1008-00009 · Lumos Analytics Inc · Insurance

insurance-carrier-notice-letter.docx DOCUMENT Data Privacy

9 / 12 ← → ✕

Contract analysis Extract to table

CALDERWOOD & HARKNESS LLP ATTORNEYS AT LAW

CALDERWOOD & HARKNESS LLP One Embarcadero Center, Suite 3400 San Francisco, California 94111

Telephone: (415) 392-7400 Facsimile: (415) 392-7401 www.calderwoodharkness.com

Rachel Bernstein Partner, Privacy & Data Security Practice Direct: (415) 392-7418 rbernstein@calderwoodharkness.com

June 20, 2024

VIA EMAIL AND CERTIFIED MAIL, RETURN RECEIPT REQUESTED

Martin Okubo Claims Adjuster NexTier Cyber Insurance Group 200 West Madison Street, Suite 3600 Chicago, Illinois 60606

Re: Notice of Claim Under Cyber Liability and Technology Errors & Omissions Insurance Policy Policy Number: NXT-CYB-2024-07812 Named Insured: Lumos Analytics Inc. Date of Incident: June 12–15, 2024 C&H Matter Number: 1008-00009

Dear Mr. Okubo:

This firm represents Lumos Analytics Inc. ("Lumos" or the "Insured"), a Delaware corporation headquartered at 450 Folsom Street, Suite 1200, San Francisco, California 94105. The purpose of this letter is to provide formal notice of a claim and/or potential claim under the above-referenced Cyber Liability and Technology Errors & Omissions Insurance Policy (the "Policy"), Policy Number NXT-CYB-2024-07812, issued by NexTier Cyber Insurance Group ("NexTier") to Lumos, with a policy period of January 1, 2024 through January 1, 2025.

This notice of claim is being provided pursuant to the notice provisions set forth in the Policy and is intended to preserve all of Lumos's rights, remedies, and entitlements to coverage under the Policy. Lumos takes its notification obligations seriously and is providing this notice as promptly as practicable following discovery and preliminary assessment of the incident described below. The facts and circumstances set forth herein are based upon information presently available to Lumos and its counsel and are subject to supplementation as additional information becomes known through the ongoing forensic investigation and legal analysis.

The specific details of the claim are set forth in the sections that follow.

I. Policy Information

The relevant Policy information is as follows:

The Policy provides coverage for, among other things, incident response costs, breach notification expenses, credit monitoring and identity theft protection services, forensic investigation costs, legal fees and expenses, regulatory defense and penalty sub-limits, crisis communications, and related first-party and third-party coverages, all as more specifically defined and set forth in the Policy's insuring agreements, endorsements, and coverage grant provisions.

II. Description of the Insured

Lumos Analytics Inc. is a software-as-a-service ("SaaS") and financial technology analytics platform provider incorporated in the State of Delaware and headquartered in San Francisco, California. Founded in 2017, Lumos develops, operates, and maintains the "Lumos Insight Platform" — a proprietary cloud-based analytics tool used by financial institutions, insurance companies, wealth management firms, and other enterprise clients to aggregate and analyze portfolio performance data, client behavioral data, risk metrics, and related financial information.

At the time of the incident described herein, the Lumos Insight Platform was operating on version v4.7.2 (build 4.7.2-rel-20240601, released June 1, 2024). The platform serves approximately 4,200 enterprise customers and hosts approximately 286,000 individual registered user accounts. Users access the platform through authenticated web-based and API-based interfaces to configure dashboards, run analytics queries, and review aggregated financial and portfolio data.

Lumos's annual recurring revenue as of the second quarter of 2024 was approximately $187.4 million. The company employs approximately 1,120 individuals across its offices in San Francisco, California (headquarters), Austin, Texas, New York, New York, and London, United Kingdom. Lumos's majority equity holder is Ridgeline Capital Partners, LP, which served as the lead investor in Lumos's Series C financing round.

III. Description of the Incident

Lumos has experienced a cybersecurity incident involving unauthorized access to user accounts on the Lumos Insight Platform through a credential-stuffing attack. The material facts presently known regarding the incident are as follows:

Nature of the Attack. The incident involved a credential-stuffing attack — the automated, high-volume injection of previously compromised username and password pairs against the Lumos Insight Platform's authentication endpoints. Credential-stuffing attacks exploit the common practice among users of reusing the same username and password combinations across multiple online services and platforms.

Source of Compromised Credentials. Based on information currently available, Lumos and its forensic investigators believe that the credential pairs used in the attack were obtained from an unrelated data breach at VaultSync Technologies, Inc. ("VaultSync"), a consumer cloud storage provider. VaultSync publicly disclosed its own data breach on May 28, 2024, and credential dumps associated with the VaultSync breach were subsequently observed circulating on dark web forums and paste sites in the days following that disclosure. The temporal correlation between the VaultSync breach disclosure and the commencement of the credential-stuffing attack against Lumos, together with preliminary analysis of the credential formats employed, supports this assessment, though forensic confirmation is ongoing.

Attack Window. The credential-stuffing attack commenced on approximately June 12, 2024, at approximately 02:14 UTC and continued through approximately June 15, 2024, at approximately 19:47 UTC. The total duration of the attack window was approximately 65.5 hours. During this period, the attack activity was not constant but occurred in bursts of varying intensity, with the highest volumes observed during off-peak hours (UTC) when legitimate platform traffic was at its lowest.

Volume of Login Attempts. Approximately 2.16 million login attempts were observed during the attack window. These attempts originated from 1,247 unique source IP addresses. Geolocation analysis of those IP addresses indicates that they were primarily located in Eastern Europe and Southeast Asia, consistent with known patterns for botnet-driven credential-stuffing infrastructure.

