1008-00009 · Lumos Analytics Inc · Notifications

ag-notification-letter-template.docx DOCUMENT Data Privacy

10 / 12 ← → ✕

Contract analysis Extract to table

CONFIDENTIAL — ATTORNEY WORK PRODUCT

CALDERWOOD & HARKNESS LLP One Embarcadero Center, Suite 3400 San Francisco, California 94111

Telephone: (415) 773-6200 Facsimile: (415) 773-6201 www.calderwoodharkness.com

August \\, 2024

C&H Matter No. 1008-00009

VIA CERTIFIED MAIL AND ELECTRONIC SUBMISSION

[Name of Attorney General] [Title — e.g., Attorney General of the State of \\\\\\\\] [Office of the Attorney General] [Consumer Protection Division / Data Privacy Unit / as applicable] [Street Address] [City, State, ZIP Code]

Re: Data Breach Notification Pursuant to [State Statutory Citation — e.g., Cal. Civ. Code § 1798.82; N.Y. Gen. Bus. Law § 899-aa; Tex. Bus. & Com. Code § 521.053] — Lumos Analytics Inc.

Dear [Attorney General / Appropriate Title]:

I. Introduction and Purpose of Notice

Calderwood & Harkness LLP writes on behalf of its client, Lumos Analytics Inc. ("Lumos" or the "Company"), a Delaware corporation headquartered at 450 Folsom Street, Suite 1200, San Francisco, California 94105 (Employer Identification Number: 83-2197564). The purpose of this letter is to provide the Office of the Attorney General of [State] with formal notification of a data security incident involving the personal information of certain residents of [State], as required by [State Statutory Citation].

Lumos is a software-as-a-service ("SaaS") and financial technology analytics company that develops and operates the Lumos Insight Platform, a cloud-based analytics tool designed to serve the financial services, insurance, and wealth management industries. As of the date of the incident described herein, the Lumos Insight Platform served approximately 4,200 enterprise customers, with approximately 286,000 total registered individual user accounts across all customer tenants. The platform enables enterprise customers and their authorized individual users to aggregate, analyze, and visualize financial and operational data for business intelligence and decision-support purposes.

This notification is being provided to the Office of the Attorney General of [State] because personal information belonging to [Number] residents of [State] was involved in the data security incident described below. In total, the personal information of 11,438 individuals across all United States jurisdictions was involved in the incident.

The specific counts of affected residents for key states are as follows, with the remaining state-specific figures set forth in our internal multi-jurisdictional analysis and populated in each respective state's filing:

We provide below a detailed description of the incident, the Company's investigation and response, the categories of personal information involved, and the remedial measures Lumos has undertaken.

II. Description of the Incident

Between approximately 02:14 Coordinated Universal Time ("UTC") on June 12, 2024, and approximately 19:47 UTC on June 15, 2024 — a window of approximately sixty-five and one-half (65.5) hours — Lumos experienced a credential-stuffing attack directed at the login interface of its Lumos Insight Platform.

A credential-stuffing attack is a type of automated cyberattack in which threat actors obtain large volumes of username and password pairs from an unrelated, third-party data breach and use automated tools to attempt to log in to accounts on other platforms and services where users may have reused the same credentials. Because many individuals reuse the same username (often an email address) and password across multiple online services, credential-stuffing attacks can result in unauthorized access to accounts on platforms that were not themselves compromised.

Based on the findings of the forensic investigation described in Section IV below, the credential pairs used in this attack are believed to have originated from a publicly disclosed data breach involving VaultSync Technologies, Inc. ("VaultSync"), a consumer cloud storage provider. VaultSync publicly disclosed its breach on May 28, 2024, and acknowledged that email addresses and hashed passwords of its users had been exposed. It is believed that threat actors obtained and decrypted a subset of those credential pairs and subsequently used them to attempt logins against numerous online services, including the Lumos Insight Platform.

During the attack window, approximately 2.16 million login attempts were directed at the Lumos Insight Platform using automated methods. These login attempts originated from 1,247 unique source IP addresses, which were primarily geolocated to Eastern Europe (including IP address ranges associated with hosting providers in Ukraine, Romania, and Moldova) and Southeast Asia (including IP address ranges associated with hosting providers in Vietnam, Thailand, and Indonesia). The use of geographically distributed IP addresses is consistent with the use of proxy networks, botnets, or commercial residential proxy services commonly employed by threat actors to evade detection and rate-limiting controls.

Of the approximately 2.16 million login attempts, 11,438 resulted in successful authentication to individual user accounts on the Lumos Insight Platform, representing a success rate of approximately 0.53%. This success rate is consistent with typical credential-stuffing attack patterns, where only a small fraction of recycled credentials match active accounts on the targeted platform.

The 11,438 successfully accessed accounts were associated with individual users distributed across 847 distinct enterprise customer tenants of Lumos. No single enterprise customer accounted for a disproportionate share of the affected accounts.

III. Detection and Containment

On June 15, 2024, at approximately 14:22 UTC, Lumos's security information and event management ("SIEM") system generated automated alerts based on anomalous login patterns detected across the Lumos Insight Platform. The anomalies included volumetric login irregularities — specifically, a significant increase in failed login attempts well above historical baselines — as well as geographic IP inconsistencies, in which multiple accounts that had historically been accessed exclusively from United States-based IP addresses were accessed within a short timeframe from IP addresses geolocated to foreign jurisdictions.

Upon receipt of the SIEM alerts, Lumos's internal Security Operations Center ("SOC") initiated a preliminary investigation and confirmed the existence of a credential-stuffing incident at approximately 16:08 UTC on June 15, 2024. The SOC escalated the incident to Lumos's executive leadership, including its General Counsel and Chief Privacy Officer, and to the Company's Chief Information Security Officer.

Lumos immediately commenced containment measures. By approximately 20:30 UTC on June 15, 2024, the Company had implemented the following immediate response actions:

1. Mandatory Global Password Reset. Lumos initiated a mandatory password reset for all approximately 286,000 registered user accounts on the Lumos Insight Platform. All existing sessions were terminated, and all users were required to create new passwords before regaining access to the platform. This measure was designed to ensure that any credentials compromised through the credential-stuffing attack — or potentially vulnerable due to credential reuse — were rendered invalid.

2. Attacker IP Address blocking. Lumos blocked all 1,247 unique source IP addresses that had been identified as originating points for the credential-stuffing attack. These IP addresses were added to a permanent relistlist maintained at the web application firewall and network perimeter levels.

