PRIVILEGED & CONFIDENTIAL ATTORNEY-CLIENT PRIVILEGE / ATTORNEY WORK PRODUCT
MEMORANDUM
September 27, 2024
FROM: Rachel Bernstein, Partner, and Sara Hendricks, Associate — Calderwood & Harkness LLP
TO: Allison Cho, General Counsel & Chief Privacy Officer, Lumos Analytics Inc.
CC: Kevin Ostrowski (Billing Partner, Calderwood & Harkness LLP); Jason Haddad (VP of Information Security / CISO, Lumos Analytics Inc.); Marcus Tan (Chief Executive Officer, Lumos Analytics Inc.)
RE: Post-Incident Remediation Summary and Matter Closeout — Credential-Stuffing Incident Affecting the Lumos Insight Platform (C&H Matter No. 1008-00009)
PRIVILEGE LEGEND: This memorandum is a privileged and confidential attorney-client communication and attorney work product prepared by Calderwood & Harkness LLP at the direction of Lumos Analytics Inc. in connection with the credential-stuffing incident affecting the Lumos Insight Platform. It is not intended for disclosure to third parties and should not be forwarded, copied, or otherwise distributed without the prior written consent of counsel. Inadvertent disclosure does not constitute a waiver of any applicable privilege.
Right-click to update Table of Contents
I. Executive Summary
The purpose of this memorandum is to provide a comprehensive closeout summary of all actions taken by Calderwood & Harkness LLP ("C&H") during the engagement opened on June 18, 2024, in response to the credential-stuffing incident affecting Lumos Analytics Inc.'s ("Lumos" or the "Company") Insight Platform (the "Incident"). This memorandum is intended to serve as a privileged record of the matter arc, key decisions, remediation actions, and outstanding risk considerations as the engagement reaches its conclusion.
C&H was engaged on June 18, 2024, to serve as lead breach response counsel for Lumos in connection with a credential-stuffing attack that occurred between approximately June 12–15, 2024. During that attack window, threat actors used compromised credential pairs obtained from an unrelated third-party breach involving VaultSync Technologies, Inc. ("VaultSync"), a consumer cloud storage provider, to gain unauthorized access to 11,438 individual user accounts on the Lumos Insight Platform. VaultSync had publicly disclosed its own data breach on May 28, 2024, and the credential pairs exploited in the attack against the Lumos Insight Platform were derived from that disclosure. The threat actors leveraged automated tools to inject those credential pairs against the Lumos Insight Platform's authentication endpoints, successfully accessing accounts where users had reused passwords across services.
C&H is pre-approved panel counsel under Lumos's cyber liability insurance policy issued by NexTier Cyber Insurance Group ("NexTier"), Policy Number NXT-CYB-2024-07812, which facilitated the prompt initiation of engagement and coordination of the insurance claim.
The scope of C&H's engagement encompassed the full spectrum of incident response activities, including: incident assessment and legal risk evaluation; forensic investigation coordination under the protection of the attorney-client privilege and work product doctrine; multi-jurisdictional breach notification analysis across all 50 U.S. states, the District of Columbia, Puerto Rico, the United Kingdom, and the European Union; regulatory communications with state Attorneys General and the UK Information Commissioner's Office ("ICO"); preparation and execution of individual and enterprise customer notifications; insurance claim coordination with NexTier; litigation readiness analysis; and pre-litigation response to a demand from plaintiffs' class action counsel.
As of the date of this memorandum, the matter is being closed based on the following milestones having been achieved:
(a) Completion of all required notifications to affected individuals, state Attorneys General, the ICO, and affected enterprise customers;
(b) Implementation of all technical remediation measures recommended by counsel and the forensic investigation team;
(c) Satisfactory conclusion of a 60-day post-notification monitoring period, during which no regulatory enforcement action was initiated and no litigation was filed; and
(d) The absence of any pending regulatory enforcement action, investigation, or filed litigation as of the date hereof.
Notwithstanding the closure of this matter, C&H recommends that Lumos maintain its internal litigation hold and continue monitoring for potential regulatory or litigation developments, particularly in light of the pre-litigation demand letter received from Garrison & Oakley LLP on August 28, 2024. These recommendations are discussed in further detail in Section XII below.
II. Background: The Incident
A. Attack Overview
The Incident involved a credential-stuffing attack — the automated, high-volume injection of username and password pairs obtained from a data breach of an unrelated third-party service — against the authentication endpoints of the Lumos Insight Platform. Credential-stuffing attacks exploit the common practice of password reuse among individuals who use the same email address and password combination across multiple online services. In this case, the credential pairs used in the attack were obtained from the breach of VaultSync Technologies, Inc., a consumer cloud storage provider headquartered in Austin, Texas. VaultSync publicly disclosed its breach on May 28, 2024, acknowledging that its user database — containing approximately 18 million email addresses and associated hashed passwords — had been compromised. Subsequent reporting indicated that a subset of VaultSync's hashed passwords had been decrypted and circulated on dark web marketplaces in the weeks following the disclosure.
The target of the attack was the Lumos Insight Platform, a cloud-based Software-as-a-Service ("SaaS") analytics tool serving approximately 4,200 enterprise customers. These enterprise customers are predominantly financial institutions, insurance companies, and wealth management firms that utilize the Insight Platform for portfolio analytics, risk modeling, and regulatory reporting. At the time of the Incident, the Insight Platform had approximately 286,000 total registered individual user accounts, each associated with an employee of an enterprise customer. The version of the Insight Platform in production at the time of the Incident was v4.7.2 (build 4.7.2-rel-20240601), which had been deployed on June 1, 2024.
