1008-00009 · Lumos Analytics Inc · Engagement

privilege-protocol-forensic-retention-memo.docx DOCUMENT Data Privacy

8 / 12 ← → ✕

PRIVILEGED AND CONFIDENTIAL ATTORNEY-CLIENT PRIVILEGE / ATTORNEY WORK PRODUCT

DO NOT DISTRIBUTE WITHOUT PRIOR AUTHORIZATION OF CALDERWOOD & HARKNESS LLP

MEMORANDUM

I. Purpose and Background

This memorandum establishes the privilege protocol and communication framework governing the retention and direction of a third-party digital forensics firm in connection with the credential-stuffing incident detected on June 15, 2024, affecting the Lumos Insight Platform (the "Incident"). The protocols set forth herein are designed to ensure the integrity of the attorney-client privilege and work product protections that attach to the forensic investigation and all related communications, findings, reports, and analyses. Strict adherence to this protocol by all parties is essential.

Calderwood & Harkness LLP ("C&H") was engaged by Lumos Analytics Inc. ("Lumos" or the "Company") on June 18, 2024, as lead outside counsel for incident response, breach notification analysis, regulatory engagement, and litigation readiness in connection with the Incident. The terms of C&H's engagement are set forth in the engagement letter executed on June 18, 2024, addressed to Allison Cho, General Counsel & Chief Privacy Officer, Lumos Analytics Inc., at 450 Folsom Street, Suite 1200, San Francisco, CA 94105.

The primary purpose of this memorandum is to ensure that the forensic investigation being conducted in connection with the Incident is structured and managed in a manner that preserves the attorney-client privilege and work product protections applicable to the investigation findings, analysis, and related communications. The legal landscape surrounding data security incidents has made clear that the manner in which a forensic investigation is initiated, directed, and documented can be dispositive of whether the resulting work product is shielded from compelled disclosure in subsequent regulatory proceedings or private litigation. See, e.g., In re consumer Data Sec. Breach Litig., 2020 WL 3470261 (E.D. Va. June 25, 2020) (finding forensic report not privileged where vendor had been engaged prior to counsel's involvement and performed work substantially similar to pre-existing contractual obligations); cf. In re Dominion Dental Servs. USA, Inc. Data Breach Litig., 429 F. Supp. 3d 190 (E.D. Va. 2019) (upholding privilege where forensic vendor was retained by and reported to outside counsel). The protocols described below are crafted to avoid the pitfalls identified in the case law and to maximize the protections available to Lumos.

This memorandum is itself a privileged attorney-client communication and constitutes attorney work product prepared in anticipation of litigation and regulatory proceedings. It should be treated accordingly and should not be disseminated beyond the addressees listed above without the express prior authorization of C&H.

II. Summary of the Incident

The following factual summary is provided for context and to establish the basis for the privilege protocol and forensic engagement structure described herein. This summary is based on information provided to C&H by Lumos personnel as of the date of this memorandum and is subject to revision as the forensic investigation progresses.

Between approximately 02:14 UTC on June 12, 2024, and approximately 19:47 UTC on June 15, 2024—a window of approximately sixty-five and one-half (65.5) hours—one or more threat actors conducted a credential-stuffing attack against the Lumos Insight Platform (version v4.7.2, build 4.7.2-rel-20240601). The attack involved the automated injection of approximately 2.16 million username/password pairs against the Platform's authentication endpoint. Based on preliminary analysis by the Lumos security operations center ("SOC") team, the credential pairs used in the attack are believed to have been sourced from the publicly disclosed breach of VaultSync Technologies, Inc., which was disclosed on May 28, 2024. The VaultSync breach reportedly exposed email addresses and plaintext or weakly hashed passwords for approximately 18 million users, a subset of whom are also Lumos Insight Platform users who had reused their VaultSync credentials on the Lumos platform.

The credential-stuffing attack resulted in unauthorized access to 11,438 individual user accounts across 847 enterprise customer tenants. To place this figure in context, the Lumos Insight Platform has approximately 286,000 total registered users across approximately 4,200 enterprise customers. The 11,438 compromised accounts thus represent approximately 4.0% of the total registered user base, and the 847 affected enterprise tenants represent approximately 20.2% of the total enterprise customer population.

Lumos's WatchTower SIEM platform, provided by Aegis Security Solutions, Inc. ("Aegis"), triggered anomaly alerts at approximately 14:22 UTC on June 15, 2024, based on the detection of an anomalous spike in failed authentication attempts and an unusual geographic distribution of successful logins. The Lumos SOC team received and began triaging these alerts and confirmed the Incident as a credential-stuffing attack at approximately 16:08 UTC on June 15, 2024. Internal escalation to Jason Haddad (CISO) and Allison Cho (General Counsel) followed promptly thereafter.

Containment measures were executed by approximately 20:30 UTC on June 15, 2024. These measures included (a) a global password reset for all 286,000 registered user accounts on the Lumos Insight Platform, requiring all users to create new credentials upon next login; and (b) the blocking of 1,247 unique source IP addresses identified as associated with the attack traffic. In addition, on June 16, 2024, the Lumos engineering team disabled the "Quick View" cached data feature of the Platform pending further investigation and security review.

The categories of data potentially exposed as a result of the unauthorized access include the following:

• User profile information — For approximately 7,820 of the 11,438 compromised accounts, the threat actor(s) potentially had access to user profile data, including full name, email address, job title, employer name, and phone number. This information is displayed on the user's profile page upon successful login.

• Partial financial data (Quick View feature) — For 2,614 of the 11,438 compromised accounts that had the "Quick View" feature enabled, the threat actor(s) potentially had access to cached partial financial account information, including last four digits of financial account numbers, account balances, and asset allocation summaries. The Quick View feature was designed to provide users with a snapshot of their connected financial data without requiring navigation to the full account detail pages, and this data was cached in the user's session upon login.

• Extended session accounts — 137 of the 11,438 compromised accounts showed session durations exceeding thirty (30) seconds, which may indicate that the threat actor(s) engaged in manual browsing, data review, or potential exfiltration activity beyond what would be expected from automated credential-stuffing tools (which typically authenticate and immediately move on). These 137 accounts warrant individual forensic review to determine the nature and extent of any data access or exfiltration.

Given the scope and nature of the Incident—including the number of affected user accounts, the involvement of partial financial data, the multi-tenant enterprise architecture of the Platform, and the potential exposure of personally identifiable information for users across multiple jurisdictions (including the United States, United Kingdom, and the European Union)—the potential for regulatory investigation and private litigation is significant. Regulatory obligations that may be implicated include, without limitation, state breach notification statutes across multiple U.S. jurisdictions (including the California Consumer Privacy Act, as amended by the CPRA), the UK General Data Protection Regulation and Data Protection Act 2018 (with respect to UK-resident users), and the EU General Data Protection Regulation (with respect to EU-resident users). In addition, the Incident may give rise to claims by affected individuals, enterprise customers, or other parties, including contract-based claims, negligence claims, and statutory claims under state consumer protection statutes.

It is therefore imperative that the forensic investigation be structured and conducted in a manner that preserves all available privileges and protections, as set forth in this memorandum.

III. Retention of Palisade Digital Forensics, Inc. at the Direction of Counsel

A. Identification of Forensic Vendor

Palisade Digital Forensics, Inc. ("Palisade"), a Washington corporation headquartered at 999 Third Avenue, Suite 2800, Seattle, WA 98104, has been selected as the third-party digital forensics and incident response firm for the Incident. Palisade was selected based on its demonstrated expertise in credential-stuffing and account-takeover investigations, its experience supporting privileged forensic engagements for technology companies, its availability for immediate deployment, and its pre-approval on the NexTier Cyber Insurance Group vendor panel (as discussed further in Section VIII below).

Dr. Neil Frasier, Principal Consultant at Palisade, will serve as Palisade's engagement lead for this matter. Dr. Frasier holds a Ph.D. in Computer Science from the University of Washington and has led forensic investigations in connection with more than forty data security incidents involving credential-stuffing, unauthorized access, and data exfiltration across the financial technology, healthcare, and enterprise software industries. Dr. Frasier's team for this engagement is expected to include additional forensic analysts and incident response specialists as needed, all of whom will be subject to the protocols set forth in this memorandum.

B. Engagement Structure — At the Direction of Counsel

The engagement structure for Palisade's retention is critical to the preservation of privilege and work product protections and has been carefully designed to withstand scrutiny in the event of a challenge to privilege in litigation or regulatory proceedings.

Palisade is being retained at the direction of C&H, acting as outside counsel to Lumos, for the primary purpose of assisting counsel in providing legal advice to Lumos regarding the Incident. Specifically, Palisade's forensic analysis is being undertaken to enable C&H to (a) advise Lumos regarding its legal obligations under applicable breach notification statutes and data protection regulations, (b) assess Lumos's litigation exposure arising from the Incident, (c) prepare for potential regulatory inquiries and enforcement actions, and (d) provide informed legal counsel regarding remediation priorities and risk mitigation.

The engagement letter with Palisade has been executed by and through C&H, not directly between Palisade and Lumos. C&H is the contracting party with Palisade; Lumos is the beneficiary of the work, but the contractual and directing relationship runs through counsel. This structure ensures that Palisade functions as a consultant to counsel—an extension of the legal team—rather than as a business vendor retained by the Company for operational purposes. Palisade did not have a pre-existing contractual relationship with Lumos for forensic, monitoring, or incident response services, and the engagement with Palisade was initiated solely in connection with the Incident and at the direction of C&H.

