, the state consumer protection agency, or another designated state official, in addition to providing individual notification to affected residents. The requirements for state-level notification vary significantly, with some states requiring notification regardless of the number of affected residents, others imposing numerical thresholds (e.g., 250, 500, or 1,000 affected residents), and some requiring notification only when notification is also provided to consumer reporting agencies.
Timing requirements. Notification timing requirements range from "the most expedient time possible and without unreasonable delay" (the most common formulation, which lacks a specific numerical deadline) to specific numerical deadlines of 30 days (Colorado, Florida), 45 days (Maryland, Washington, Oregon), 60 days (Connecticut, Delaware, Rhode Island, Vermont, and others), or 90 days (a small number of states). Several states toll the deadline during law enforcement investigations upon a request from law enforcement that notification be delayed to avoid compromising an ongoing investigation.
This memorandum analyzes each applicable jurisdiction based on the specific data elements at issue in this Incident and the nature of the unauthorized access, taking into account the forensic conclusions regarding the absence of evidence of data exfiltration.
B. Key Analytical Questions for This Incident
The Incident presents several recurring analytical questions that arise across multiple jurisdictions. We address these questions here as a framework for the jurisdiction-specific analysis that follows.
1. Definition of "Personal Information" — Do the Exposed Data Elements Meet the Statutory Threshold?
The central question in determining whether notification is required in each jurisdiction is whether the data elements exposed in the Incident meet that jurisdiction's statutory definition of "personal information" (or equivalent). The data elements at issue fall into two categories:
For all 11,438 affected accounts: Full name, email address, job title, and employer name. For approximately 7,820 of these accounts, a phone number was also accessible.
For the 2,614 accounts with Quick View enabled: In addition to the above, partial financial account numbers (last four digits only), account balances, and asset allocation summaries.
These data elements present the following analytical considerations:
Name plus email address: Most state breach notification statutes do not, by themselves, treat a person's name in combination with an email address as triggering "personal information" — unless the email address is combined with a password, security question and answer, or other credential that would permit access to an online account. The Incident, however, involves a credential-stuffing attack in which the threat actor possessed and used valid email/username and password combinations (obtained from VaultSync) to access Lumos accounts. In states that include "email address in combination with a password or security question and answer" within their definition of personal information — such as New York (SHIELD Act), California (as amended), North Dakota, and others — the Incident may trigger the notification obligation on this basis alone, because the threat actor possessed the combination of email address and password, and that combination was used to access the Lumos account.
Name plus phone number: Telephone numbers are generally not enumerated as a triggering data element under most state breach notification statutes. While phone numbers can facilitate social engineering and SIM-swapping attacks, and while the exposure of phone numbers in combination with other identifying information is a legitimate privacy concern, the phone number alone does not satisfy the statutory trigger in the vast majority of jurisdictions. Several states with broader catch-all provisions may reach a different conclusion, as discussed below.
Name plus partial financial account numbers (last four digits): This is the closest question presented by the Incident. Many statutes define "financial account number" as a full account number, or an account number in combination with any required security code, access code, or password that would permit access to the financial account. Last-four-digit truncations are the standard masking technique used throughout the financial services industry precisely because the last four digits alone are generally insufficient to permit account access. Under a strict reading of most statutes, the exposure of the last four digits of an account number, without the full account number and without an associated security code or password, would not satisfy the statutory definition of "financial account number." However, several factors counsel in favor of a broader reading in certain jurisdictions: (a) some statutes refer more broadly to "financial information" or "account information" without specifying that a full account number is required; (b) partial account numbers, when combined with name, email, employer, and other identifying information, could facilitate social engineering attacks against financial institutions; and (c) the exposure of account balances and asset allocation summaries, while not themselves enumerated data elements, provide financially sensitive information that could be exploited.
Catch-all provisions: Several states (including Texas, as discussed below) have enacted broader catch-all provisions that define "personal information" to include any information that, alone or in combination with other information, could be used to commit identity theft or identity fraud. Under these provisions, the combination of full name, email address, employer, job title, phone number, and partial financial data could potentially meet the statutory threshold, even though no single data element falls squarely within the traditional enumerated categories.
2. "Acquisition" Versus "Access" Distinction
The distinction between "acquisition" and "access" as the triggering event for notification is a material issue in this Incident because Palisade's forensic investigation found no evidence of bulk data exfiltration, but confirmed that the threat actor's automated tools successfully authenticated to 11,438 user accounts and that data was displayed on the account profile pages during the authenticated sessions.