Successful Unauthorized Access. Of the approximately 2.16 million login attempts, 11,438 resulted in successful authentication — meaning that the threat actor(s) obtained access to 11,438 individual user accounts on the Lumos Insight Platform. This represents a success rate of approximately 0.53% of total login attempts, which is consistent with industry-observed credential-stuffing success rates and further supports the assessment that the attack relied upon recycled credentials from an external breach rather than any compromise of Lumos's own credential stores.

Enterprise Customers Affected. The 11,438 compromised user accounts belonged to users across 847 distinct enterprise customer tenants, out of Lumos's total base of approximately 4,200 enterprise customers. Accordingly, approximately 20.2% of Lumos's enterprise customer base had at least one user account among those that were accessed during the incident.

Detection. The attack was detected on June 15, 2024, at approximately 14:22 UTC, when Lumos's Security Information and Event Management ("SIEM") platform — branded "WatchTower" and provided by Aegis Security Solutions, Inc. — triggered a series of anomaly alerts. These alerts were based on volumetric login pattern analysis (i.e., the abnormally high volume of failed and successful authentication attempts) and geographic IP anomalies (i.e., login attempts from unusual geographic locations relative to the historical baseline for affected accounts). Following triage by Lumos's internal Security Operations Center ("SOC"), the credential-stuffing incident was confirmed at approximately 16:08 UTC on June 15, 2024, and incident response protocols were activated.

Containment. Lumos executed immediate containment measures, which were substantially completed by approximately 20:30 UTC on June 15, 2024. These measures included a global password reset for all approximately 286,000 registered user accounts on the Lumos Insight Platform and the blocking of all 1,247 identified offending IP address ranges at the network perimeter. Additional containment and remediation steps taken in the following days are described in Section VII below.

IV. Data Categories Potentially Exposed

Based on Lumos's preliminary assessment of the data accessible within the Lumos Insight Platform's user interface for authenticated users, the following categories of data were potentially exposed for the 11,438 user accounts that were accessed during the attack:

Data Accessible for All 11,438 Accessed Accounts. For each of the 11,438 accounts to which unauthorized access was obtained, the following data elements were accessible within the user profile and account interface:

• Full name (first and last)

• Email address

• Job title

• Employer name

• Phone number (note: the phone number field was populated for approximately 7,820 of the 11,438 accessed accounts, representing approximately 68.4% of accessed accounts; the remaining accounts had not provided a phone number)

• Dashboard configurations and saved analytics queries, which constitute proprietary business data belonging to the respective enterprise customer

Additional Data for Accounts with "Quick View" Enabled. For 2,614 of the 11,438 accessed accounts — representing approximately 22.9% of the total accessed accounts — the individual user had enabled a platform feature known as "Quick View." The Quick View feature cached partial portfolio data on the user's profile page for at-a-glance review. For these 2,614 accounts, the following additional data categories were potentially exposed:

• Partial financial account numbers (last four digits only)

• Account balances

• Asset allocation summaries

Data Not Exposed. Lumos confirms that no Social Security numbers, full financial account numbers, or payment card data (e.g., credit or debit card numbers, CVV codes, or expiration dates) were stored on user-facing profile pages or otherwise accessible via the Lumos Insight Platform's user interface. Accordingly, these categories of highly sensitive personal data are not believed to have been exposed as a result of this incident.

Potential Manual Review by Threat Actor(s). Lumos's preliminary log analysis has identified 137 accounts — out of the 11,438 total accessed accounts — for which the session duration following the successful unauthorized login exceeded 30 seconds. The extended session durations for these 137 accounts may indicate manual review or browsing of the account contents by the threat actor(s), as opposed to purely automated credential validation. This subset of accounts is receiving heightened scrutiny during the forensic investigation, and further details will be provided as they become available.

V. Forensic Investigation

At the direction of Calderwood & Harkness LLP, and in a manner designed to preserve attorney-client privilege and work product protections to the greatest extent possible, Lumos has retained Palisade Digital Forensics, Inc. ("Palisade"), headquartered in Seattle, Washington, as an independent third-party digital forensics and incident response firm to conduct a comprehensive forensic investigation of the incident. The engagement is being directed by Dr. Neil Frasier, Principal Consultant at Palisade, who serves as the engagement lead.

Palisade was formally retained on June 18, 2024, and its investigation commenced immediately thereafter. The investigation is currently underway and has not yet concluded. Preliminary indications from Palisade's initial assessment — which remain subject to completion of the full forensic analysis and delivery of a final report — include the following:

1. No compromise of internal systems. There is currently no evidence of compromise of Lumos's internal systems, databases, infrastructure, source code repositories, or credential stores. All unauthorized access to the 11,438 user accounts was accomplished using valid user credentials that were obtained externally (i.e., from the VaultSync breach or related credential dumps) and submitted through Lumos's standard authentication endpoints.

2. No evidence of bulk data exfiltration. There is currently no evidence that bulk data exfiltration occurred during the attack. The overwhelming majority of unauthorized access sessions were of short duration, consistent with automated credential validation (i.e., confirming the validity of a username/password pair) rather than systematic data harvesting. As noted above, 137 accounts exhibited session durations exceeding 30 seconds, and these accounts are being analyzed in greater detail.

3. No evidence of malware deployment. There is currently no evidence that malware, ransomware, backdoors, web shells, or any other form of malicious software was deployed within the Lumos environment as a result of the incident.

4. No evidence of lateral movement or privilege escalation. There is currently no evidence that the threat actor(s) achieved lateral movement within the Lumos environment, escalated privileges beyond those associated with the compromised user accounts, or accessed any systems, databases, or resources beyond those available to an authenticated standard-tier user through the Lumos Insight Platform's user interface.

Palisade is expected to deliver its preliminary findings within the coming days. A final forensic report, including a comprehensive timeline of the attack, detailed analysis of impacted data, and remediation recommendations, will follow upon completion of the investigation. Lumos will share relevant findings with NexTier as appropriate, subject to applicable privilege considerations.