B. Attack Window and Detection
Based on the forensic investigation conducted by Palisade Digital Forensics, Inc. ("Palisade"), as described in Section IV below, the attack commenced at approximately 02:14 UTC on June 12, 2024, when the first wave of automated login attempts was directed at the Insight Platform's primary authentication endpoint. The attack continued, with varying intensity, over the following days. The last unauthorized login attributed to the attack occurred at approximately 19:47 UTC on June 15, 2024. The total duration of the attack window was therefore approximately 65.5 hours.
The attack was detected by Lumos's internal Security Information and Event Management ("SIEM") platform, branded as "WatchTower" and provided by Aegis Security Solutions, Inc. ("Aegis"). The WatchTower platform triggered anomaly alerts at approximately 14:22 UTC on June 15, 2024. These alerts were generated based on two primary indicators: (1) volumetric login patterns significantly exceeding normal baseline activity, and (2) geographic IP anomalies, specifically the concentration of successful login events from IP addresses geolocated to regions where Lumos has minimal or no user base. Lumos's Security Operations Center ("SOC") team reviewed the WatchTower alerts and confirmed the Incident at approximately 16:08 UTC on June 15, 2024, at which point the Company began executing its incident response plan and initiated outreach to C&H and other key advisors.
C. Containment
Lumos's internal security team, under the direction of Jason Haddad, VP of Information Security and CISO, executed containment measures promptly following confirmation of the Incident. By approximately 20:30 UTC on June 15, 2024, the following containment actions had been completed:
• Global Password Reset: A mandatory password reset was executed for all approximately 286,000 Insight Platform user accounts. All active sessions were invalidated, and users were required to establish new passwords upon next login. This action was taken to neutralize any compromised credential pairs that had not yet been used in the attack, as well as to secure the 11,438 accounts that had been accessed by the threat actor.
• IP Address blocking: A total of 1,247 unique source IP addresses associated with the attack were identified through log analysis and blocked at the platform's web application firewall ("WAF") and network perimeter. These IP addresses were primarily geolocated to Eastern Europe (particularly Ukraine, Romania, and Moldova) and Southeast Asia (primarily Vietnam and Indonesia), consistent with known proxy and VPN infrastructure commonly used in credential-stuffing campaigns.
On June 16, 2024, Lumos took the additional step of permanently disabling the "Quick View" cached data feature within the Insight Platform. The Quick View feature had been a convenience function that cached partial portfolio data — including partial financial account numbers (last four digits only), account balances, and asset allocation summaries — for rapid retrieval within the user dashboard. This feature was identified as the primary driver of data exposure for the subset of 2,614 affected accounts that contained cached financial data. The decision to permanently disable Quick View was made by Brian Kowalski, VP of Engineering, in consultation with Jason Haddad and with the concurrence of counsel.
D. Scope of Unauthorized Access
The forensic investigation conducted by Palisade established the following parameters regarding the scope of unauthorized access:
Login Attempts and Success Rate. Approximately 2.16 million credential pairs were attempted against the Insight Platform's authentication endpoint during the attack window. Of those, 11,438 resulted in successful authentication, yielding a success rate of approximately 0.53% (11,438 ÷ 2,160,000). This success rate is consistent with industry expectations for credential-stuffing attacks, which typically produce success rates ranging from 0.1% to 2.0%, depending on the degree of password reuse within the target user population.
Enterprise Customer Impact. The 11,438 successfully accessed accounts belonged to individual users across 847 distinct enterprise customer tenants, out of a total of approximately 4,200 enterprise customers on the Insight Platform. This means that approximately 20.2% of enterprise customer tenants had at least one user account accessed during the attack.
Data Categories Exposed. The data categories potentially exposed within accessed accounts included the following:
• User Profile Information: Full name, email address, job title, and employer name. This information was populated in all 11,438 accessed accounts.
• Phone Number: Populated in approximately 7,820 of the 11,438 accounts (approximately 68.4%). The remaining accounts did not have a phone number entered in the user profile.
• Dashboard Configurations and Saved Analytics Queries: Each user account contained personalized dashboard configurations and saved analytics queries, which constitute proprietary business data of the enterprise customers. The nature and sensitivity of this data varied by user.
• Cached Financial Data (Quick View Feature): In 2,614 accounts (22.9% of the 11,438 successfully accessed accounts), the "Quick View" feature had cached partial portfolio data. This cached data included partial financial account numbers (last four digits only), account balances, and asset allocation summaries. This subset of accounts presented the most significant data exposure from a regulatory notification perspective.
Data Categories Not Exposed. Importantly, no Social Security numbers, full financial account numbers, payment card numbers, or other highly sensitive financial identifiers were stored in or accessible via user-facing profile pages or the Insight Platform's user interface. The Insight Platform's architecture segregates sensitive financial identifiers in backend databases that are not accessible through the user-facing application layer.
III. Engagement of Counsel and Key Advisors
A. Calderwood & Harkness LLP (Lead Breach Response Counsel)
C&H was engaged as lead breach response counsel on June 18, 2024, three days after Lumos confirmed the Incident. The engagement was opened under C&H Matter No. 1008-00009. The engagement team comprises the following attorneys, all of whom are members of the firm's Privacy & Data Security practice group in the San Francisco office (One Embarcadero Center, Suite 3400, San Francisco, CA 94111):
• Rachel Bernstein, Partner — Responsible Partner for the engagement, leading all strategic decisions, regulatory analysis, and client communications.