This structure is critical to establishing and preserving the attorney-client privilege and work product protection over Palisade's investigation, findings, reports, and communications. Courts have recognized that communications between an attorney's non-testifying expert or consultant and the client may be protected by the attorney-client privilege where the expert is retained to assist the attorney in rendering legal advice. See Kovel, 296 F.2d at 918–22 (2d Cir. 1961); In re Dominion Dental Servs. USA, Inc. Data Breach Litig., 429 F. Supp. 3d at 200–01. Additionally, Palisade's work product—including its reports, analyses, findings, memoranda, and communications—constitutes opinion work product and/or fact work product prepared in anticipation of litigation and at the direction of counsel, and is entitled to protection under Federal Rule of Civil Procedure 26(b)(3) and its state-law equivalents.

Palisade's work is undertaken in anticipation of litigation and regulatory proceedings and to enable C&H to provide informed legal advice to Lumos. To be clear, C&H is directing the forensic investigation. C&H will define and refine the scope of Palisade's work, will direct Palisade's analytical priorities, will receive and review all Palisade deliverables before any dissemination to the Lumos team, and will control the use and distribution of Palisade's work product. All parties should conduct themselves consistently with this framework at all times.

C. Scope of Palisade's Engagement

The scope of Palisade's forensic engagement encompasses the following areas of investigation, as directed by C&H:

1. Attack vector confirmation. Detailed forensic analysis of the credential-stuffing attack, including confirmation of the attack vector (i.e., automated credential injection against the Platform's authentication endpoint), the precise timeline of the attack, and the source of the credential pairs used (including any linkage to the VaultSync Technologies breach).

2. Account enumeration. Complete identification and enumeration of all user accounts accessed during the attack window, including verification of the preliminary count of 11,438 compromised accounts and the 847 affected enterprise customer tenants.

3. Session activity analysis. Granular analysis of session activity for each compromised account, with particular attention to the 137 accounts with session durations exceeding thirty (30) seconds. This analysis should include review of page access logs, API call logs, and any available clickstream data to determine what information the threat actor(s) accessed or attempted to access within each session.

4. Data exfiltration assessment. Determination of whether any data exfiltration, download, export, or screenshot activity occurred during any of the compromised sessions. This is a critical question for breach notification analysis and litigation exposure assessment.

5. Malware and persistence analysis. Assessment of whether any malware, persistence mechanisms, backdoors, web shells, or other unauthorized code was deployed on the Platform's infrastructure during or as a result of the attack.

6. Lateral movement and privilege escalation. Evaluation of whether any lateral movement or privilege escalation occurred—i.e., whether the threat actor(s) moved from compromised user accounts to other systems, administrative accounts, or infrastructure components.

7. Log preservation and analysis. Preservation and analysis of all relevant server logs, authentication logs, API gateway logs, network traffic data, firewall logs, and forensic images. Palisade will create forensic images of affected systems as necessary to preserve evidence in a forensically sound manner.

8. Quick View data exposure assessment. Targeted assessment of the 2,614 Quick View-enabled accounts to determine the extent of partial financial data exposure, including whether cached financial data was accessed, viewed, or potentially exfiltrated during the compromised sessions.

Palisade is expected to deliver the following work product to C&H:

• Preliminary findings memorandum — A preliminary memorandum summarizing initial findings, including confirmation or refinement of the scope of compromise, initial assessment of data exposure, and identification of any issues requiring immediate attention. Target delivery: within approximately eight (8) days of engagement commencement.

• Final forensic investigation report — A comprehensive final report documenting the full findings of the forensic investigation, including detailed analysis of all items within the scope of engagement. Target delivery: within approximately four (4) weeks of engagement commencement.

Both deliverables will be addressed to C&H, marked with the privilege legend specified in Section V.A below, and delivered in accordance with the reporting chain specified in Section IV.B below. C&H reserves the right to direct additional or modified scope during the course of the engagement as the investigation develops and as legal analysis requires.

D. Billing and Cost

Palisade's engagement is structured as a flat-fee arrangement in the amount of $285,000 for the scope of work described in Section III.C above, with provision for overage billing at agreed hourly rates ($575/hour for Principal Consultant; $425/hour for Senior Analyst; $325/hour for Analyst) in the event the scope of work materially expands beyond the parameters anticipated at the time of engagement. Any overage billing will require advance authorization by C&H.

All Palisade invoices are to be directed to C&H for review and forwarding to Lumos. As applicable, C&H will facilitate submission of Palisade invoices to NexTier Cyber Insurance Group (the "Carrier") under Policy No. NXT-CYB-2024-07812 for coverage above the $500,000 per-claim retention. Palisade invoices submitted to the Carrier will be reviewed by C&H to ensure that invoice descriptions do not contain privileged work product content and are appropriately redacted to protect privilege while providing sufficient information for claims processing.

C&H is pre-approved panel counsel under the NexTier policy, which facilitates the privilege-consistent billing structure. The engagement of Palisade through C&H is consistent with the Carrier's panel vendor requirements, as Palisade is also a pre-approved forensic vendor on the NexTier panel.

IV. Privilege Protocol — Communications and Reporting

A. Fundamental Principle

All communications between Palisade, C&H, and Lumos personnel regarding the forensic investigation are to be treated as privileged attorney-client communications and/or attorney work product. This includes, without limitation, all oral communications (in-person meetings, telephone calls, videoconferences), written communications (emails, memoranda, reports, instant messages), and electronic deliverables (forensic images, log analyses, data compilations, presentations, spreadsheets, and other work product).

No Palisade findings, reports, data, analysis, or other work product may be shared outside the attorney-client relationship without the express prior authorization of C&H. This restriction applies to all Palisade personnel, all C&H personnel, and all Lumos personnel who receive or have access to such materials. Any unauthorized disclosure of privileged materials may result in a waiver of the attorney-client privilege and/or work product protection, the consequences of which are described in Section XI below.

B. Reporting Chain

The reporting chain for Palisade's forensic work product is structured as follows to ensure the integrity of the privilege framework:

1. All Palisade reports, findings, memoranda, interim updates, and communications concerning the forensic investigation must be directed to C&H in the first instance. The designated C&H recipients are:

• Rachel Bernstein, Partner (rachel.bernstein@calderwoodharkness.com)

• Sara Hendricks, Associate (sara.hendricks@calderwoodharkness.com)

• Kevin Ostrowski, Senior Counsel (kevin.ostrowski@calderwoodharkness.com) — as needed

• Priscilla Wynn, Associate (priscilla.wynn@calderwoodharkness.com) — as needed

2. Palisade is not to deliver reports, findings, analysis, or any substantive work product directly to Lumos business teams, engineering teams, or any Lumos personnel other than the three designated recipients of this memorandum—namely, Allison Cho (General Counsel & CPO), Jason Haddad (CISO), and Deepika Narayanan (CTO). Even those individuals should receive Palisade's substantive work product only through or with the knowledge of C&H.

3. C&H will, after review, share relevant findings with the Lumos incident response team as appropriate and in a manner consistent with maintaining privilege. All materials shared by C&H with Lumos personnel will bear applicable privilege markings and will be accompanied by instructions regarding their confidential and privileged nature.

This reporting structure ensures that C&H maintains direction and control over the forensic investigation and that all privileged materials flow through counsel before reaching the client, consistent with the framework necessary to sustain a privilege claim.

C. Approved Lumos Contacts for Forensic Coordination

The forensic investigation will require Palisade to obtain technical data, log access, system access, and technical information from Lumos's engineering and security teams. Palisade may communicate with the following Lumos personnel for these technical coordination purposes:

• Jason Haddad, VP of Information Security (CISO) — primary technical point of contact for all forensic coordination, including log access, system access, and technical data requests.

• Deepika Narayanan, Chief Technology Officer — escalation contact for technical matters that cannot be resolved through Mr. Haddad.

• Brian Kowalski, VP of Engineering — for platform-specific technical inquiries, including questions regarding the architecture of the Lumos Insight Platform, the Quick View feature, authentication infrastructure, API gateway configuration, and related technical matters.

These communications should be limited to the exchange of technical data and information necessary to facilitate the forensic investigation. All substantive discussions regarding forensic findings, legal implications, legal conclusions, or the interpretation or significance of forensic evidence must include an C&H attorney. The C&H attorneys authorized to participate in such discussions are Rachel Bernstein, Sara Hendricks, and Priscilla Wynn. Palisade personnel should arrange for C&H participation in any call, meeting, or communication that is expected to involve or may potentially involve substantive discussion of findings or conclusions.

Palisade personnel should not engage in discussions regarding the Incident with any other Lumos employees, board members, investors, auditors, customers, regulators, vendors, or third parties without C&H's prior written consent. Any request from any party not listed above for information from or contact with Palisade regarding this engagement should be immediately referred to C&H.

D. Exclusion of Business-Side Personnel

To preserve the privilege, Palisade's findings and reports are not to be shared with Lumos's business-side teams, including but not limited to the sales, marketing, product management, and customer success organizations. In particular, no Palisade work product should be shared with Fiona Albrecht (Director of Customer Success) or her team without C&H's prior authorization, notwithstanding that the customer success team may be involved in customer-facing communications regarding the Incident. Any factual information needed by the customer success team for customer communications will be provided by C&H in a format designed to preserve privilege over the underlying forensic work product.

Additionally, Palisade's findings and reports are not to be shared with Lumos's private equity sponsor, Ridgeline Capital Partners, LP ("Ridgeline"), or with any Ridgeline personnel, including without limitation Vanessa Collier (Operating Partner at Ridgeline and Lumos Board Member) and Theodore "Ted" Ridgeway (Managing Partner of Ridgeline), unless and until C&H has reviewed the materials and authorized their disclosure in a manner consistent with maintaining privilege. C&H recognizes that Lumos's board of directors and its sponsor may require updates regarding the Incident; however, any board or investor communication regarding the forensic investigation will be prepared or reviewed by C&H before dissemination, and C&H will advise on the appropriate scope and format of such communications to mitigate the risk of privilege waiver.

