1008-00009 · Lumos Analytics Inc · Engagement

engagement-letter-lumos-breach-response.docx DOCUMENT Data Privacy

7 / 12 ← → ✕

CALDERWOOD & HARKNESS LLP Attorneys at Law

One Embarcadero Center, Suite 3400 San Francisco, California 94111 Telephone: (415) 781-2600 Facsimile: (415) 781-2601 www.calderwoodharkness.com

June 18, 2024

VIA EMAIL AND HAND DELIVERY

Allison Cho General Counsel & Chief Privacy Officer Lumos Analytics Inc. 450 Folsom Street, Suite 1200 San Francisco, CA 94105

Re: Engagement of Calderwood & Harkness LLP — Data Security Incident Response Matter Number: 1008-00009 Credential-Stuffing Incident Affecting the Lumos Insight Platform

Dear Ms. Cho:

1. Purpose and Background

Thank you for selecting Calderwood & Harkness LLP ("C&H" or the "Firm") to serve as outside counsel to Lumos Analytics Inc. ("Lumos" or the "Company") in connection with the data security incident involving the Lumos Insight Platform (the "Incident"). We appreciate the confidence you and your team have placed in the Firm, and we are committed to providing Lumos with the highest-quality legal counsel throughout this engagement.

As you are aware, on June 15, 2024, Lumos's Security Operations Center detected a credential-stuffing attack targeting the Lumos Insight Platform. Based on preliminary information provided by your internal incident response team, threat actors utilized compromised credential pairs—believed to have been obtained from an unrelated third-party breach—to gain unauthorized access to user accounts on the Lumos Insight Platform. Your team has determined that the attack window ran from approximately June 12, 2024 through June 15, 2024, during which period the threat actors may have accessed personal information, account metadata, and other data associated with affected user accounts. At this early stage, the full scope of the data potentially accessed or exfiltrated remains under investigation.

This letter sets forth the terms and scope of the Firm's engagement in connection with the Incident and the legal services we will provide. We ask that you review this letter carefully and, if the terms are acceptable, countersign a copy in the space provided below. If you have any questions about the terms described herein, please do not hesitate to contact me directly.

2. Client Identification

The client for this engagement is Lumos Analytics Inc., a Delaware corporation headquartered in San Francisco, California. The Firm's duties of loyalty, confidentiality, and zealous advocacy run solely to Lumos Analytics Inc. as an entity.

The Firm does not represent, and will not be deemed to represent, any individual officers, directors, employees, or affiliates of Lumos in their individual or personal capacities in connection with this engagement. Without limiting the generality of the foregoing, this engagement does not establish an attorney-client relationship between the Firm and any of the Company's equity holders, board members, or affiliates, including but not limited to Ridgeline Capital Partners, LP, unless the Firm and such person or entity separately agree in writing to the creation of such a relationship, subject to applicable conflicts analysis and the informed consent of all affected parties.

Similarly, the Firm does not represent any enterprise customers, end users, data subjects, or other third parties associated with the Lumos Insight Platform. Any communications between the Firm and such parties in the course of this engagement are undertaken solely on behalf of, and at the direction of, Lumos Analytics Inc.

3. Scope of Services

The Firm's representation will encompass the following areas in connection with the credential-stuffing incident described above. The scope of this engagement may be modified or expanded from time to time upon mutual written agreement between the parties.

3.1 Incident Assessment and Coordination

The Firm will serve as lead outside counsel coordinating the overall legal response to the Incident. In this capacity, C&H will interface with Lumos's internal incident response team, including the Chief Information Security Officer (Jason Haddad), the Chief Technology Officer (Deepika Narayanan), the Vice President of Engineering (Brian Kowalski), and such other personnel as Lumos may designate from time to time. The Firm will provide legal guidance on containment strategies, evidence preservation protocols, remediation measures, and the development and execution of an incident response plan consistent with applicable legal requirements and industry best practices. The Firm will also coordinate among the various external advisors, vendors, and consultants engaged in connection with the Incident, as described further below, to ensure a cohesive and legally defensible response.

3.2 Forensic Investigation Coordination

The Firm will direct and manage the engagement of a qualified third-party digital forensics firm to conduct a comprehensive forensic investigation of the Incident. The forensic vendor will be retained at the direction of, and through, C&H for the express purpose of preserving the attorney-client privilege and work product protections with respect to the forensic investigation, its findings, and all related communications. The Firm currently anticipates retaining Palisade Digital Forensics, Inc. (Seattle, Washington) for this purpose, with Dr. Neil Frasier serving as the engagement lead. The selection of Palisade Digital Forensics, Inc. is subject to Lumos's approval and, to the extent applicable, the approval or acknowledgment of Lumos's cyber liability insurer (as discussed in Section 3.7 below).

The Firm will oversee the forensic investigation, including the development of the forensic scope of work and investigative plan; review all forensic findings, reports, and deliverables; and translate forensic conclusions into legal risk assessments for Lumos's use in connection with breach notification analysis, regulatory communications, and litigation readiness. All forensic reports and interim findings will be prepared at the direction of counsel, addressed to C&H, and marked as privileged and confidential attorney work product.

3.3 Multi-Jurisdictional Breach Notification Analysis

The Firm will conduct a comprehensive analysis of breach notification obligations applicable to the Incident under all relevant United States federal and state laws, including the breach notification statutes and regulations of all fifty states, the District of Columbia, Guam, Puerto Rico, the U.S. Virgin Islands, and any other applicable U.S. territories. The Firm will also analyze notification obligations under applicable international data protection laws, including but not limited to Regulation (EU) 2016/679 (the General Data Protection Regulation, or "EU GDPR") and the United Kingdom General Data Protection Regulation (the "UK GDPR"), together with the UK Data Protection Act 2018, to the extent the Incident involves the personal data of individuals located in the European Economic Area or the United Kingdom.

The Firm will determine whether the Incident triggers mandatory notification obligations to affected individuals, state attorneys general, other federal or state regulators, and/or non-U.S. data protection authorities. The Firm will prepare a detailed memorandum setting forth the applicable notification obligations, statutory and regulatory timelines, recommended notification content, and strategic recommendations for the sequencing and manner of notification. This memorandum will be updated as the forensic investigation yields additional information regarding the scope and nature of the data at issue.