On June 16, 2024, Lumos took the additional step of permanently disabling a platform feature known as "Quick View." The Quick View feature had been an optional user-configurable setting that cached certain partial financial data — including partial account numbers (last four digits only), account balances, and asset allocation summaries — on individual user profile pages within the platform for convenient at-a-glance access. By disabling this feature, Lumos ensured that the cached partial financial data was no longer accessible through the user profile interface.

On June 18, 2024, Lumos engaged Calderwood & Harkness LLP as outside legal counsel to oversee the legal aspects of the incident response and to coordinate regulatory notification obligations. On the same date, Lumos retained a nationally recognized third-party digital forensic investigation firm to conduct a comprehensive forensic investigation of the incident, including an analysis of the scope and nature of the unauthorized access, the categories of data potentially exposed, and the presence or absence of any data exfiltration.

IV. Investigation Findings

The third-party forensic investigation was conducted over a period of approximately four weeks and was completed with the issuance of a final written report on July 15, 2024. For purposes of applicable state notification deadlines, July 15, 2024 constitutes the "determination date" — the date on which the nature, scope, and extent of the data security incident were reasonably determined with sufficient certainty to enable Lumos to identify the categories of personal information involved and the individuals whose information was affected.

The key findings of the forensic investigation are summarized as follows:

a. No Compromise of Lumos Internal Systems. All unauthorized access to user accounts on the Lumos Insight Platform was accomplished using valid user credentials — that is, correct username and password pairs — obtained from an external, unrelated source (believed to be the VaultSync Technologies breach). At no point during the incident was there any compromise of Lumos's internal systems, databases, servers, network infrastructure, or application code. The Lumos Insight Platform's authentication system functioned as designed; the unauthorized logins were successful because the threat actors possessed valid credentials.

b. No Malware or Persistence Mechanisms. No malware, ransomware, backdoors, web shells, or other persistence mechanisms were deployed in any of the 11,438 accessed user accounts, or anywhere within the Lumos Insight Platform environment. The threat actors did not install any software, modify any system configurations, or create any new accounts.

c. No Lateral Movement or Privilege Escalation. There was no evidence of lateral movement within the Lumos Insight Platform. The unauthorized access was limited to the individual user accounts for which the threat actors possessed valid credentials. No evidence of privilege escalation was identified — that is, the threat actors did not obtain or attempt to obtain administrative or elevated access privileges.

d. No Evidence of Bulk Data Exfiltration. No evidence of bulk data exfiltration was identified during the forensic investigation. Analysis of server-side logs, network traffic data, and application-layer logs revealed that the median session duration of the 11,438 unauthorized access sessions was approximately 4.2 seconds. This extremely brief session duration is consistent with automated credential validation — a common technique in which threat actors use automated tools to rapidly test whether credential pairs are valid, without engaging in substantive interaction with the account or downloading data. The brief session durations suggest that the primary objective of the threat actors was to compile a list of validated credentials for potential future use or sale, rather than to access or harvest the data within the accounts.

e. Extended-Duration Sessions. Of the 11,438 unauthorized access sessions, 137 accounts exhibited session durations exceeding 30 seconds. These accounts were subjected to individual, manual review by the forensic investigation team. Upon examination of server-side application logs, including page-view logs, API call logs, and data request logs, no evidence of data download activity, data export commands, screenshot capture, or other data harvesting activity was detected for any of these 137 accounts. It is possible that the extended session durations reflected automated browsing or indexing by the threat actors' tools, rather than manual data review.

While the forensic investigation did not identify evidence of actual data exfiltration or misuse, it is not possible to determine with absolute certainty whether the threat actors viewed, copied, or otherwise obtained the personal information accessible within the compromised accounts during the unauthorized sessions. Accordingly, Lumos is treating all 11,438 affected accounts as potentially compromised and is providing notification to all affected individuals and to the Offices of the Attorneys General of all applicable states.

V. Categories of Personal Information Accessed

Based on the forensic investigation, the following categories of personal information were accessible within the 11,438 compromised user accounts at the time of the unauthorized access:

1. User Profile Information. All 11,438 affected accounts contained user profile information, which included the individual's full name, email address, job title, and employer name. This information is entered by users during the account registration process and is displayed on the user's profile page within the Lumos Insight Platform.

2. Telephone Number. Approximately 7,820 of the 11,438 affected accounts (approximately 68.4%) had a telephone number populated in the user profile. The remaining approximately 3,618 accounts did not have a telephone number on file, as this field was optional during account registration.

3. Dashboard Configurations and Saved Analytics Queries. Affected accounts contained dashboard configurations and saved analytics queries created by the individual user. These items consist of proprietary business data belonging to the user's enterprise customer employer and are not categorized as individual personal information. However, they are noted here for completeness, as they were within the scope of data potentially viewable during the unauthorized sessions.

4. Partial Financial Data (Quick View Feature). For 2,614 of the 11,438 affected accounts (approximately 22.9%), the individual user had enabled the optional "Quick View" feature, which cached partial portfolio data on the user's profile page. The data potentially exposed through the Quick View feature included:

• Partial financial account numbers, consisting of the last four digits only;

• Account balances; and

• Asset allocation summaries.

It is important to note that the Quick View feature displayed only partial (truncated) financial account numbers and did not display full account numbers at any time.

Data Categories NOT Involved in This Incident. The following categories of sensitive personal information were not stored in user-facing profile pages, were not accessible through the Lumos Insight Platform user interface, and were not involved in this incident:

• Social Security numbers;

• Full financial account numbers (only the last four digits were displayed via the Quick View feature for the subset of users who had enabled that feature);

• Driver's license numbers or state identification card numbers;

• Payment card numbers (credit card or debit card numbers);

• Passwords or security credentials (passwords are stored in hashed and salted format and are not displayed or accessible through the user interface); and

• Health or medical information.

VI. Number of Affected Residents of [State]

The number of residents of the State of [State] whose personal information was involved in this data security incident is: [Number].

This figure was determined through a multi-jurisdictional analysis conducted by Lumos, in coordination with Calderwood & Harkness LLP, using the residential address information on file for each affected user account, supplemented by additional address verification procedures where necessary.

The total number of individuals affected across all United States jurisdictions is 11,438.

VII. Remediation Measures Taken by Lumos

In addition to the immediate containment actions described in Section III above, Lumos has implemented the following remedial measures to strengthen the security of the Lumos Insight Platform and reduce the risk of similar incidents in the future:

1. Mandatory Multi-Factor Authentication ("MFA"). Lumos has deployed mandatory multi-factor authentication for all Lumos Insight Platform user accounts. Following implementation, all users are required to verify their identity using a second authentication factor (such as a one-time passcode sent via SMS or generated by an authenticator application) in addition to their password when logging in. This measure significantly reduces the risk of unauthorized access through credential-stuffing attacks, even where a user's password has been compromised. Deployment of mandatory MFA was completed on July 22, 2024.