Similarly, Palisade's work product should not be shared with Lumos's external auditors or with any regulatory body without C&H's prior authorization and involvement.

V. Document Labeling and Handling Requirements

A. Privilege Markings

All documents, reports, memoranda, emails, presentations, spreadsheets, and other materials prepared by Palisade in connection with this engagement must bear the following legend prominently on each page:

"PRIVILEGED AND CONFIDENTIAL — PREPARED AT THE DIRECTION OF COUNSEL — ATTORNEY-CLIENT PRIVILEGE / ATTORNEY WORK PRODUCT — CALDERWOOD & HARKNESS LLP"

This legend must appear in the header or footer of each page of written deliverables and in a conspicuous location (such as a cover page or header) on presentations and other formatted documents.

Electronic files—including forensic images, log exports, data analysis workbooks, spreadsheets, and other digital work product—must include this legend in the file metadata (in the "comments," "subject," or "author" fields, as appropriate to the file format) or, where metadata insertion is not practicable, in a cover sheet or readme file accompanying each file or group of files. Forensic images delivered on physical media (e.g., external hard drives) must be labeled with this legend on the physical media and in accompanying documentation.

B. Email Subject Lines

All email communications among Palisade, C&H, and authorized Lumos personnel relating to the forensic investigation must include the following in the subject line:

"PRIVILEGED & CONFIDENTIAL — Attorney Work Product — Lumos Incident Response [C&H Matter No. 1008-00009]"

This subject-line convention must be used for all new email threads and maintained in all reply and forward chains. If an email thread that did not originate with this subject-line convention evolves to include substantive discussion of forensic findings or the investigation, the participants should create a new email thread with the appropriate subject line rather than continuing the non-conforming thread.

C. File Storage and Access Controls

Palisade must store all engagement-related materials—including forensic images, log data, analysis workbooks, draft and final reports, internal notes, and all communications related to the engagement—in a secure, access-controlled environment that is physically and logically segregated from Palisade's general client files and from the files of Palisade's other engagements. Access controls must include, at a minimum, encryption at rest (AES-256 or equivalent), multi-factor authentication for access, and role-based access restrictions.

Access to engagement materials must be limited to the Palisade team members assigned to this engagement (as identified by Dr. Neil Frasier and approved by C&H) and to C&H attorneys working on this matter. Palisade must maintain a current list of all personnel with access to engagement materials and must promptly notify C&H of any changes to the access list.

Upon conclusion of the engagement, the disposition of all Palisade-held materials—including forensic images, log data, analysis files, reports, communications, and any copies thereof—will be directed by C&H. Palisade must not destroy, delete, or dispose of any engagement-related materials without C&H's prior written authorization. C&H anticipates that, upon conclusion of the engagement, Palisade will be directed to either (a) return all materials to C&H, (b) securely destroy all materials pursuant to a destruction protocol approved by C&H, or (c) retain materials for a specified period subject to continuing access controls, as circumstances require.

VI. Separation of Forensic Investigation from Lumos Internal IT Remediation

A. Distinction Between Privileged Forensic Work and Business Remediation

It is essential to maintain a clear and demonstrable distinction between the following two categories of activity:

1. Palisade's privileged forensic investigation — This investigation is being conducted at the direction of C&H, as outside counsel to Lumos, for the primary purpose of assisting counsel in providing legal advice to Lumos. The investigation is undertaken in anticipation of litigation and regulatory proceedings. Palisade's work product, findings, reports, analyses, and related communications are covered by the attorney-client privilege and work product protection, subject to adherence to the protocols set forth in this memorandum.

2. Lumos's internal IT remediation and security improvement efforts — These activities are being conducted by Lumos's engineering and information security teams (under the direction of Jason Haddad, CISO, and Brian Kowalski, VP of Engineering) for business purposes—specifically, to remediate the vulnerabilities exploited in the Incident and to strengthen the Platform's security posture. These activities include, without limitation, the deployment of multi-factor authentication (MFA) for all Platform users, the implementation of bot-detection and CAPTCHA mechanisms on the authentication endpoint, changes to rate-limiting and throttling configurations, integration of credential-screening services (e.g., checking user credentials against known breach databases), enhancement of monitoring and alerting rules in the WatchTower SIEM platform, and other security improvements identified by the Lumos team.

Lumos's internal remediation work is being conducted for business and operational purposes and is not privileged. The documentation of remediation activities—including engineering tickets, change management records, configuration changes, project plans, and internal status reports—will likely be discoverable in litigation or regulatory proceedings, and Lumos personnel should prepare such documentation with that understanding.

Lumos IT and security personnel should not commingle their own internal investigation notes, remediation documentation, or status reports with Palisade's privileged forensic work product. Internal remediation documents should not reference, incorporate, quote, summarize, or attach Palisade's findings or reports, and should not describe communications with C&H regarding the investigation. If Lumos personnel have questions about whether a particular document or communication would be considered privileged or non-privileged, they should consult with C&H before creating or distributing the document.

If Lumos's internal team identifies information or findings that may be relevant to the forensic investigation—for example, discovery of additional indicators of compromise, identification of previously undetected attack activity, or new information regarding the scope of data exposure—such information should be communicated to C&H through Allison Cho or Jason Haddad. C&H will then coordinate with Palisade as appropriate to incorporate such information into the forensic investigation.

B. Pre-Existing and Independently Generated Records

Certain Lumos records relevant to the Incident exist independently of the forensic investigation and were created in the ordinary course of Lumos's business operations prior to or without regard to C&H's engagement of Palisade. These records include, without limitation:

• WatchTower/Aegis SIEM logs and alert data

• Authentication logs generated by the Lumos Insight Platform

• Network traffic logs and firewall logs generated by Lumos's infrastructure

• API gateway logs

• User session data and access records

• System configuration files and architecture documentation

These underlying records are not themselves privileged by virtue of the forensic investigation. They were created for business and operational purposes and would exist irrespective of C&H's engagement of Palisade. The fact that Palisade reviews, analyzes, copies, or relies upon such records in the course of the forensic investigation does not render the underlying records privileged, and Lumos should expect that such records may be subject to discovery in litigation or regulatory proceedings.

However, Palisade's analysis, selection, compilation, organization, and conclusions drawn from such records—including which records Palisade chose to examine, how Palisade organized or filtered the data, what analytical methodologies Palisade applied, and the conclusions and opinions Palisade reached—are protected work product. The distinction between the underlying factual records and Palisade's analytical work product must be maintained.

Lumos should preserve all such underlying records in their native form pursuant to the litigation hold described in Section VII below. Preservation of native records should be accomplished through Lumos's own data retention and preservation processes, independent of any copies or images created by Palisade for purposes of the forensic investigation.

VII. Litigation Hold

A. Issuance. Concurrent with this memorandum, C&H has directed and Lumos Analytics Inc. has issued an internal litigation hold notice dated June 18, 2024 (the "Litigation Hold"), directing the preservation of all records, data, and materials related to the credential-stuffing Incident. The Litigation Hold has been distributed to all identified custodians and relevant personnel. The issuance of the Litigation Hold reflects C&H's assessment that litigation and/or regulatory proceedings are reasonably anticipated in connection with the Incident, triggering Lumos's obligations to preserve potentially relevant evidence.

B. Scope of Litigation Hold

The Litigation Hold covers, without limitation, the following categories of records, data, and materials:

• All server logs, authentication logs, and SIEM (WatchTower/Aegis) alert data from the period of May 1, 2024, through the present and continuing until the Litigation Hold is lifted.

• All network traffic logs, firewall logs, load balancer logs, and CDN logs relevant to the attack window (June 12–15, 2024) and surrounding periods (at minimum, June 1, 2024, through the present).

• Forensic images of affected systems created by Palisade or by Lumos's internal team, including all chain-of-custody documentation associated with such images.

• All internal communications (including email, Meridian Solutions messages, Northgate Data Systems messages, and any other messaging platforms used by Lumos personnel) among Lumos personnel regarding the Incident, including communications with C&H and Palisade.

• All communications with third parties regarding the Incident, including without limitation communications with:

• NexTier Cyber Insurance Group and its claims adjuster, Martin Okubo

• Aegis Security Solutions, Inc. (SIEM vendor)

• Threshold Public Relations LLC (crisis communications), including communications with Janelle Morse

• Harmon Watts & Kendrick LLP (UK/EU counsel), including communications with Catherine Wye

• VaultSync Technologies, Inc. or its counsel (if any)

• Any affected customers or users who have contacted Lumos regarding the Incident

• User account data, session data, and access records for all 11,438 compromised accounts, including account profile data, session tokens, session timestamps, page access logs, and API call logs.

• Records relating to the Quick View feature, including feature configuration data, cached data records, and data retention settings, and specifically including records for the 2,614 accounts with cached partial financial data.

• Records relating to the 137 accounts with extended session durations exceeding thirty (30) seconds, including all available session data and any supplemental logs or records that may shed light on the activity conducted during those sessions.

• All remediation records and change management documentation, including engineering tickets, configuration change records, deployment logs, project plans, and internal status reports related to security improvements implemented in response to the Incident.

• Board and investor communications regarding the Incident, including board presentations, board minutes, committee minutes, and any communications with Ridgeline Capital Partners, LP or its personnel.

• All records relating to Lumos's pre-Incident security posture and authentication infrastructure, including MFA configuration (or absence thereof), rate-limiting settings, bot-detection mechanisms, password policies, and any prior security assessments, penetration tests, or vulnerability scans relevant to the attack vector exploited in the Incident.