3.4 Regulatory Communications

The Firm will draft and coordinate all filings with state attorneys general offices and other U.S. regulators as required by applicable breach notification statutes and regulations. This includes the preparation and submission of attorney general notification letters and any accompanying data submissions or certifications, as well as the filing of notifications with any other regulatory authorities (such as the U.S. Department of Health and Human Services, if health information is determined to be implicated, or the Federal Trade Commission, if applicable).

For non-U.S. regulatory notifications, the Firm will coordinate with local counsel in the relevant jurisdictions. The Firm anticipates working with Harmon Watts & Kendrick LLP ("HWK"), based in London, England, for the preparation and submission of regulatory notifications to the UK Information Commissioner's Office and any applicable EU data protection authorities. C&H will oversee and coordinate with HWK to ensure consistency in messaging, legal strategy, and timeline, though HWK's engagement will be subject to its own separate engagement terms with Lumos (as discussed in Section 9 below).

The Firm will also respond to any regulatory inquiries, information requests, or formal investigations arising from the Incident, including the drafting of responses to civil investigative demands, subpoenas, or similar compulsory process from state attorneys general or other regulatory bodies.

3.5 Individual and Customer Notifications

The Firm will draft template individual breach notification letters for distribution to affected users of the Lumos Insight Platform, tailored to comply with the specific content requirements of each applicable state or jurisdiction. The Firm will also draft any required substitute notice, media notice, or website posting language as may be mandated under applicable law.

In addition, the Firm will draft enterprise customer (B2B) notification communications for affected customer tenants of the Lumos Insight Platform. These communications will be designed to satisfy Lumos's contractual notification obligations under applicable customer agreements and data processing addenda, while being appropriately calibrated to manage legal risk and maintain customer confidence.

The Firm will coordinate with Lumos's crisis communications advisor—currently anticipated to be Threshold Public Relations LLC—on messaging strategy, public statements, and external communications relating to the Incident. The Firm will review all external-facing communications from a legal perspective to ensure consistency with legal positions and to minimize the risk of inadvertent admissions or privilege waiver.

The Firm will also advise Lumos regarding the offering of credit monitoring and identity theft protection services to affected individuals, including the selection of a credit monitoring vendor, the scope and duration of services to be offered, and the drafting of enrollment communications. The Firm will assist in evaluating whether such offerings are legally required, recommended as a matter of best practice, or advisable from a litigation risk mitigation standpoint.

3.6 Litigation Readiness and Defense

The Firm will monitor for potential litigation arising from the Incident, including putative class action lawsuits, individual claims, and demands from affected consumers, enterprise customers, or other third parties. The Firm will advise Lumos on its litigation hold obligations—including the identification, preservation, and collection of relevant data and documents—and will recommend that Lumos issue a litigation hold notice immediately, as discussed further in Section 7 below.

The Firm will respond to any pre-litigation demands, demand letters, or complaints received by Lumos in connection with the Incident. Should litigation be filed, the Firm will advise Lumos on litigation strategy, prepare for potential litigation defense, and assist in the preservation of favorable evidence and the development of applicable legal theories and defenses. The Firm's scope of services in connection with any actual litigation would be addressed separately at that time, and the parties may enter into an amendment to this engagement letter or a supplemental engagement letter as appropriate to address the defense of any specific claim or proceeding.

3.7 Insurance Coordination

The Firm will coordinate with Lumos's cyber liability insurer, NexTier Cyber Insurance Group, in connection with coverage available under Policy Number NXT-CYB-2024-07812 (the "Policy"). Based on information provided by Lumos, the Policy has the following key terms:

• Policy Period: January 1, 2024 through January 1, 2025

• Coverage Limit: $15,000,000 per occurrence / $30,000,000 aggregate

• Self-Insured Retention ("SIR"): $500,000 per claim

The Firm will assist Lumos in preparing and submitting the notice of claim to NexTier in accordance with the Policy's notice provisions. The Firm will liaise with the assigned claims adjuster regarding coverage determinations, cost approvals for legal fees and vendor expenses, and claims management protocols. The Firm will also advise Lumos on its rights and obligations under the Policy, including the applicability of coverage to the various categories of costs and expenses arising from the Incident.

The Firm notes that Calderwood & Harkness LLP is pre-approved panel counsel under the NexTier cyber liability policy, which permits Lumos to retain C&H directly without the need for separate insurer approval of the Firm. This status is expected to facilitate a streamlined relationship between C&H, Lumos, and NexTier with respect to billing, reporting, and claims administration. Notwithstanding the Firm's panel status, all of the Firm's duties of loyalty, confidentiality, and professional responsibility run to Lumos as the client, and not to NexTier or any other insurer.

4. Engagement Team

The following attorneys will be primarily responsible for this engagement:

All four timekeepers identified above are based in the Firm's San Francisco office. Rachel Bernstein will serve as the primary point of contact for Lumos and will have overall responsibility for the engagement, including the coordination of all work streams, the supervision of all work product, and direct communication with Ms. Cho and other designated Lumos personnel. Kevin Ostrowski will oversee all billing and financial aspects of the engagement, including the preparation and review of invoices, budget management, and coordination with NexTier Cyber Insurance Group regarding billing guidelines and cost submissions.

From time to time, additional attorneys, paralegals, legal assistants, or other professional staff may be assigned to work on the engagement as the scope and pace of the matter require. The Firm will provide advance notice to Lumos before staffing additional timekeepers on the matter, and will endeavor to maintain staffing efficiency and cost-effectiveness consistent with the demands of the engagement.

5. Fees and Billing

5.1 Hourly Rates

The Firm will bill for legal services rendered in connection with this engagement on an hourly basis at the Firm's standard hourly rates, which are as follows for the initial engagement team (rates current as of calendar year 2024):

• Partners: $1,050 – $1,250 per hour

• Associates: $525 – $750 per hour

• Paralegals/Legal Assistants: $275 – $375 per hour

Specific rates for each timekeeper will be set forth on each invoice. The Firm's standard hourly rates are subject to annual adjustment, typically effective as of January 1 of each year. The Firm will provide Lumos with advance written notice of any rate adjustments. The blended rate across the initial engagement team is anticipated to be competitive with market rates for comparable data security incident response work in the San Francisco Bay Area and national markets. Time will be billed in increments of one-tenth of an hour (six-minute increments).