VI. Breach Response Counsel

Calderwood & Harkness LLP was retained by Lumos Analytics Inc. on June 18, 2024, as lead outside counsel for all aspects of the incident response, including but not limited to breach notification analysis, multi-jurisdictional regulatory engagement, customer and individual communications, litigation readiness and defense, and coordination with the forensic investigation.

Calderwood & Harkness LLP confirms that it is pre-approved panel counsel under the NexTier Policy, Policy Number NXT-CYB-2024-07812, and therefore eligible for coverage of its fees and expenses pursuant to the Policy's terms.

The Calderwood & Harkness engagement team for this matter is as follows:

• Rachel Bernstein — Responsible Partner, Privacy & Data Security Practice

• Kevin Ostrowski — Billing Partner, Privacy & Data Security Practice

• Sara Hendricks — Lead Associate, Privacy & Data Security Practice

• Priscilla Wynn — Working Associate, Privacy & Data Security Practice

In addition to Calderwood & Harkness LLP, Lumos has engaged the following additional professional service providers in connection with the incident response:

• Harmon Watts & Kendrick LLP (London, United Kingdom) — retained as coordinating counsel for notification to the United Kingdom Information Commissioner's Office ("ICO") and analysis under the European Union General Data Protection Regulation ("GDPR") and the UK Data Protection Act 2018. The engagement is led by Catherine Wye, Partner, Data Privacy and Cybersecurity.

• Threshold Public Relations LLC (New York, New York) — retained for crisis communications support, including media strategy, enterprise customer communications planning, and public messaging. The engagement is led by Janelle Morse, Senior Managing Director.

VII. Immediate Containment and Remediation Steps Taken

In addition to the containment measures described in Section III above, Lumos has taken the following steps in response to the incident:

1. Global password reset — All approximately 286,000 registered user accounts on the Lumos Insight Platform were subject to a mandatory password reset. Affected users were required to establish new credentials upon their next login. This measure was completed on June 15, 2024.

2. IP blocking — The 1,247 source IP address ranges identified as associated with the credential-stuffing attack were blocked at the network perimeter. This measure was completed on June 15, 2024.

3. Disabling of "Quick View" feature — The Quick View cached data feature, which cached partial portfolio data on user profile pages for the 2,614 accounts that had enabled the feature, was disabled platform-wide. This measure was completed on June 16, 2024.

4. Litigation hold — A comprehensive internal litigation hold was issued covering all incident-related records, system and application logs, security event data, communications, forensic images, and related materials. The litigation hold was issued on June 18, 2024, and has been distributed to all relevant custodians within the organization.

5. ICO 72-hour notification — In coordination with Harmon Watts & Kendrick LLP, Lumos filed a 72-hour breach notification with the United Kingdom Information Commissioner's Office on June 18, 2024, with respect to 814 UK-resident individuals whose accounts were among the 11,438 accounts accessed during the incident. This filing was made within the 72-hour notification window prescribed by Article 33 of the UK GDPR.

6. Additional remediation measures — Lumos is currently planning and implementing additional remediation measures to harden the Lumos Insight Platform's authentication infrastructure and reduce the risk of future credential-stuffing attacks. These measures include, but are not limited to:

• Mandatory multi-factor authentication ("MFA") rollout for all user accounts

• Deployment of advanced bot-detection and CAPTCHA mechanisms at authentication endpoints

• Authentication rate-limiting enhancements to throttle high-volume login attempts

• Integration of credential-screening services to check user-submitted passwords against known breached credential databases at the time of account creation and password changes

VIII. Anticipated Costs and Expenses

While it is premature to provide a final or comprehensive estimate of total incident response costs, and while costs will continue to accrue as the investigation and response progress, Lumos anticipates that the following categories of costs and expenses will be incurred in connection with the incident and for which coverage under the Policy is expected:

• Legal fees and expenses — Fees and costs incurred by Calderwood & Harkness LLP (as pre-approved panel counsel) and Harmon Watts & Kendrick LLP (as UK/EU coordinating counsel) in connection with incident response, breach notification analysis, regulatory engagement, customer communications, and litigation readiness.

• Forensic investigation costs — Fees and costs incurred by Palisade Digital Forensics, Inc. for the forensic investigation, evidence preservation, log analysis, and preparation of forensic reports.

• Crisis communications costs — Fees and costs incurred by Threshold Public Relations LLC for crisis communications strategy, media management, and enterprise customer communications support.

• Breach notification costs — Multi-jurisdictional individual and regulatory breach notification costs, including printing, postage, mailing services, email notification platform costs, and associated administrative expenses.

• Credit monitoring and identity theft protection — Costs of providing credit monitoring and identity theft protection services to affected individuals. Lumos anticipates engaging Sentinel Identity Services, Inc. (Atlanta, Georgia) as the credit monitoring vendor, subject to NexTier's approval if required under the Policy.

• Regulatory response and defense costs — Costs associated with responding to regulatory inquiries, investigations, or enforcement actions by state attorneys general, the UK ICO, or other regulatory authorities.

• Third-party claims and litigation defense — Costs associated with defending against potential third-party claims, demands, or litigation arising from the incident, including claims by affected individuals, enterprise customers, or business partners.

Lumos acknowledges the $500,000 per-claim self-insured retention applicable under the Policy and will diligently track all costs and expenses against the retention threshold. Lumos will provide NexTier with updated cost estimates and supporting documentation — including invoices, engagement letters, and vendor agreements — as the response progresses and as costs are incurred.

IX. Notification Obligations — Preliminary Assessment

The 11,438 individuals whose accounts were accessed during the incident reside across all 50 United States, the District of Columbia, Puerto Rico, and the United Kingdom. Accordingly, Lumos anticipates that multi-jurisdictional individual and regulatory breach notification obligations will apply under the various state breach notification statutes, as well as under the UK GDPR and the UK Data Protection Act 2018.

