ATTORNEY-CLIENT PRIVILEGED AND CONFIDENTIAL ATTORNEY WORK PRODUCT — DO NOT DISTRIBUTE
MEMORANDUM
June 26, 2024
TO: Allison Cho, General Counsel & Chief Privacy Officer, Lumos Analytics Inc.
FROM: Sara Hendricks, Associate, Calderwood & Harkness LLP Priscilla Wynn, Associate, Calderwood & Harkness LLP
CC: Rachel Bernstein, Partner, Calderwood & Harkness LLP Kevin Ostrowski, Partner, Calderwood & Harkness LLP
RE: Preliminary Incident Assessment — Credential-Stuffing Attack on Lumos Insight Platform (C&H Matter No. 1008-00009)
PRIVILEGE NOTICE: This memorandum is a privileged and confidential attorney-client communication and constitutes attorney work product prepared in anticipation of litigation. It contains legal analysis and advice and should not be disclosed to any third party without prior written authorization from Calderwood & Harkness LLP. Disclosure to unauthorized parties may result in waiver of applicable privileges. Any inadvertent disclosure of this memorandum does not constitute a waiver of any privilege or protection, and the recipient is requested to notify Calderwood & Harkness LLP immediately and return or destroy all copies.
I. EXECUTIVE SUMMARY
Calderwood & Harkness LLP ("C&H") was engaged on June 18, 2024, to serve as lead outside breach response counsel for Lumos Analytics Inc. ("Lumos" or the "Company") in connection with a credential-stuffing attack affecting the Company's Lumos Insight Platform. This memorandum provides our preliminary assessment of the incident based on the information available to date, including the preliminary forensic findings memorandum delivered by Palisade Digital Forensics, Inc. ("Palisade") on June 26, 2024. Palisade was retained at the direction of counsel to preserve applicable attorney-client and work product protections.
The key topline findings from the investigation to date are as follows:
• Attack Vector and Scope: Threat actors used compromised credential pairs sourced from an unrelated third-party data breach affecting VaultSync Technologies, Inc. ("VaultSync") to conduct an automated credential-stuffing attack against the Lumos Insight Platform's authentication endpoint. Between approximately 02:14 UTC on June 12, 2024, and approximately 19:47 UTC on June 15, 2024, the threat actors gained unauthorized access to 11,438 individual user accounts across 847 distinct enterprise customer tenants.
• No Internal System Compromise: Palisade's preliminary forensic analysis found no evidence that the threat actors compromised Lumos's internal systems, infrastructure, source code, or backend databases. All unauthorized access was accomplished solely through the use of valid user credentials obtained from an external source.
• No Evidence of Bulk Data Exfiltration: Session duration analysis indicates a median session length of 4.2 seconds per successfully authenticated session, which is consistent with automated credential validation ("account checking") rather than data harvesting. No evidence of bulk data download or exfiltration was observed.
• Data Categories Exposed: User profile information — including full name, email address, job title, employer name, and (for approximately 68.4% of affected accounts) phone number — was accessible in all 11,438 accessed accounts. For a subset of 2,614 accounts (22.9%), cached partial financial data (last four digits of financial account numbers, account balances, and asset allocation summaries) was also accessible through a "Quick View" feature that has since been permanently disabled.
• Containment: Lumos contained the incident on June 15, 2024, by executing a global password reset for all approximately 286,000 registered user accounts and blocking the 1,247 identified source IP addresses associated with the attack.
• Notification Obligations: Our preliminary legal analysis indicates that breach notification obligations are likely triggered in multiple U.S. jurisdictions, including California and New York. A comprehensive multi-jurisdictional notification analysis is forthcoming and will be delivered following receipt of Palisade's final forensic report, which is expected in mid-July 2024.
• Recommendation: We recommend that Lumos begin planning and preparation for multi-state individual and Attorney General notifications, including engagement of a notification and identity protection vendor, while awaiting Palisade's final report. We further recommend that enterprise customer communications be prepared in coordination with the Company's customer success team and crisis communications advisors.
II. BACKGROUND
A. Lumos Analytics Inc. — Company Overview
Lumos Analytics Inc. is a Delaware corporation headquartered at 450 Folsom Street, Suite 1200, San Francisco, California 94105. The Company operates the Lumos Insight Platform, a software-as-a-service ("SaaS") fintech analytics platform that provides advanced data analytics, portfolio analytics, risk modeling, and reporting tools primarily to financial institutions, insurance companies, and wealth management firms.
As of the date of this memorandum, the Lumos Insight Platform serves approximately 4,200 enterprise customers, with a total of approximately 286,000 registered individual user accounts across the platform. The Company maintains additional office locations in Austin, Texas; New York, New York; and London, United Kingdom. Lumos employs approximately 1,120 individuals across these locations.
The version of the Lumos Insight Platform in production at the time of the incident was v4.7.2 (build 4.7.2-rel-20240601), which had been deployed to the production environment on June 1, 2024.
Lumos's majority equity holder is Ridgeline Capital Partners, LP ("Ridgeline"), a private equity firm that acquired its majority position during the Company's 2021 Series C financing round. Ridgeline holds board observer rights, and Vanessa Collier, Operating Partner (Technology) at Ridgeline, holds a seat on the Lumos Board of Directors. The Stockholders' Agreement between Lumos and Ridgeline contains certain information rights and notification covenants relevant to the incident, which are discussed further in Section VIII of this memorandum.
B. Engagement of Calderwood & Harkness LLP and Palisade Digital Forensics
C&H was engaged on June 18, 2024, as lead outside counsel for all aspects of incident response, including forensic investigation oversight, breach notification analysis, regulatory engagement and communications, customer and affected-individual communications, litigation preparedness, and insurance coordination. The engagement was authorized by General Counsel Allison Cho, with the concurrence of the Lumos Board of Directors.