5.2 Expenses. In addition to professional fees, Lumos will be responsible for the reimbursement of reasonable out-of-pocket expenses incurred by the Firm in connection with the engagement. Such expenses include, but are not limited to, the following: travel expenses (airfare, lodging, ground transportation, and meals); courier and express delivery charges; document production, photocopying, and printing costs; computerized legal research charges (e.g., Westmark Data Systems, Sundial Solutions); court filing fees; expert and vendor fees; long-distance telephone charges; and other similar direct costs. The Firm will not incur any single extraordinary expense in excess of $5,000 without obtaining Lumos's prior approval.

Fees and expenses of third-party vendors retained at the direction of counsel in connection with this engagement—including, without limitation, Palisade Digital Forensics, Inc.—will be billed separately by those vendors, either directly to Lumos or through the Firm, as may be coordinated with NexTier Cyber Insurance Group in accordance with the applicable claims management protocols. The Firm will provide Lumos with copies of all third-party vendor invoices submitted through the Firm.

5.3 Invoicing. The Firm will submit monthly invoices for professional fees and disbursements incurred during the preceding calendar month. Invoices will contain reasonable detail regarding the services rendered, including date, timekeeper, hours, and a description of the work performed, in a format consistent with applicable insurance billing guidelines. All invoices are due and payable within thirty (30) days of the invoice date.

To the extent that NexTier Cyber Insurance Group reimburses legal costs under the applicable Policy, the Firm will cooperate with Lumos and NexTier to facilitate direct payment or reimbursement, as applicable, subject to the $500,000 per-claim self-insured retention. Until the SIR has been exhausted, Lumos will be directly responsible for payment of all invoices. The Firm will work with Lumos and NexTier to coordinate billing and payment logistics, including compliance with any insurer billing guidelines or requirements for pre-approval of certain categories of work.

5.4 Fee Estimates

Given the evolving and inherently unpredictable nature of incident response matters, the Firm is unable to provide a fixed fee or binding cost estimate at this time. The total cost of the engagement will depend on a number of factors that are not yet fully known, including the scope of the data compromise as determined by the forensic investigation, the number of jurisdictions in which notification is required, the volume of regulatory inquiries and potential litigation, and other developments that may arise during the course of the engagement.

The Firm will endeavor to provide periodic budget updates and will promptly advise Lumos if costs are expected to materially exceed prior estimates or budgetary expectations. The Firm is committed to staffing and managing this engagement efficiently and will discuss any budgetary concerns with Lumos proactively and in good faith.

6. Attorney-Client Privilege and Confidentiality

All communications between C&H and Lumos, and all work product prepared by C&H in connection with this engagement, are intended to be protected by the attorney-client privilege, the work product doctrine, and/or other applicable legal protections. These protections are critical to ensuring that Lumos receives candid and comprehensive legal advice and that the Firm's work product is shielded from discovery in the event of litigation or regulatory proceedings.

Lumos should take care to maintain the confidentiality of all privileged communications and should not disclose them to third parties without prior consultation with the Firm. Inadvertent or unnecessary disclosure of privileged materials to third parties may result in a waiver of the privilege, which could have significant adverse consequences in the event of litigation or regulatory investigation.

The retention of forensic investigators, consultants, and other vendors at the direction of counsel is specifically intended to bring those consultants' work within the scope of the attorney-client privilege and work product protection. Accordingly, all communications with, and reports and deliverables from, Palisade Digital Forensics, Inc. (and any other consultant retained at the Firm's direction) should be directed through or addressed to C&H, prominently marked as "PRIVILEGED AND CONFIDENTIAL — ATTORNEY WORK PRODUCT — PREPARED AT THE DIRECTION OF COUNSEL," and not disseminated beyond the core incident response team without C&H's prior guidance and approval.

Lumos should further ensure that internal communications regarding the Incident—including emails, instant messages, Meridian Solutions or Teams messages, and other digital communications—are appropriately marked and distributed only to those individuals with a need to know. The Firm recommends that Lumos establish a defined "core incident response team" for purposes of privileged communications regarding the Incident, and that all communications among that team be marked as privileged.

7. Document Preservation and Litigation Hold

The Firm strongly recommends that Lumos immediately issue an internal litigation hold directive to all relevant personnel and departments within the Company. The issuance of a timely and comprehensive litigation hold is essential to Lumos's compliance with its legal obligation to preserve potentially relevant evidence in anticipation of litigation, regulatory investigation, or other proceedings that may arise from the Incident.

The litigation hold should cover all documents, data, records, logs, communications (including emails, instant messages, chat logs, and other electronic communications), forensic images, system logs, access logs, authentication records, incident response notes, network traffic captures, and any other information or materials related to:

(a) the credential-stuffing incident and its detection, investigation, and remediation;

(b) the Lumos Insight Platform, including user account data, access controls, authentication mechanisms, and security configurations;

(c) user account access during and surrounding the attack window of approximately June 12, 2024 through June 15, 2024; and

(d) any prior security assessments, vulnerability scans, penetration tests, or risk assessments relating to the Lumos Insight Platform or its authentication infrastructure.

The litigation hold should apply to all relevant custodians, including members of the incident response team, the information security and engineering teams, customer support personnel, and any executives or employees who have knowledge of or involvement in the Incident or the Lumos Insight Platform's security posture.

The Firm will assist in preparing or reviewing a litigation hold notice as needed. This letter confirms C&H's understanding that Lumos intends to issue such a hold effective today, June 18, 2024, and that Lumos will take all reasonable steps to ensure compliance with the hold across the organization.

8. Conflicts of Interest

Based on a comprehensive conflicts check conducted by the Firm's conflicts department prior to the commencement of this engagement, the Firm has not identified any conflicts of interest that would preclude the Firm from representing Lumos Analytics Inc. in connection with this matter. The conflicts check encompassed the Company, its current officers and directors, its known principal equity holders (including Ridgeline Capital Partners, LP), and other relevant parties identified by Lumos in the course of the conflicts clearance process.