A comprehensive, state-by-state and jurisdiction-by-jurisdiction breach notification analysis is currently being prepared by Calderwood & Harkness LLP. This analysis will be finalized following receipt of Palisade Digital Forensics' final forensic report, which will confirm the precise scope and nature of the data accessed and the identities and residences of all affected individuals.

Certain states with particularly restrictive notification timelines are expected to drive the overall notification schedule. For example, Colorado (C.R.S. § 6-1-716) and Florida (Fla. Stat. § 501.171) each require notification to affected individuals within 30 days of determination that a breach has occurred. Lumos is aware of these accelerated deadlines and is taking steps to ensure that notification can be initiated within the most restrictive applicable timeframes.

As noted in Section VII above, the required 72-hour notification to the UK Information Commissioner's Office has already been filed. Individual notifications to the 814 UK-resident affected users are being planned in coordination with Harmon Watts & Kendrick LLP.

X. Significant Enterprise Customers Affected

Among the 847 enterprise customer tenants affected by the incident, certain high-profile enterprise customers have been identified. These customers are entities with significant market presence and regulatory profiles, and the impact of the incident on their user accounts warrants particular attention in the context of Lumos's notification and communications strategy. The most significant affected enterprise customers identified to date include, but are not limited to:

• Cascadia National Bancorp (Portland, Oregon) — 312 of its 1,247 Lumos user accounts were among the 11,438 accounts accessed during the incident. Cascadia National Bancorp is a publicly traded bank holding company and is subject to federal banking regulatory oversight.

• Ironbridge Insurance Holdings, Inc. (Philadelphia, Pennsylvania) — 204 of its user accounts were accessed during the incident. Ironbridge is a multi-line insurance holding company subject to state insurance regulatory oversight in multiple jurisdictions.

• Monarch Wealth Advisors, LLC (Hartford, Connecticut) — 89 of its user accounts were accessed during the incident. Monarch is a registered investment adviser subject to oversight by the Securities and Exchange Commission.

Enterprise customer notifications are being planned by Lumos, in coordination with Calderwood & Harkness LLP and Threshold Public Relations LLC, and will be coordinated with the individual user notifications described in Section IX above. Lumos is aware that certain of its enterprise customer agreements may contain contractual notification obligations with specific timelines and procedures, and those contractual requirements are being separately analyzed.

XI. Requests

In light of the foregoing, Lumos respectfully requests that NexTier take the following actions:

1. Acknowledge receipt of this notice of claim in writing at your earliest convenience.

2. Confirm coverage under Policy Number NXT-CYB-2024-07812 for the incident described herein, subject to the terms, conditions, exclusions, and limitations of the Policy.

3. Assign a dedicated claims handler for this matter to facilitate ongoing coordination between NexTier, Calderwood & Harkness LLP, and Lumos.

4. Confirm approval of breach response counsel — specifically, confirm that Calderwood & Harkness LLP is approved as breach response counsel under the Policy in its capacity as pre-approved panel counsel.

5. Advise of any additional information or documentation required by NexTier to process this claim, including any specific forms, authorizations, or supplemental materials.

Lumos will cooperate fully with NexTier throughout the claims process and will provide regular updates on the status of the forensic investigation, the breach notification process, the engagement of vendors and service providers, and the tracking of costs and expenses against the self-insured retention and policy limits.

XII. Reservation of Rights

This notice of claim is provided for the purpose of preserving all of Lumos's rights, remedies, and entitlements under the Policy and applicable law. Nothing in this letter is intended to, nor shall it be construed to, limit, waive, modify, or relinquish any coverage, rights, or defenses available to Lumos under the Policy or otherwise.

Lumos expressly reserves the right to supplement, amend, or update this notice as additional facts, circumstances, and information become known through the ongoing forensic investigation, legal analysis, regulatory engagement, and incident response process. Any failure to identify a specific category of loss, expense, or potential claim in this letter shall not constitute a waiver of Lumos's right to seek coverage for such loss, expense, or claim under the Policy.

XIII. Contact Information

All communications regarding this claim should be directed to the following:

Primary Contact — Outside Counsel:

Rachel Bernstein, Partner Calderwood & Harkness LLP One Embarcadero Center, Suite 3400 San Francisco, California 94111 Telephone: (415) 392-7418

Email: rbernstein@calderwoodharkness.com

With a copy to — Insured's In-House Counsel:

Allison Cho, General Counsel & Chief Privacy Officer Lumos Analytics Inc. 450 Folsom Street, Suite 1200 San Francisco, California 94105 Telephone: (415) 555-2900

Email: allison.cho@lumosanalytics.com

We appreciate NexTier's prompt attention to this matter and look forward to working cooperatively with your claims team throughout the response process. Please do not hesitate to contact me directly if you have any questions or require any additional information.

Very truly yours,

CALDERWOOD & HARKNESS LLP

By: ________

Rachel Bernstein Partner, Privacy & Data Security Practice Calderwood & Harkness LLP One Embarcadero Center, Suite 3400 San Francisco, California 94111

Enclosures: None

cc:

Allison Cho, General Counsel & Chief Privacy Officer, Lumos Analytics Inc. Kevin Ostrowski, Partner, Calderwood & Harkness LLP

Item	Detail
Policy Number	NXT-CYB-2024-07812
Named Insured	Lumos Analytics Inc.
Insured EIN	83-2197564
Delaware Entity File Number	6284731
Policy Period	January 1, 2024 through January 1, 2025
Per-Occurrence Limit	$15,000,000
Aggregate Limit	$30,000,000
Self-Insured Retention (SIR)	$500,000 per claim
Coverage Type	Cyber Liability and Technology Errors & Omissions