C&H is pre-approved panel counsel under Lumos's cyber liability and technology errors and omissions insurance policy issued by NexTier Cyber Insurance Group (Policy No. NXT-CYB-2024-07812). The pre-approval status of C&H as panel counsel was confirmed by NexTier at the time of claim submission, as described further in Section VI below.
On June 18, 2024, at C&H's direction and in order to preserve the protections of the attorney-client privilege and the work product doctrine, Lumos retained Palisade Digital Forensics, Inc. ("Palisade") to conduct a comprehensive forensic investigation of the incident. Palisade's engagement lead is Dr. Neil Frasier, Principal Consultant, and the firm is headquartered at 999 Third Avenue, Suite 2800, Seattle, Washington 98104. All Palisade reports, communications, draft deliverables, and work papers are directed to and through C&H in order to maintain the privileged nature of the forensic investigation.
Concurrent with the engagement of outside counsel and forensic investigators, Lumos issued an internal litigation hold on June 18, 2024. The litigation hold was communicated to all relevant custodians and covers all incident-related records, system logs, access logs, network traffic captures, communications (including email, instant messaging, and Brightmoor Data Systems), forensic images, and any other documents or data relating to the credential-stuffing incident, the Company's investigation, and its response.
Additionally, a formal insurance claim was submitted to NexTier Cyber Insurance Group on June 20, 2024. As of the date of this memorandum, NexTier has acknowledged receipt of the claim submission; however, a formal coverage determination letter has not yet been issued. The current status of the insurance claim is discussed further in Section VI.
III. FACTUAL SUMMARY OF THE INCIDENT
A. Origin of Compromised Credentials — VaultSync Technologies, Inc. Breach
On May 28, 2024, VaultSync Technologies, Inc. ("VaultSync"), a California-based consumer cloud storage provider, publicly disclosed that it had experienced a data breach resulting in the unauthorized access to and exfiltration of user credential data, including email addresses and hashed passwords, for a significant number of VaultSync users. Media reporting and VaultSync's own disclosures indicated that the compromised credential data was subsequently made available on dark web marketplaces and credential-sharing forums.
Based on Palisade's preliminary forensic analysis, the threat actors responsible for the Lumos credential-stuffing attack appear to have obtained username/password pairs derived from the VaultSync breach and used these credential pairs in an automated attack against the Lumos Insight Platform. This attack vector is consistent with the well-documented credential-stuffing methodology, in which threat actors exploit the tendency of a subset of users to reuse the same password across multiple online services. By testing VaultSync-derived email/password combinations against the Lumos Insight Platform's login endpoint, the threat actors were able to successfully authenticate into accounts belonging to users who had reused their VaultSync password for their Lumos account.
It is important to note that Lumos had no direct business relationship, vendor relationship, or integration with VaultSync Technologies. The compromised credential pairs were obtained by the threat actors entirely from an external source and were injected against the Lumos Insight Platform's publicly facing authentication endpoint. There is no indication that VaultSync had any access to or connection with the Lumos Insight Platform or Lumos's systems.
B. Attack Window and Methodology
Palisade's analysis of server logs, authentication logs, Web Application Firewall ("WAF") logs, and network traffic data has established the following timeline and methodology for the credential-stuffing attack:
• Attack Commencement: Approximately 02:14 UTC on June 12, 2024. Palisade identified the first cluster of anomalous login attempts originating from the threat actors' distributed infrastructure at this timestamp. The initial attempts showed a rapid escalation from a baseline of approximately 50 authentication requests per minute to over 800 requests per minute within the first 30 minutes.
• Attack Conclusion (Last Unauthorized Login): Approximately 19:47 UTC on June 15, 2024. The final successfully authenticated unauthorized session was recorded at this timestamp, approximately four hours after the initial anomaly alert was triggered by the Lumos SIEM platform.
• Total Attack Duration: Approximately 65.5 hours from commencement to final unauthorized access. The attack was not continuous at uniform intensity throughout this window; Palisade observed periodic variations in attack volume, with peak activity concentrated during overnight hours in U.S. time zones, consistent with an effort to minimize the likelihood of immediate human detection.
• Attack Methodology: The attack was conducted as an automated credential-stuffing operation using large-volume injection of username/password pairs against the Lumos Insight Platform's standard authentication endpoint (the primary login API at `auth.lumosanalytics.com/v2/login`). The attack utilized distributed infrastructure across 1,247 unique source IP addresses, which Palisade has geolocated primarily to Eastern Europe (particularly Romania, Ukraine, and Moldova) and Southeast Asia (primarily Vietnam and Indonesia). The use of a large number of distributed IP addresses is consistent with the use of residential proxy networks or botnet infrastructure designed to evade IP-based rate limiting and blocking mechanisms.
• Total Login Attempts Observed: Approximately 2.16 million credential pair attempts were directed at the Lumos authentication endpoint during the attack window.
• Total Accounts Successfully Accessed: 11,438 unique user accounts were successfully authenticated by the threat actors during the attack window.
• Success Rate: 11,438 successful authentications out of approximately 2,160,000 attempts yields a success rate of approximately 0.53%. This success rate is consistent with credential-stuffing attacks documented in industry research, where the fraction of targeted users who reuse credentials across services typically ranges from 0.1% to 2%, depending on the user population.
• Affected Enterprise Customers: The 11,438 compromised individual user accounts spanned 847 distinct enterprise customer tenants on the Lumos Insight Platform, out of the Company's approximately 4,200 total enterprise customers.