In the event that a conflict of interest arises during the course of the engagement, the Firm will promptly notify Lumos and discuss appropriate measures to address the conflict. Such measures may include obtaining the informed written consent of all affected parties, implementing appropriate screening or ethical wall procedures within the Firm, or, if the conflict cannot be resolved, withdrawal from the representation in accordance with applicable professional responsibility rules.

Lumos acknowledges that C&H is a large, multi-office law firm that represents and may in the future represent other clients in matters unrelated to this engagement. Such representations do not constitute a conflict of interest, and Lumos agrees that the Firm's representation of Lumos in this matter does not preclude the Firm from representing other clients in matters that are not substantially related to this engagement, provided that such representations do not involve the assertion of a position adverse to Lumos in connection with this matter.

9. Scope Limitations

This engagement is limited to the matters described in Section 3 above. The Firm is not being retained to provide general corporate, transactional, tax, employment, intellectual property, or regulatory advice outside the scope of the Incident response, nor to represent Lumos in any other matter or proceeding not arising from the Incident.

If Lumos desires the Firm's assistance with matters outside the scope of this engagement—including, without limitation, general data privacy compliance, product counseling, or corporate transactions—the parties will enter into a separate engagement letter or written amendment to this engagement letter setting forth the terms and scope of such additional representation.

As noted in Section 3.4 above, UK and EU regulatory notifications will be handled by Harmon Watts & Kendrick LLP as coordinating local counsel in those jurisdictions. C&H will oversee and coordinate with HWK to ensure consistency in strategy and messaging, but HWK's engagement will be subject to its own separate engagement terms with Lumos, including with respect to fees, billing, conflicts, and professional responsibility obligations. C&H does not assume responsibility for HWK's legal advice or services, and HWK's fees and expenses are not included in C&H's invoices unless otherwise agreed.

10. Termination

Either party may terminate this engagement at any time upon written notice to the other party. In the event of termination, Lumos will remain responsible for payment of all professional fees and expenses incurred by the Firm through the date of termination, as well as any outstanding invoices for fees and expenses incurred prior to that date. The Firm's obligation to continue providing services will cease upon the effective date of termination, subject to any duties imposed by applicable professional responsibility rules, including the Firm's obligation to take reasonable steps to protect the client's interests upon withdrawal (such as providing reasonable notice and allowing time for the engagement of successor counsel).

Upon termination or completion of the engagement, the Firm will cooperate with Lumos in the orderly transition of the matter, including the transfer of files, work product, and other materials to Lumos or its designated successor counsel. The Firm will retain copies of engagement files in accordance with its document retention policies, as described in Section 11 below.

The Firm's obligations regarding attorney-client privilege, confidentiality, and the protection of Lumos's proprietary information will survive termination of the engagement and will continue in full force and effect indefinitely.

11. Document Retention

Following the closure of this engagement, the Firm will retain engagement files—including correspondence, memoranda, pleadings, research, and other materials generated or maintained in connection with the representation—in accordance with the Firm's standard document retention policy. Under the Firm's current policy, engagement files are retained for a minimum of ten (10) years from the date of matter closure, unless a longer retention period is required by applicable law, regulation, or professional responsibility rule.

Lumos may request copies of its files at any time during or after the engagement. Following the expiration of the applicable retention period, the Firm reserves the right to destroy engagement files in accordance with its policies, without further notice to Lumos.

12. Governing Law and Dispute Resolution

This engagement letter and the terms and conditions set forth herein will be governed by and construed in accordance with the laws of the State of California, without regard to its conflict-of-laws principles.

Any disputes arising out of or relating to this engagement, including disputes regarding fees, the scope of representation, or the Firm's professional obligations, will be resolved through binding arbitration in San Francisco, California, in accordance with the rules of a nationally recognized arbitration organization (such as JAMS or the American Arbitration Association), unless the parties mutually agree in writing to an alternative dispute resolution mechanism. The decision of the arbitrator(s) will be final and binding on the parties, and judgment on the arbitration award may be entered in any court of competent jurisdiction.

13. Acceptance and Execution

We respectfully request that you confirm Lumos Analytics Inc.'s agreement to the terms set forth in this letter by signing and returning a copy of this letter to the undersigned. This letter, together with any amendments agreed to in writing by both parties, constitutes the entire agreement between Calderwood & Harkness LLP and Lumos Analytics Inc. with respect to the Firm's engagement in connection with the Incident, and supersedes all prior or contemporaneous oral or written understandings or agreements relating to the subject matter hereof.

Given the time-sensitive nature of data security incident response, the parties acknowledge that the Firm may commence work on this engagement immediately upon execution of this letter. The parties further acknowledge that, due to the urgency of the situation, certain preliminary work may be undertaken by the Firm prior to receipt of a signed copy of this letter, and that such work shall be deemed to have been performed under the terms and conditions set forth herein.

We look forward to working with you and the Lumos team during this critical period. Please do not hesitate to contact me at (415) 781-2610 or rbernstein@calderwoodharkness.com if you have any questions or wish to discuss any aspect of this engagement.

Sincerely,

CALDERWOOD & HARKNESS LLP

By: ________

Rachel Bernstein Partner, Privacy & Data Security Calderwood & Harkness LLP One Embarcadero Center, Suite 3400 San Francisco, CA 94111 Telephone: (415) 781-2610

Email: rbernstein@calderwoodharkness.com

ACKNOWLEDGED AND AGREED:

LUMOS ANALYTICS INC.

By: ________

Name: Allison Cho

Title: General Counsel & Chief Privacy Officer

Lumos Analytics Inc. 450 Folsom Street, Suite 1200 San Francisco, CA 94105

Date: ________

cc: Rachel Bernstein, Kevin Ostrowski, Sara Hendricks, Priscilla Wynn (C&H engagement team file)

Enclosures: None

For the avoidance of doubt, the Client, Lumos Analytics Inc., is a portfolio company of Pinnacle Venture Fund II LP, and certain consents and reporting obligations to the sponsor may apply in connection with this matter.