CALDERWOOD & HARKNESS LLP ATTORNEYS AT LAW
CALDERWOOD & HARKNESS LLP One Embarcadero Center, Suite 3400 San Francisco, California 94111
Telephone: (415) 392-7400 Facsimile: (415) 392-7401 www.calderwoodharkness.com
Rachel Bernstein Partner, Privacy & Data Security Practice Direct: (415) 392-7418 rbernstein@calderwoodharkness.com
June 20, 2024
VIA EMAIL AND CERTIFIED MAIL, RETURN RECEIPT REQUESTED
Martin Okubo Claims Adjuster NexTier Cyber Insurance Group 200 West Madison Street, Suite 3600 Chicago, Illinois 60606
Re: Notice of Claim Under Cyber Liability and Technology Errors & Omissions Insurance Policy Policy Number: NXT-CYB-2024-07812 Named Insured: Lumos Analytics Inc. Date of Incident: June 12–15, 2024 C&H Matter Number: 1008-00009
Dear Mr. Okubo:
This firm represents Lumos Analytics Inc. ("Lumos" or the "Insured"), a Delaware corporation headquartered at 450 Folsom Street, Suite 1200, San Francisco, California 94105. The purpose of this letter is to provide formal notice of a claim and/or potential claim under the above-referenced Cyber Liability and Technology Errors & Omissions Insurance Policy (the "Policy"), Policy Number NXT-CYB-2024-07812, issued by NexTier Cyber Insurance Group ("NexTier") to Lumos, with a policy period of January 1, 2024 through January 1, 2025.
This notice of claim is being provided pursuant to the notice provisions set forth in the Policy and is intended to preserve all of Lumos's rights, remedies, and entitlements to coverage under the Policy. Lumos takes its notification obligations seriously and is providing this notice as promptly as practicable following discovery and preliminary assessment of the incident described below. The facts and circumstances set forth herein are based upon information presently available to Lumos and its counsel and are subject to supplementation as additional information becomes known through the ongoing forensic investigation and legal analysis.
The specific details of the claim are set forth in the sections that follow.
I. Policy Information
The relevant Policy information is as follows:
The Policy provides coverage for, among other things, incident response costs, breach notification expenses, credit monitoring and identity theft protection services, forensic investigation costs, legal fees and expenses, regulatory defense and penalty sub-limits, crisis communications, and related first-party and third-party coverages, all as more specifically defined and set forth in the Policy's insuring agreements, endorsements, and coverage grant provisions.
II. Description of the Insured
Lumos Analytics Inc. is a software-as-a-service ("SaaS") and financial technology analytics platform provider incorporated in the State of Delaware and headquartered in San Francisco, California. Founded in 2017, Lumos develops, operates, and maintains the "Lumos Insight Platform" — a proprietary cloud-based analytics tool used by financial institutions, insurance companies, wealth management firms, and other enterprise clients to aggregate and analyze portfolio performance data, client behavioral data, risk metrics, and related financial information.
At the time of the incident described herein, the Lumos Insight Platform was operating on version v4.7.2 (build 4.7.2-rel-20240601, released June 1, 2024). The platform serves approximately 4,200 enterprise customers and hosts approximately 286,000 individual registered user accounts. Users access the platform through authenticated web-based and API-based interfaces to configure dashboards, run analytics queries, and review aggregated financial and portfolio data.
Lumos's annual recurring revenue as of the second quarter of 2024 was approximately $187.4 million. The company employs approximately 1,120 individuals across its offices in San Francisco, California (headquarters), Austin, Texas, New York, New York, and London, United Kingdom. Lumos's majority equity holder is Ridgeline Capital Partners, LP, which served as the lead investor in Lumos's Series C financing round.
III. Description of the Incident
Lumos has experienced a cybersecurity incident involving unauthorized access to user accounts on the Lumos Insight Platform through a credential-stuffing attack. The material facts presently known regarding the incident are as follows:
Nature of the Attack. The incident involved a credential-stuffing attack — the automated, high-volume injection of previously compromised username and password pairs against the Lumos Insight Platform's authentication endpoints. Credential-stuffing attacks exploit the common practice among users of reusing the same username and password combinations across multiple online services and platforms.
Source of Compromised Credentials. Based on information currently available, Lumos and its forensic investigators believe that the credential pairs used in the attack were obtained from an unrelated data breach at VaultSync Technologies, Inc. ("VaultSync"), a consumer cloud storage provider. VaultSync publicly disclosed its own data breach on May 28, 2024, and credential dumps associated with the VaultSync breach were subsequently observed circulating on dark web forums and paste sites in the days following that disclosure. The temporal correlation between the VaultSync breach disclosure and the commencement of the credential-stuffing attack against Lumos, together with preliminary analysis of the credential formats employed, supports this assessment, though forensic confirmation is ongoing.
Attack Window. The credential-stuffing attack commenced on approximately June 12, 2024, at approximately 02:14 UTC and continued through approximately June 15, 2024, at approximately 19:47 UTC. The total duration of the attack window was approximately 65.5 hours. During this period, the attack activity was not constant but occurred in bursts of varying intensity, with the highest volumes observed during off-peak hours (UTC) when legitimate platform traffic was at its lowest.
Volume of Login Attempts. Approximately 2.16 million login attempts were observed during the attack window. These attempts originated from 1,247 unique source IP addresses. Geolocation analysis of those IP addresses indicates that they were primarily located in Eastern Europe and Southeast Asia, consistent with known patterns for botnet-driven credential-stuffing infrastructure.
Successful Unauthorized Access. Of the approximately 2.16 million login attempts, 11,438 resulted in successful authentication — meaning that the threat actor(s) obtained access to 11,438 individual user accounts on the Lumos Insight Platform. This represents a success rate of approximately 0.53% of total login attempts, which is consistent with industry-observed credential-stuffing success rates and further supports the assessment that the attack relied upon recycled credentials from an external breach rather than any compromise of Lumos's own credential stores.