2. Advanced Bot-Detection and CAPTCHA. Lumos has deployed advanced bot-detection and CAPTCHA challenge mechanisms on all Lumos Insight Platform login pages. These mechanisms are designed to distinguish between automated login attempts (such as those used in credential-stuffing attacks) and legitimate human login activity, and to block or challenge suspicious automated traffic. Deployment was completed on July 8, 2024.

3. Authentication Rate-Limiting. Lumos has significantly reduced the authentication rate limit on the Lumos Insight Platform. The prior rate limit permitted up to 100 login attempts per minute from a single source IP address. The rate limit has been reduced to 10 login attempts per minute per source IP address. This tenfold reduction substantially limits the throughput of automated credential-stuffing tools and increases the likelihood that such attacks will be detected before a significant number of accounts are compromised.

4. Quick View Feature Permanently Disabled. As noted in Section III above, the Quick View feature was permanently disabled on June 16, 2024. Cached partial financial data is no longer accessible through user profile pages on the Lumos Insight Platform. Lumos does not intend to reinstate this feature.

5. Credential-Screening Service. Lumos has integrated a real-time credential-screening service into the Lumos Insight Platform's login and password-change workflows. This service checks user passwords against databases of credentials known to have been exposed in prior data breaches. If a user attempts to set or use a password that has been identified in a known breach database, the user is prompted to select a different password. This measure is designed to prevent users from using compromised credentials on the Lumos Insight Platform.

6. Global Password Reset. As described in Section III, a mandatory global password reset was initiated for all approximately 286,000 registered users on June 15, 2024. All users were required to create new passwords meeting enhanced complexity requirements before regaining access to the platform.

7. IP blocking. All 1,247 identified attacker source IP addresses were blocked immediately upon identification and have been added to a permanent relistlist. In addition, Lumos has enhanced its IP reputation monitoring capabilities to enable more rapid identification and blocking of suspicious IP addresses on an ongoing basis.

Lumos continues to evaluate its security posture and is committed to implementing additional measures as appropriate based on evolving threat intelligence and industry best practices.

VIII. Notification to Affected Individuals

Lumos is providing direct written notification to all 11,438 affected individuals concurrently with this Attorney General notification. Individual notifications are being sent via email on August 5, 2024, to the email address on file for each affected individual.

For a subset of 1,612 individuals whose email notifications bounced back as undeliverable or whose email addresses were flagged as potentially compromised during the incident (and therefore may no longer be under the control of the legitimate account holder), Lumos is sending notification via U.S. first-class mail to the individual's residential address on file.

A copy of the sample individual breach notification letter is enclosed with this filing as Attachment A. The individual notification letter describes the nature of the incident, the types of personal information potentially involved, the steps Lumos has taken in response to the incident, recommendations for the individual to protect themselves, and information regarding the complimentary credit monitoring and identity theft protection services being offered by Lumos, as further described in Section IX below.

IX. Credit Monitoring and Identity Theft Protection Services

Although the forensic investigation did not identify evidence of actual data exfiltration or misuse, and although the categories of data involved in this incident did not include Social Security numbers, full financial account numbers, or other categories of information most commonly associated with identity theft, Lumos has determined to offer all 11,438 affected individuals twenty-four (24) months of complimentary credit monitoring and identity theft protection services as a precautionary measure and as a demonstration of the Company's commitment to the security of its users' personal information.

These services are being provided through Sentinel Identity Services, Inc., located at 1200 Peachtree Street NE, Suite 600, Atlanta, Georgia 30309. Sentinel Identity Services is a nationally recognized provider of credit monitoring and identity theft protection solutions.

The individual notification letter provided to each affected individual contains detailed enrollment instructions and a unique activation code that the individual may use to enroll in the complimentary credit monitoring and identity theft protection services at no cost to the individual. A dedicated toll-free telephone number is also provided in the individual notification letter, through which affected individuals may obtain assistance with enrollment or ask questions regarding the incident and the services being offered.

X. Timing of Notification

Lumos became aware of the data security incident on June 15, 2024, when its SIEM system detected anomalous login activity on the Lumos Insight Platform, as described in Section III above.

Lumos immediately commenced an investigation and engaged outside forensic experts on June 18, 2024. The forensic investigation was completed on July 15, 2024, with the issuance of the final forensic report. July 15, 2024 constitutes the "determination date" for purposes of applicable state data breach notification statutes — that is, the date on which Lumos reasonably determined the nature, scope, and identity of the individuals whose personal information was involved in the incident with sufficient specificity to enable the preparation and transmission of legally compliant notifications.

This notification to the Office of the Attorney General of [State] is being submitted on [August \\, 2024], which is [Number] days after the determination date of July 15, 2024. Individual notifications to affected residents of [State] are being sent on August 5, 2024.

This notification is being provided [within 30 days / within 45 days / within 60 days / in the most expedient time possible and without unreasonable delay] of the determination date, as required by [State Statutory Citation].

No law enforcement agency has requested a delay in notification.

XI. Contact Information

Any questions regarding this notification or the underlying data security incident may be directed to the following contacts:

Legal Counsel for Lumos Analytics Inc.:

Rachel Bernstein, Partner Calderwood & Harkness LLP One Embarcadero Center, Suite 3400 San Francisco, California 94111 Telephone: (415) 773-6244

Email: rbernstein@calderwoodharkness.com

Lumos Analytics Inc.:

Allison Cho, General Counsel & Chief Privacy Officer Lumos Analytics Inc. 450 Folsom Street, Suite 1200 San Francisco, California 94105 Telephone: (415) 555-0198

Email: acho@lumosanalytics.com

XII. Closing

Lumos takes the security of the personal information entrusted to it with the utmost seriousness and sincerely regrets any concern or inconvenience this incident may cause to affected individuals. The Company has acted swiftly to contain the incident, investigate its scope, and implement meaningful remedial measures designed to substantially reduce the risk of a similar incident occurring in the future.

Lumos remains firmly committed to the protection of personal information and to full cooperation with the Office of the Attorney General of [State] regarding this matter. Should the Office of the Attorney General require any additional information, documentation, or clarification concerning this incident or Lumos's response, we respectfully invite the Office to contact the undersigned at the address and telephone number provided above, and we will respond promptly.

We appreciate the Office's attention to this matter.