Attorney	Role	Title
Rachel Bernstein	Responsible Partner	Partner, Privacy & Data Security
Kevin Ostrowski	Billing Partner	Partner, Privacy & Data Security
Sara Hendricks	Lead Associate	Associate, Privacy & Data Security
Priscilla Wynn	Working Associate	Associate, Privacy & Data Security

CALDERWOOD & HARKNESS LLP Attorneys at Law
One Embarcadero Center, Suite 3400 San Francisco, California 94111 Telephone: (415) 781-2600 Facsimile: (415) 781-2601 www.calderwoodharkness.com
June 18, 2024
VIA EMAIL AND HAND DELIVERY
Allison Cho General Counsel & Chief Privacy Officer Lumos Analytics Inc. 450 Folsom Street, Suite 1200 San Francisco, CA 94105
Re: Engagement of Calderwood & Harkness LLP — Data Security Incident Response Matter Number: 1008-00009 Credential-Stuffing Incident Affecting the Lumos Insight Platform
Dear Ms. Cho:
1. Purpose and Background
Thank you for selecting Calderwood & Harkness LLP ("C&H" or the "Firm") to serve as outside counsel to Lumos Analytics Inc. ("Lumos" or the "Company") in connection with the data security incident involving the Lumos Insight Platform (the "Incident"). We appreciate the confidence you and your team have placed in the Firm, and we are committed to providing Lumos with the highest-quality legal counsel throughout this engagement.
As you are aware, on June 15, 2024, Lumos's Security Operations Center detected a credential-stuffing attack targeting the Lumos Insight Platform. Based on preliminary information provided by your internal incident response team, threat actors utilized compromised credential pairs—believed to have been obtained from an unrelated third-party breach—to gain unauthorized access to user accounts on the Lumos Insight Platform. Your team has determined that the attack window ran from approximately June 12, 2024 through June 15, 2024, during which period the threat actors may have accessed personal information, account metadata, and other data associated with affected user accounts. At this early stage, the full scope of the data potentially accessed or exfiltrated remains under investigation.
This letter sets forth the terms and scope of the Firm's engagement in connection with the Incident and the legal services we will provide. We ask that you review this letter carefully and, if the terms are acceptable, countersign a copy in the space provided below. If you have any questions about the terms described herein, please do not hesitate to contact me directly.
2. Client Identification
The client for this engagement is Lumos Analytics Inc., a Delaware corporation headquartered in San Francisco, California. The Firm's duties of loyalty, confidentiality, and zealous advocacy run solely to Lumos Analytics Inc. as an entity.
The Firm does not represent, and will not be deemed to represent, any individual officers, directors, employees, or affiliates of Lumos in their individual or personal capacities in connection with this engagement. Without limiting the generality of the foregoing, this engagement does not establish an attorney-client relationship between the Firm and any of the Company's equity holders, board members, or affiliates, including but not limited to Ridgeline Capital Partners, LP, unless the Firm and such person or entity separately agree in writing to the creation of such a relationship, subject to applicable conflicts analysis and the informed consent of all affected parties.
Similarly, the Firm does not represent any enterprise customers, end users, data subjects, or other third parties associated with the Lumos Insight Platform. Any communications between the Firm and such parties in the course of this engagement are undertaken solely on behalf of, and at the direction of, Lumos Analytics Inc.
3. Scope of Services
The Firm's representation will encompass the following areas in connection with the credential-stuffing incident described above. The scope of this engagement may be modified or expanded from time to time upon mutual written agreement between the parties.
3.1 Incident Assessment and Coordination
The Firm will serve as lead outside counsel coordinating the overall legal response to the Incident. In this capacity, C&H will interface with Lumos's internal incident response team, including the Chief Information Security Officer (Jason Haddad), the Chief Technology Officer (Deepika Narayanan), the Vice President of Engineering (Brian Kowalski), and such other personnel as Lumos may designate from time to time. The Firm will provide legal guidance on containment strategies, evidence preservation protocols, remediation measures, and the development and execution of an incident response plan consistent with applicable legal requirements and industry best practices. The Firm will also coordinate among the various external advisors, vendors, and consultants engaged in connection with the Incident, as described further below, to ensure a cohesive and legally defensible response.
3.2 Forensic Investigation Coordination
The Firm will direct and manage the engagement of a qualified third-party digital forensics firm to conduct a comprehensive forensic investigation of the Incident. The forensic vendor will be retained at the direction of, and through, C&H for the express purpose of preserving the attorney-client privilege and work product protections with respect to the forensic investigation, its findings, and all related communications. The Firm currently anticipates retaining Palisade Digital Forensics, Inc. (Seattle, Washington) for this purpose, with Dr. Neil Frasier serving as the engagement lead. The selection of Palisade Digital Forensics, Inc. is subject to Lumos's approval and, to the extent applicable, the approval or acknowledgment of Lumos's cyber liability insurer (as discussed in Section 3.7 below).
The Firm will oversee the forensic investigation, including the development of the forensic scope of work and investigative plan; review all forensic findings, reports, and deliverables; and translate forensic conclusions into legal risk assessments for Lumos's use in connection with breach notification analysis, regulatory communications, and litigation readiness. All forensic reports and interim findings will be prepared at the direction of counsel, addressed to C&H, and marked as privileged and confidential attorney work product.
3.3 Multi-Jurisdictional Breach Notification Analysis
The Firm will conduct a comprehensive analysis of breach notification obligations applicable to the Incident under all relevant United States federal and state laws, including the breach notification statutes and regulations of all fifty states, the District of Columbia, Guam, Puerto Rico, the U.S. Virgin Islands, and any other applicable U.S. territories. The Firm will also analyze notification obligations under applicable international data protection laws, including but not limited to Regulation (EU) 2016/679 (the General Data Protection Regulation, or "EU GDPR") and the United Kingdom General Data Protection Regulation (the "UK GDPR"), together with the UK Data Protection Act 2018, to the extent the Incident involves the personal data of individuals located in the European Economic Area or the United Kingdom.
The Firm will determine whether the Incident triggers mandatory notification obligations to affected individuals, state attorneys general, other federal or state regulators, and/or non-U.S. data protection authorities. The Firm will prepare a detailed memorandum setting forth the applicable notification obligations, statutory and regulatory timelines, recommended notification content, and strategic recommendations for the sequencing and manner of notification. This memorandum will be updated as the forensic investigation yields additional information regarding the scope and nature of the data at issue.
3.4 Regulatory Communications