• Kevin Ostrowski, Partner — Billing Partner, responsible for engagement administration and oversight.
• Sara Hendricks, Associate — Lead Associate, responsible for day-to-day matter management, notification drafting, forensic investigation coordination, and litigation analysis.
• Priscilla Wynn, Associate — Working Associate, supporting multi-jurisdictional notification analysis, AG filing preparation, and document management.
C&H is pre-approved panel counsel under Lumos's cyber liability insurance policy with NexTier Cyber Insurance Group, which allowed for immediate engagement without the delay that sometimes accompanies insurer approval of counsel selection.
B. Palisade Digital Forensics, Inc. (Forensic Investigation)
Palisade Digital Forensics, Inc. ("Palisade") was retained at the direction of C&H on June 18, 2024, for the purpose of conducting a forensic investigation into the Incident. The decision to retain Palisade through outside counsel, rather than through Lumos directly, was made deliberately in order to preserve the attorney-client privilege and attorney work product protections applicable to the forensic investigation, its findings, and all related communications. The engagement lead at Palisade was Dr. Neil Frasier, Principal Consultant. Palisade is headquartered at 999 Third Avenue, Suite 2800, Seattle, WA 98104.
All forensic reports, memoranda, and communications generated by Palisade in connection with this engagement were directed through C&H pursuant to the privilege protocol memorandum dated June 18, 2024 (the "Privilege Protocol"). Under the Privilege Protocol, Palisade was instructed to communicate findings exclusively to C&H, and all deliverables were marked as privileged attorney-client communications and attorney work product.
C. Harmon Watts & Kendrick LLP (UK/EU Regulatory Counsel)
Harmon Watts & Kendrick LLP ("HWK") was engaged to serve as UK and EU regulatory counsel in connection with the Incident, given that a subset of affected users were residents of the United Kingdom and European Union member states. The engagement was led by Catherine Wye, Partner, in HWK's London office located at 30 Finsbury Square, London EC2A 1AG. HWK coordinated the ICO notification filing under the UK GDPR and Data Protection Act 2018, and provided analysis regarding EU General Data Protection Regulation ("GDPR") notification obligations for the smaller subset of EU-resident affected users.
D. Threshold Public Relations LLC (Crisis Communications)
Threshold Public Relations LLC ("Threshold") was retained to manage crisis communications related to the Incident. The engagement was led by Janelle Morse, headquartered at 375 Park Avenue, Suite 1410, New York, NY 10152. Threshold's scope of work included the preparation of a customer FAQ document, a press holding statement for use in the event of media inquiries, and messaging guidance for Lumos's customer-facing teams. All external communications and media strategies were reviewed and approved by C&H prior to publication or distribution.
E. Sentinel Identity Services, Inc. (Credit Monitoring & Notification Vendor)
Sentinel Identity Services, Inc. ("Sentinel") was engaged to provide credit monitoring and identity theft protection services to affected individuals, as well as notification mailing and email delivery logistics. Sentinel is headquartered at 1200 Peachtree Street NE, Suite 600, Atlanta, GA 30309. Sentinel's services included the provision of 24 months of credit monitoring and identity theft protection to all affected individuals who chose to enroll, as well as the printing, mailing, and email delivery of individual notification letters.
F. Litigation Hold
On June 18, 2024, Lumos issued an internal litigation hold covering all Incident-related records, logs, communications, and forensic images. The litigation hold was drafted by C&H and distributed by Allison Cho to all relevant custodians within Lumos, including members of the security, engineering, legal, executive, and customer success teams. The hold encompasses, among other materials, server logs, SIEM alerts, firewall logs, email communications, Meridian Solutions messages, forensic images, and all documents generated in connection with the investigation and remediation. The litigation hold remains in effect as of the date of this memorandum. As discussed in Section XII below, C&H recommends that the hold remain in place until further notice from counsel.
IV. Forensic Investigation Results and Timeline
A. Preliminary Findings
Palisade commenced its forensic investigation immediately upon retention on June 18, 2024. Palisade's investigators worked with Lumos's security and engineering teams to collect and preserve relevant log data, authentication records, session metadata, and system images. Palisade delivered a preliminary findings memorandum to C&H on June 26, 2024, eight days after engagement.
The preliminary conclusions contained in that memorandum confirmed the attack vector as credential stuffing from externally sourced credentials, consistent with Lumos's initial assessment. Palisade's preliminary analysis found no evidence of any compromise to Lumos's internal systems, databases, or infrastructure. Additionally, no malware was detected on any system or within any accessed user account environment. These preliminary findings provided a degree of assurance that the Incident was externally driven and that the Company's core infrastructure had not been compromised.
B. Final Forensic Report
Palisade delivered the final forensic investigation report to C&H on July 15, 2024, approximately four weeks after the engagement commenced. The final report was comprehensive, spanning the full attack window, and incorporated detailed analysis of all available log data, session records, network traffic captures, and system artifacts.
The date of delivery of the final forensic report — July 15, 2024 — was designated as the "determination date" for purposes of computing statutory notification deadlines under applicable U.S. state breach notification laws. This determination date reflects the date on which Lumos, through counsel, had sufficient information to determine the identity of affected individuals and the categories of personal information exposed, thereby triggering notification obligations. While Lumos had awareness of the Incident as of June 15, 2024, and the ICO notification was filed within 72 hours of that awareness date consistent with UK GDPR requirements, the more detailed analysis necessary to identify all affected individuals and assess statutory notification obligations across U.S. jurisdictions was not complete until the final forensic report was received on July 15, 2024.