C. Detection and Containment
The incident was detected and contained as follows:
Detection. At approximately 14:22 UTC on June 15, 2024, the Company's Security Information and Event Management ("SIEM") platform — a solution branded "WatchTower," provided by Aegis Security Solutions, Inc. — triggered a series of anomaly alerts. These alerts were generated based on two primary detection criteria: (1) volumetric login patterns, specifically a statistically significant increase in successful authentication events over a rolling 24-hour window; and (2) geographic IP anomalies, specifically a surge of successful login events originating from IP addresses not previously associated with known user activity, concentrated in geographic regions (Eastern Europe and Southeast Asia) where Lumos has minimal historical user presence. The WatchTower alerts were classified at severity level "High" and were routed to the Lumos Security Operations Center ("SOC") incident queue.
SOC Confirmation. The Lumos SOC team, under the leadership of Jason Haddad, Vice President of Information Security and Chief Information Security Officer ("CISO"), initiated triage of the WatchTower alerts at approximately 14:35 UTC on June 15, 2024. Following manual review of authentication logs, source IP geolocation data, and user account activity patterns, the SOC team confirmed the credential-stuffing incident at approximately 16:08 UTC on June 15, 2024. Mr. Haddad immediately escalated the incident to General Counsel Allison Cho and to Vice President of Engineering Brian Kowalski.
Containment Measures. The following containment actions were executed by the Lumos SOC and engineering teams, with all measures substantially completed by approximately 20:30 UTC on June 15, 2024:
1. Forced Global Password Reset. A mandatory password reset was initiated for all approximately 286,000 registered user accounts on the Lumos Insight Platform. All active sessions were terminated, and all existing passwords were invalidated. Users were required to establish new passwords upon their next login attempt. This measure was designed to immediately invalidate any compromised credentials still in the possession of the threat actors.
2. IP blocking. The 1,247 identified offending source IP addresses and their associated IP ranges were blocked at the network edge via updates to the Company's WAF rules and firewall access control lists. This blocking was applied at both the CDN layer and the origin server layer to ensure comprehensive coverage.
3. Incident Response Team Activation. Lumos's internal incident response team was formally activated and incident escalation procedures were initiated in accordance with the Company's written Incident Response Plan (last updated March 2024). The incident was assigned internal incident tracking number LUM-IR-2024-0047.
Additional Immediate Remediation (June 16, 2024). On June 16, 2024, following further analysis by the engineering and security teams, the "Quick View" feature — which had cached partial portfolio data on user profile pages — was permanently disabled across the Lumos Insight Platform. This action eliminated the mechanism through which partial financial account numbers and account balance data had been accessible to the threat actors for the subset of 2,614 affected accounts that had enabled this feature. The Quick View feature will not be re-enabled. Mr. Kowalski has confirmed that the cached data associated with Quick View has been purged from the application layer.
D. Scope of Data Exposed
Based on Palisade's preliminary forensic analysis and the Company's own review of the data elements stored in and accessible through the Lumos Insight Platform's user interface, the following categories of data were potentially accessible to the threat actors during the credential-stuffing attack:
1. User Profile Information (All 11,438 Accessed Accounts). For all 11,438 accounts in which the threat actors successfully authenticated, the authenticated session would have provided access to the user profile information stored on the Lumos Insight Platform. The user profile page contains the following data elements:
• Full name (first name and last name)
• Email address (the email address used as the account username)
• Job title (as entered by the user during account setup or profile configuration)
• Employer name (typically the name of the enterprise customer organization)
• Phone number — this field was populated for approximately 7,820 of the 11,438 affected accounts (approximately 68.4%); the remaining accounts had not provided a phone number during registration or profile setup
In addition to user profile information, the authenticated session would have provided the threat actors with visibility into each user's dashboard configurations and saved analytics queries. These elements constitute proprietary business data belonging to the respective enterprise customer and may contain commercially sensitive information regarding the customer's analytical methodologies, investment thesis elements, or portfolio construction approaches. While this data does not constitute "personal information" for purposes of most breach notification statutes, it may be material to affected enterprise customers from a business confidentiality perspective and will need to be addressed in customer communications.
2. Cached Partial Financial Data — Quick View Feature (2,614 Accounts). In 2,614 accounts (representing 22.9% of the 11,438 total accessed accounts), the individual user had enabled a feature designated "Quick View." The Quick View feature was an optional convenience feature that cached a summary snapshot of the user's portfolio data on the user profile page, allowing the user to view high-level portfolio information without navigating to the full analytics dashboard. The following data elements were visible through the Quick View feature:
• Partial financial account numbers — specifically, the last four digits only of financial account numbers associated with the user's connected portfolio accounts
• Account balances — current or most-recently-cached account balance amounts for connected portfolio accounts
• Asset allocation summaries — high-level percentage-based asset allocation breakdowns (e.g., equities, fixed income, alternatives) for connected portfolio accounts
This subset of 2,614 accounts represents the highest-risk category from a notification analysis perspective, as the exposure of partial financial account numbers in combination with other personally identifiable information may trigger notification obligations in certain jurisdictions, as discussed in Section IV below.
3. Data Not Stored or Accessible. It is significant to note that the Lumos Insight Platform does not store the following data elements in user-facing profile pages or in any interface accessible through the authenticated user interface:
• Social Security numbers or national identification numbers of any kind
• Full financial account numbers, routing numbers, or IBAN numbers (only last-four-digit truncated numbers were accessible through the Quick View feature)
• Payment card numbers (PAN), expiration dates, or CVV/CVC codes
• Driver's license numbers or state identification card numbers
• Passwords or password hashes (passwords are stored in a dedicated authentication database as salted bcrypt hashes and are not displayed or accessible through the user interface)
• Health or medical information
• Biometric data
The absence of these high-sensitivity data elements meaningfully reduces, but does not eliminate, the notification obligations analysis, as discussed in Section IV.