The Firm will draft and coordinate all filings with state attorneys general offices and other U.S. regulators as required by applicable breach notification statutes and regulations. This includes the preparation and submission of attorney general notification letters and any accompanying data submissions or certifications, as well as the filing of notifications with any other regulatory authorities (such as the U.S. Department of Health and Human Services, if health information is determined to be implicated, or the Federal Trade Commission, if applicable).
For non-U.S. regulatory notifications, the Firm will coordinate with local counsel in the relevant jurisdictions. The Firm anticipates working with Harmon Watts & Kendrick LLP ("HWK"), based in London, England, for the preparation and submission of regulatory notifications to the UK Information Commissioner's Office and any applicable EU data protection authorities. C&H will oversee and coordinate with HWK to ensure consistency in messaging, legal strategy, and timeline, though HWK's engagement will be subject to its own separate engagement terms with Lumos (as discussed in Section 9 below).
The Firm will also respond to any regulatory inquiries, information requests, or formal investigations arising from the Incident, including the drafting of responses to civil investigative demands, subpoenas, or similar compulsory process from state attorneys general or other regulatory bodies.
3.5 Individual and Customer Notifications
The Firm will draft template individual breach notification letters for distribution to affected users of the Lumos Insight Platform, tailored to comply with the specific content requirements of each applicable state or jurisdiction. The Firm will also draft any required substitute notice, media notice, or website posting language as may be mandated under applicable law.
In addition, the Firm will draft enterprise customer (B2B) notification communications for affected customer tenants of the Lumos Insight Platform. These communications will be designed to satisfy Lumos's contractual notification obligations under applicable customer agreements and data processing addenda, while being appropriately calibrated to manage legal risk and maintain customer confidence.
The Firm will coordinate with Lumos's crisis communications advisor—currently anticipated to be Threshold Public Relations LLC—on messaging strategy, public statements, and external communications relating to the Incident. The Firm will review all external-facing communications from a legal perspective to ensure consistency with legal positions and to minimize the risk of inadvertent admissions or privilege waiver.
The Firm will also advise Lumos regarding the offering of credit monitoring and identity theft protection services to affected individuals, including the selection of a credit monitoring vendor, the scope and duration of services to be offered, and the drafting of enrollment communications. The Firm will assist in evaluating whether such offerings are legally required, recommended as a matter of best practice, or advisable from a litigation risk mitigation standpoint.
3.6 Litigation Readiness and Defense
The Firm will monitor for potential litigation arising from the Incident, including putative class action lawsuits, individual claims, and demands from affected consumers, enterprise customers, or other third parties. The Firm will advise Lumos on its litigation hold obligations—including the identification, preservation, and collection of relevant data and documents—and will recommend that Lumos issue a litigation hold notice immediately, as discussed further in Section 7 below.
The Firm will respond to any pre-litigation demands, demand letters, or complaints received by Lumos in connection with the Incident. Should litigation be filed, the Firm will advise Lumos on litigation strategy, prepare for potential litigation defense, and assist in the preservation of favorable evidence and the development of applicable legal theories and defenses. The Firm's scope of services in connection with any actual litigation would be addressed separately at that time, and the parties may enter into an amendment to this engagement letter or a supplemental engagement letter as appropriate to address the defense of any specific claim or proceeding.
3.7 Insurance Coordination
The Firm will coordinate with Lumos's cyber liability insurer, NexTier Cyber Insurance Group, in connection with coverage available under Policy Number NXT-CYB-2024-07812 (the "Policy"). Based on information provided by Lumos, the Policy has the following key terms:
•  Policy Period: January 1, 2024 through January 1, 2025
•  Coverage Limit: $15,000,000 per occurrence / $30,000,000 aggregate
•  Self-Insured Retention ("SIR"): $500,000 per claim
The Firm will assist Lumos in preparing and submitting the notice of claim to NexTier in accordance with the Policy's notice provisions. The Firm will liaise with the assigned claims adjuster regarding coverage determinations, cost approvals for legal fees and vendor expenses, and claims management protocols. The Firm will also advise Lumos on its rights and obligations under the Policy, including the applicability of coverage to the various categories of costs and expenses arising from the Incident.
The Firm notes that Calderwood & Harkness LLP is pre-approved panel counsel under the NexTier cyber liability policy, which permits Lumos to retain C&H directly without the need for separate insurer approval of the Firm. This status is expected to facilitate a streamlined relationship between C&H, Lumos, and NexTier with respect to billing, reporting, and claims administration. Notwithstanding the Firm's panel status, all of the Firm's duties of loyalty, confidentiality, and professional responsibility run to Lumos as the client, and not to NexTier or any other insurer.
4. Engagement Team
The following attorneys will be primarily responsible for this engagement:
All four timekeepers identified above are based in the Firm's San Francisco office. Rachel Bernstein will serve as the primary point of contact for Lumos and will have overall responsibility for the engagement, including the coordination of all work streams, the supervision of all work product, and direct communication with Ms. Cho and other designated Lumos personnel. Kevin Ostrowski will oversee all billing and financial aspects of the engagement, including the preparation and review of invoices, budget management, and coordination with NexTier Cyber Insurance Group regarding billing guidelines and cost submissions.
From time to time, additional attorneys, paralegals, legal assistants, or other professional staff may be assigned to work on the engagement as the scope and pace of the matter require. The Firm will provide advance notice to Lumos before staffing additional timekeepers on the matter, and will endeavor to maintain staffing efficiency and cost-effectiveness consistent with the demands of the engagement.
5. Fees and Billing
5.1 Hourly Rates
The Firm will bill for legal services rendered in connection with this engagement on an hourly basis at the Firm's standard hourly rates, which are as follows for the initial engagement team (rates current as of calendar year 2024):
•  Partners: $1,050 – $1,250 per hour
•  Associates: $525 – $750 per hour
•  Paralegals/Legal Assistants: $275 – $375 per hour
Specific rates for each timekeeper will be set forth on each invoice. The Firm's standard hourly rates are subject to annual adjustment, typically effective as of January 1 of each year. The Firm will provide Lumos with advance written notice of any rate adjustments. The blended rate across the initial engagement team is anticipated to be competitive with market rates for comparable data security incident response work in the San Francisco Bay Area and national markets. Time will be billed in increments of one-tenth of an hour (six-minute increments).