Respectfully submitted,

CALDERWOOD & HARKNESS LLP

By: ________

Rachel Bernstein Partner, Privacy & Data Security One Embarcadero Center, Suite 3400 San Francisco, California 94111

On behalf of Lumos Analytics Inc.

Enclosure: Attachment A — Sample Individual Breach Notification Letter (dated August 5, 2024)

STATE-SPECIFIC APPENDIX / DRAFTING NOTES INTERNAL TEMPLATE GUIDANCE — NOT FOR FILING

PRIVILEGED AND CONFIDENTIAL — ATTORNEY WORK PRODUCT — DO NOT FILE

A. Instructions for Template Completion

This template letter is designed for use across all thirty-four (34) states that require notification to the Office of the Attorney General (or equivalent state official) in connection with data breaches affecting state residents. A separate, completed version of this letter must be prepared and filed for each such state.

For each state-specific filing, the following bracketed fields must be populated with the appropriate information:

1. [State] — Insert the full name of the applicable state (e.g., "California," "New York," "Texas").

2. [Name of Attorney General] — Insert the full name of the current Attorney General (e.g., "The Honorable Rob Bonta, Attorney General of the State of California").

3. [Title] — Insert the appropriate title and form of address.

4. [Office of the Attorney General / Division] — Insert the name of the specific division or unit within the Office of the Attorney General to which breach notifications are directed (e.g., California Department of Justice, Privacy Enforcement & Protection Unit; New York Office of the Attorney General, Bureau of Internet & Technology; Texas Office of the Attorney General, Consumer Protection Division).

5. [Street Address, City, State, ZIP Code] — Insert the mailing address for breach notification submissions.

6. [State Statutory Citation] — Insert the applicable state data breach notification statute citation in the "Re:" line and all references within the body of the letter (see reference table below).

7. [Number of Affected Residents] — Insert the number of affected residents for the specific state (see reference table below).

8. [Statutory Notification Deadline Language] — Insert the applicable statutory deadline language in Section X (e.g., "within 30 days," "within 45 days," "within 60 days," or "in the most expedient time possible and without unreasonable delay").

9. [Number of Days Since Determination Date] — Calculate the number of calendar days between July 15, 2024 (the determination date) and the actual filing date, and insert the appropriate figure.

10. [State-Specific Required Content] — Certain states require the inclusion of specific additional content in the Attorney General notification letter or the individual notification letter. Review the multi-jurisdictional notification analysis memo dated July 18, 2024, for state-specific requirements, including but not limited to:

• Specific toll-free telephone numbers for consumer inquiries (e.g., state AG consumer hotline numbers);

• Inclusion of contact information for the state Attorney General's office for consumer complaints;

• Specific statutory language that must appear in the individual notification letter;

• Online submission requirements or specific forms that must accompany the letter; and

• Requirements to submit the notification electronically through a state-specific online portal (e.g., Indiana, Iowa, Maine, Montana, New Hampshire, Oregon, Washington).

B. Reference Table: Key State-Specific Figures

C. States Not Requiring Attorney General Notification

Eight (8) states were determined not to require Attorney General notification for this incident because the categories of personal information accessed in the incident did not meet the statutory definition of "personal information" triggering notification obligations in those jurisdictions. Specifically, the absence of Social Security numbers, driver's license numbers, state identification card numbers, and full financial account numbers from the exposed data means that the statutory thresholds for notification were not met in those states. These determinations are documented in the multi-jurisdictional notification analysis memo dated July 18, 2024, and should be reviewed and confirmed by the responsible attorney before finalizing the filing schedule.

D. Individual Notification Scope

Individual notifications are being sent to affected residents of forty-two (42) states, plus the District of Columbia and Puerto Rico. This represents a broader geographic scope than the thirty-four (34) states requiring Attorney General notification, because many states require notification to affected individuals at lower thresholds than those required for Attorney General notification, and because Lumos has elected to notify all affected individuals regardless of whether their state of residence technically requires notification based on the categories of data involved.

E. Filing Schedule

All Attorney General notifications are to be filed between August 1, 2024, and August 5, 2024. This schedule is designed to satisfy the most restrictive applicable notification deadline, which is the thirty (30) day requirement under Colorado (Colo. Rev. Stat. § 6-1-716) and Florida (Fla. Stat. § 501.171), yielding a deadline of August 14, 2024. Filing all notifications by August 5, 2024, provides a comfortable margin of nine (9) days before the earliest applicable statutory deadline.

F. Filing Method Notes

• States with online submission portals: Several states require or strongly prefer electronic submission through a dedicated online portal. Confirm submission method for each state and retain confirmation receipts.

• States requiring certified mail: Where applicable, send via certified mail, return receipt requested, and retain proof of mailing.

• States requiring both electronic and mail submission: Where applicable, submit through both channels and retain confirmation of each.

• Attachment A (Individual Notification Letter): Enclose a copy with each Attorney General filing. Confirm whether any state requires a state-specific version of the individual notification letter with tailored statutory language.

End of Template — Calderwood & Harkness LLP — C&H Matter No. 1008-00009 Prepared by: Privacy & Data Security Practice Group Last Revised: July 28, 2024

State	Number of Affected Residents	Applicable Statutory Citation
California	3,412	Cal. Civ. Code § 1798.82
New York	2,107	N.Y. Gen. Bus. Law § 899-aa
Texas	1,843	Tex. Bus. & Com. Code § 521.053
[Additional States]	[To be populated per multi-jurisdictional analysis]	[Applicable citation]
Total (All Jurisdictions)	11,438	—
State	Affected Residents	Statutory Citation	Notification Deadline	Filing Deadline
California	3,412	Cal. Civ. Code § 1798.82	Most expedient time possible; no later than required	August 5, 2024
New York	2,107	N.Y. Gen. Bus. Law § 899-aa (SHIELD Act)	Most expedient time possible without unreasonable delay	August 5, 2024
Texas	1,843	Tex. Bus. & Com. Code § 521.053	60 days from determination	September 13, 2024 (filing by Aug. 5)
Colorado	[To be populated]	Colo. Rev. Stat. § 6-1-716	30 days from determination	August 14, 2024 (filing by Aug. 5)
Florida	[To be populated]	Fla. Stat. § 501.171	30 days from determination	August 14, 2024 (filing by Aug. 5)
Maryland	[To be populated]	Md. Code, Com. Law § 14-3504	45 days from determination	August 29, 2024 (filing by Aug. 5)
[Remaining 28 states]	[To be populated from multi-jurisdictional analysis memo dated July 18, 2024]	[Applicable citation]	[Applicable deadline]	[Filing by Aug. 1–5, 2024]