C. Key Forensic Conclusions
The final forensic report reached the following key conclusions:
1. No Compromise of Internal Systems. There was no evidence of any compromise to Lumos's internal systems, databases, or infrastructure. All unauthorized access was accomplished exclusively through the use of valid user credentials obtained externally from the VaultSync breach. The threat actors did not exploit any vulnerability in the Insight Platform's code, infrastructure, or configurations; rather, they leveraged legitimate authentication mechanisms using stolen credentials.
2. No Malware or Persistence Mechanisms. No malware, backdoors, web shells, or other persistence mechanisms were deployed in or through any of the 11,438 accessed accounts. The threat actors did not install any software or modify any system files.
3. No Lateral Movement or Privilege Escalation. There was no evidence of lateral movement within the Insight Platform environment or of any privilege escalation beyond the permissions of the individual user accounts that were accessed. Each unauthorized session was confined to the scope of the individual user account that was authenticated.
4. No Evidence of Bulk Data Exfiltration. Critically, Palisade found no evidence of bulk data exfiltration from any accessed account. An analysis of session duration data revealed that the median session duration for the 11,438 unauthorized access events was 4.2 seconds per session. This extremely short session duration is consistent with automated credential validation — commonly referred to as "account checking" — in which the threat actor's automated tools verify whether a credential pair successfully authenticates and then immediately move on to the next pair. This pattern strongly suggests that the primary objective of the attack was to validate credential pairs, rather than to access, view, or download the data contained within user accounts.
5. Accounts with Extended Session Duration. Palisade identified 137 accounts in which session durations exceeded 30 seconds, suggesting the possibility of manual review by the threat actor or a more deliberate interaction with the account contents. Palisade conducted an individual review of the server logs for each of these 137 accounts. Upon that review, no evidence of data download, export, or screenshot activity was detected in any of these accounts. While the extended session duration introduces a degree of uncertainty regarding whether account contents were visually reviewed by the threat actor, the absence of any detectable exfiltration activity mitigates the risk that data was actually acquired or retained.
These forensic conclusions have been a central element of C&H's breach notification analysis, regulatory communications, litigation risk assessment, and enterprise customer communications. The absence of evidence of exfiltration is a significant factor in the overall risk profile of the Incident.
V. Multi-Jurisdictional Breach Notification Compliance
A. United States — Individual Notifications
1. Notification Analysis Summary
C&H conducted a comprehensive multi-jurisdictional breach notification analysis to determine which U.S. state statutes required individual notification to affected residents. Because the 11,438 affected individuals resided across all 50 states, the District of Columbia, and Puerto Rico, C&H analyzed the breach notification laws of each of these jurisdictions. The resulting analysis was documented in a detailed memorandum delivered to Allison Cho on July 18, 2024.
The analysis focused on whether the categories of personal information accessed in each user account met the statutory definition of "personal information" (or equivalent terminology) triggering notification obligations under each applicable state law. The key data elements at issue were: (a) full name; (b) email address; (c) phone number; (d) job title and employer name; (e) dashboard configurations and analytics queries; and (f) for the subset of 2,614 accounts, partial financial account numbers (last four digits), account balances, and asset allocation summaries.
The following state-specific analyses warrant particular attention:
California (Cal. Civ. Code § 1798.82; CCPA/CPRA): A total of 3,412 affected accounts were associated with California-resident users, making California the single largest affected jurisdiction. C&H's analysis examined whether credential-stuffing access — where no evidence of data exfiltration was found — constitutes an "acquisition" of personal information within the meaning of California's breach notification statute. The statute requires notification when "personal information was, or is reasonably believed to have been, acquired by an unauthorized person." The question of whether unauthorized access alone, absent evidence of actual data acquisition, satisfies this standard remains a close call under California law, as courts and regulators have not definitively resolved the distinction between "access" and "acquisition" in the credential-stuffing context. C&H's conservative recommendation was to proceed with notification to California residents, erring on the side of over-notification rather than risking non-compliance. This recommendation was accepted by Lumos, and notifications were sent to all 3,412 California-resident affected individuals.
New York (SHIELD Act, N.Y. Gen. Bus. Law § 899-aa): A total of 2,107 affected accounts were associated with New York-resident users. Under the SHIELD Act, New York adopted a broader definition of a security breach that includes unauthorized "access" to private information, without requiring evidence of acquisition. Accordingly, notification was clearly required and was sent to all 2,107 New York-resident affected individuals.
Texas (Tex. Bus. & Com. Code § 521.053): A total of 1,843 affected accounts were associated with Texas-resident users. Texas law requires notification when sensitive personal information was or is reasonably believed to have been acquired by an unauthorized person. Consistent with the conservative approach applied throughout the analysis, notification was required and sent.
In total, C&H determined that individual notification was required in 42 states, the District of Columbia, and Puerto Rico. In the remaining eight states, C&H concluded that notification was not required because the data elements accessed in user accounts in those jurisdictions did not meet the statutory definition of "personal information" triggering notification obligations. Specifically, in those jurisdictions, the notification statute requires the exposure of a Social Security number, driver's license number, state identification number, or full financial account number — none of which were stored in or accessible via the Insight Platform's user-facing interface. The absence of these data elements in the Insight Platform obviated the notification obligation in those jurisdictions.
2. Notification Execution
The determination date — the date on which Lumos had sufficient information to determine the scope and nature of the exposure — was established as July 15, 2024, the date on which Palisade delivered its final forensic report.