E. Exfiltration Assessment — Palisade Preliminary Findings
Palisade's preliminary forensic analysis addressed the critical question of whether the threat actors actually exfiltrated (i.e., downloaded, copied, or otherwise extracted) data from the accessed accounts, or whether the unauthorized access was limited to automated credential validation activity without meaningful data harvesting. The key findings are as follows:
No evidence of bulk data exfiltration. Palisade's analysis of server-side access logs, network traffic captures, API call logs, and session metadata indicates that the vast majority of the successfully authenticated sessions were extremely short in duration, with a median session duration of 4.2 seconds per successfully authenticated session. This access pattern is highly consistent with automated "account checking" or credential validation activity — that is, the threat actors' automated tools were confirming that a given credential pair was valid for a Lumos account and then immediately moving on to the next credential pair, without lingering in the account to view or extract data. This behavior is commonly observed in credential-stuffing operations, where the primary objective is to compile a list of validated credentials for later monetization or resale, rather than to immediately exploit the accessed accounts.
Extended session accounts. Notwithstanding the general finding above, Palisade identified 137 of the 11,438 accessed accounts that showed session durations exceeding 30 seconds, with the longest observed session lasting approximately 7 minutes and 14 seconds. These extended sessions may suggest that a human operator associated with the threat actor group manually reviewed or interacted with these specific accounts, as opposed to the purely automated access observed in the remaining accounts. Palisade has flagged these 137 accounts for individual, account-level review in its final investigation report, and C&H will conduct a focused analysis of the notification obligations specific to these accounts once that review is complete.
Preliminary conclusion on the 137 extended-session accounts. Upon initial review, Palisade found no evidence of data download activity, screenshot functionality invocation, export functionality invocation, API data extraction calls, or any other server-side indication of data export in connection with any of the 137 extended-session accounts. The server-side application logs, which record user-initiated actions such as data export requests, report generation, CSV/PDF download commands, and similar operations, show no such activity in these sessions.
However, Palisade has appropriately noted a limitation in this analysis: certain client-side data capture methods — such as the threat actor taking a screenshot of their own browser window, using browser developer tools to capture page content, or employing third-party screen capture software on their own machine — would not generate any server-side log entries and therefore cannot be definitively ruled out based on the available forensic evidence. This limitation is inherent in any server-side forensic analysis and is not unique to this incident. The significance of this limitation will be addressed in our notification analysis, as the inability to rule out client-side capture may weigh in favor of a conservative notification approach.
F. Key Forensic Conclusions (Preliminary)
Palisade's preliminary findings, as set forth in its June 26, 2024 preliminary findings memorandum delivered to C&H, include the following key conclusions:
1. No compromise of Lumos internal systems, databases, or infrastructure. The threat actors did not breach Lumos's network perimeter, exploit any software vulnerability in the Insight Platform codebase, gain access to backend databases, compromise any administrative account, or access any system or resource beyond what was available through the standard authenticated user interface. All unauthorized access was accomplished solely through the use of valid user credentials obtained from an external source (the VaultSync breach). The Lumos Insight Platform's infrastructure, source code, and backend systems remain uncompromised.
2. No malware or persistence mechanisms. No malware, backdoors, web shells, remote access tools, or other persistence mechanisms were deployed in or through any of the 11,438 accessed accounts. The threat actors did not modify any account settings, install any plugins or integrations, or take any action that would provide ongoing access beyond the individual authenticated session.
3. No lateral movement or privilege escalation. The accessed accounts were used only at the permission level of the individual user; no evidence was found that any account was used to escalate privileges, access administrative functions, view data belonging to other users, or move laterally to other accounts or systems within the Lumos Insight Platform or the broader Lumos corporate environment.
4. No evidence of bulk data exfiltration. As described above in Section III.E, session duration patterns are consistent with automated credential validation rather than data harvesting, and no server-side evidence of data export activity was detected.
5. 137 extended-session accounts require further review. These accounts will be the subject of individual, detailed analysis in Palisade's final investigation report, which is expected in mid-July 2024.
IV. PRELIMINARY LEGAL ANALYSIS — U.S. BREACH NOTIFICATION OBLIGATIONS
A. General Framework
All 50 U.S. states, the District of Columbia, and the U.S. territories (including Puerto Rico, Guam, and the U.S. Virgin Islands) have enacted data breach notification statutes that impose obligations on entities that experience a breach of security involving the personal information of residents of those jurisdictions. While these statutes share a common conceptual framework, they vary significantly in their specific definitions of covered data elements, their articulation of the triggering event (e.g., "acquisition" versus "access"), the deadlines imposed for individual and regulatory notification, the required content and format of notifications, and the availability of exceptions (e.g., harm-based safe harbors, encryption safe harbors, or de minimis thresholds).
For each jurisdiction in which affected individuals reside, the key analytical questions are:
(1) Whether the specific data elements accessed in this incident meet the statutory definition of "personal information," "private information," "personally identifiable information," or the equivalent term used in the applicable statute;
(2) Whether the nature of the unauthorized access — credential stuffing resulting in authenticated access to user accounts, without affirmative evidence of data exfiltration — meets the statutory trigger for notification (e.g., whether mere "access" is sufficient, or whether "acquisition," "misuse," or other additional elements are required); and
(3) The applicable notification deadlines, Attorney General and/or other regulatory notification requirements, and any specific content or formatting mandates for the notification letters.
Given the geographic distribution of the 11,438 affected user accounts, which span all 50 states, the District of Columbia, and Puerto Rico based on user registration address data, a comprehensive multi-jurisdictional notification analysis will be required. This section provides a preliminary analysis of two key jurisdictions — California and New York — that represent significant concentrations of affected individuals and that illustrate the range of analytical issues presented by this incident. A full 50-state analysis will follow in a separate memorandum.
B. California — Cal. Civ. Code § 1798.82 and CCPA/CPRA
Affected accounts: Based on user registration address data, 3,412 accounts with California-resident users were among the 11,438 accessed accounts. California thus represents the single largest concentration of affected individuals by jurisdiction.