CONFIDENTIAL — ATTORNEY WORK PRODUCT
CALDERWOOD & HARKNESS LLP One Embarcadero Center, Suite 3400 San Francisco, California 94111
Telephone: (415) 773-6200 Facsimile: (415) 773-6201 www.calderwoodharkness.com
August \\, 2024
C&H Matter No. 1008-00009
VIA CERTIFIED MAIL AND ELECTRONIC SUBMISSION
[Name of Attorney General] [Title — e.g., Attorney General of the State of \\\\\\\\] [Office of the Attorney General] [Consumer Protection Division / Data Privacy Unit / as applicable] [Street Address] [City, State, ZIP Code]
Re: Data Breach Notification Pursuant to [State Statutory Citation — e.g., Cal. Civ. Code § 1798.82; N.Y. Gen. Bus. Law § 899-aa; Tex. Bus. & Com. Code § 521.053] — Lumos Analytics Inc.
Dear [Attorney General / Appropriate Title]:
I. Introduction and Purpose of Notice
Calderwood & Harkness LLP writes on behalf of its client, Lumos Analytics Inc. ("Lumos" or the "Company"), a Delaware corporation headquartered at 450 Folsom Street, Suite 1200, San Francisco, California 94105 (Employer Identification Number: 83-2197564). The purpose of this letter is to provide the Office of the Attorney General of [State] with formal notification of a data security incident involving the personal information of certain residents of [State], as required by [State Statutory Citation].
Lumos is a software-as-a-service ("SaaS") and financial technology analytics company that develops and operates the Lumos Insight Platform, a cloud-based analytics tool designed to serve the financial services, insurance, and wealth management industries. As of the date of the incident described herein, the Lumos Insight Platform served approximately 4,200 enterprise customers, with approximately 286,000 total registered individual user accounts across all customer tenants. The platform enables enterprise customers and their authorized individual users to aggregate, analyze, and visualize financial and operational data for business intelligence and decision-support purposes.
This notification is being provided to the Office of the Attorney General of [State] because personal information belonging to [Number] residents of [State] was involved in the data security incident described below. In total, the personal information of 11,438 individuals across all United States jurisdictions was involved in the incident.
The specific counts of affected residents for key states are as follows, with the remaining state-specific figures set forth in our internal multi-jurisdictional analysis and populated in each respective state's filing:
We provide below a detailed description of the incident, the Company's investigation and response, the categories of personal information involved, and the remedial measures Lumos has undertaken.
II. Description of the Incident
Between approximately 02:14 Coordinated Universal Time ("UTC") on June 12, 2024, and approximately 19:47 UTC on June 15, 2024 — a window of approximately sixty-five and one-half (65.5) hours — Lumos experienced a credential-stuffing attack directed at the login interface of its Lumos Insight Platform.
A credential-stuffing attack is a type of automated cyberattack in which threat actors obtain large volumes of username and password pairs from an unrelated, third-party data breach and use automated tools to attempt to log in to accounts on other platforms and services where users may have reused the same credentials. Because many individuals reuse the same username (often an email address) and password across multiple online services, credential-stuffing attacks can result in unauthorized access to accounts on platforms that were not themselves compromised.
Based on the findings of the forensic investigation described in Section IV below, the credential pairs used in this attack are believed to have originated from a publicly disclosed data breach involving VaultSync Technologies, Inc. ("VaultSync"), a consumer cloud storage provider. VaultSync publicly disclosed its breach on May 28, 2024, and acknowledged that email addresses and hashed passwords of its users had been exposed. It is believed that threat actors obtained and decrypted a subset of those credential pairs and subsequently used them to attempt logins against numerous online services, including the Lumos Insight Platform.
During the attack window, approximately 2.16 million login attempts were directed at the Lumos Insight Platform using automated methods. These login attempts originated from 1,247 unique source IP addresses, which were primarily geolocated to Eastern Europe (including IP address ranges associated with hosting providers in Ukraine, Romania, and Moldova) and Southeast Asia (including IP address ranges associated with hosting providers in Vietnam, Thailand, and Indonesia). The use of geographically distributed IP addresses is consistent with the use of proxy networks, botnets, or commercial residential proxy services commonly employed by threat actors to evade detection and rate-limiting controls.
Of the approximately 2.16 million login attempts, 11,438 resulted in successful authentication to individual user accounts on the Lumos Insight Platform, representing a success rate of approximately 0.53%. This success rate is consistent with typical credential-stuffing attack patterns, where only a small fraction of recycled credentials match active accounts on the targeted platform.
The 11,438 successfully accessed accounts were associated with individual users distributed across 847 distinct enterprise customer tenants of Lumos. No single enterprise customer accounted for a disproportionate share of the affected accounts.
III. Detection and Containment
On June 15, 2024, at approximately 14:22 UTC, Lumos's security information and event management ("SIEM") system generated automated alerts based on anomalous login patterns detected across the Lumos Insight Platform. The anomalies included volumetric login irregularities — specifically, a significant increase in failed login attempts well above historical baselines — as well as geographic IP inconsistencies, in which multiple accounts that had historically been accessed exclusively from United States-based IP addresses were accessed within a short timeframe from IP addresses geolocated to foreign jurisdictions.
Upon receipt of the SIEM alerts, Lumos's internal Security Operations Center ("SOC") initiated a preliminary investigation and confirmed the existence of a credential-stuffing incident at approximately 16:08 UTC on June 15, 2024. The SOC escalated the incident to Lumos's executive leadership, including its General Counsel and Chief Privacy Officer, and to the Company's Chief Information Security Officer.
Lumos immediately commenced containment measures. By approximately 20:30 UTC on June 15, 2024, the Company had implemented the following immediate response actions:
1. Mandatory Global Password Reset. Lumos initiated a mandatory password reset for all approximately 286,000 registered user accounts on the Lumos Insight Platform. All existing sessions were terminated, and all users were required to create new passwords before regaining access to the platform. This measure was designed to ensure that any credentials compromised through the credential-stuffing attack — or potentially vulnerable due to credential reuse — were rendered invalid.
2. Attacker IP Address blocking. Lumos blocked all 1,247 unique source IP addresses that had been identified as originating points for the credential-stuffing attack. These IP addresses were added to a permanent relistlist maintained at the web application firewall and network perimeter levels.
On June 16, 2024, Lumos took the additional step of permanently disabling a platform feature known as "Quick View." The Quick View feature had been an optional user-configurable setting that cached certain partial financial data — including partial account numbers (last four digits only), account balances, and asset allocation summaries — on individual user profile pages within the platform for convenient at-a-glance access. By disabling this feature, Lumos ensured that the cached partial financial data was no longer accessible through the user profile interface.