Enterprise Customers Affected. The 11,438 compromised user accounts belonged to users across 847 distinct enterprise customer tenants, out of Lumos's total base of approximately 4,200 enterprise customers. Accordingly, approximately 20.2% of Lumos's enterprise customer base had at least one user account among those that were accessed during the incident.
Detection. The attack was detected on June 15, 2024, at approximately 14:22 UTC, when Lumos's Security Information and Event Management ("SIEM") platform — branded "WatchTower" and provided by Aegis Security Solutions, Inc. — triggered a series of anomaly alerts. These alerts were based on volumetric login pattern analysis (i.e., the abnormally high volume of failed and successful authentication attempts) and geographic IP anomalies (i.e., login attempts from unusual geographic locations relative to the historical baseline for affected accounts). Following triage by Lumos's internal Security Operations Center ("SOC"), the credential-stuffing incident was confirmed at approximately 16:08 UTC on June 15, 2024, and incident response protocols were activated.
Containment. Lumos executed immediate containment measures, which were substantially completed by approximately 20:30 UTC on June 15, 2024. These measures included a global password reset for all approximately 286,000 registered user accounts on the Lumos Insight Platform and the blocking of all 1,247 identified offending IP address ranges at the network perimeter. Additional containment and remediation steps taken in the following days are described in Section VII below.
IV. Data Categories Potentially Exposed
Based on Lumos's preliminary assessment of the data accessible within the Lumos Insight Platform's user interface for authenticated users, the following categories of data were potentially exposed for the 11,438 user accounts that were accessed during the attack:
Data Accessible for All 11,438 Accessed Accounts. For each of the 11,438 accounts to which unauthorized access was obtained, the following data elements were accessible within the user profile and account interface:
• Full name (first and last)
• Email address
• Job title
• Employer name
• Phone number (note: the phone number field was populated for approximately 7,820 of the 11,438 accessed accounts, representing approximately 68.4% of accessed accounts; the remaining accounts had not provided a phone number)
• Dashboard configurations and saved analytics queries, which constitute proprietary business data belonging to the respective enterprise customer
Additional Data for Accounts with "Quick View" Enabled. For 2,614 of the 11,438 accessed accounts — representing approximately 22.9% of the total accessed accounts — the individual user had enabled a platform feature known as "Quick View." The Quick View feature cached partial portfolio data on the user's profile page for at-a-glance review. For these 2,614 accounts, the following additional data categories were potentially exposed:
• Partial financial account numbers (last four digits only)
• Account balances
• Asset allocation summaries
Data Not Exposed. Lumos confirms that no Social Security numbers, full financial account numbers, or payment card data (e.g., credit or debit card numbers, CVV codes, or expiration dates) were stored on user-facing profile pages or otherwise accessible via the Lumos Insight Platform's user interface. Accordingly, these categories of highly sensitive personal data are not believed to have been exposed as a result of this incident.
Potential Manual Review by Threat Actor(s). Lumos's preliminary log analysis has identified 137 accounts — out of the 11,438 total accessed accounts — for which the session duration following the successful unauthorized login exceeded 30 seconds. The extended session durations for these 137 accounts may indicate manual review or browsing of the account contents by the threat actor(s), as opposed to purely automated credential validation. This subset of accounts is receiving heightened scrutiny during the forensic investigation, and further details will be provided as they become available.
V. Forensic Investigation
At the direction of Calderwood & Harkness LLP, and in a manner designed to preserve attorney-client privilege and work product protections to the greatest extent possible, Lumos has retained Palisade Digital Forensics, Inc. ("Palisade"), headquartered in Seattle, Washington, as an independent third-party digital forensics and incident response firm to conduct a comprehensive forensic investigation of the incident. The engagement is being directed by Dr. Neil Frasier, Principal Consultant at Palisade, who serves as the engagement lead.
Palisade was formally retained on June 18, 2024, and its investigation commenced immediately thereafter. The investigation is currently underway and has not yet concluded. Preliminary indications from Palisade's initial assessment — which remain subject to completion of the full forensic analysis and delivery of a final report — include the following:
1. No compromise of internal systems. There is currently no evidence of compromise of Lumos's internal systems, databases, infrastructure, source code repositories, or credential stores. All unauthorized access to the 11,438 user accounts was accomplished using valid user credentials that were obtained externally (i.e., from the VaultSync breach or related credential dumps) and submitted through Lumos's standard authentication endpoints.
2. No evidence of bulk data exfiltration. There is currently no evidence that bulk data exfiltration occurred during the attack. The overwhelming majority of unauthorized access sessions were of short duration, consistent with automated credential validation (i.e., confirming the validity of a username/password pair) rather than systematic data harvesting. As noted above, 137 accounts exhibited session durations exceeding 30 seconds, and these accounts are being analyzed in greater detail.
3. No evidence of malware deployment. There is currently no evidence that malware, ransomware, backdoors, web shells, or any other form of malicious software was deployed within the Lumos environment as a result of the incident.
4. No evidence of lateral movement or privilege escalation. There is currently no evidence that the threat actor(s) achieved lateral movement within the Lumos environment, escalated privileges beyond those associated with the compromised user accounts, or accessed any systems, databases, or resources beyond those available to an authenticated standard-tier user through the Lumos Insight Platform's user interface.
Palisade is expected to deliver its preliminary findings within the coming days. A final forensic report, including a comprehensive timeline of the attack, detailed analysis of impacted data, and remediation recommendations, will follow upon completion of the investigation. Lumos will share relevant findings with NexTier as appropriate, subject to applicable privilege considerations.