Statutory trigger under Cal. Civ. Code § 1798.82. California's breach notification statute requires any person or business that conducts business in California, and that owns or licenses computerized data that includes personal information, to notify California residents whose unencrypted personal information was, or is reasonably believed to have been, "acquired by an unauthorized person." The statute defines "personal information" as an individual's first name or first initial and last name in combination with any one or more of the following data elements, when either the name or the data elements are not encrypted: (i) Social Security number; (ii) driver's license number or California identification card number; (iii) financial account number, credit or debit card number, in combination with any required security code, access code, or password that would permit access to an individual's financial account; (iv) medical information; (v) health insurance information; or (vi) as amended by AB 1130 (effective January 1, 2020), a user name or email address, in combination with a password or security question and answer that would permit access to an online account.
Analysis of data elements accessed. The data accessed in the Lumos incident includes full name in combination with email address, phone number, job title, and employer name. For 2,614 accounts, partial financial account numbers (last four digits only) and account balances were also accessible through the Quick View feature. Critically, full financial account numbers were not stored or exposed, and no Social Security numbers, driver's license numbers, medical information, or health insurance information was accessed. The partial (last-four-digit) account numbers, standing alone, do not constitute "financial account numbers" as that term is typically interpreted under the statute, particularly given that no associated security code, access code, or password permitting access to the underlying financial account was exposed.
However, the amended provision regarding email address combined with password warrants careful analysis. The threat actors possessed valid email/password combinations for the affected Lumos accounts — that is, they had the users' email addresses and the passwords that permitted access to the Lumos Insight Platform accounts. This combination may satisfy the amended definition of personal information under Cal. Civ. Code § 1798.82(h)(1)(G), depending on whether the statute is interpreted to cover email/password combinations that grant access to any online account, or only email/password combinations that the data holder itself maintains (which, in this case, Lumos did maintain). Given that the credentials were obtained from an external breach (VaultSync) and reused by individuals to access their Lumos accounts, the question of whether Lumos "owns or licenses" this personal information within the meaning of the statute adds a layer of complexity.
Key interpretive question — "acquired." The credential-stuffing access without affirmative evidence of data exfiltration presents a close question as to whether the personal information was "acquired" by the threat actors within the meaning of § 1798.82. The term "acquired" is not defined in the statute, and California courts and the Attorney General's office have not definitively resolved whether mere unauthorized access to a system or account, absent evidence of actual download, copying, or exfiltration of data, constitutes "acquisition" for purposes of triggering notification.
Some guidance from the California Attorney General's office and enforcement practice suggests a broad reading of "acquired," under which unauthorized access that provides the ability to view personal information may be sufficient, on the theory that the data has been "acquired" by the viewer at the moment it is displayed, regardless of whether a copy is made. Conversely, the statutory text could support a narrower interpretation requiring some affirmative act of taking or possessing the data, as distinct from merely accessing a page on which data is displayed.
Recommendation. Given the volume of California-resident accounts (3,412), the ambiguity in the statutory interpretation, the California Attorney General's historically assertive enforcement posture in the data privacy and security space, and the reputational and enforcement risks associated with non-notification, we recommend the conservative approach of proceeding with notification to affected California-resident individuals. In our assessment, the reputational, regulatory, and litigation risks of non-notification substantially outweigh the incremental costs of providing notification.
CCPA/CPRA considerations. The California Consumer Privacy Act, as amended by the California Privacy Rights Act ("CCPA/CPRA"), codified at Cal. Civ. Code § 1798.150, provides a private right of action for California residents whose "nonencrypted and nonredacted personal information," as defined in Cal. Civ. Code § 1798.81.5(d)(1)(A), is subject to an unauthorized access and exfiltration, theft, or disclosure as a result of the business's violation of the duty to implement and maintain reasonable security procedures and practices. The definition of personal information under this private right of action provision is narrower than the general notification statute and requires elements such as a Social Security number, driver's license number, financial account number with access codes, medical information, or health insurance information.
The partial (last-four-digit) financial account numbers accessible through the Quick View feature, without associated access codes or passwords to the underlying financial accounts, may not meet this narrower threshold. However, further analysis is warranted, particularly with respect to: (a) whether the account balance information accessible through Quick View, in combination with the partial account numbers, could be deemed sufficient under an expansive interpretation; and (b) whether the duty-to-implement-reasonable-security element of the CCPA private right of action is potentially implicated by the absence of mandatory multi-factor authentication on the Lumos Insight Platform at the time of the incident. These issues will be addressed in our comprehensive notification memorandum.
C. New York — SHIELD Act (N.Y. Gen. Bus. Law § 899-aa)
Affected accounts: Based on user registration address data, 2,107 accounts with New York-resident users were among the 11,438 accessed accounts. New York represents the second-largest concentration of affected individuals by jurisdiction.
Statutory trigger under the SHIELD Act. New York's Stop Hacks and Improve Electronic Data Security Act (the "SHIELD Act"), which became effective on March 21, 2020, significantly amended New York's breach notification law (N.Y. Gen. Bus. Law § 899-aa) in two critical respects relevant to this incident. First, the SHIELD Act expanded the definition of "private information" to include, in addition to the traditional combination of name plus specified data elements, certain standalone data elements such as (i) a user name or email address in combination with a password or security question and answer that would permit access to an online account, (ii) biometric information, and (iii) account number, credit or debit card number, even without any required security code, access code, or password, if the number could be used to access an individual's financial account. Second, the SHIELD Act lowered the notification trigger from "acquisition" of private information to "access to" private information — a significantly broader standard.