On June 18, 2024, Lumos engaged Calderwood & Harkness LLP as outside legal counsel to oversee the legal aspects of the incident response and to coordinate regulatory notification obligations. On the same date, Lumos retained a nationally recognized third-party digital forensic investigation firm to conduct a comprehensive forensic investigation of the incident, including an analysis of the scope and nature of the unauthorized access, the categories of data potentially exposed, and the presence or absence of any data exfiltration.
IV. Investigation Findings
The third-party forensic investigation was conducted over a period of approximately four weeks and was completed with the issuance of a final written report on July 15, 2024. For purposes of applicable state notification deadlines, July 15, 2024 constitutes the "determination date" — the date on which the nature, scope, and extent of the data security incident were reasonably determined with sufficient certainty to enable Lumos to identify the categories of personal information involved and the individuals whose information was affected.
The key findings of the forensic investigation are summarized as follows:
a. No Compromise of Lumos Internal Systems. All unauthorized access to user accounts on the Lumos Insight Platform was accomplished using valid user credentials — that is, correct username and password pairs — obtained from an external, unrelated source (believed to be the VaultSync Technologies breach). At no point during the incident was there any compromise of Lumos's internal systems, databases, servers, network infrastructure, or application code. The Lumos Insight Platform's authentication system functioned as designed; the unauthorized logins were successful because the threat actors possessed valid credentials.
b. No Malware or Persistence Mechanisms. No malware, ransomware, backdoors, web shells, or other persistence mechanisms were deployed in any of the 11,438 accessed user accounts, or anywhere within the Lumos Insight Platform environment. The threat actors did not install any software, modify any system configurations, or create any new accounts.
c. No Lateral Movement or Privilege Escalation. There was no evidence of lateral movement within the Lumos Insight Platform. The unauthorized access was limited to the individual user accounts for which the threat actors possessed valid credentials. No evidence of privilege escalation was identified — that is, the threat actors did not obtain or attempt to obtain administrative or elevated access privileges.
d. No Evidence of Bulk Data Exfiltration. No evidence of bulk data exfiltration was identified during the forensic investigation. Analysis of server-side logs, network traffic data, and application-layer logs revealed that the median session duration of the 11,438 unauthorized access sessions was approximately 4.2 seconds. This extremely brief session duration is consistent with automated credential validation — a common technique in which threat actors use automated tools to rapidly test whether credential pairs are valid, without engaging in substantive interaction with the account or downloading data. The brief session durations suggest that the primary objective of the threat actors was to compile a list of validated credentials for potential future use or sale, rather than to access or harvest the data within the accounts.
e. Extended-Duration Sessions. Of the 11,438 unauthorized access sessions, 137 accounts exhibited session durations exceeding 30 seconds. These accounts were subjected to individual, manual review by the forensic investigation team. Upon examination of server-side application logs, including page-view logs, API call logs, and data request logs, no evidence of data download activity, data export commands, screenshot capture, or other data harvesting activity was detected for any of these 137 accounts. It is possible that the extended session durations reflected automated browsing or indexing by the threat actors' tools, rather than manual data review.
While the forensic investigation did not identify evidence of actual data exfiltration or misuse, it is not possible to determine with absolute certainty whether the threat actors viewed, copied, or otherwise obtained the personal information accessible within the compromised accounts during the unauthorized sessions. Accordingly, Lumos is treating all 11,438 affected accounts as potentially compromised and is providing notification to all affected individuals and to the Offices of the Attorneys General of all applicable states.
V. Categories of Personal Information Accessed
Based on the forensic investigation, the following categories of personal information were accessible within the 11,438 compromised user accounts at the time of the unauthorized access:
1. User Profile Information. All 11,438 affected accounts contained user profile information, which included the individual's full name, email address, job title, and employer name. This information is entered by users during the account registration process and is displayed on the user's profile page within the Lumos Insight Platform.
2. Telephone Number. Approximately 7,820 of the 11,438 affected accounts (approximately 68.4%) had a telephone number populated in the user profile. The remaining approximately 3,618 accounts did not have a telephone number on file, as this field was optional during account registration.
3. Dashboard Configurations and Saved Analytics Queries. Affected accounts contained dashboard configurations and saved analytics queries created by the individual user. These items consist of proprietary business data belonging to the user's enterprise customer employer and are not categorized as individual personal information. However, they are noted here for completeness, as they were within the scope of data potentially viewable during the unauthorized sessions.
4. Partial Financial Data (Quick View Feature). For 2,614 of the 11,438 affected accounts (approximately 22.9%), the individual user had enabled the optional "Quick View" feature, which cached partial portfolio data on the user's profile page. The data potentially exposed through the Quick View feature included:
• Partial financial account numbers, consisting of the last four digits only;
• Account balances; and
• Asset allocation summaries.
It is important to note that the Quick View feature displayed only partial (truncated) financial account numbers and did not display full account numbers at any time.
Data Categories NOT Involved in This Incident. The following categories of sensitive personal information were not stored in user-facing profile pages, were not accessible through the Lumos Insight Platform user interface, and were not involved in this incident:
• Social Security numbers;
• Full financial account numbers (only the last four digits were displayed via the Quick View feature for the subset of users who had enabled that feature);
• Driver's license numbers or state identification card numbers;
• Payment card numbers (credit card or debit card numbers);
• Passwords or security credentials (passwords are stored in hashed and salted format and are not displayed or accessible through the user interface); and
• Health or medical information.
VI. Number of Affected Residents of [State]
The number of residents of the State of [State] whose personal information was involved in this data security incident is: [Number].
This figure was determined through a multi-jurisdictional analysis conducted by Lumos, in coordination with Calderwood & Harkness LLP, using the residential address information on file for each affected user account, supplemented by additional address verification procedures where necessary.
The total number of individuals affected across all United States jurisdictions is 11,438.
VII. Remediation Measures Taken by Lumos
In addition to the immediate containment actions described in Section III above, Lumos has implemented the following remedial measures to strengthen the security of the Lumos Insight Platform and reduce the risk of similar incidents in the future:
1. Mandatory Multi-Factor Authentication ("MFA"). Lumos has deployed mandatory multi-factor authentication for all Lumos Insight Platform user accounts. Following implementation, all users are required to verify their identity using a second authentication factor (such as a one-time passcode sent via SMS or generated by an authenticator application) in addition to their password when logging in. This measure significantly reduces the risk of unauthorized access through credential-stuffing attacks, even where a user's password has been compromised. Deployment of mandatory MFA was completed on July 22, 2024.
2. Advanced Bot-Detection and CAPTCHA. Lumos has deployed advanced bot-detection and CAPTCHA challenge mechanisms on all Lumos Insight Platform login pages. These mechanisms are designed to distinguish between automated login attempts (such as those used in credential-stuffing attacks) and legitimate human login activity, and to block or challenge suspicious automated traffic. Deployment was completed on July 8, 2024.
3. Authentication Rate-Limiting. Lumos has significantly reduced the authentication rate limit on the Lumos Insight Platform. The prior rate limit permitted up to 100 login attempts per minute from a single source IP address. The rate limit has been reduced to 10 login attempts per minute per source IP address. This tenfold reduction substantially limits the throughput of automated credential-stuffing tools and increases the likelihood that such attacks will be detected before a significant number of accounts are compromised.
4. Quick View Feature Permanently Disabled. As noted in Section III above, the Quick View feature was permanently disabled on June 16, 2024. Cached partial financial data is no longer accessible through user profile pages on the Lumos Insight Platform. Lumos does not intend to reinstate this feature.
5. Credential-Screening Service. Lumos has integrated a real-time credential-screening service into the Lumos Insight Platform's login and password-change workflows. This service checks user passwords against databases of credentials known to have been exposed in prior data breaches. If a user attempts to set or use a password that has been identified in a known breach database, the user is prompted to select a different password. This measure is designed to prevent users from using compromised credentials on the Lumos Insight Platform.
6. Global Password Reset. As described in Section III, a mandatory global password reset was initiated for all approximately 286,000 registered users on June 15, 2024. All users were required to create new passwords meeting enhanced complexity requirements before regaining access to the platform.
7. IP blocking. All 1,247 identified attacker source IP addresses were blocked immediately upon identification and have been added to a permanent relistlist. In addition, Lumos has enhanced its IP reputation monitoring capabilities to enable more rapid identification and blocking of suspicious IP addresses on an ongoing basis.
Lumos continues to evaluate its security posture and is committed to implementing additional measures as appropriate based on evolving threat intelligence and industry best practices.
VIII. Notification to Affected Individuals
Lumos is providing direct written notification to all 11,438 affected individuals concurrently with this Attorney General notification. Individual notifications are being sent via email on August 5, 2024, to the email address on file for each affected individual.
For a subset of 1,612 individuals whose email notifications bounced back as undeliverable or whose email addresses were flagged as potentially compromised during the incident (and therefore may no longer be under the control of the legitimate account holder), Lumos is sending notification via U.S. first-class mail to the individual's residential address on file.
A copy of the sample individual breach notification letter is enclosed with this filing as Attachment A. The individual notification letter describes the nature of the incident, the types of personal information potentially involved, the steps Lumos has taken in response to the incident, recommendations for the individual to protect themselves, and information regarding the complimentary credit monitoring and identity theft protection services being offered by Lumos, as further described in Section IX below.
IX. Credit Monitoring and Identity Theft Protection Services
Although the forensic investigation did not identify evidence of actual data exfiltration or misuse, and although the categories of data involved in this incident did not include Social Security numbers, full financial account numbers, or other categories of information most commonly associated with identity theft, Lumos has determined to offer all 11,438 affected individuals twenty-four (24) months of complimentary credit monitoring and identity theft protection services as a precautionary measure and as a demonstration of the Company's commitment to the security of its users' personal information.
These services are being provided through Sentinel Identity Services, Inc., located at 1200 Peachtree Street NE, Suite 600, Atlanta, Georgia 30309. Sentinel Identity Services is a nationally recognized provider of credit monitoring and identity theft protection solutions.
The individual notification letter provided to each affected individual contains detailed enrollment instructions and a unique activation code that the individual may use to enroll in the complimentary credit monitoring and identity theft protection services at no cost to the individual. A dedicated toll-free telephone number is also provided in the individual notification letter, through which affected individuals may obtain assistance with enrollment or ask questions regarding the incident and the services being offered.
X. Timing of Notification
Lumos became aware of the data security incident on June 15, 2024, when its SIEM system detected anomalous login activity on the Lumos Insight Platform, as described in Section III above.
Lumos immediately commenced an investigation and engaged outside forensic experts on June 18, 2024. The forensic investigation was completed on July 15, 2024, with the issuance of the final forensic report. July 15, 2024 constitutes the "determination date" for purposes of applicable state data breach notification statutes — that is, the date on which Lumos reasonably determined the nature, scope, and identity of the individuals whose personal information was involved in the incident with sufficient specificity to enable the preparation and transmission of legally compliant notifications.
This notification to the Office of the Attorney General of [State] is being submitted on [August \\, 2024], which is [Number] days after the determination date of July 15, 2024. Individual notifications to affected residents of [State] are being sent on August 5, 2024.
This notification is being provided [within 30 days / within 45 days / within 60 days / in the most expedient time possible and without unreasonable delay] of the determination date, as required by [State Statutory Citation].
No law enforcement agency has requested a delay in notification.
XI. Contact Information
Any questions regarding this notification or the underlying data security incident may be directed to the following contacts:
Legal Counsel for Lumos Analytics Inc.:
Rachel Bernstein, Partner Calderwood & Harkness LLP One Embarcadero Center, Suite 3400 San Francisco, California 94111 Telephone: (415) 773-6244
Email: rbernstein@calderwoodharkness.com
Lumos Analytics Inc.:
Allison Cho, General Counsel & Chief Privacy Officer Lumos Analytics Inc. 450 Folsom Street, Suite 1200 San Francisco, California 94105 Telephone: (415) 555-0198
Email: acho@lumosanalytics.com
XII. Closing
Lumos takes the security of the personal information entrusted to it with the utmost seriousness and sincerely regrets any concern or inconvenience this incident may cause to affected individuals. The Company has acted swiftly to contain the incident, investigate its scope, and implement meaningful remedial measures designed to substantially reduce the risk of a similar incident occurring in the future.