VI. Breach Response Counsel
Calderwood & Harkness LLP was retained by Lumos Analytics Inc. on June 18, 2024, as lead outside counsel for all aspects of the incident response, including but not limited to breach notification analysis, multi-jurisdictional regulatory engagement, customer and individual communications, litigation readiness and defense, and coordination with the forensic investigation.
Calderwood & Harkness LLP confirms that it is pre-approved panel counsel under the NexTier Policy, Policy Number NXT-CYB-2024-07812, and therefore eligible for coverage of its fees and expenses pursuant to the Policy's terms.
The Calderwood & Harkness engagement team for this matter is as follows:
• Rachel Bernstein — Responsible Partner, Privacy & Data Security Practice
• Kevin Ostrowski — Billing Partner, Privacy & Data Security Practice
• Sara Hendricks — Lead Associate, Privacy & Data Security Practice
• Priscilla Wynn — Working Associate, Privacy & Data Security Practice
In addition to Calderwood & Harkness LLP, Lumos has engaged the following additional professional service providers in connection with the incident response:
• Harmon Watts & Kendrick LLP (London, United Kingdom) — retained as coordinating counsel for notification to the United Kingdom Information Commissioner's Office ("ICO") and analysis under the European Union General Data Protection Regulation ("GDPR") and the UK Data Protection Act 2018. The engagement is led by Catherine Wye, Partner, Data Privacy and Cybersecurity.
• Threshold Public Relations LLC (New York, New York) — retained for crisis communications support, including media strategy, enterprise customer communications planning, and public messaging. The engagement is led by Janelle Morse, Senior Managing Director.
VII. Immediate Containment and Remediation Steps Taken
In addition to the containment measures described in Section III above, Lumos has taken the following steps in response to the incident:
1. Global password reset — All approximately 286,000 registered user accounts on the Lumos Insight Platform were subject to a mandatory password reset. Affected users were required to establish new credentials upon their next login. This measure was completed on June 15, 2024.
2. IP blocking — The 1,247 source IP address ranges identified as associated with the credential-stuffing attack were blocked at the network perimeter. This measure was completed on June 15, 2024.
3. Disabling of "Quick View" feature — The Quick View cached data feature, which cached partial portfolio data on user profile pages for the 2,614 accounts that had enabled the feature, was disabled platform-wide. This measure was completed on June 16, 2024.
4. Litigation hold — A comprehensive internal litigation hold was issued covering all incident-related records, system and application logs, security event data, communications, forensic images, and related materials. The litigation hold was issued on June 18, 2024, and has been distributed to all relevant custodians within the organization.
5. ICO 72-hour notification — In coordination with Harmon Watts & Kendrick LLP, Lumos filed a 72-hour breach notification with the United Kingdom Information Commissioner's Office on June 18, 2024, with respect to 814 UK-resident individuals whose accounts were among the 11,438 accounts accessed during the incident. This filing was made within the 72-hour notification window prescribed by Article 33 of the UK GDPR.
6. Additional remediation measures — Lumos is currently planning and implementing additional remediation measures to harden the Lumos Insight Platform's authentication infrastructure and reduce the risk of future credential-stuffing attacks. These measures include, but are not limited to:
• Mandatory multi-factor authentication ("MFA") rollout for all user accounts
• Deployment of advanced bot-detection and CAPTCHA mechanisms at authentication endpoints
• Authentication rate-limiting enhancements to throttle high-volume login attempts
• Integration of credential-screening services to check user-submitted passwords against known breached credential databases at the time of account creation and password changes
VIII. Anticipated Costs and Expenses
While it is premature to provide a final or comprehensive estimate of total incident response costs, and while costs will continue to accrue as the investigation and response progress, Lumos anticipates that the following categories of costs and expenses will be incurred in connection with the incident and for which coverage under the Policy is expected:
• Legal fees and expenses — Fees and costs incurred by Calderwood & Harkness LLP (as pre-approved panel counsel) and Harmon Watts & Kendrick LLP (as UK/EU coordinating counsel) in connection with incident response, breach notification analysis, regulatory engagement, customer communications, and litigation readiness.
• Forensic investigation costs — Fees and costs incurred by Palisade Digital Forensics, Inc. for the forensic investigation, evidence preservation, log analysis, and preparation of forensic reports.
• Crisis communications costs — Fees and costs incurred by Threshold Public Relations LLC for crisis communications strategy, media management, and enterprise customer communications support.
• Breach notification costs — Multi-jurisdictional individual and regulatory breach notification costs, including printing, postage, mailing services, email notification platform costs, and associated administrative expenses.
• Credit monitoring and identity theft protection — Costs of providing credit monitoring and identity theft protection services to affected individuals. Lumos anticipates engaging Sentinel Identity Services, Inc. (Atlanta, Georgia) as the credit monitoring vendor, subject to NexTier's approval if required under the Policy.
• Regulatory response and defense costs — Costs associated with responding to regulatory inquiries, investigations, or enforcement actions by state attorneys general, the UK ICO, or other regulatory authorities.
• Third-party claims and litigation defense — Costs associated with defending against potential third-party claims, demands, or litigation arising from the incident, including claims by affected individuals, enterprise customers, or business partners.
Lumos acknowledges the $500,000 per-claim self-insured retention applicable under the Policy and will diligently track all costs and expenses against the retention threshold. Lumos will provide NexTier with updated cost estimates and supporting documentation — including invoices, engagement letters, and vendor agreements — as the response progresses and as costs are incurred.
IX. Notification Obligations — Preliminary Assessment