Definition of "private information." Under the SHIELD Act, "private information" means either: (a) personal information (defined as any information concerning a natural person which, because of name, number, personal mark, or other identifier, can be used to identify such natural person) consisting of any information in combination with any one or more of the following data elements, when either the data element or the combination of personal information plus the data element is not encrypted or is encrypted with an encryption key that has also been accessed or acquired: (i) Social Security number; (ii) driver's license number or non-driver identification card number; (iii) account number, credit or debit card number, in combination with any required security code, access code, or password; or (iv) account number, credit or debit card number, if circumstances exist wherein such number could be used to access an individual's financial account without additional identifying information, security code, access code, or password; or (b) a user name or email address in combination with a password or security question and answer that would permit access to an online account.
Analysis. The access to full name, email address, and phone number, combined with the access to partial financial account numbers (last four digits) and account balances for the 2,614 Quick View accounts, presents a strong case for notification under the SHIELD Act. Critically, the SHIELD Act's "access to" standard is substantially broader than California's "acquisition" standard. Under the SHIELD Act, unauthorized access to private information alone, without any additional evidence of exfiltration, download, or misuse, is sufficient to trigger the notification obligation. The credential-stuffing access in this incident — which resulted in the threat actors viewing user profile pages containing personal information — clearly constitutes "access to" private information under the plain language of the statute.
Furthermore, with respect to the email/password combination, the SHIELD Act's standalone category of "user name or email address in combination with a password or security question and answer that would permit access to an online account" is directly implicated: the threat actors possessed and used valid email/password combinations that permitted access to the affected individuals' Lumos Insight Platform accounts.
Recommendation. Notification is required for New York-resident affected users under the SHIELD Act. The SHIELD Act also requires notification to the New York Attorney General, the New York Department of State, and the New York Division of State Police when the number of affected New York residents exceeds certain thresholds. Given that 2,107 New York residents are affected, all three regulatory notifications will be required. The SHIELD Act does not impose a specific deadline for notification but requires that notification be made "in the most expedient time possible and without unreasonable delay." We will advise on recommended timing in the comprehensive notification memorandum.
D. Other Jurisdictions — Need for Comprehensive Analysis
Based on Lumos's user registration data, affected individuals reside in all 50 U.S. states, the District of Columbia, and Puerto Rico. The following table summarizes the ten states with the highest concentrations of affected accounts:
Several states have enacted notification statutes with broad "access" triggers similar to New York that do not require evidence of "acquisition" or "exfiltration" as a precondition to notification. Other states retain narrower definitions of "personal information" that may not encompass the specific data elements exposed in this incident — particularly in jurisdictions where the statutory definition is limited to name in combination with Social Security number, driver's license number, or full (not partial) financial account number. Because none of these high-sensitivity elements (SSN, full account numbers, driver's license numbers) were stored in or accessible through the Lumos Insight Platform, there may be a basis for concluding that notification is not required in certain narrow-definition states. However, the increasingly common inclusion of email/password combinations in state definitions of personal information complicates this analysis.
Texas (Tex. Bus. & Com. Code § 521.053) is flagged as a particularly significant jurisdiction given the 1,843 affected Texas-resident accounts and Texas's inclusion of login credentials (username combined with password or security question) in its definition of sensitive personal information, as well as Texas's 60-day notification deadline from the date of determination that a breach has occurred.
C&H will prepare a comprehensive 50-state + D.C. + territories notification analysis memorandum, which will identify for each jurisdiction:
(a) Whether individual notification to affected residents is required based on the specific data elements exposed;
(b) Whether Attorney General, state agency, or other regulatory notification is required, and the identity of the applicable regulatory recipient;
(c) The applicable notification deadline, including the specific triggering event from which the deadline runs (e.g., date of discovery, date of determination, completion of investigation);
(d) Specific content and formatting requirements for notification letters (several states mandate the inclusion of specific language, free credit monitoring offers, or contact information for the state AG's office); and
(e) Jurisdictions in which notification is not required based on the data elements exposed, with documentation of the analytical basis for that conclusion.
This comprehensive memorandum is targeted for delivery in mid-to-late July 2024, following receipt of Palisade's final forensic report, which will provide the definitive scope determination necessary to finalize the notification analysis.
V. UK AND EU DATA PROTECTION CONSIDERATIONS
A. ICO Notification
Lumos maintains a London office located at 25 Worship Street, 4th Floor, London EC2A 2DX, and provides services to UK and EU-based enterprise clients through its Lumos Insight Platform. Based on user registration address data, approximately 814 UK-resident user accounts were among the 11,438 accounts accessed during the credential-stuffing attack.
Under Article 33 of the UK General Data Protection Regulation ("UK GDPR"), as retained and incorporated into UK law following Brexit, a data controller must notify the Information Commissioner's Office ("ICO") of a personal data breach without undue delay and, where feasible, not later than 72 hours after becoming aware of the breach, unless the personal data breach is unlikely to result in a risk to the rights and freedoms of natural persons. Where notification is made more than 72 hours after awareness, the controller must provide reasons for the delay.
Lumos's UK and EU data protection counsel, Harmon Watts & Kendrick LLP ("HWK"), with lead partner Catherine Wye (London), filed the ICO notification on June 18, 2024, which was within the 72-hour window calculated from the point of confirmed awareness of the incident at approximately 16:08 UTC on June 15, 2024. The ICO notification was submitted as an initial notification, with an indication that the investigation is ongoing and that supplemental information will be provided upon completion of the forensic investigation.
The question of whether individual notifications to UK data subjects are required under Article 34 of the UK GDPR will need to be assessed once the final forensic report from Palisade is available. Article 34 requires individual notification where the personal data breach is "likely to result in a high risk to the rights and freedoms of natural persons." Given that the data elements exposed for most affected UK accounts were limited to name, email, job title, employer, and phone number — and that no evidence of exfiltration was found — there is a reasonable basis to argue that the threshold of "high risk" may not be met for the majority of affected UK accounts. However, for UK-resident accounts within the 2,614 Quick View subset (where partial financial data was accessible), individual notification is more likely warranted. HWK is conducting this assessment and will provide recommendations in coordination with C&H.