Based on this determination date, C&H calculated the applicable statutory deadlines across all relevant jurisdictions. The most restrictive deadlines were as follows:
• Colorado and Florida — 30 days from the determination date, yielding a deadline of August 14, 2024.
• Maryland — 45 days from the determination date, yielding a deadline of August 29, 2024.
• The majority of other states require notification within 60 days, or "without unreasonable delay," or a similar standard.
Lumos executed individual notifications on August 5, 2024, well within all applicable statutory deadlines. The notification was delivered to all 11,438 affected individuals through the following methods:
• Email: The primary method of delivery was email notification, sent to the email address on file for each of the 11,438 affected individuals. Email notifications were transmitted through the Sentinel Identity Services platform to ensure deliverability tracking and documentation.
• U.S. Mail: For 1,612 individuals whose email addresses bounced or were flagged as potentially compromised (given that the email address itself was a data element accessed in the Incident), follow-up notification letters were sent via U.S. mail to the most recent physical address on file for those individuals.
The individual notification letters were drafted by C&H with input from Threshold Public Relations and reviewed by Allison Cho prior to distribution. The content of the letters included: a description of the Incident, including the dates of the attack and the date of discovery; the types of personal information involved; a description of the steps taken by Lumos to investigate and remediate the Incident; the offer of 24 months of complimentary credit monitoring and identity theft protection through Sentinel Identity Services, Inc., along with enrollment instructions and an activation code; and recommended steps that individuals could take to protect themselves, including changing passwords on other services where the same credentials may have been used.
B. United States — State Attorney General Notifications
C&H determined that 34 state Attorney General offices required notification under the applicable state breach notification statutes. AG notifications were filed between August 1 and August 5, 2024. In each case, the notification was filed in advance of or concurrent with the individual notification to ensure compliance with statutes that require AG notification prior to or simultaneous with individual notification.
Each AG notification letter included: a description of the Incident, including the nature of the attack, the dates of the attack window, and the date of discovery; the categories of personal information accessed; the total number of affected individuals across the entire Incident (11,438); the number of affected residents in the applicable state; a description of the remediation steps taken by Lumos; the offer of 24 months of credit monitoring to affected individuals; and a sample copy of the individual notification letter.
State-specific affected individual counts included in the AG filings were as follows (selected jurisdictions):
C. United Kingdom — ICO Notification
A total of 814 UK-resident affected user accounts were identified among the 11,438 accounts accessed during the Incident. Under the UK GDPR and Data Protection Act 2018, Lumos, as a data controller processing personal data of UK data subjects, was required to notify the ICO within 72 hours of becoming "aware" of a personal data breach where the breach is likely to result in a risk to the rights and freedoms of individuals.
Lumos became aware of the Incident at approximately 16:08 UTC on June 15, 2024, when its SOC team confirmed the credential-stuffing attack. The ICO notification was filed on June 18, 2024, within the 72-hour notification window. The notification was coordinated and submitted by Harmon Watts & Kendrick LLP (Catherine Wye) on behalf of Lumos, in coordination with C&H.
The ICO acknowledged receipt of the notification. Following its review, the ICO issued a no further action letter dated August 22, 2024, indicating that the ICO did not intend to take any further regulatory action in connection with the Incident. This outcome is consistent with the nature of the Incident, the absence of evidence of data exfiltration, and the prompt and comprehensive remediation measures implemented by Lumos.
Individual notifications to all 814 UK-resident affected data subjects were sent on August 5, 2024, concurrent with the U.S. individual notifications. These notices were tailored to include references to the UK GDPR and the affected individuals' rights under UK data protection law, including the right to lodge a complaint with the ICO.
D. European Union (Non-UK)
C&H and HWK identified 47 EU-resident affected user accounts, distributed across the following member states: Germany (19), France (14), Netherlands (9), and Ireland (5).
Under Article 33 of the EU GDPR, a controller is required to notify the competent supervisory authority within 72 hours of becoming aware of a personal data breach, unless the breach is unlikely to result in a risk to the rights and freedoms of natural persons. C&H and HWK assessed the notification obligation for these 47 EU-resident accounts under a de minimis exposure analysis, considering the following factors: (a) the relatively small number of affected individuals in each member state; (b) the limited categories of personal data accessed (primarily professional contact information and, in a subset, partial financial data); (c) the absence of any special category data (as defined under Article 9 of the GDPR); (d) the absence of evidence of data exfiltration; and (e) the prompt remediation measures implemented by Lumos. Based on this analysis, C&H and HWK concluded that the breach was unlikely to result in a risk to the rights and freedoms of the affected individuals sufficient to trigger the mandatory DPA notification obligation under Article 33.
Notwithstanding this determination, and consistent with the conservative approach adopted throughout the notification process, individual notices were sent to all 47 EU-resident affected users as a precautionary measure. These notices were sent on August 5, 2024, concurrent with the U.S. and UK notifications, and included information about the Incident, the categories of personal data accessed, the remediation measures taken, and the affected individuals' rights under the GDPR, including the right to lodge a complaint with the relevant national supervisory authority.
E. Regulatory Response Summary
As of the date of this memorandum, September 27, 2024, the regulatory response to the Incident has been entirely favorable:
• U.S. State Attorneys General: No enforcement action, formal inquiry, subpoena, civil investigative demand, or investigation has been initiated by any U.S. state Attorney General in connection with the Incident.
• Federal Trade Commission (FTC): No enforcement action, inquiry, or communication has been received from the FTC.
• UK Information Commissioner's Office (ICO): The ICO issued a no further action letter on August 22, 2024, effectively closing its review of the Incident.