C. Custodians. Key custodians subject to the Litigation Hold include the following individuals, each of whom has received a copy of the Litigation Hold notice and has been instructed to preserve all potentially relevant records in their possession, custody, or control:

• Marcus Tan, Chief Executive Officer

• Deepika Narayanan, Chief Technology Officer

• Allison Cho, General Counsel & Chief Privacy Officer

• Jason Haddad, VP of Information Security (CISO)

• Brian Kowalski, VP of Engineering

• Fiona Albrecht, Director of Customer Success

• All members of the Lumos SOC team who were involved in the detection, triage, escalation, and containment of the Incident

C&H may identify additional custodians as the investigation progresses and will coordinate with Allison Cho to issue supplemental Litigation Hold notices as necessary.

D. Duration. The Litigation Hold will remain in effect until C&H issues written notice that it may be lifted, following C&H's assessment of the regulatory and litigation landscape. No Lumos personnel should destroy, delete, modify, or allow the routine deletion of any records within the scope of the Litigation Hold without C&H's prior written authorization, regardless of any contrary document retention policies, automated deletion schedules, or storage management practices that may otherwise apply.

VIII. Coordination with Insurance Carrier

A notice of claim was submitted to NexTier Cyber Insurance Group ("NexTier" or the "Carrier") on June 20, 2024, under Policy No. NXT-CYB-2024-07812. The relevant policy parameters are as follows:

• Policy period: January 1, 2024 – January 1, 2025

• Per-occurrence limit: $15,000,000

• Aggregate limit: $30,000,000

• Per-claim retention (deductible): $500,000

• Claims adjuster: Martin Okubo, NexTier Cyber Insurance Group

C&H is pre-approved panel counsel under the NexTier policy, and Palisade is a pre-approved forensic vendor on the NexTier panel. This pre-approval status facilitates the privilege-consistent engagement and billing structure described in this memorandum.

In the course of evaluating the claim, NexTier may request access to Palisade's forensic findings or to other information regarding the Incident. Any such requests from NexTier or from Martin Okubo must be directed to and coordinated through C&H. C&H will evaluate each such request and will ensure that any disclosure is made in a manner that does not waive the attorney-client privilege or work product protection. Potential frameworks for sharing information with NexTier include (a) the common-interest doctrine, pursuant to which the insurer and insured may share privileged information without waiver where they share a common legal interest; (b) specific policy provisions regarding the insured's cooperation obligations, which may permit or require certain disclosures; and (c) carefully structured oral briefings or redacted summaries that provide the Carrier with necessary information without full disclosure of privileged work product.

Palisade is not to communicate directly with NexTier or its claims adjuster, Martin Okubo, regarding any aspect of the forensic investigation, the Incident, or this engagement without C&H's prior authorization. Any inquiries from NexTier directed to Palisade should be immediately referred to C&H.

IX. Coordination with UK/EU Counsel

Harmon Watts & Kendrick LLP ("HWK"), led by Catherine Wye in their London office at 30 Finsbury Square, London EC2A 1AG, United Kingdom, has been engaged as coordinating counsel for UK Information Commissioner's Office ("ICO") notification and EU General Data Protection Regulation ("GDPR") analysis relating to Lumos's UK-based operations and the affected user accounts of UK- and EU-resident individuals.

Based on preliminary data provided by Lumos, 814 of the 11,438 compromised user accounts belong to UK-resident individuals, and an additional 47 compromised accounts belong to EU-resident individuals (across multiple EU member states). The UK GDPR and the Data Protection Act 2018 require notification to the ICO within seventy-two (72) hours of the data controller becoming aware of a personal data breach that is likely to result in a risk to the rights and freedoms of natural persons. Consistent with this requirement, HWK coordinated the filing of the ICO 72-hour notification on June 18, 2024, within the 72-hour window from Lumos's awareness of the Incident on June 15, 2024. The notification was filed on a preliminary basis, with an indication that further details would be provided as the forensic investigation progresses.

To the extent Palisade's forensic findings are relevant to the ICO notification, any subsequent ICO inquiry or investigation, or GDPR compliance analysis for EU-resident users, C&H will coordinate the sharing of appropriate information with HWK. Such sharing will be conducted under a common-interest framework, with privilege maintained. C&H and HWK have entered into a common-interest agreement to facilitate the exchange of privileged information in connection with the Incident.

Palisade should not communicate directly with HWK or any HWK personnel regarding the forensic investigation, the Incident, or this engagement without C&H's prior authorization. Any inquiries from HWK directed to Palisade should be immediately referred to C&H.

X. Crisis Communications Coordination

Threshold Public Relations LLC ("Threshold PR"), with account lead Janelle Morse, located at 375 Park Avenue, Suite 1410, New York, NY 10152, has been engaged by Lumos for crisis communications support and customer messaging in connection with the Incident. Threshold PR is assisting Lumos with the development of public statements, customer notifications, FAQs, media responses, and other communications materials.

It is important to note that Threshold PR is a business vendor of Lumos, retained by Lumos for public relations and communications purposes. Threshold PR's engagement is not structured through C&H, and Threshold PR's work product is generally not protected by the attorney-client privilege or the work product doctrine. Communications with Threshold PR and materials prepared by or shared with Threshold PR should be treated as non-privileged and potentially discoverable.

Accordingly, the following restrictions apply:

• Palisade must not share any forensic findings, reports, analysis, or other work product with Threshold PR personnel, including Janelle Morse. Threshold PR is not an approved recipient of Palisade's privileged work product under any circumstances.

• Any factual information regarding the Incident that is to be incorporated into public statements, customer communications, press materials, FAQs, or other externally facing documents must be reviewed and approved by C&H before dissemination. C&H will work with Allison Cho to determine what factual information may be appropriately shared with Threshold PR for communications purposes, and C&H will ensure that any information provided to Threshold PR does not include or reveal privileged forensic work product or attorney-client communications.

• Lumos personnel should not forward, copy, or share any communications from C&H or Palisade with Threshold PR, and should not include Threshold PR personnel on any email threads, calls, or meetings that involve discussion of the forensic investigation or C&H's legal advice.

XI. Consequences of Non-Compliance

Failure to adhere to the privilege protocol set forth in this memorandum may result in waiver of the attorney-client privilege and/or work product protection over the forensic investigation and related communications. The consequences of such a waiver could be severe and far-reaching. In the event of regulatory investigations by state attorneys general, the Federal Trade Commission, the ICO, or other regulatory bodies, a waiver of privilege could result in compelled disclosure of Palisade's forensic findings, C&H's legal analysis and advice, and internal communications regarding the Incident. In the event of private litigation by affected individuals, enterprise customers, or other parties, a waiver could provide plaintiffs with access to the most sensitive and detailed analysis of the Incident, including analysis that might otherwise be shielded from disclosure.

Moreover, courts have held that privilege waivers in the context of data breach investigations may extend beyond the specific document or communication that was improperly disclosed, potentially resulting in a subject-matter waiver that encompasses all related privileged communications. See, e.g., In re Penmark Group, 2020 WL 3470261, at *6. The risks of non-compliance are therefore not limited to the specific instance of improper disclosure but may cascade to affect the privilege status of the entire body of privileged work product and communications generated in connection with the Incident.

All recipients of this memorandum are requested to acknowledge their understanding of and commitment to the protocols set forth herein. Each recipient should review this memorandum carefully and direct any questions regarding its application to specific situations to Rachel Bernstein (rachel.bernstein@calderwoodharkness.com) or Sara Hendricks (sara.hendricks@calderwoodharkness.com) at Calderwood & Harkness LLP, One Embarcadero Center, Suite 3400, San Francisco, CA 94111, telephone (415) 555-7200.

XII. Acknowledgment

By signing below, each undersigned acknowledges that they have read, understand, and agree to comply with the Forensic Vendor Retention Protocol and Privilege Framework set forth in this memorandum.

LUMOS ANALYTICS INC.

By: ________

Name: Allison Cho

Title: General Counsel & Chief Privacy Officer

Date: ________

LUMOS ANALYTICS INC.

By: ________

Name: Jason Haddad

Title: VP of Information Security (CISO)

Date: ________

LUMOS ANALYTICS INC.

By: ________

Name: Deepika Narayanan

Title: Chief Technology Officer

Date: ________

Note: A copy of this memorandum will be provided to Dr. Neil Frasier, Principal Consultant, at Palisade Digital Forensics, Inc. under separate cover, together with a request for Dr. Frasier's written acknowledgment of and agreement to comply with the protocols set forth herein. Dr. Frasier's acknowledgment will be maintained in C&H's files for this matter.

•

CALDERWOOD & HARKNESS LLP

By: ________

Rachel Bernstein Partner, Privacy & Data Security

By: ________

Sara Hendricks Associate, Privacy & Data Security

C&H Matter No. 1008-00009 One Embarcadero Center, Suite 3400 San Francisco, CA 94111 Telephone: (415) 555-7200

PRIVILEGED AND CONFIDENTIAL — ATTORNEY-CLIENT PRIVILEGE / ATTORNEY WORK PRODUCT DO NOT DISTRIBUTE WITHOUT PRIOR AUTHORIZATION OF CALDERWOOD & HARKNESS LLP

TO:

Jason Haddad, VP of Information Security (CISO), Lumos Analytics Inc.

Deepika Narayanan, Chief Technology Officer, Lumos Analytics Inc.