B. EU GDPR — Non-UK Residents
In addition to the UK-resident accounts, a small number of accounts belonging to residents of European Union member states (excluding the UK) were among the 11,438 accessed accounts. The preliminary count of affected EU-resident (non-UK) user accounts is as follows:
Under the EU General Data Protection Regulation (Regulation (EU) 2016/679), the obligations regarding notification to supervisory authorities (Article 33) and communication to data subjects (Article 34) are substantively similar to those under the UK GDPR. However, the question of which supervisory authority has jurisdiction, and whether separate Data Protection Authority ("DPA") notifications are required in each affected EU member state, depends on the determination of Lumos's "lead supervisory authority" under the GDPR's one-stop-shop mechanism and on the establishment through which data is processed.
HWK is evaluating whether separate DPA notifications are required under the GDPR for the 47 affected EU-resident individuals. Given the relatively small number of affected accounts, the nature of the data elements exposed, and the absence of evidence of exfiltration, HWK is considering whether the exposure is sufficiently de minimis and does not involve special category data under Article 9 of the GDPR, such that individual notice as a precautionary measure — rather than formal DPA notification — may be the appropriate course of action. HWK's analysis and recommendations on this point will be included in the comprehensive notification memorandum.
VI. INSURANCE COVERAGE STATUS
Lumos maintains a cyber liability and technology errors and omissions insurance policy issued by NexTier Cyber Insurance Group. The key terms of the policy are as follows:
• Insurer: NexTier Cyber Insurance Group
• Policy Number: NXT-CYB-2024-07812
• Policy Period: January 1, 2024 through January 1, 2025
• Coverage Limit: $15,000,000 per occurrence / $30,000,000 aggregate
• Self-Insured Retention ("SIR"): $500,000 per claim
The NexTier policy provides coverage for, among other things, breach response costs (including forensic investigation, legal fees, notification costs, credit monitoring and identity protection services, and crisis communications), regulatory defense and fines (subject to insurability in the applicable jurisdiction), and liability arising from third-party claims related to a data breach or security incident.
C&H submitted formal notice of the claim to NexTier on June 20, 2024, via the insurer's designated claims portal and by concurrent email to NexTier's claims department. As of the date of this memorandum, NexTier has acknowledged receipt of the claim submission and has assigned Martin Okubo as the claims adjuster responsible for the matter. However, a formal coverage determination letter — confirming or denying coverage and specifying any applicable reservations of rights — has not yet been issued by NexTier.
C&H is pre-approved panel counsel under the NexTier policy, which means that Lumos's retention of C&H as breach response counsel was pre-authorized and does not require separate insurer approval. Similarly, Palisade's engagement as forensic investigators, retained at the direction of outside counsel, is expected to be covered under the policy's breach response coverage provisions, subject to the $500,000 per-claim self-insured retention. We anticipate that NexTier will issue its formal coverage determination within the next two to three weeks. C&H will review the determination and any reservations of rights and advise Lumos accordingly.
We note that diligent documentation of all breach response costs — including legal fees, forensic investigation fees, notification costs, credit monitoring costs, crisis communications fees, and any other response-related expenditures — will be essential for insurance reimbursement purposes. We recommend that Lumos maintain a centralized cost tracking ledger for all incident-related expenses and coordinate with C&H on any cost items that may require pre-approval from the insurer.
VII. IMMEDIATE REMEDIATION ACTIONS TAKEN BY LUMOS
The following remediation actions have been completed by Lumos's engineering and security teams as of the date of this memorandum:
1. Global Password Reset. A mandatory password reset was executed for all approximately 286,000 registered user accounts on the Lumos Insight Platform. This action was completed on June 15, 2024, at approximately 20:30 UTC. All active sessions were terminated, all existing passwords were invalidated, and all users were required to establish new credentials upon their next login attempt.
2. IP blocking. The 1,247 identified source IP addresses associated with the credential-stuffing attack, along with associated IP ranges identified through CIDR analysis, were blocked at the network edge through WAF rule updates and firewall access control list modifications. This action was completed on June 15, 2024.
3. Quick View Feature Permanently Disabled. The Quick View feature, which had cached partial portfolio data (including partial financial account numbers, account balances, and asset allocation summaries) on user profile pages, was permanently disabled across the Lumos Insight Platform. This action was completed on June 16, 2024. The cached data associated with Quick View has been purged from the application layer. The Quick View feature will not be reinstated.
4. Internal Litigation Hold. A comprehensive internal litigation hold was issued on June 18, 2024. The hold covers all incident-related records, system logs, access logs, authentication logs, network traffic captures, communications (including email, Meridian Solutions, and instant messaging), forensic images, backup media, and any other documents or electronically stored information relating to the credential-stuffing incident, the investigation, and the Company's response. The litigation hold was communicated to all relevant custodians identified in coordination with outside counsel.
In addition to the completed actions described above, the following additional remediation measures are either currently in progress or under active evaluation by the Lumos engineering and security teams. These measures will be addressed in greater detail in future correspondence:
• Mandatory Multi-Factor Authentication (MFA) Rollout. Lumos is developing and implementing mandatory multi-factor authentication for all Lumos Insight Platform user accounts. Prior to the incident, MFA was available as an optional feature that could be enabled by enterprise customer administrators or individual users, but it was not required by default. The engineering team, led by VP of Engineering Brian Kowalski, is targeting completion of the mandatory MFA rollout by the end of July 2024. Upon implementation, all users will be required to enroll in MFA using either a time-based one-time password (TOTP) authenticator application or SMS-based verification. The implementation of mandatory MFA is the single most impactful remediation measure for preventing future credential-stuffing attacks.