5.2 Expenses.  In addition to professional fees, Lumos will be responsible for the reimbursement of reasonable out-of-pocket expenses incurred by the Firm in connection with the engagement. Such expenses include, but are not limited to, the following: travel expenses (airfare, lodging, ground transportation, and meals); courier and express delivery charges; document production, photocopying, and printing costs; computerized legal research charges (e.g., Westmark Data Systems, Sundial Solutions); court filing fees; expert and vendor fees; long-distance telephone charges; and other similar direct costs. The Firm will not incur any single extraordinary expense in excess of $5,000 without obtaining Lumos's prior approval.
Fees and expenses of third-party vendors retained at the direction of counsel in connection with this engagement—including, without limitation, Palisade Digital Forensics, Inc.—will be billed separately by those vendors, either directly to Lumos or through the Firm, as may be coordinated with NexTier Cyber Insurance Group in accordance with the applicable claims management protocols. The Firm will provide Lumos with copies of all third-party vendor invoices submitted through the Firm.
5.3 Invoicing.  The Firm will submit monthly invoices for professional fees and disbursements incurred during the preceding calendar month. Invoices will contain reasonable detail regarding the services rendered, including date, timekeeper, hours, and a description of the work performed, in a format consistent with applicable insurance billing guidelines. All invoices are due and payable within thirty (30) days of the invoice date.
To the extent that NexTier Cyber Insurance Group reimburses legal costs under the applicable Policy, the Firm will cooperate with Lumos and NexTier to facilitate direct payment or reimbursement, as applicable, subject to the $500,000 per-claim self-insured retention. Until the SIR has been exhausted, Lumos will be directly responsible for payment of all invoices. The Firm will work with Lumos and NexTier to coordinate billing and payment logistics, including compliance with any insurer billing guidelines or requirements for pre-approval of certain categories of work.
5.4 Fee Estimates
Given the evolving and inherently unpredictable nature of incident response matters, the Firm is unable to provide a fixed fee or binding cost estimate at this time. The total cost of the engagement will depend on a number of factors that are not yet fully known, including the scope of the data compromise as determined by the forensic investigation, the number of jurisdictions in which notification is required, the volume of regulatory inquiries and potential litigation, and other developments that may arise during the course of the engagement.
The Firm will endeavor to provide periodic budget updates and will promptly advise Lumos if costs are expected to materially exceed prior estimates or budgetary expectations. The Firm is committed to staffing and managing this engagement efficiently and will discuss any budgetary concerns with Lumos proactively and in good faith.
6. Attorney-Client Privilege and Confidentiality
All communications between C&H and Lumos, and all work product prepared by C&H in connection with this engagement, are intended to be protected by the attorney-client privilege, the work product doctrine, and/or other applicable legal protections. These protections are critical to ensuring that Lumos receives candid and comprehensive legal advice and that the Firm's work product is shielded from discovery in the event of litigation or regulatory proceedings.
Lumos should take care to maintain the confidentiality of all privileged communications and should not disclose them to third parties without prior consultation with the Firm. Inadvertent or unnecessary disclosure of privileged materials to third parties may result in a waiver of the privilege, which could have significant adverse consequences in the event of litigation or regulatory investigation.
The retention of forensic investigators, consultants, and other vendors at the direction of counsel is specifically intended to bring those consultants' work within the scope of the attorney-client privilege and work product protection. Accordingly, all communications with, and reports and deliverables from, Palisade Digital Forensics, Inc. (and any other consultant retained at the Firm's direction) should be directed through or addressed to C&H, prominently marked as "PRIVILEGED AND CONFIDENTIAL — ATTORNEY WORK PRODUCT — PREPARED AT THE DIRECTION OF COUNSEL," and not disseminated beyond the core incident response team without C&H's prior guidance and approval.
Lumos should further ensure that internal communications regarding the Incident—including emails, instant messages, Meridian Solutions or Teams messages, and other digital communications—are appropriately marked and distributed only to those individuals with a need to know. The Firm recommends that Lumos establish a defined "core incident response team" for purposes of privileged communications regarding the Incident, and that all communications among that team be marked as privileged.
7. Document Preservation and Litigation Hold
The Firm strongly recommends that Lumos immediately issue an internal litigation hold directive to all relevant personnel and departments within the Company. The issuance of a timely and comprehensive litigation hold is essential to Lumos's compliance with its legal obligation to preserve potentially relevant evidence in anticipation of litigation, regulatory investigation, or other proceedings that may arise from the Incident.
The litigation hold should cover all documents, data, records, logs, communications (including emails, instant messages, chat logs, and other electronic communications), forensic images, system logs, access logs, authentication records, incident response notes, network traffic captures, and any other information or materials related to:
(a) the credential-stuffing incident and its detection, investigation, and remediation;
(b) the Lumos Insight Platform, including user account data, access controls, authentication mechanisms, and security configurations;
(c) user account access during and surrounding the attack window of approximately June 12, 2024 through June 15, 2024; and
(d) any prior security assessments, vulnerability scans, penetration tests, or risk assessments relating to the Lumos Insight Platform or its authentication infrastructure.
The litigation hold should apply to all relevant custodians, including members of the incident response team, the information security and engineering teams, customer support personnel, and any executives or employees who have knowledge of or involvement in the Incident or the Lumos Insight Platform's security posture.
The Firm will assist in preparing or reviewing a litigation hold notice as needed. This letter confirms C&H's understanding that Lumos intends to issue such a hold effective today, June 18, 2024, and that Lumos will take all reasonable steps to ensure compliance with the hold across the organization.
8. Conflicts of Interest
Based on a comprehensive conflicts check conducted by the Firm's conflicts department prior to the commencement of this engagement, the Firm has not identified any conflicts of interest that would preclude the Firm from representing Lumos Analytics Inc. in connection with this matter. The conflicts check encompassed the Company, its current officers and directors, its known principal equity holders (including Ridgeline Capital Partners, LP), and other relevant parties identified by Lumos in the course of the conflicts clearance process.