In states that use an "acquisition" trigger — such as California (Cal. Civ. Code § 1798.82, which requires that personal information "was, or is reasonably believed to have been, acquired by an unauthorized person") — an argument could be made that the threat actor accessed the data but did not acquire it, because there is no affirmative evidence that the data was copied, downloaded, or removed from the Lumos Insight Platform. Under this argument, the mere display of data on a screen during an automated credential-checking session does not constitute "acquisition."
In states that use an "access" trigger — such as New York (N.Y. Gen. Bus. Law § 899-aa (SHIELD Act)) — the analysis is more straightforward, because the unauthorized authentication to user accounts and the display of personal data on the account pages clearly constitutes "access to" personal information, regardless of whether the data was exfiltrated.
Conservative recommendation: We recommend treating access as presumptive acquisition for all states, including those with an "acquisition" trigger, for the following reasons:
(a) Difficulty of proving a negative. While Palisade found no evidence of data exfiltration, this conclusion is based on the absence of detectable exfiltration indicators in server-side logs. Client-side data capture methods (e.g., screenshots, screen recordings, or local caching by the threat actor's browser) would not be detectable through server-side logging. It is therefore impossible to affirmatively rule out that data was captured during the 11,438 authenticated sessions.
(b) Regulatory expectations. State regulators, including Attorneys General, consistently favor over-notification and take a dim view of entities that rely on narrow statutory interpretations to avoid notification obligations. Relying on the acquisition/access distinction to avoid notification in a subset of states, while simultaneously notifying in other states, could be perceived as inconsistent and could invite regulatory scrutiny.
(c) 137 extended sessions. The 137 accounts with session durations exceeding 30 seconds present a heightened risk that data was manually reviewed and potentially captured by the threat actor. While Palisade found no server-side evidence of data download or screenshot activity for these accounts, the extended session durations are suggestive of human interaction with the account pages, making it more difficult to argue that data was not acquired.
(d) Operational consistency. Adopting a uniform notification approach across all jurisdictions simplifies the notification process, reduces the risk of administrative error, and avoids the need to make individualized residency-based determinations about which affected individuals do and do not receive notification based on subtle differences in statutory language.
3. Notification Timing and Deadlines
State notification deadlines range from specific numerical requirements (30, 45, 60, or 90 days from the date of determination or discovery) to general standards such as "the most expedient time possible and without unreasonable delay." The determination date for deadline calculation purposes is July 15, 2024, as discussed in Section I above. Our recommended notification execution date of August 5, 2024 — 21 days after the determination date — satisfies all applicable deadlines, including the most restrictive.
4. Attorney General and Agency Notification Requirements
Among the 50 states, the District of Columbia, and the U.S. territories, 34 states require notification to the state Attorney General or other designated state agency in connection with a breach notification. These requirements are subject to varying numerical thresholds — for example, some states require AG notification only when notification is provided to 250, 500, or 1,000 or more residents of the state. Based on the affected account data provided by Lumos, the Company meets or exceeds the applicable threshold in all 34 states requiring AG notification. Calderwood & Harkness will prepare and file the AG notifications for each such jurisdiction.
IV. State-by-State Analysis — Key Jurisdictions
This section provides detailed analysis for the states with the largest numbers of affected residents, the most restrictive notification deadlines, or the most complex analytical issues. A comprehensive summary of all 50 states, the District of Columbia, and U.S. territories is provided in Appendix A.
A. California
Statute: Cal. Civ. Code § 1798.82 (general breach notification); Cal. Civ. Code § 1798.29 (applicable to state agencies; not applicable here as Lumos is a private entity).
CCPA/CPRA considerations: The California Consumer Privacy Act, as amended by the California Privacy Rights Act ("CCPA/CPRA"), includes a private right of action under Cal. Civ. Code § 1798.150 for data breaches involving nonencrypted and nonredacted personal information — as defined in Cal. Civ. Code § 1798.81.5(d)(1)(A) — resulting from a business's failure to implement and maintain reasonable security procedures and practices appropriate to the nature of the information. The § 1798.150 private right of action carries statutory damages of not less than $100 and not greater than $750 per consumer per incident, or actual damages, whichever is greater. This private right of action is the subject of a separate analysis that is beyond the scope of this notification-focused memorandum, but we flag it here for completeness and note that the notification letters should be carefully drafted with awareness of the litigation exposure discussed in Section XII below.
Affected accounts: 3,412 California-resident users, making California the state with the largest number of affected residents.