• EU Data Protection Authorities: No contact has been received from any EU Data Protection Authority.
While the absence of regulatory action to date is encouraging, C&H notes that certain state Attorneys General and the FTC retain the ability to initiate investigations on longer timelines, and Lumos should remain vigilant as discussed in the recommendations in Section XII.
VI. Credit Monitoring and Identity Theft Protection
As part of its remediation response, Lumos offered 24 months of complimentary credit monitoring and identity theft protection services to all 11,438 affected individuals. These services are being provided through Sentinel Identity Services, Inc. ("Sentinel"). The offering includes three-bureau credit monitoring, identity theft detection alerts, and identity restoration services administered by Sentinel's dedicated fraud resolution specialists.
The per-person cost of the credit monitoring and identity theft protection services is $14.50 per month per enrolled individual, for a duration of 24 months. This yields a per-individual cost of $348.00 over the full monitoring period ($14.50 × 24 months = $348.00). The projected total cost of the credit monitoring program, assuming full enrollment of all 11,438 affected individuals, is $3,978,432 ($348.00 × 11,438 = $3,978,432). This figure represents a maximum exposure estimate; actual costs will depend on the ultimate enrollment rate.
As of the matter closeout date of September 27, 2024, a total of 4,287 individuals had enrolled in the credit monitoring program, representing an enrollment rate of approximately 37.5%. This enrollment rate is consistent with industry norms for data breach credit monitoring offerings, which typically see enrollment rates in the range of 10% to 40%, depending on the nature and severity of the exposed data. Based on current enrollment, the actual projected credit monitoring cost is significantly lower than the maximum exposure; however, the enrollment period remains open, and additional individuals may enroll in the coming months.
In addition to the credit monitoring costs, Sentinel's notification mailing and vendor costs totaled $34,200, which includes the costs of printing and mailing physical notification letters, postage, and the email platform used for electronic delivery of notifications.
Going forward, the credit monitoring program will continue for 24 months from each individual's enrollment date. Sentinel administers the program directly and will handle all enrollee inquiries, alerts, and identity restoration services without further involvement from C&H. Lumos's ongoing obligation is limited to payment of the monthly per-enrollee fees to Sentinel, which are submitted to NexTier for reimbursement under the cyber liability policy.
VII. Technical Remediation Measures Implemented by Lumos
In addition to the legal and notification workstreams managed by C&H, Lumos implemented a comprehensive set of technical remediation measures designed to address the specific attack vector exploited in the Incident and to reduce the risk of similar attacks in the future. These measures were overseen by Brian Kowalski, VP of Engineering, and Jason Haddad, VP of Information Security and CISO, with input from C&H and Palisade regarding the forensic findings and recommended security enhancements.
A. Immediate Containment (June 15–16, 2024)
The following immediate containment measures were executed during and immediately following the detection and confirmation of the Incident:
1. Global Password Reset. A mandatory password reset was executed for all approximately 286,000 Insight Platform user accounts, invalidating all active sessions and requiring users to establish new credentials upon next login. This measure was completed by approximately 20:30 UTC on June 15, 2024.
2. IP Address blocking. A total of 1,247 unique source IP addresses associated with the credential-stuffing attack were identified through analysis of authentication logs and blocked at the platform's web application firewall and network perimeter. This measure was completed by approximately 20:30 UTC on June 15, 2024.
3. Permanent Disabling of "Quick View" Cached Data Feature. The Quick View feature, which had cached partial portfolio data (including partial financial account numbers, account balances, and asset allocation summaries) within the user dashboard for rapid retrieval, was permanently disabled. All cached data associated with the feature was purged from the platform. This measure was completed on June 16, 2024.
B. Enhanced Security Controls (June–July 2024)
The following enhanced security controls were implemented in the weeks following the Incident as longer-term remediation measures:
4. Advanced Bot-Detection and CAPTCHA Deployment. Advanced bot-detection technology and CAPTCHA challenges were deployed on all Insight Platform login endpoints to detect and block automated credential injection attempts. The CAPTCHA challenge presents an interactive verification step that is designed to distinguish between human users and automated scripts, thereby significantly increasing the difficulty and cost of credential-stuffing attacks. This measure was completed on July 8, 2024.
5. Mandatory Multi-Factor Authentication (MFA). Mandatory multi-factor authentication was rolled out for all Insight Platform user accounts. Users are now required to authenticate using a second factor — either a time-based one-time password ("TOTP") generated by an authenticator application, or a push notification to a registered mobile device — in addition to their username and password. MFA is now a mandatory requirement and cannot be disabled by users or enterprise tenant administrators. This measure was completed on July 22, 2024.
6. Rate-Limiting on Authentication Endpoints. The rate limit on the Insight Platform's authentication endpoints was reduced from 100 login attempts per minute per source IP address to 10 login attempts per minute per source IP address. This measure was implemented concurrently with the CAPTCHA deployment on July 8, 2024. The reduced rate limit significantly constrains the throughput of automated credential-stuffing tools.
7. Credential-Screening Service Integration. A credential-screening service was integrated into the Insight Platform's authentication and password-change workflows. This service checks user passwords against known breach databases (including the Hollowell Services Inc. API and proprietary breach intelligence feeds) at the time of login and at the time of password change events. Users whose passwords are found in known breach databases are required to change their password before proceeding. This measure was implemented as part of the MFA rollout and completed on July 22, 2024.