In the event that a conflict of interest arises during the course of the engagement, the Firm will promptly notify Lumos and discuss appropriate measures to address the conflict. Such measures may include obtaining the informed written consent of all affected parties, implementing appropriate screening or ethical wall procedures within the Firm, or, if the conflict cannot be resolved, withdrawal from the representation in accordance with applicable professional responsibility rules.
Lumos acknowledges that C&H is a large, multi-office law firm that represents and may in the future represent other clients in matters unrelated to this engagement. Such representations do not constitute a conflict of interest, and Lumos agrees that the Firm's representation of Lumos in this matter does not preclude the Firm from representing other clients in matters that are not substantially related to this engagement, provided that such representations do not involve the assertion of a position adverse to Lumos in connection with this matter.
9. Scope Limitations
This engagement is limited to the matters described in Section 3 above. The Firm is not being retained to provide general corporate, transactional, tax, employment, intellectual property, or regulatory advice outside the scope of the Incident response, nor to represent Lumos in any other matter or proceeding not arising from the Incident.
If Lumos desires the Firm's assistance with matters outside the scope of this engagement—including, without limitation, general data privacy compliance, product counseling, or corporate transactions—the parties will enter into a separate engagement letter or written amendment to this engagement letter setting forth the terms and scope of such additional representation.
As noted in Section 3.4 above, UK and EU regulatory notifications will be handled by Harmon Watts & Kendrick LLP as coordinating local counsel in those jurisdictions. C&H will oversee and coordinate with HWK to ensure consistency in strategy and messaging, but HWK's engagement will be subject to its own separate engagement terms with Lumos, including with respect to fees, billing, conflicts, and professional responsibility obligations. C&H does not assume responsibility for HWK's legal advice or services, and HWK's fees and expenses are not included in C&H's invoices unless otherwise agreed.
10. Termination
Either party may terminate this engagement at any time upon written notice to the other party. In the event of termination, Lumos will remain responsible for payment of all professional fees and expenses incurred by the Firm through the date of termination, as well as any outstanding invoices for fees and expenses incurred prior to that date. The Firm's obligation to continue providing services will cease upon the effective date of termination, subject to any duties imposed by applicable professional responsibility rules, including the Firm's obligation to take reasonable steps to protect the client's interests upon withdrawal (such as providing reasonable notice and allowing time for the engagement of successor counsel).
Upon termination or completion of the engagement, the Firm will cooperate with Lumos in the orderly transition of the matter, including the transfer of files, work product, and other materials to Lumos or its designated successor counsel. The Firm will retain copies of engagement files in accordance with its document retention policies, as described in Section 11 below.
The Firm's obligations regarding attorney-client privilege, confidentiality, and the protection of Lumos's proprietary information will survive termination of the engagement and will continue in full force and effect indefinitely.
11. Document Retention
Following the closure of this engagement, the Firm will retain engagement files—including correspondence, memoranda, pleadings, research, and other materials generated or maintained in connection with the representation—in accordance with the Firm's standard document retention policy. Under the Firm's current policy, engagement files are retained for a minimum of ten (10) years from the date of matter closure, unless a longer retention period is required by applicable law, regulation, or professional responsibility rule.
Lumos may request copies of its files at any time during or after the engagement. Following the expiration of the applicable retention period, the Firm reserves the right to destroy engagement files in accordance with its policies, without further notice to Lumos.
12. Governing Law and Dispute Resolution
This engagement letter and the terms and conditions set forth herein will be governed by and construed in accordance with the laws of the State of California, without regard to its conflict-of-laws principles.
Any disputes arising out of or relating to this engagement, including disputes regarding fees, the scope of representation, or the Firm's professional obligations, will be resolved through binding arbitration in San Francisco, California, in accordance with the rules of a nationally recognized arbitration organization (such as JAMS or the American Arbitration Association), unless the parties mutually agree in writing to an alternative dispute resolution mechanism. The decision of the arbitrator(s) will be final and binding on the parties, and judgment on the arbitration award may be entered in any court of competent jurisdiction.
13. Acceptance and Execution
We respectfully request that you confirm Lumos Analytics Inc.'s agreement to the terms set forth in this letter by signing and returning a copy of this letter to the undersigned. This letter, together with any amendments agreed to in writing by both parties, constitutes the entire agreement between Calderwood & Harkness LLP and Lumos Analytics Inc. with respect to the Firm's engagement in connection with the Incident, and supersedes all prior or contemporaneous oral or written understandings or agreements relating to the subject matter hereof.
Given the time-sensitive nature of data security incident response, the parties acknowledge that the Firm may commence work on this engagement immediately upon execution of this letter. The parties further acknowledge that, due to the urgency of the situation, certain preliminary work may be undertaken by the Firm prior to receipt of a signed copy of this letter, and that such work shall be deemed to have been performed under the terms and conditions set forth herein.
We look forward to working with you and the Lumos team during this critical period. Please do not hesitate to contact me at (415) 781-2610 or rbernstein@calderwoodharkness.com if you have any questions or wish to discuss any aspect of this engagement.
Sincerely,
CALDERWOOD & HARKNESS LLP
By: ________
Rachel Bernstein Partner, Privacy & Data Security Calderwood & Harkness LLP One Embarcadero Center, Suite 3400 San Francisco, CA 94111 Telephone: (415) 781-2610
Email: rbernstein@calderwoodharkness.com
ACKNOWLEDGED AND AGREED:
LUMOS ANALYTICS INC.
By: ________
Name: Allison Cho
Title: General Counsel & Chief Privacy Officer
Lumos Analytics Inc. 450 Folsom Street, Suite 1200 San Francisco, CA 94105
Date: ________
cc: Rachel Bernstein, Kevin Ostrowski, Sara Hendricks, Priscilla Wynn (C&H engagement team file)
Enclosures: None
For the avoidance of doubt, the Client, Lumos Analytics Inc., is a portfolio company of Pinnacle Venture Fund II LP, and certain consents and reporting obligations to the sponsor may apply in connection with this matter.
Attorney | Role | Title
Rachel Bernstein | Responsible Partner | Partner, Privacy & Data Security
Kevin Ostrowski | Billing Partner | Partner, Privacy & Data Security
Sara Hendricks | Lead Associate | Associate, Privacy & Data Security
Priscilla Wynn | Working Associate | Associate, Privacy & Data Security

CALDERWOOD & HARKNESS LLP Attorneys at Law

VIA EMAIL AND HAND DELIVERY

CALDERWOOD & HARKNESS LLP

ACKNOWLEDGED AND AGREED:

LUMOS ANALYTICS INC.

Record

Parties

Dates

Amounts