Definition of "personal information" (§ 1798.82(h)): An individual's first name or first initial and last name, in combination with any one or more of the following data elements, when either the name or the data element is not encrypted or redacted:
(1) Social Security number;
(2) Driver's license number or California identification card number;
(3) Account number or credit or debit card number, in combination with any required security code, access code, or password that would permit access to an individual's financial account;
(4) Medical information;
(5) Health insurance information;
(6) Unique biometric data generated from measurements or technical analysis of human body characteristics;
(7) Information or data collected through the operation or use of an automated license plate recognition system;
(8) Genetic data;
(9) A tax identification number.
In addition, the statute also defines "personal information" to include an individual's username or email address, in combination with a password or security question and answer, that would permit access to an online account.
Analysis of data elements at issue:
Name + email address (without associated password): An email address without an associated password or security credential does not independently trigger § 1798.82 under the enumerated data element categories (items (1)–(9) above). However, the email/credential-based prong (username or email address in combination with a password or security question and answer that would permit access to an online account) requires closer analysis. In this Incident, the threat actor possessed valid email/username and password combinations (obtained from VaultSync) that permitted access to Lumos accounts. The email addresses are now confirmed as valid and associated with active Lumos accounts, and the associated passwords (from VaultSync) are known to the threat actor. This arguably constitutes information that could facilitate further account compromise, particularly for users who have not yet changed their credentials on other platforms where the same email/password combination may be reused. Under the email/credential prong, the combination of email address plus password is "personal information," and the Incident involved the use of this combination to access accounts. However, the passwords were not stored on or obtained from Lumos — they were obtained from VaultSync. The question is whether § 1798.82's email/credential prong applies when the passwords were not maintained by the notifying entity. We believe the better reading is that the prong is triggered where the combination of email and password permits access to the notifying entity's platform, regardless of the source of the password, because the statutory purpose is to protect individuals whose online accounts have been accessed through compromised credentials.
Name + phone number: Phone number is not a specifically enumerated data element under § 1798.82. The exposure of phone numbers does not independently trigger the notification obligation under California law.
Name + partial financial account numbers (last four digits): For the subset of 2,614 accounts with Quick View data, the analysis turns on whether the last four digits of a financial account number, without the full account number and without an associated security code or password, meets the definition of "account number" in § 1798.82(h)(3). The statute refers to an "account number or credit or debit card number, in combination with any required security code, access code, or password that would permit access to an individual's financial account." The last four digits of an account number, standing alone, are generally insufficient to permit access to a financial account and are the industry-standard form of masking or truncation. We believe that last-four-digit truncated account numbers likely do not meet the statutory definition in California. However, the combined exposure of partial account numbers with account balances and asset allocation data provides a more complete financial profile that could be used for social engineering purposes, and a regulator could take a broader view.
"Acquisition" requirement: Section 1798.82(a) provides that notification is required when an entity that "owns or licenses computerized data that includes personal information" Discovers or is notified that the personal information "was, or is reasonably believed to have been, acquired by an unauthorized person." California's statute uses an "acquisition" trigger, which is a higher threshold than mere "access." As discussed in Section III.B.2, Palisade found no evidence of bulk data exfiltration, which could support a conclusion that data was not "acquired." However, the distinction between viewing data on a screen and acquiring it is difficult to enforce as a practical matter. Given the 137 sessions exceeding 30 seconds, the inherent limitations of server-side logging in detecting client-side data capture, and the "reasonably believed to have been acquired" standard (which incorporates a reasonableness analysis rather than requiring affirmative proof of acquisition), we believe there is a reasonable basis to conclude that data displayed on screen during the authenticated sessions was, or is reasonably believed to have been, acquired.
Recommendation: Notify. A conservative approach is warranted given: (a) the volume of affected California residents (3,412 — the largest single-state population); (b) the applicability of the email/credential prong to this Incident; (c) the 2,614 accounts with partial financial data; (d) the strong regulatory expectations in California favoring over-notification; (e) the difficulty of proving that data was not acquired; and (f) the CCPA/CPRA private right of action exposure, which makes it particularly important to demonstrate a good-faith notification posture.
AG notification: Required under Cal. Civ. Code § 1798.82(f) when notification is provided to more than 500 California residents. With 3,412 affected California residents, AG notification is required. The entity must submit a sample copy of the notification letter to the AG electronically, using the AG's online reporting form.