FROM:

Sara Hendricks, Associate, Privacy & Data Security, Calderwood & Harkness LLP

DATE:	June 18, 2024
RE:	Forensic Vendor Retention Protocol and Privilege Framework — Credential-Stuffing Incident Affecting the Lumos Insight Platform
C&H MATTER NO.:	1008-00009

PRIVILEGED AND CONFIDENTIAL ATTORNEY-CLIENT PRIVILEGE / ATTORNEY WORK PRODUCT
DO NOT DISTRIBUTE WITHOUT PRIOR AUTHORIZATION OF CALDERWOOD & HARKNESS LLP
MEMORANDUM
I. Purpose and Background
This memorandum establishes the privilege protocol and communication framework governing the retention and direction of a third-party digital forensics firm in connection with the credential-stuffing incident detected on June 15, 2024, affecting the Lumos Insight Platform (the "Incident"). The protocols set forth herein are designed to ensure the integrity of the attorney-client privilege and work product protections that attach to the forensic investigation and all related communications, findings, reports, and analyses. Strict adherence to this protocol by all parties is essential.
Calderwood & Harkness LLP ("C&H") was engaged by Lumos Analytics Inc. ("Lumos" or the "Company") on June 18, 2024, as lead outside counsel for incident response, breach notification analysis, regulatory engagement, and litigation readiness in connection with the Incident. The terms of C&H's engagement are set forth in the engagement letter executed on June 18, 2024, addressed to Allison Cho, General Counsel & Chief Privacy Officer, Lumos Analytics Inc., at 450 Folsom Street, Suite 1200, San Francisco, CA 94105.
The primary purpose of this memorandum is to ensure that the forensic investigation being conducted in connection with the Incident is structured and managed in a manner that preserves the attorney-client privilege and work product protections applicable to the investigation findings, analysis, and related communications. The legal landscape surrounding data security incidents has made clear that the manner in which a forensic investigation is initiated, directed, and documented can be dispositive of whether the resulting work product is shielded from compelled disclosure in subsequent regulatory proceedings or private litigation. See, e.g., In re consumer Data Sec. Breach Litig., 2020 WL 3470261 (E.D. Va. June 25, 2020) (finding forensic report not privileged where vendor had been engaged prior to counsel's involvement and performed work substantially similar to pre-existing contractual obligations); cf. In re Dominion Dental Servs. USA, Inc. Data Breach Litig., 429 F. Supp. 3d 190 (E.D. Va. 2019) (upholding privilege where forensic vendor was retained by and reported to outside counsel). The protocols described below are crafted to avoid the pitfalls identified in the case law and to maximize the protections available to Lumos.
This memorandum is itself a privileged attorney-client communication and constitutes attorney work product prepared in anticipation of litigation and regulatory proceedings. It should be treated accordingly and should not be disseminated beyond the addressees listed above without the express prior authorization of C&H.
II. Summary of the Incident
The following factual summary is provided for context and to establish the basis for the privilege protocol and forensic engagement structure described herein. This summary is based on information provided to C&H by Lumos personnel as of the date of this memorandum and is subject to revision as the forensic investigation progresses.
Between approximately 02:14 UTC on June 12, 2024, and approximately 19:47 UTC on June 15, 2024—a window of approximately sixty-five and one-half (65.5) hours—one or more threat actors conducted a credential-stuffing attack against the Lumos Insight Platform (version v4.7.2, build 4.7.2-rel-20240601). The attack involved the automated injection of approximately 2.16 million username/password pairs against the Platform's authentication endpoint. Based on preliminary analysis by the Lumos security operations center ("SOC") team, the credential pairs used in the attack are believed to have been sourced from the publicly disclosed breach of VaultSync Technologies, Inc., which was disclosed on May 28, 2024. The VaultSync breach reportedly exposed email addresses and plaintext or weakly hashed passwords for approximately 18 million users, a subset of whom are also Lumos Insight Platform users who had reused their VaultSync credentials on the Lumos platform.
The credential-stuffing attack resulted in unauthorized access to 11,438 individual user accounts across 847 enterprise customer tenants. To place this figure in context, the Lumos Insight Platform has approximately 286,000 total registered users across approximately 4,200 enterprise customers. The 11,438 compromised accounts thus represent approximately 4.0% of the total registered user base, and the 847 affected enterprise tenants represent approximately 20.2% of the total enterprise customer population.
Lumos's WatchTower SIEM platform, provided by Aegis Security Solutions, Inc. ("Aegis"), triggered anomaly alerts at approximately 14:22 UTC on June 15, 2024, based on the detection of an anomalous spike in failed authentication attempts and an unusual geographic distribution of successful logins. The Lumos SOC team received and began triaging these alerts and confirmed the Incident as a credential-stuffing attack at approximately 16:08 UTC on June 15, 2024. Internal escalation to Jason Haddad (CISO) and Allison Cho (General Counsel) followed promptly thereafter.
Containment measures were executed by approximately 20:30 UTC on June 15, 2024. These measures included (a) a global password reset for all 286,000 registered user accounts on the Lumos Insight Platform, requiring all users to create new credentials upon next login; and (b) the blocking of 1,247 unique source IP addresses identified as associated with the attack traffic. In addition, on June 16, 2024, the Lumos engineering team disabled the "Quick View" cached data feature of the Platform pending further investigation and security review.
The categories of data potentially exposed as a result of the unauthorized access include the following:
•  User profile information — For approximately 7,820 of the 11,438 compromised accounts, the threat actor(s) potentially had access to user profile data, including full name, email address, job title, employer name, and phone number. This information is displayed on the user's profile page upon successful login.
•  Partial financial data (Quick View feature) — For 2,614 of the 11,438 compromised accounts that had the "Quick View" feature enabled, the threat actor(s) potentially had access to cached partial financial account information, including last four digits of financial account numbers, account balances, and asset allocation summaries. The Quick View feature was designed to provide users with a snapshot of their connected financial data without requiring navigation to the full account detail pages, and this data was cached in the user's session upon login.
•  Extended session accounts — 137 of the 11,438 compromised accounts showed session durations exceeding thirty (30) seconds, which may indicate that the threat actor(s) engaged in manual browsing, data review, or potential exfiltration activity beyond what would be expected from automated credential-stuffing tools (which typically authenticate and immediately move on). These 137 accounts warrant individual forensic review to determine the nature and extent of any data access or exfiltration.
Given the scope and nature of the Incident—including the number of affected user accounts, the involvement of partial financial data, the multi-tenant enterprise architecture of the Platform, and the potential exposure of personally identifiable information for users across multiple jurisdictions (including the United States, United Kingdom, and the European Union)—the potential for regulatory investigation and private litigation is significant. Regulatory obligations that may be implicated include, without limitation, state breach notification statutes across multiple U.S. jurisdictions (including the California Consumer Privacy Act, as amended by the CPRA), the UK General Data Protection Regulation and Data Protection Act 2018 (with respect to UK-resident users), and the EU General Data Protection Regulation (with respect to EU-resident users). In addition, the Incident may give rise to claims by affected individuals, enterprise customers, or other parties, including contract-based claims, negligence claims, and statutory claims under state consumer protection statutes.
It is therefore imperative that the forensic investigation be structured and conducted in a manner that preserves all available privileges and protections, as set forth in this memorandum.
III. Retention of Palisade Digital Forensics, Inc. at the Direction of Counsel
A. Identification of Forensic Vendor
Palisade Digital Forensics, Inc. ("Palisade"), a Washington corporation headquartered at 999 Third Avenue, Suite 2800, Seattle, WA 98104, has been selected as the third-party digital forensics and incident response firm for the Incident. Palisade was selected based on its demonstrated expertise in credential-stuffing and account-takeover investigations, its experience supporting privileged forensic engagements for technology companies, its availability for immediate deployment, and its pre-approval on the NexTier Cyber Insurance Group vendor panel (as discussed further in Section VIII below).
Dr. Neil Frasier, Principal Consultant at Palisade, will serve as Palisade's engagement lead for this matter. Dr. Frasier holds a Ph.D. in Computer Science from the University of Washington and has led forensic investigations in connection with more than forty data security incidents involving credential-stuffing, unauthorized access, and data exfiltration across the financial technology, healthcare, and enterprise software industries. Dr. Frasier's team for this engagement is expected to include additional forensic analysts and incident response specialists as needed, all of whom will be subject to the protocols set forth in this memorandum.
B. Engagement Structure — At the Direction of Counsel
The engagement structure for Palisade's retention is critical to the preservation of privilege and work product protections and has been carefully designed to withstand scrutiny in the event of a challenge to privilege in litigation or regulatory proceedings.
Palisade is being retained at the direction of C&H, acting as outside counsel to Lumos, for the primary purpose of assisting counsel in providing legal advice to Lumos regarding the Incident. Specifically, Palisade's forensic analysis is being undertaken to enable C&H to (a) advise Lumos regarding its legal obligations under applicable breach notification statutes and data protection regulations, (b) assess Lumos's litigation exposure arising from the Incident, (c) prepare for potential regulatory inquiries and enforcement actions, and (d) provide informed legal counsel regarding remediation priorities and risk mitigation.
The engagement letter with Palisade has been executed by and through C&H, not directly between Palisade and Lumos. C&H is the contracting party with Palisade; Lumos is the beneficiary of the work, but the contractual and directing relationship runs through counsel. This structure ensures that Palisade functions as a consultant to counsel—an extension of the legal team—rather than as a business vendor retained by the Company for operational purposes. Palisade did not have a pre-existing contractual relationship with Lumos for forensic, monitoring, or incident response services, and the engagement with Palisade was initiated solely in connection with the Incident and at the direction of C&H.