C. Observations
These measures collectively address the specific attack vector exploited in the Incident — automated credential injection using credentials obtained from a third-party breach — by (a) preventing automated login attempts through bot detection and CAPTCHA; (b) rendering stolen passwords insufficient for authentication through mandatory MFA; (c) limiting the throughput of any remaining automated attempts through rate-limiting; and (d) proactively identifying and invalidating compromised credentials through the credential-screening service. Taken together, these controls represent a robust and layered defense against credential-stuffing attacks and substantially reduce the risk of a similar incident in the future.
VIII. Insurance Coverage and Cost Summary
A. Policy Details
Lumos maintains a cyber liability insurance policy with NexTier Cyber Insurance Group ("NexTier"), which provides coverage for costs incurred in connection with data security incidents, including forensic investigation, legal fees, notification costs, credit monitoring, crisis communications, and related expenses. The relevant policy details are as follows:
B. Claim Timeline
C&H submitted a claim under the NexTier policy on behalf of Lumos on June 20, 2024, two days after the engagement commenced. The claim was assigned to Martin Okubo, a senior claims adjuster at NexTier. NexTier acknowledged coverage for the Incident on July 3, 2024, confirming that the credential-stuffing attack constituted a covered event under the policy and that the costs of incident response, forensic investigation, breach notification, credit monitoring, and related legal and professional services fell within the scope of coverage. NexTier also confirmed that C&H qualifies as pre-approved panel counsel under the policy, allowing legal fees to be submitted for reimbursement at the firm's standard panel counsel rates.
C. Total Estimated Incident Response Costs
The following table summarizes the total estimated costs of the Incident response as of the date of this memorandum:
The credit monitoring cost of $3,978,432 represents the maximum projected cost assuming full enrollment of all 11,438 affected individuals. As noted in Section VI, the current enrollment rate is approximately 37.5% (4,287 individuals), and actual costs are expected to be lower than the maximum projection. Final costs will be reconciled upon expiration of the credit monitoring enrollment period.
D. Insurance Coverage Calculation
The estimated covered amount of $4,665,732 is subject to final adjustment by NexTier upon completion of the credit monitoring program and reconciliation of all actual costs. All amounts are well within the $15 million per-occurrence policy limit, and no coverage disputes have arisen during the claims process. NexTier has been cooperative and responsive throughout the engagement, and Lumos has maintained regular communication with Martin Okubo regarding invoicing and cost documentation.
Final reconciliation of actual costs will occur upon the expiration of the credit monitoring enrollment period. Lumos should continue to submit all Incident-related invoices to NexTier in a timely manner to ensure full reimbursement of covered costs.
IX. Litigation Posture
A. Filed Litigation
As of the date of this memorandum, September 27, 2024, no lawsuits have been filed against Lumos Analytics Inc. in any jurisdiction in connection with the credential-stuffing incident. C&H has monitored federal and state court dockets and has not identified any complaints naming Lumos as a defendant in connection with the Incident.
B. Pre-Litigation Demand
On August 28, 2024, Lumos received a pre-litigation demand letter from Garrison & Oakley LLP, a plaintiffs' class action firm with offices at 1500 Market Street, Suite 3200, Philadelphia, PA 19102. The demand letter was sent on behalf of an unnamed putative class of affected users of the Lumos Insight Platform, and alleged that Lumos had failed to implement adequate security measures to protect user accounts, resulting in unauthorized access to personal and financial information. The letter demanded that Lumos enter into pre-suit settlement negotiations and suggested that the firm was evaluating the filing of a putative class action complaint.
C&H responded to the Garrison & Oakley demand letter on September 12, 2024. The response was carefully drafted to protect Lumos's legal position while avoiding the disclosure of any privileged information or forensic details beyond what was already publicly available through the notification letters and AG filings. Specifically, the response:
• Acknowledged receipt of the demand letter;
• Stated that Lumos had fully complied with all applicable breach notification statutes across all affected jurisdictions;
• Noted that Lumos had offered 24 months of complimentary credit monitoring and identity theft protection services to all affected individuals;
• Confirmed that Lumos had implemented comprehensive technical remediation measures to enhance the security of the Insight Platform;
• Stated that the forensic investigation confirmed no evidence of data exfiltration;
• Declined to engage in pre-suit settlement discussions at this time; and
• Reserved all rights and defenses without any admission of liability.
No privileged information, forensic details, or other sensitive materials were disclosed in the response beyond the information already contained in the publicly available notification letters and AG filings. As of the date of this memorandum, no follow-up communication has been received from Garrison & Oakley.
C. Ongoing Risk Assessment
While no litigation has been filed as of this date, the Garrison & Oakley demand letter indicates that plaintiffs' class action counsel is actively monitoring the situation and may file suit. C&H's assessment of the litigation risk profile is as follows:
The absence of evidence of data exfiltration is a significant mitigating factor. In the credential-stuffing context, plaintiffs in data breach class actions typically face difficulty establishing Article III standing where there is no evidence that personal information was actually acquired, viewed, or misused by the threat actor. The short median session duration (4.2 seconds) documented in the forensic investigation is strongly indicative of automated credential validation rather than data harvesting, which further supports a standing defense.
Additionally, the relatively limited scope of data categories exposed in the Incident — primarily professional contact information and, in a subset of accounts, partial financial data (last four digits of account numbers, balances, and asset allocation summaries) — reduces the severity of any claimed harm. Notably, no Social Security numbers, full financial account numbers, or payment card data were exposed.