Timing: Section 1798.82(a) requires notification "in the most expedient time possible and without unreasonable delay." The statute does not impose a specific numerical deadline but provides that notification may be delayed if a law enforcement agency determines that notification will impede a criminal investigation (no such request has been made here). California law is generally interpreted to require notification within 30 to 60 days of determination.
Recommended action: File AG notification and send individual notices by August 5, 2024.
B. New York
Statute: N.Y. Gen. Bus. Law § 899-aa, as amended by the Stop Hacks and Improve Electronic Data Security Act (the "SHIELD Act"), effective March 21, 2020.
Affected accounts: 2,107 New York-resident users.
Definition of "private information" (§ 899-aa(1)(b)): The SHIELD Act defines "private information" through two independent prongs:
Prong 1 (Name plus data element): Personal information consisting of any information in combination with any one or more of the following data elements, when either the data element or the combination of personal information plus the data element is not encrypted, or is encrypted with an encryption key that has also been accessed or acquired: (i) Social Security number; (ii) driver's license number or non-driver identification card number; (iii) account number, credit or debit card number, in combination with any required security code, access code, password, or other information that would permit access to an individual's financial account; (iv) account number, or credit or debit card number, if circumstances exist wherein such number could be used to access an individual's financial account without additional identifying information, security code, access code, or password; (v) biometric information (fingerprints, voice prints, retina or iris images, or other unique physical representations or digital representations of biometric data used to authenticate or ascertain the individual's identity).
Prong 2 (Username/email plus credential): A username or email address in combination with a password or security question and answer that would permit access to an online account.
Notably, the SHIELD Act's Prong 2 does not require that the affected individual's name be part of the compromised information — the combination of username or email address plus password alone constitutes "private information."
Analysis:
The SHIELD Act's Prong 2 is directly applicable to this Incident. The threat actor possessed and used valid username/email address and password combinations to access Lumos accounts. Even though these credentials were obtained from VaultSync rather than from Lumos, the fact that the credential combinations permitted access to the Lumos Insight Platform means that "private information" under the SHIELD Act was compromised. The Prong 2 trigger is met regardless of the source of the compromised credentials, because the statutory definition focuses on the nature of the information (username/email + password permitting online account access) rather than the source from which the information was obtained.
Separately, under Prong 1, the combination of name plus email address plus employer/job title does not independently trigger the notification obligation without an additional specifically enumerated data element (SSN, driver's license, financial account number with security code, or biometric data). For the accounts with Quick View data, the partial financial account numbers (last four digits) present the same analytical question discussed in the California analysis. Section 899-aa(1)(b)(iii) refers to an "account number, credit or debit card number, in combination with any required security code, access code, password, or other information that would permit access to an individual's financial account," and subsection (iv) refers to an "account number, or credit or debit card number, if circumstances exist wherein such number could be used to access an individual's financial account without additional identifying information." The last four digits alone would likely not meet either formulation, as they are insufficient to access a financial account. However, this analysis is academic in this case because Prong 2 provides an independent and clearly satisfied basis for notification.
"Access" trigger: The SHIELD Act is triggered by "access to" private information, in contrast to the "acquisition" trigger used by California and certain other states. Under § 899-aa(1)(c), a "breach of the security of the system" includes "unauthorized access to or acquisition of, or access to or acquisition of without valid authorization, computerized data that compromises the security, confidentiality, or integrity of private information maintained by a business." The access trigger is a materially lower threshold than an acquisition trigger. The unauthorized authentication to 2,107 New York-resident user accounts and the display of private information (username/email + password combinations) clearly satisfies the access trigger. No evidence of data exfiltration is required.
Recommendation: Notification required. The SHIELD Act's Prong 2 (username/email + password) is directly applicable, and the access trigger is clearly met. Notification to all 2,107 New York-resident affected users is required.
AG notification: Required under § 899-aa(8). The entity must notify: (a) the New York State Attorney General; (b) the New York State Department of State; and (c) the New York State Division of State Police. In addition, if notification is provided to more than 5,000 New York residents, the entity must also notify consumer reporting agencies. Here, with 2,107 affected New York residents, AG/Department of State/State Police notification is required, but the consumer reporting agency notification threshold (5,000) is not triggered.
Timing: Section 899-aa(2) requires notification "in the most expedient time possible and without unreasonable delay." No specific numerical deadline is imposed, consistent with the pre-SHIELD Act notification timing requirement. The statute provides for delay at the request of law enforcement if notification would interfere with a criminal investigation (no such request has been made here).
Recommended action: File notifications with the AG, Department of State, and Division of State Police, and send individual notices by August 5, 2024.