This structure is critical to establishing and preserving the attorney-client privilege and work product protection over Palisade's investigation, findings, reports, and communications. Courts have recognized that communications between an attorney's non-testifying expert or consultant and the client may be protected by the attorney-client privilege where the expert is retained to assist the attorney in rendering legal advice. See Kovel, 296 F.2d at 918–22 (2d Cir. 1961); In re Dominion Dental Servs. USA, Inc. Data Breach Litig., 429 F. Supp. 3d at 200–01. Additionally, Palisade's work product—including its reports, analyses, findings, memoranda, and communications—constitutes opinion work product and/or fact work product prepared in anticipation of litigation and at the direction of counsel, and is entitled to protection under Federal Rule of Civil Procedure 26(b)(3) and its state-law equivalents.
Palisade's work is undertaken in anticipation of litigation and regulatory proceedings and to enable C&H to provide informed legal advice to Lumos. To be clear, C&H is directing the forensic investigation. C&H will define and refine the scope of Palisade's work, will direct Palisade's analytical priorities, will receive and review all Palisade deliverables before any dissemination to the Lumos team, and will control the use and distribution of Palisade's work product. All parties should conduct themselves consistently with this framework at all times.
C. Scope of Palisade's Engagement
The scope of Palisade's forensic engagement encompasses the following areas of investigation, as directed by C&H:
1.  Attack vector confirmation. Detailed forensic analysis of the credential-stuffing attack, including confirmation of the attack vector (i.e., automated credential injection against the Platform's authentication endpoint), the precise timeline of the attack, and the source of the credential pairs used (including any linkage to the VaultSync Technologies breach).
2.  Account enumeration. Complete identification and enumeration of all user accounts accessed during the attack window, including verification of the preliminary count of 11,438 compromised accounts and the 847 affected enterprise customer tenants.
3.  Session activity analysis. Granular analysis of session activity for each compromised account, with particular attention to the 137 accounts with session durations exceeding thirty (30) seconds. This analysis should include review of page access logs, API call logs, and any available clickstream data to determine what information the threat actor(s) accessed or attempted to access within each session.
4.  Data exfiltration assessment. Determination of whether any data exfiltration, download, export, or screenshot activity occurred during any of the compromised sessions. This is a critical question for breach notification analysis and litigation exposure assessment.
5.  Malware and persistence analysis. Assessment of whether any malware, persistence mechanisms, backdoors, web shells, or other unauthorized code was deployed on the Platform's infrastructure during or as a result of the attack.
6.  Lateral movement and privilege escalation. Evaluation of whether any lateral movement or privilege escalation occurred—i.e., whether the threat actor(s) moved from compromised user accounts to other systems, administrative accounts, or infrastructure components.
7.  Log preservation and analysis. Preservation and analysis of all relevant server logs, authentication logs, API gateway logs, network traffic data, firewall logs, and forensic images. Palisade will create forensic images of affected systems as necessary to preserve evidence in a forensically sound manner.
8.  Quick View data exposure assessment. Targeted assessment of the 2,614 Quick View-enabled accounts to determine the extent of partial financial data exposure, including whether cached financial data was accessed, viewed, or potentially exfiltrated during the compromised sessions.
Palisade is expected to deliver the following work product to C&H:
•  Preliminary findings memorandum — A preliminary memorandum summarizing initial findings, including confirmation or refinement of the scope of compromise, initial assessment of data exposure, and identification of any issues requiring immediate attention. Target delivery: within approximately eight (8) days of engagement commencement.
•  Final forensic investigation report — A comprehensive final report documenting the full findings of the forensic investigation, including detailed analysis of all items within the scope of engagement. Target delivery: within approximately four (4) weeks of engagement commencement.
Both deliverables will be addressed to C&H, marked with the privilege legend specified in Section V.A below, and delivered in accordance with the reporting chain specified in Section IV.B below. C&H reserves the right to direct additional or modified scope during the course of the engagement as the investigation develops and as legal analysis requires.
D. Billing and Cost
Palisade's engagement is structured as a flat-fee arrangement in the amount of $285,000 for the scope of work described in Section III.C above, with provision for overage billing at agreed hourly rates ($575/hour for Principal Consultant; $425/hour for Senior Analyst; $325/hour for Analyst) in the event the scope of work materially expands beyond the parameters anticipated at the time of engagement. Any overage billing will require advance authorization by C&H.
All Palisade invoices are to be directed to C&H for review and forwarding to Lumos. As applicable, C&H will facilitate submission of Palisade invoices to NexTier Cyber Insurance Group (the "Carrier") under Policy No. NXT-CYB-2024-07812 for coverage above the $500,000 per-claim retention. Palisade invoices submitted to the Carrier will be reviewed by C&H to ensure that invoice descriptions do not contain privileged work product content and are appropriately redacted to protect privilege while providing sufficient information for claims processing.
C&H is pre-approved panel counsel under the NexTier policy, which facilitates the privilege-consistent billing structure. The engagement of Palisade through C&H is consistent with the Carrier's panel vendor requirements, as Palisade is also a pre-approved forensic vendor on the NexTier panel.
IV. Privilege Protocol — Communications and Reporting
A. Fundamental Principle
All communications between Palisade, C&H, and Lumos personnel regarding the forensic investigation are to be treated as privileged attorney-client communications and/or attorney work product. This includes, without limitation, all oral communications (in-person meetings, telephone calls, videoconferences), written communications (emails, memoranda, reports, instant messages), and electronic deliverables (forensic images, log analyses, data compilations, presentations, spreadsheets, and other work product).
No Palisade findings, reports, data, analysis, or other work product may be shared outside the attorney-client relationship without the express prior authorization of C&H. This restriction applies to all Palisade personnel, all C&H personnel, and all Lumos personnel who receive or have access to such materials. Any unauthorized disclosure of privileged materials may result in a waiver of the attorney-client privilege and/or work product protection, the consequences of which are described in Section XI below.
B. Reporting Chain
The reporting chain for Palisade's forensic work product is structured as follows to ensure the integrity of the privilege framework:
1.  All Palisade reports, findings, memoranda, interim updates, and communications concerning the forensic investigation must be directed to C&H in the first instance. The designated C&H recipients are:
•  Rachel Bernstein, Partner (rachel.bernstein@calderwoodharkness.com)
•  Sara Hendricks, Associate (sara.hendricks@calderwoodharkness.com)
•  Kevin Ostrowski, Senior Counsel (kevin.ostrowski@calderwoodharkness.com) — as needed
•  Priscilla Wynn, Associate (priscilla.wynn@calderwoodharkness.com) — as needed
2.  Palisade is not to deliver reports, findings, analysis, or any substantive work product directly to Lumos business teams, engineering teams, or any Lumos personnel other than the three designated recipients of this memorandum—namely, Allison Cho (General Counsel & CPO), Jason Haddad (CISO), and Deepika Narayanan (CTO). Even those individuals should receive Palisade's substantive work product only through or with the knowledge of C&H.
3.  C&H will, after review, share relevant findings with the Lumos incident response team as appropriate and in a manner consistent with maintaining privilege. All materials shared by C&H with Lumos personnel will bear applicable privilege markings and will be accompanied by instructions regarding their confidential and privileged nature.
This reporting structure ensures that C&H maintains direction and control over the forensic investigation and that all privileged materials flow through counsel before reaching the client, consistent with the framework necessary to sustain a privilege claim.
C. Approved Lumos Contacts for Forensic Coordination
The forensic investigation will require Palisade to obtain technical data, log access, system access, and technical information from Lumos's engineering and security teams. Palisade may communicate with the following Lumos personnel for these technical coordination purposes:
•  Jason Haddad, VP of Information Security (CISO) — primary technical point of contact for all forensic coordination, including log access, system access, and technical data requests.
•  Deepika Narayanan, Chief Technology Officer — escalation contact for technical matters that cannot be resolved through Mr. Haddad.
•  Brian Kowalski, VP of Engineering — for platform-specific technical inquiries, including questions regarding the architecture of the Lumos Insight Platform, the Quick View feature, authentication infrastructure, API gateway configuration, and related technical matters.
These communications should be limited to the exchange of technical data and information necessary to facilitate the forensic investigation. All substantive discussions regarding forensic findings, legal implications, legal conclusions, or the interpretation or significance of forensic evidence must include an C&H attorney. The C&H attorneys authorized to participate in such discussions are Rachel Bernstein, Sara Hendricks, and Priscilla Wynn. Palisade personnel should arrange for C&H participation in any call, meeting, or communication that is expected to involve or may potentially involve substantive discussion of findings or conclusions.
Palisade personnel should not engage in discussions regarding the Incident with any other Lumos employees, board members, investors, auditors, customers, regulators, vendors, or third parties without C&H's prior written consent. Any request from any party not listed above for information from or contact with Palisade regarding this engagement should be immediately referred to C&H.
D. Exclusion of Business-Side Personnel
To preserve the privilege, Palisade's findings and reports are not to be shared with Lumos's business-side teams, including but not limited to the sales, marketing, product management, and customer success organizations. In particular, no Palisade work product should be shared with Fiona Albrecht (Director of Customer Success) or her team without C&H's prior authorization, notwithstanding that the customer success team may be involved in customer-facing communications regarding the Incident. Any factual information needed by the customer success team for customer communications will be provided by C&H in a format designed to preserve privilege over the underlying forensic work product.
Additionally, Palisade's findings and reports are not to be shared with Lumos's private equity sponsor, Ridgeline Capital Partners, LP ("Ridgeline"), or with any Ridgeline personnel, including without limitation Vanessa Collier (Operating Partner at Ridgeline and Lumos Board Member) and Theodore "Ted" Ridgeway (Managing Partner of Ridgeline), unless and until C&H has reviewed the materials and authorized their disclosure in a manner consistent with maintaining privilege. C&H recognizes that Lumos's board of directors and its sponsor may require updates regarding the Incident; however, any board or investor communication regarding the forensic investigation will be prepared or reviewed by C&H before dissemination, and C&H will advise on the appropriate scope and format of such communications to mitigate the risk of privilege waiver.