The 11,438 individuals whose accounts were accessed during the incident reside across all 50 United States, the District of Columbia, Puerto Rico, and the United Kingdom. Accordingly, Lumos anticipates that multi-jurisdictional individual and regulatory breach notification obligations will apply under the various state breach notification statutes, as well as under the UK GDPR and the UK Data Protection Act 2018.
A comprehensive, state-by-state and jurisdiction-by-jurisdiction breach notification analysis is currently being prepared by Calderwood & Harkness LLP. This analysis will be finalized following receipt of Palisade Digital Forensics' final forensic report, which will confirm the precise scope and nature of the data accessed and the identities and residences of all affected individuals.
Certain states with particularly restrictive notification timelines are expected to drive the overall notification schedule. For example, Colorado (C.R.S. § 6-1-716) and Florida (Fla. Stat. § 501.171) each require notification to affected individuals within 30 days of determination that a breach has occurred. Lumos is aware of these accelerated deadlines and is taking steps to ensure that notification can be initiated within the most restrictive applicable timeframes.
As noted in Section VII above, the required 72-hour notification to the UK Information Commissioner's Office has already been filed. Individual notifications to the 814 UK-resident affected users are being planned in coordination with Harmon Watts & Kendrick LLP.
X. Significant Enterprise Customers Affected
Among the 847 enterprise customer tenants affected by the incident, certain high-profile enterprise customers have been identified. These customers are entities with significant market presence and regulatory profiles, and the impact of the incident on their user accounts warrants particular attention in the context of Lumos's notification and communications strategy. The most significant affected enterprise customers identified to date include, but are not limited to:
• Cascadia National Bancorp (Portland, Oregon) — 312 of its 1,247 Lumos user accounts were among the 11,438 accounts accessed during the incident. Cascadia National Bancorp is a publicly traded bank holding company and is subject to federal banking regulatory oversight.
• Ironbridge Insurance Holdings, Inc. (Philadelphia, Pennsylvania) — 204 of its user accounts were accessed during the incident. Ironbridge is a multi-line insurance holding company subject to state insurance regulatory oversight in multiple jurisdictions.
• Monarch Wealth Advisors, LLC (Hartford, Connecticut) — 89 of its user accounts were accessed during the incident. Monarch is a registered investment adviser subject to oversight by the Securities and Exchange Commission.
Enterprise customer notifications are being planned by Lumos, in coordination with Calderwood & Harkness LLP and Threshold Public Relations LLC, and will be coordinated with the individual user notifications described in Section IX above. Lumos is aware that certain of its enterprise customer agreements may contain contractual notification obligations with specific timelines and procedures, and those contractual requirements are being separately analyzed.
XI. Requests
In light of the foregoing, Lumos respectfully requests that NexTier take the following actions:
1. Acknowledge receipt of this notice of claim in writing at your earliest convenience.
2. Confirm coverage under Policy Number NXT-CYB-2024-07812 for the incident described herein, subject to the terms, conditions, exclusions, and limitations of the Policy.
3. Assign a dedicated claims handler for this matter to facilitate ongoing coordination between NexTier, Calderwood & Harkness LLP, and Lumos.
4. Confirm approval of breach response counsel — specifically, confirm that Calderwood & Harkness LLP is approved as breach response counsel under the Policy in its capacity as pre-approved panel counsel.
5. Advise of any additional information or documentation required by NexTier to process this claim, including any specific forms, authorizations, or supplemental materials.
Lumos will cooperate fully with NexTier throughout the claims process and will provide regular updates on the status of the forensic investigation, the breach notification process, the engagement of vendors and service providers, and the tracking of costs and expenses against the self-insured retention and policy limits.
XII. Reservation of Rights
This notice of claim is provided for the purpose of preserving all of Lumos's rights, remedies, and entitlements under the Policy and applicable law. Nothing in this letter is intended to, nor shall it be construed to, limit, waive, modify, or relinquish any coverage, rights, or defenses available to Lumos under the Policy or otherwise.
Lumos expressly reserves the right to supplement, amend, or update this notice as additional facts, circumstances, and information become known through the ongoing forensic investigation, legal analysis, regulatory engagement, and incident response process. Any failure to identify a specific category of loss, expense, or potential claim in this letter shall not constitute a waiver of Lumos's right to seek coverage for such loss, expense, or claim under the Policy.
XIII. Contact Information
All communications regarding this claim should be directed to the following:
Primary Contact — Outside Counsel:
Rachel Bernstein, Partner Calderwood & Harkness LLP One Embarcadero Center, Suite 3400 San Francisco, California 94111 Telephone: (415) 392-7418
Email: rbernstein@calderwoodharkness.com
With a copy to — Insured's In-House Counsel:
Allison Cho, General Counsel & Chief Privacy Officer Lumos Analytics Inc. 450 Folsom Street, Suite 1200 San Francisco, California 94105 Telephone: (415) 555-2900
Email: allison.cho@lumosanalytics.com
We appreciate NexTier's prompt attention to this matter and look forward to working cooperatively with your claims team throughout the response process. Please do not hesitate to contact me directly if you have any questions or require any additional information.
Very truly yours,
CALDERWOOD & HARKNESS LLP
CALDERWOOD & HARKNESS LLP
By: ________
Rachel Bernstein Partner, Privacy & Data Security Practice Calderwood & Harkness LLP One Embarcadero Center, Suite 3400 San Francisco, California 94111
Enclosures: None
cc:
Allison Cho, General Counsel & Chief Privacy Officer, Lumos Analytics Inc. Kevin Ostrowski, Partner, Calderwood & Harkness LLP
Item | Detail
Policy Number | NXT-CYB-2024-07812
Named Insured | Lumos Analytics Inc.
Insured EIN | 83-2197564
Delaware Entity File Number | 6284731
Policy Period | January 1, 2024 through January 1, 2025
Per-Occurrence Limit | $15,000,000
Aggregate Limit | $30,000,000
Self-Insured Retention (SIR) | $500,000 per claim
Coverage Type | Cyber Liability and Technology Errors & Omissions

CALDERWOOD & HARKNESS LLP ATTORNEYS AT LAW

VIA EMAIL AND CERTIFIED MAIL, RETURN RECEIPT REQUESTED

CALDERWOOD & HARKNESS LLP

CALDERWOOD & HARKNESS LLP

Record

Parties

Dates

Amounts