C. Texas
Statute: Tex. Bus. & Com. Code § 521.053.
Affected accounts: 1,843 Texas-resident users.
Definition of "sensitive personal information" (§ 521.002(a)(2)): An individual's first name or first initial and last name in combination with any one or more of the following items, if the name and the items are not encrypted:
(i) Social Security number;
(ii) Driver's license number or government-issued identification number;
(iii) Account number or credit or debit card number in combination with any required security code, access code, or password that would permit access to an individual's financial account;
(iv) Information that identifies an individual and relates to (a) the physical or mental health or condition of the individual, (b) the provision of health care to the individual, or (c) payment for the provision of health care to the individual.
In addition, Texas law provides a broader definition that includes "information regarding an individual that, alone or in combination with other information, including information that is not sensitive personal information, could reasonably be used to identify the individual, and that, alone or in combination with other information, could be used to commit identity fraud." Tex. Bus. & Com. Code § 521.002(a)(2).
Analysis:
Under the specifically enumerated data elements, the combination of name plus email plus phone number does not satisfy the statutory threshold — neither email nor phone number is a specifically enumerated element. For the Quick View accounts, partial financial account numbers (last four digits) without a security code or password likely do not meet the statutory definition in § 521.002(a)(2)(iii).
However, Texas's broader catch-all provision — which defines "sensitive personal information" to include information that "alone or in combination with other information ... could be used to commit identity fraud" — provides an independent basis for notification. The combination of full name, email address, employer name, job title, and phone number provides sufficient information to facilitate identity fraud through social engineering, phishing, spear-phishing, or business email compromise attacks. A threat actor armed with an individual's full name, employer, job title, email address, and phone number could craft highly targeted phishing communications, impersonate the individual in communications with colleagues or financial institutions, or use the information to answer security questions or reset account credentials on other platforms. These risks are amplified by the fact that the affected individuals are professionals (given that Lumos Insight Platform is an enterprise analytics tool), and their professional contact information and employer affiliation could be leveraged in business email compromise schemes.
Additionally, for the 2,614 accounts with Quick View data, the combination of name, email, employer, phone number, and partial financial data (account balances and asset allocation summaries, in addition to last-four-digit account numbers) provides a substantial financial profile that could be used to impersonate the individual in interactions with financial institutions or to facilitate targeted spear-phishing attacks.
Recommendation: Notification required. A conservative approach is recommended under the catch-all provision, particularly given: (a) the volume of Texas-resident users (1,843); (b) the nature of the exposed data elements (professional profile information that could be used for social engineering and identity fraud); (c) the Texas Attorney General's historically aggressive enforcement posture; and (d) the low cost and low risk of over-notification compared to the regulatory and litigation risk of under-notification.
AG notification: Required under § 521.053(i) when notification is provided to 250 or more Texas residents at one time. With 1,843 affected Texas residents, AG notification is required.
Timing: Section 521.053(b) requires notification "as quickly as possible." No specific numerical deadline is imposed, but the statute requires that notification be made without unreasonable delay.
Recommended action: File AG notification and send individual notices by August 5, 2024.
D. Colorado
Statute: C.R.S. § 6-1-716.
Affected accounts: To be populated from final Lumos residency records. Colorado is identified here as a priority jurisdiction because it imposes one of the most restrictive notification deadlines in the country.
Definition of "personal information" (§ 6-1-716(1)(g)): A Colorado resident's first name or first initial and last name in combination with one or more of the following: (i) Social Security number; (ii) student, military, or passport identification number; (iii) driver's license number or identification card number; (iv) medical information; (v) health insurance identification number; (vi) biometric data; (vii) an account number or credit or debit card number in combination with any required security code, access code, or password that would permit access to a resident's financial account; or (viii) a username, email address, or any other account holder identifying information, in combination with a password, security question/answer, or other authentication credential, for an online account.
Analysis: Colorado's definition includes the email/credential prong (subsection (viii)), which is directly applicable to this Incident for the same reasons discussed in the California and New York analyses. Notification is required.
Timing: 30 days from the date of determination that a security breach occurred. This is among the most restrictive deadlines in the country. With a determination date of July 15, 2024, the Colorado deadline is August 14, 2024.
AG notification: Required under § 6-1-716(2)(e) when notification is provided to 500 or more Colorado residents. Whether the 500-resident threshold is met will depend on the final residency data, but given the overall distribution of affected users, it is likely that the threshold is met.
Recommendation: Notify. This jurisdiction, along with Florida, drives the overall timeline urgency for the notification plan.