Similarly, Palisade's work product should not be shared with Lumos's external auditors or with any regulatory body without C&H's prior authorization and involvement.
V. Document Labeling and Handling Requirements
A. Privilege Markings
All documents, reports, memoranda, emails, presentations, spreadsheets, and other materials prepared by Palisade in connection with this engagement must bear the following legend prominently on each page:
"PRIVILEGED AND CONFIDENTIAL — PREPARED AT THE DIRECTION OF COUNSEL — ATTORNEY-CLIENT PRIVILEGE / ATTORNEY WORK PRODUCT — CALDERWOOD & HARKNESS LLP"
This legend must appear in the header or footer of each page of written deliverables and in a conspicuous location (such as a cover page or header) on presentations and other formatted documents.
Electronic files—including forensic images, log exports, data analysis workbooks, spreadsheets, and other digital work product—must include this legend in the file metadata (in the "comments," "subject," or "author" fields, as appropriate to the file format) or, where metadata insertion is not practicable, in a cover sheet or readme file accompanying each file or group of files. Forensic images delivered on physical media (e.g., external hard drives) must be labeled with this legend on the physical media and in accompanying documentation.
B. Email Subject Lines
All email communications among Palisade, C&H, and authorized Lumos personnel relating to the forensic investigation must include the following in the subject line:
"PRIVILEGED & CONFIDENTIAL — Attorney Work Product — Lumos Incident Response [C&H Matter No. 1008-00009]"
This subject-line convention must be used for all new email threads and maintained in all reply and forward chains. If an email thread that did not originate with this subject-line convention evolves to include substantive discussion of forensic findings or the investigation, the participants should create a new email thread with the appropriate subject line rather than continuing the non-conforming thread.
C. File Storage and Access Controls
Palisade must store all engagement-related materials—including forensic images, log data, analysis workbooks, draft and final reports, internal notes, and all communications related to the engagement—in a secure, access-controlled environment that is physically and logically segregated from Palisade's general client files and from the files of Palisade's other engagements. Access controls must include, at a minimum, encryption at rest (AES-256 or equivalent), multi-factor authentication for access, and role-based access restrictions.
Access to engagement materials must be limited to the Palisade team members assigned to this engagement (as identified by Dr. Neil Frasier and approved by C&H) and to C&H attorneys working on this matter. Palisade must maintain a current list of all personnel with access to engagement materials and must promptly notify C&H of any changes to the access list.
Upon conclusion of the engagement, the disposition of all Palisade-held materials—including forensic images, log data, analysis files, reports, communications, and any copies thereof—will be directed by C&H. Palisade must not destroy, delete, or dispose of any engagement-related materials without C&H's prior written authorization. C&H anticipates that, upon conclusion of the engagement, Palisade will be directed to either (a) return all materials to C&H, (b) securely destroy all materials pursuant to a destruction protocol approved by C&H, or (c) retain materials for a specified period subject to continuing access controls, as circumstances require.
VI. Separation of Forensic Investigation from Lumos Internal IT Remediation
A. Distinction Between Privileged Forensic Work and Business Remediation
It is essential to maintain a clear and demonstrable distinction between the following two categories of activity:
1.  Palisade's privileged forensic investigation — This investigation is being conducted at the direction of C&H, as outside counsel to Lumos, for the primary purpose of assisting counsel in providing legal advice to Lumos. The investigation is undertaken in anticipation of litigation and regulatory proceedings. Palisade's work product, findings, reports, analyses, and related communications are covered by the attorney-client privilege and work product protection, subject to adherence to the protocols set forth in this memorandum.
2.  Lumos's internal IT remediation and security improvement efforts — These activities are being conducted by Lumos's engineering and information security teams (under the direction of Jason Haddad, CISO, and Brian Kowalski, VP of Engineering) for business purposes—specifically, to remediate the vulnerabilities exploited in the Incident and to strengthen the Platform's security posture. These activities include, without limitation, the deployment of multi-factor authentication (MFA) for all Platform users, the implementation of bot-detection and CAPTCHA mechanisms on the authentication endpoint, changes to rate-limiting and throttling configurations, integration of credential-screening services (e.g., checking user credentials against known breach databases), enhancement of monitoring and alerting rules in the WatchTower SIEM platform, and other security improvements identified by the Lumos team.
Lumos's internal remediation work is being conducted for business and operational purposes and is not privileged. The documentation of remediation activities—including engineering tickets, change management records, configuration changes, project plans, and internal status reports—will likely be discoverable in litigation or regulatory proceedings, and Lumos personnel should prepare such documentation with that understanding.
Lumos IT and security personnel should not commingle their own internal investigation notes, remediation documentation, or status reports with Palisade's privileged forensic work product. Internal remediation documents should not reference, incorporate, quote, summarize, or attach Palisade's findings or reports, and should not describe communications with C&H regarding the investigation. If Lumos personnel have questions about whether a particular document or communication would be considered privileged or non-privileged, they should consult with C&H before creating or distributing the document.
If Lumos's internal team identifies information or findings that may be relevant to the forensic investigation—for example, discovery of additional indicators of compromise, identification of previously undetected attack activity, or new information regarding the scope of data exposure—such information should be communicated to C&H through Allison Cho or Jason Haddad. C&H will then coordinate with Palisade as appropriate to incorporate such information into the forensic investigation.
B. Pre-Existing and Independently Generated Records
Certain Lumos records relevant to the Incident exist independently of the forensic investigation and were created in the ordinary course of Lumos's business operations prior to or without regard to C&H's engagement of Palisade. These records include, without limitation:
•  WatchTower/Aegis SIEM logs and alert data
•  Authentication logs generated by the Lumos Insight Platform
•  Network traffic logs and firewall logs generated by Lumos's infrastructure
•  API gateway logs
•  User session data and access records
•  System configuration files and architecture documentation
These underlying records are not themselves privileged by virtue of the forensic investigation. They were created for business and operational purposes and would exist irrespective of C&H's engagement of Palisade. The fact that Palisade reviews, analyzes, copies, or relies upon such records in the course of the forensic investigation does not render the underlying records privileged, and Lumos should expect that such records may be subject to discovery in litigation or regulatory proceedings.
However, Palisade's analysis, selection, compilation, organization, and conclusions drawn from such records—including which records Palisade chose to examine, how Palisade organized or filtered the data, what analytical methodologies Palisade applied, and the conclusions and opinions Palisade reached—are protected work product. The distinction between the underlying factual records and Palisade's analytical work product must be maintained.
Lumos should preserve all such underlying records in their native form pursuant to the litigation hold described in Section VII below. Preservation of native records should be accomplished through Lumos's own data retention and preservation processes, independent of any copies or images created by Palisade for purposes of the forensic investigation.
VII. Litigation Hold
A. Issuance.  Concurrent with this memorandum, C&H has directed and Lumos Analytics Inc. has issued an internal litigation hold notice dated June 18, 2024 (the "Litigation Hold"), directing the preservation of all records, data, and materials related to the credential-stuffing Incident. The Litigation Hold has been distributed to all identified custodians and relevant personnel. The issuance of the Litigation Hold reflects C&H's assessment that litigation and/or regulatory proceedings are reasonably anticipated in connection with the Incident, triggering Lumos's obligations to preserve potentially relevant evidence.
B. Scope of Litigation Hold
The Litigation Hold covers, without limitation, the following categories of records, data, and materials:
•  All server logs, authentication logs, and SIEM (WatchTower/Aegis) alert data from the period of May 1, 2024, through the present and continuing until the Litigation Hold is lifted.
•  All network traffic logs, firewall logs, load balancer logs, and CDN logs relevant to the attack window (June 12–15, 2024) and surrounding periods (at minimum, June 1, 2024, through the present).
•  Forensic images of affected systems created by Palisade or by Lumos's internal team, including all chain-of-custody documentation associated with such images.
•  All internal communications (including email, Meridian Solutions messages, Northgate Data Systems messages, and any other messaging platforms used by Lumos personnel) among Lumos personnel regarding the Incident, including communications with C&H and Palisade.
•  All communications with third parties regarding the Incident, including without limitation communications with:
•  NexTier Cyber Insurance Group and its claims adjuster, Martin Okubo
•  Aegis Security Solutions, Inc. (SIEM vendor)
•  Threshold Public Relations LLC (crisis communications), including communications with Janelle Morse
•  Harmon Watts & Kendrick LLP (UK/EU counsel), including communications with Catherine Wye
•  VaultSync Technologies, Inc. or its counsel (if any)
•  Any affected customers or users who have contacted Lumos regarding the Incident
•  User account data, session data, and access records for all 11,438 compromised accounts, including account profile data, session tokens, session timestamps, page access logs, and API call logs.
•  Records relating to the Quick View feature, including feature configuration data, cached data records, and data retention settings, and specifically including records for the 2,614 accounts with cached partial financial data.
•  Records relating to the 137 accounts with extended session durations exceeding thirty (30) seconds, including all available session data and any supplemental logs or records that may shed light on the activity conducted during those sessions.
•  All remediation records and change management documentation, including engineering tickets, configuration change records, deployment logs, project plans, and internal status reports related to security improvements implemented in response to the Incident.