Lumos remains firmly committed to the protection of personal information and to full cooperation with the Office of the Attorney General of [State] regarding this matter. Should the Office of the Attorney General require any additional information, documentation, or clarification concerning this incident or Lumos's response, we respectfully invite the Office to contact the undersigned at the address and telephone number provided above, and we will respond promptly.
We appreciate the Office's attention to this matter.
Respectfully submitted,
CALDERWOOD & HARKNESS LLP
By: ________
Rachel Bernstein Partner, Privacy & Data Security One Embarcadero Center, Suite 3400 San Francisco, California 94111
On behalf of Lumos Analytics Inc.
Enclosure: Attachment A — Sample Individual Breach Notification Letter (dated August 5, 2024)
STATE-SPECIFIC APPENDIX / DRAFTING NOTES INTERNAL TEMPLATE GUIDANCE — NOT FOR FILING
PRIVILEGED AND CONFIDENTIAL — ATTORNEY WORK PRODUCT — DO NOT FILE
A. Instructions for Template Completion
This template letter is designed for use across all thirty-four (34) states that require notification to the Office of the Attorney General (or equivalent state official) in connection with data breaches affecting state residents. A separate, completed version of this letter must be prepared and filed for each such state.
For each state-specific filing, the following bracketed fields must be populated with the appropriate information:
1. [State] — Insert the full name of the applicable state (e.g., "California," "New York," "Texas").
2. [Name of Attorney General] — Insert the full name of the current Attorney General (e.g., "The Honorable Rob Bonta, Attorney General of the State of California").
3. [Title] — Insert the appropriate title and form of address.
4. [Office of the Attorney General / Division] — Insert the name of the specific division or unit within the Office of the Attorney General to which breach notifications are directed (e.g., California Department of Justice, Privacy Enforcement & Protection Unit; New York Office of the Attorney General, Bureau of Internet & Technology; Texas Office of the Attorney General, Consumer Protection Division).
5. [Street Address, City, State, ZIP Code] — Insert the mailing address for breach notification submissions.
6. [State Statutory Citation] — Insert the applicable state data breach notification statute citation in the "Re:" line and all references within the body of the letter (see reference table below).
7. [Number of Affected Residents] — Insert the number of affected residents for the specific state (see reference table below).
8. [Statutory Notification Deadline Language] — Insert the applicable statutory deadline language in Section X (e.g., "within 30 days," "within 45 days," "within 60 days," or "in the most expedient time possible and without unreasonable delay").
9. [Number of Days Since Determination Date] — Calculate the number of calendar days between July 15, 2024 (the determination date) and the actual filing date, and insert the appropriate figure.
10. [State-Specific Required Content] — Certain states require the inclusion of specific additional content in the Attorney General notification letter or the individual notification letter. Review the multi-jurisdictional notification analysis memo dated July 18, 2024, for state-specific requirements, including but not limited to:
• Specific toll-free telephone numbers for consumer inquiries (e.g., state AG consumer hotline numbers);
• Inclusion of contact information for the state Attorney General's office for consumer complaints;
• Specific statutory language that must appear in the individual notification letter;
• Online submission requirements or specific forms that must accompany the letter; and
• Requirements to submit the notification electronically through a state-specific online portal (e.g., Indiana, Iowa, Maine, Montana, New Hampshire, Oregon, Washington).
B. Reference Table: Key State-Specific Figures
C. States Not Requiring Attorney General Notification
Eight (8) states were determined not to require Attorney General notification for this incident because the categories of personal information accessed in the incident did not meet the statutory definition of "personal information" triggering notification obligations in those jurisdictions. Specifically, the absence of Social Security numbers, driver's license numbers, state identification card numbers, and full financial account numbers from the exposed data means that the statutory thresholds for notification were not met in those states. These determinations are documented in the multi-jurisdictional notification analysis memo dated July 18, 2024, and should be reviewed and confirmed by the responsible attorney before finalizing the filing schedule.
D. Individual Notification Scope
Individual notifications are being sent to affected residents of forty-two (42) states, plus the District of Columbia and Puerto Rico. This represents a broader geographic scope than the thirty-four (34) states requiring Attorney General notification, because many states require notification to affected individuals at lower thresholds than those required for Attorney General notification, and because Lumos has elected to notify all affected individuals regardless of whether their state of residence technically requires notification based on the categories of data involved.
E. Filing Schedule
All Attorney General notifications are to be filed between August 1, 2024, and August 5, 2024. This schedule is designed to satisfy the most restrictive applicable notification deadline, which is the thirty (30) day requirement under Colorado (Colo. Rev. Stat. § 6-1-716) and Florida (Fla. Stat. § 501.171), yielding a deadline of August 14, 2024. Filing all notifications by August 5, 2024, provides a comfortable margin of nine (9) days before the earliest applicable statutory deadline.
F. Filing Method Notes
• States with online submission portals: Several states require or strongly prefer electronic submission through a dedicated online portal. Confirm submission method for each state and retain confirmation receipts.
• States requiring certified mail: Where applicable, send via certified mail, return receipt requested, and retain proof of mailing.
• States requiring both electronic and mail submission: Where applicable, submit through both channels and retain confirmation of each.
• Attachment A (Individual Notification Letter): Enclose a copy with each Attorney General filing. Confirm whether any state requires a state-specific version of the individual notification letter with tailored statutory language.
End of Template — Calderwood & Harkness LLP — C&H Matter No. 1008-00009 Prepared by: Privacy & Data Security Practice Group Last Revised: July 28, 2024
State | Number of Affected Residents | Applicable Statutory Citation
California | 3,412 | Cal. Civ. Code § 1798.82
New York | 2,107 | N.Y. Gen. Bus. Law § 899-aa
Texas | 1,843 | Tex. Bus. & Com. Code § 521.053
[Additional States] | [To be populated per multi-jurisdictional analysis] | [Applicable citation]
Total (All Jurisdictions) | 11,438 | —
State | Affected Residents | Statutory Citation | Notification Deadline | Filing Deadline
California | 3,412 | Cal. Civ. Code § 1798.82 | Most expedient time possible; no later than required | August 5, 2024
New York | 2,107 | N.Y. Gen. Bus. Law § 899-aa (SHIELD Act) | Most expedient time possible without unreasonable delay | August 5, 2024
Texas | 1,843 | Tex. Bus. & Com. Code § 521.053 | 60 days from determination | September 13, 2024 (filing by Aug. 5)
Colorado | [To be populated] | Colo. Rev. Stat. § 6-1-716 | 30 days from determination | August 14, 2024 (filing by Aug. 5)
Florida | [To be populated] | Fla. Stat. § 501.171 | 30 days from determination | August 14, 2024 (filing by Aug. 5)
Maryland | [To be populated] | Md. Code, Com. Law § 14-3504 | 45 days from determination | August 29, 2024 (filing by Aug. 5)
[Remaining 28 states] | [To be populated from multi-jurisdictional analysis memo dated July 18, 2024] | [Applicable citation] | [Applicable deadline] | [Filing by Aug. 1–5, 2024]

CONFIDENTIAL — ATTORNEY WORK PRODUCT

VIA CERTIFIED MAIL AND ELECTRONIC SUBMISSION

CALDERWOOD & HARKNESS LLP

Record

Parties

Dates

Amounts