Recommended action: File AG notification and send individual notices by August 5, 2024, well in advance of the August 14 deadline.
E. Florida
Statute: Fla. Stat. § 501.171 (the Florida Information Protection Act of 2014, "FIPA").
Affected accounts: To be populated from final Lumos residency records. Florida is identified as a priority jurisdiction due to its 30-day notification deadline.
Definition of "personal information" (§ 501.171(1)(g)): An individual's first name or first initial and last name in combination with one or more of the following: (i) Social Security number; (ii) driver's license or identification card number, passport number, military identification number, or other similar number issued on a government document used to verify identity; (iii) a financial account number or credit or debit card number, in combination with any required security code, access code, or password that is necessary to permit access to an individual's financial account; (iv) any information regarding an individual's medical history, mental or physical condition, or medical treatment or diagnosis by a health care professional; or (v) an individual's health insurance policy number or subscriber identification number and any unique identifier used by a health insurer to identify the individual. Florida also includes username or email address in combination with a password or security question and answer that would permit access to an online account.
Analysis: Florida's definition includes the email/credential prong, which is applicable to this Incident. Notification is required.
Timing: 30 days from determination of the breach or reason to believe a breach occurred. Fla. Stat. § 501.171(4)(a). With a determination date of July 15, 2024, the Florida deadline is August 14, 2024, co-driving the most restrictive timeline with Colorado.
AG notification: Required under § 501.171(3) when notification is provided to 500 or more Florida residents. The entity must provide notice to the Florida Department of Legal Affairs (AG). If notification is provided to more than 1,000 individuals, the entity must also notify consumer reporting agencies.
Recommendation: Notify. This jurisdiction co-drives the most restrictive deadline with Colorado.
Recommended action: File AG notification and send individual notices by August 5, 2024, well in advance of the August 14 deadline.
F. Maryland
Statute: Md. Code, Com. Law § 14-3504.
Affected accounts: To be populated from final Lumos residency records.
Definition of "personal information": An individual's first name or first initial and last name in combination with one or more of the following: (i) Social Security number; (ii) driver's license number or state identification card number; (iii) account number, credit card number, or debit card number, in combination with any required security code, access code, or password that permits access to an individual's financial account; (iv) individual taxpayer identification number; (v) passport number or other identification number issued by the United States; (vi) health information; (vii) biometric data; (viii) username or email address in combination with a password or security question and answer that would permit access to an individual's email account.
Analysis: Maryland's definition includes the email/credential prong. The analysis is substantively the same as for California, New York, Colorado, and Florida: the threat actor possessed valid email/username and password combinations that permitted access to Lumos accounts, triggering the notification obligation.
Timing: 45 days from the date the business conducts in good faith an investigation and determines that a breach of the security of a system has occurred. Md. Code, Com. Law § 14-3504(e)(1). With a determination date of July 15, 2024, the Maryland deadline is August 29, 2024.
AG notification: Required under § 14-3504(i). The business must notify the AG before providing notice to affected individuals. The AG notification must include the scope of the breach, the steps taken to restore the security of the system, and a copy of the individual notification.
Recommendation: Notify.
Recommended action: File AG notification and send individual notices by August 5, 2024, well in advance of the August 29 deadline.
G. Additional States — Summary Table
A detailed analysis of each of the remaining states, the District of Columbia, Puerto Rico, Guam, and the U.S. Virgin Islands is provided in Appendix A. For each jurisdiction, Appendix A identifies the applicable statute, the definition of personal information, the triggering event (access, acquisition, or other), whether notification is required based on the data elements involved in this Incident, whether AG notification is required and at what threshold, the timing requirement, the number of affected residents (where available), and our recommendation.
The following is a summary of the conclusions set forth in Appendix A:
States requiring notification (42 states plus D.C. and Puerto Rico): Alabama, Alaska, Arizona, Arkansas, California, Colorado, Connecticut, Delaware, Florida, Georgia, Hawaii, Idaho, Illinois, Indiana, Iowa, Kansas, Louisiana, Maine, Maryland, Massachusetts, Michigan, Minnesota, Missouri, Montana, Nebraska, Nevada, Ne

PRIVILEGED & CONFIDENTIAL — ATTORNEY-CLIENT PRIVILEGE / ATTORNEY WORK PRODUCT

DO NOT DISTRIBUTE WITHOUT PRIOR AUTHORIZATION OF COUNSEL

MEMORANDUM

Record

Parties

Dates

Amounts