However, the risk of litigation is not eliminated. The 2,614 accounts in which cached financial data was exposed present a more compelling fact pattern for potential plaintiffs. Additionally, developments in standing doctrine and state consumer protection law continue to evolve in ways that may be favorable to plaintiffs.
Lumos should continue to monitor for any filed complaints and should promptly forward any service of process to C&H for immediate review and response.
X. Key Enterprise Customer Communications
Given that the Lumos Insight Platform serves enterprise customers, and that the Incident affected user accounts across 847 distinct enterprise customer tenants, enterprise customer communications were a critical component of the Incident response.
Notification letters were sent to the designated security and compliance contacts at all 847 affected enterprise customer tenants on August 5, 2024, concurrent with the individual notifications to affected users. These enterprise customer notifications were prepared by C&H in coordination with Lumos's Customer Success team. Fiona Albrecht, Director of Customer Success at Lumos, served as the dedicated customer-facing point of contact for all enterprise customer inquiries related to the Incident.
Several significant enterprise customers were affected, including:
• Cascadia National Bancorp (900 SW Fifth Avenue, Portland, OR 97204): 312 accounts accessed out of 1,247 total Lumos accounts held by Cascadia employees. Cascadia is one of Lumos's largest enterprise customers and a major regional banking institution. C&H and Lumos conducted a dedicated briefing call with Cascadia's General Counsel and CISO on August 8, 2024, to address Cascadia's specific concerns.
• Monarch Wealth Advisors, LLC (281 Trumbull Street, Suite 1400, Hartford, CT 06103): 89 accounts accessed. Monarch's compliance team requested and received a supplemental written summary of the Incident and remediation measures on August 12, 2024.
• Ironbridge Insurance Holdings, Inc. (1601 Chestnut Street, Suite 2200, Philadelphia, PA 19103): 204 accounts accessed. Ironbridge's security team participated in a follow-up call with Jason Haddad on August 15, 2024, to discuss the enhanced security controls implemented by Lumos.
All enterprise customer communications confirmed that (a) there was no compromise of Lumos's internal systems or infrastructure; (b) the attack was limited to unauthorized access through externally sourced credentials; (c) comprehensive remediation measures had been implemented, including mandatory MFA, CAPTCHA deployment, rate-limiting, and credential screening; and (d) individual notifications and credit monitoring offers were being sent directly to all affected users.
As of the date of this memorandum, no enterprise customer has terminated its contract with Lumos or initiated legal action against Lumos in connection with the Incident. Several enterprise customers have requested security questionnaire updates and supplemental security assessments, which are being handled by Lumos's security team in the ordinary course.
Threshold Public Relations (Janelle Morse, Account Lead) prepared a customer FAQ document and a press holding statement for use in the event of media inquiries. The FAQ document was distributed to Lumos's Customer Success team to support inbound customer communications. The press holding statement was approved by C&H and Allison Cho but was not ultimately needed, as no press inquiries were received during the monitoring period.
XI. 60-Day Post-Notification Monitoring Period
Following the completion of individual and Attorney General notifications on August 5, 2024, C&H and Lumos jointly undertook a 60-day post-notification monitoring period. The full 60-day period extends through approximately October 4, 2024; however, the matter is being closed slightly ahead of the full 60-day mark given the satisfactory status across all monitoring dimensions. C&H will continue to be available should any developments arise during the remaining days of the monitoring period.
During the monitoring period, C&H monitored for the following categories of developments:
• Regulatory Inquiries, Enforcement Actions, or Requests for Additional Information: C&H monitored for any communications from state Attorneys General, the Federal Trade Commission, the ICO, or any EU Data Protection Authority requesting additional information, initiating a formal investigation, or commencing enforcement proceedings.
• Filed Litigation or Additional Pre-Litigation Demands: C&H monitored federal and state court dockets for any complaints naming Lumos in connection with the Incident, and monitored Lumos's incoming correspondence for additional pre-litigation demands beyond the Garrison & Oakley letter.
• Customer Escalations or Contractual Disputes: C&H and Lumos's legal team monitored for any enterprise customer escalations, contract termination notices, or indemnification demands related to the Incident.
• Media Inquiries or Adverse Press Coverage: C&H and Threshold Public Relations monitored media outlets and social media channels for any press inquiries or adverse coverage related to the Incident.
Results of the Monitoring Period. The monitoring period has yielded uniformly favorable results:
• No regulatory inquiries, enforcement actions, subpoenas, or requests for additional information were received from any state Attorney General, the FTC, or any European data protection authority.
• The ICO closed its review of the Incident with a no further action letter dated August 22, 2024.
• One pre-litigation demand was received (from Garrison & Oakley LLP on August 28, 2024), which was responded to on September 12, 2024, as described in Section IX.B above. No follow-up communication has been received from Garrison & Oakley as of the date of this memorandum.
• No lawsuits have been filed.
• No media inquiries were received, and no adverse press coverage was identified.
• No enterprise customers have terminated their contracts or initiated legal action against Lumos.
XII. Matter Closure and Recommendations
A. Confirmation of Matter Closure
C&H Matter No. 1008-00009 is hereby closed effective September 27, 2024. All work within the defined scope of the engagement has been completed, as summarized below:
• Forensic investigation coordinated (through Palisade Digital Forensics) and concluded, with final report delivered July 15, 2024;
• Multi-jurisdictional breach notification analysis completed and delivered July 18, 2024;
• Individual notifications to all 11,438 affected individuals sent on August 5, 2024;
• Attorney General notifications filed with 34 state AG offices between August 1–5, 2024;
• ICO notification filed on June 18, 2024, and closed with no further action on August 22, 2024;