• Advanced Bot-Detection and CAPTCHA Implementation. Lumos is implementing advanced bot-detection technology and CAPTCHA challenges on the Insight Platform login page to detect and block automated credential-stuffing attempts. The engineering team is evaluating vendors including Crowne Albany Health IT and Dunmore Health IT. Target completion is estimated for early July 2024.
• Rate-Limiting Adjustments on Authentication Endpoints. The Lumos engineering and security teams are evaluating a significant reduction in the permitted authentication attempt rate from the current threshold of 100 attempts per minute per source IP address to 10 attempts per minute per source IP address. VP of Engineering Brian Kowalski and CISO Jason Haddad are jointly leading this evaluation, which requires balancing security considerations against the potential for false-positive blocking of legitimate users, particularly enterprise customers accessing the platform through shared corporate IP addresses or VPN exit nodes.
• Credential-Screening Service Integration. Lumos is evaluating the integration of a credential-screening service that would check user passwords against known breach databases (such as the Hollowell Services Inc. database) at the time of login and password change. Users found to be using credentials that appear in known breach datasets would be prompted to change their password immediately. This measure is designed to proactively address the credential-reuse behavior that enabled the attack.
VIII. RECOMMENDATIONS AND NEXT STEPS
Based on the preliminary forensic findings and legal analysis set forth above, C&H recommends the following actions and next steps:
1. Await Palisade Final Forensic Report. Palisade anticipates delivering its final investigation report in mid-July 2024. The final report will include: (a) an individual, account-level review of the 137 extended-session accounts identified in the preliminary findings; (b) a definitive assessment of exfiltration risk across all 11,438 accessed accounts; (c) a comprehensive scope confirmation, including final affected-account counts by jurisdiction; and (d) any additional findings arising from Palisade's continued forensic analysis. The final report date will serve as the "determination date" for purposes of calculating notification deadlines in most jurisdictions, as many state statutes begin the notification clock from the date on which the entity "determines" or "becomes aware" that a breach has occurred, which is generally interpreted as the date on which the investigation has progressed to the point of identifying the scope and nature of the breach with reasonable certainty.
2. Comprehensive Multi-Jurisdictional Notification Analysis. C&H will prepare and deliver a comprehensive 50-state + D.C. + territories + UK/EU notification obligations analysis memorandum promptly following receipt of the final forensic report. As described in Section IV.D above, this analysis will identify all jurisdictions in which notification is required, the applicable deadlines, content and formatting requirements, and regulatory filing obligations. This memorandum will also include draft notification letter templates for review and approval.
3. Notification Preparation. Lumos should begin the process of engaging a notification vendor for the logistics of individual and Attorney General notifications. C&H recommends coordinating with Sentinel Identity Services, Inc. for both notification mailing and email logistics and the provision of credit monitoring and identity theft protection services to affected individuals. Sentinel is a well-regarded provider in the breach response space and has been utilized in prior C&H engagements. Early engagement with a notification vendor will reduce lead time once the final forensic report is received and the comprehensive notification analysis is complete.
4. Credit Monitoring. C&H recommends that Lumos offer 24 months of complimentary credit monitoring and identity theft protection services to all 11,438 affected individuals, regardless of whether the specific data elements accessed in a given individual's account technically trigger a notification obligation in their state of residence. While this approach may result in providing credit monitoring to individuals who reside in jurisdictions where notification is not legally required, the incremental cost is modest in the context of the overall response, and the benefits are significant: (a) it demonstrates good faith and a commitment to consumer protection, which is viewed favorably by regulators and courts; (b) it mitigates litigation risk by reducing the likelihood that affected individuals will claim harm from the absence of protective services; (c) it is consistent with industry best practices for incidents of this scale; and (d) it supports Lumos's customer relationship and reputational objectives.
5. Enterprise Customer Communications. Lumos should begin preparing customer-facing communications for the 847 affected enterprise customer tenants whose individual users were among the 11,438 accessed accounts. These communications should inform each affected enterprise customer of the incident, describe the nature and scope of the unauthorized access affecting their users, summarize the containment and remediation measures taken by Lumos, and outline the steps Lumos is taking to prevent recurrence. C&H will prepare template communications for review and approval, in coordination with Lumos's Director of Customer Success, Fiona Albrecht, and the Company's crisis communications firm, Threshold Public Relations LLC (account lead: Janelle Morse). Customer communications should be carefully timed and coordinated with individual notifications to ensure consistency of messaging.
6. Board and Investor Notification. Under the Stockholders' Agreement between Lumos and Ridgeline Capital Partners, LP, the Company is required to notify Ridgeline of material security incidents that may affect the Company's operations, financial condition, or legal posture. C&H recommends that General Counsel Allison Cho prepare a formal memorandum to the Lumos Board of Directors and to Ridgeline Capital Partners, LP (attention: Vanessa Collier, Operating Partner and Board Member; and Theodore "Ted" Ridgeway, Managing Partner) summarizing the incident, the investigation, the containment and remediation measures, and the Company's legal posture and expected next steps. C&H is available to assist in the preparation of this memorandum and to participate in any Board or investor presentation, as appropriate. This notification should be made promptly, and in any event prior to the commencement of individual notifications.
7. Preserve Litigation Readiness. Although no litigation has been filed or threatened as of the date of this memorandum, credential-stuffing and data breach incidents of this nature and scale — particularly those involving financial data elements and affecting a significant number of individuals — frequently result in putative class action complaints alleging negligence, breach of contract, violations of state consumer protection statutes, and violations of the CCPA or similar state privacy laws. To maintain litigation readiness, Lumos should:
(a) Continue to maintain its internal litigation hold and ensure compliance by all relevant custodians;
(b) Preserve all forensic images, log data, network traffic captures, and any other evidence collected or generated during the investigation;
(c) Avoid making any public statements regarding the incident beyond approved messaging developed in coordination with Threshold Public Relations and C&H