•  Board and investor communications regarding the Incident, including board presentations, board minutes, committee minutes, and any communications with Ridgeline Capital Partners, LP or its personnel.
•  All records relating to Lumos's pre-Incident security posture and authentication infrastructure, including MFA configuration (or absence thereof), rate-limiting settings, bot-detection mechanisms, password policies, and any prior security assessments, penetration tests, or vulnerability scans relevant to the attack vector exploited in the Incident.
C. Custodians.  Key custodians subject to the Litigation Hold include the following individuals, each of whom has received a copy of the Litigation Hold notice and has been instructed to preserve all potentially relevant records in their possession, custody, or control:
•  Marcus Tan, Chief Executive Officer
•  Deepika Narayanan, Chief Technology Officer
•  Allison Cho, General Counsel & Chief Privacy Officer
•  Jason Haddad, VP of Information Security (CISO)
•  Brian Kowalski, VP of Engineering
•  Fiona Albrecht, Director of Customer Success
•  All members of the Lumos SOC team who were involved in the detection, triage, escalation, and containment of the Incident
C&H may identify additional custodians as the investigation progresses and will coordinate with Allison Cho to issue supplemental Litigation Hold notices as necessary.
D. Duration.  The Litigation Hold will remain in effect until C&H issues written notice that it may be lifted, following C&H's assessment of the regulatory and litigation landscape. No Lumos personnel should destroy, delete, modify, or allow the routine deletion of any records within the scope of the Litigation Hold without C&H's prior written authorization, regardless of any contrary document retention policies, automated deletion schedules, or storage management practices that may otherwise apply.
VIII. Coordination with Insurance Carrier
A notice of claim was submitted to NexTier Cyber Insurance Group ("NexTier" or the "Carrier") on June 20, 2024, under Policy No. NXT-CYB-2024-07812. The relevant policy parameters are as follows:
•  Policy period: January 1, 2024 – January 1, 2025
•  Per-occurrence limit: $15,000,000
•  Aggregate limit: $30,000,000
•  Per-claim retention (deductible): $500,000
•  Claims adjuster: Martin Okubo, NexTier Cyber Insurance Group
C&H is pre-approved panel counsel under the NexTier policy, and Palisade is a pre-approved forensic vendor on the NexTier panel. This pre-approval status facilitates the privilege-consistent engagement and billing structure described in this memorandum.
In the course of evaluating the claim, NexTier may request access to Palisade's forensic findings or to other information regarding the Incident. Any such requests from NexTier or from Martin Okubo must be directed to and coordinated through C&H. C&H will evaluate each such request and will ensure that any disclosure is made in a manner that does not waive the attorney-client privilege or work product protection. Potential frameworks for sharing information with NexTier include (a) the common-interest doctrine, pursuant to which the insurer and insured may share privileged information without waiver where they share a common legal interest; (b) specific policy provisions regarding the insured's cooperation obligations, which may permit or require certain disclosures; and (c) carefully structured oral briefings or redacted summaries that provide the Carrier with necessary information without full disclosure of privileged work product.
Palisade is not to communicate directly with NexTier or its claims adjuster, Martin Okubo, regarding any aspect of the forensic investigation, the Incident, or this engagement without C&H's prior authorization. Any inquiries from NexTier directed to Palisade should be immediately referred to C&H.
IX. Coordination with UK/EU Counsel
Harmon Watts & Kendrick LLP ("HWK"), led by Catherine Wye in their London office at 30 Finsbury Square, London EC2A 1AG, United Kingdom, has been engaged as coordinating counsel for UK Information Commissioner's Office ("ICO") notification and EU General Data Protection Regulation ("GDPR") analysis relating to Lumos's UK-based operations and the affected user accounts of UK- and EU-resident individuals.
Based on preliminary data provided by Lumos, 814 of the 11,438 compromised user accounts belong to UK-resident individuals, and an additional 47 compromised accounts belong to EU-resident individuals (across multiple EU member states). The UK GDPR and the Data Protection Act 2018 require notification to the ICO within seventy-two (72) hours of the data controller becoming aware of a personal data breach that is likely to result in a risk to the rights and freedoms of natural persons. Consistent with this requirement, HWK coordinated the filing of the ICO 72-hour notification on June 18, 2024, within the 72-hour window from Lumos's awareness of the Incident on June 15, 2024. The notification was filed on a preliminary basis, with an indication that further details would be provided as the forensic investigation progresses.
To the extent Palisade's forensic findings are relevant to the ICO notification, any subsequent ICO inquiry or investigation, or GDPR compliance analysis for EU-resident users, C&H will coordinate the sharing of appropriate information with HWK. Such sharing will be conducted under a common-interest framework, with privilege maintained. C&H and HWK have entered into a common-interest agreement to facilitate the exchange of privileged information in connection with the Incident.
Palisade should not communicate directly with HWK or any HWK personnel regarding the forensic investigation, the Incident, or this engagement without C&H's prior authorization. Any inquiries from HWK directed to Palisade should be immediately referred to C&H.
X. Crisis Communications Coordination
Threshold Public Relations LLC ("Threshold PR"), with account lead Janelle Morse, located at 375 Park Avenue, Suite 1410, New York, NY 10152, has been engaged by Lumos for crisis communications support and customer messaging in connection with the Incident. Threshold PR is assisting Lumos with the development of public statements, customer notifications, FAQs, media responses, and other communications materials.
It is important to note that Threshold PR is a business vendor of Lumos, retained by Lumos for public relations and communications purposes. Threshold PR's engagement is not structured through C&H, and Threshold PR's work product is generally not protected by the attorney-client privilege or the work product doctrine. Communications with Threshold PR and materials prepared by or shared with Threshold PR should be treated as non-privileged and potentially discoverable.
Accordingly, the following restrictions apply:
•  Palisade must not share any forensic findings, reports, analysis, or other work product with Threshold PR personnel, including Janelle Morse. Threshold PR is not an approved recipient of Palisade's privileged work product under any circumstances.
•  Any factual information regarding the Incident that is to be incorporated into public statements, customer communications, press materials, FAQs, or other externally facing documents must be reviewed and approved by C&H before dissemination. C&H will work with Allison Cho to determine what factual information may be appropriately shared with Threshold PR for communications purposes, and C&H will ensure that any information provided to Threshold PR does not include or reveal privileged forensic work product or attorney-client communications.
•  Lumos personnel should not forward, copy, or share any communications from C&H or Palisade with Threshold PR, and should not include Threshold PR personnel on any email threads, calls, or meetings that involve discussion of the forensic investigation or C&H's legal advice.
XI. Consequences of Non-Compliance
Failure to adhere to the privilege protocol set forth in this memorandum may result in waiver of the attorney-client privilege and/or work product protection over the forensic investigation and related communications. The consequences of such a waiver could be severe and far-reaching. In the event of regulatory investigations by state attorneys general, the Federal Trade Commission, the ICO, or other regulatory bodies, a waiver of privilege could result in compelled disclosure of Palisade's forensic findings, C&H's legal analysis and advice, and internal communications regarding the Incident. In the event of private litigation by affected individuals, enterprise customers, or other parties, a waiver could provide plaintiffs with access to the most sensitive and detailed analysis of the Incident, including analysis that might otherwise be shielded from disclosure.
Moreover, courts have held that privilege waivers in the context of data breach investigations may extend beyond the specific document or communication that was improperly disclosed, potentially resulting in a subject-matter waiver that encompasses all related privileged communications. See, e.g., In re Penmark Group, 2020 WL 3470261, at *6. The risks of non-compliance are therefore not limited to the specific instance of improper disclosure but may cascade to affect the privilege status of the entire body of privileged work product and communications generated in connection with the Incident.
All recipients of this memorandum are requested to acknowledge their understanding of and commitment to the protocols set forth herein. Each recipient should review this memorandum carefully and direct any questions regarding its application to specific situations to Rachel Bernstein (rachel.bernstein@calderwoodharkness.com) or Sara Hendricks (sara.hendricks@calderwoodharkness.com) at Calderwood & Harkness LLP, One Embarcadero Center, Suite 3400, San Francisco, CA 94111, telephone (415) 555-7200.
XII. Acknowledgment
By signing below, each undersigned acknowledges that they have read, understand, and agree to comply with the Forensic Vendor Retention Protocol and Privilege Framework set forth in this memorandum.
LUMOS ANALYTICS INC.
By: ________
Name: Allison Cho
Title: General Counsel & Chief Privacy Officer
Date: ________
LUMOS ANALYTICS INC.
By: ________
Name: Jason Haddad
Title: VP of Information Security (CISO)
Date: ________
LUMOS ANALYTICS INC.
By: ________
Name: Deepika Narayanan
Title: Chief Technology Officer
Date: ________
Note: A copy of this memorandum will be provided to Dr. Neil Frasier, Principal Consultant, at Palisade Digital Forensics, Inc. under separate cover, together with a request for Dr. Frasier's written acknowledgment of and agreement to comply with the protocols set forth herein. Dr. Frasier's acknowledgment will be maintained in C&H's files for this matter.
•          
CALDERWOOD & HARKNESS LLP
By: ________
Rachel Bernstein Partner, Privacy & Data Security
By: ________
Sara Hendricks Associate, Privacy & Data Security
C&H Matter No. 1008-00009 One Embarcadero Center, Suite 3400 San Francisco, CA 94111 Telephone: (415) 555-7200
PRIVILEGED AND CONFIDENTIAL — ATTORNEY-CLIENT PRIVILEGE / ATTORNEY WORK PRODUCT DO NOT DISTRIBUTE WITHOUT PRIOR AUTHORIZATION OF CALDERWOOD & HARKNESS LLP
TO: | Allison Cho, General Counsel & Chief Privacy Officer, Lumos Analytics Inc.
Jason Haddad, VP of Information Security (CISO), Lumos Analytics Inc.
Deepika Narayanan, Chief Technology Officer, Lumos Analytics Inc.
FROM: | Rachel Bernstein, Partner, Privacy & Data Security, Calderwood & Harkness LLP
Sara Hendricks, Associate, Privacy & Data Security, Calderwood & Harkness LLP
DATE: | June 18, 2024
RE: | Forensic Vendor Retention Protocol and Privilege Framework — Credential-Stuffing Incident Affecting the Lumos Insight Platform
C&H MATTER NO.: | 1008-00009

PRIVILEGED AND CONFIDENTIAL ATTORNEY-CLIENT PRIVILEGE / ATTORNEY WORK PRODUCT

DO NOT DISTRIBUTE WITHOUT PRIOR AUTHORIZATION OF CALDERWOOD & HARKNESS LLP

MEMORANDUM

LUMOS ANALYTICS INC.

LUMOS ANALYTICS INC.

LUMOS ANALYTICS INC.

CALDERWOOD & HARKNESS LLP

Record

Parties

Dates

Amounts