1008-00009 · Lumos Analytics Inc · Notifications

enterprise-customer-notification-letter-template.docx DOCUMENT Data Privacy

11 / 12 ← → ✕

LUMOS ANALYTICS INC. 450 Folsom Street, Suite 1200 San Francisco, CA 94105

August 5, 2024

[Customer Contact Name] [Customer Contact Title] [Customer Legal Name] [Customer Street Address] [Customer City, State ZIP]

Re: Notice of Security Incident Affecting Lumos Insight Platform User Accounts Associated with [Customer Legal Name]

Dear [Customer Contact Name]:

1. Purpose and Overview of Notification

Lumos Analytics Inc. ("Lumos" or the "Company") is writing to notify [Customer Legal Name] ("[Customer Legal Name]" or "Customer") of a security incident involving unauthorized access to certain user accounts on the Lumos Insight Platform (the "Platform" or "Insight Platform"). Lumos deeply values its relationship with [Customer Legal Name] and is committed to full transparency regarding this matter and its potential impact on your organization and your personnel.

The purpose of this letter is to provide [Customer Legal Name] with a detailed account of the incident, including the nature and timeline of the unauthorized access, the categories of data that were potentially affected, the comprehensive remediation measures Lumos has undertaken in response, and the steps being taken to support the individual users whose accounts were accessed. We want to ensure that [Customer Legal Name] has all of the information necessary to evaluate this incident in the context of your organization's own security, compliance, and risk management frameworks.

In connection with this incident, Lumos has engaged Calderwood & Harkness LLP as outside breach response counsel to advise on all legal, regulatory, and notification obligations arising from the incident. Lumos has also retained Palisade Digital Forensics, Inc. ("Palisade"), a nationally recognized independent forensic investigation firm, to conduct an independent, thorough investigation of the incident, including a full review of server logs, authentication records, network traffic data, and affected user accounts. The findings of Palisade's investigation are summarized in Section 3 of this letter.

This enterprise notification is being sent concurrently with individual breach notification letters that Lumos is delivering directly to all affected individual users, including those users affiliated with [Customer Legal Name]. Further details regarding the individual notification process and the complimentary credit monitoring and identity theft protection services being offered to affected users are set forth in Section 6 below.

2. Description of the Incident

Nature of the Attack

Between approximately June 12, 2024, at 02:14 UTC, and June 15, 2024, at 19:47 UTC, one or more threat actors conducted a credential-stuffing attack against the Lumos Insight Platform. A credential-stuffing attack is a form of cyberattack in which an adversary uses automated tools to inject large volumes of username-and-password pairs — typically obtained from unrelated, previously disclosed data breaches — into the login page of a targeted service. The attack exploits the common practice of credential reuse, whereby individuals use the same or similar username and password combinations across multiple online services.

In this instance, the threat actors utilized username-and-password pairs that were obtained from an unrelated, third-party data breach involving VaultSync Technologies, Inc. ("VaultSync"), a consumer cloud storage provider. VaultSync publicly disclosed its own security breach on May 28, 2024, acknowledging that a database containing user credentials had been exfiltrated from its systems in a separate and unrelated cyberattack. The compromised VaultSync credentials were subsequently made available on underground forums and dark-web marketplaces, where they were acquired by the threat actors who carried out the credential-stuffing attack against the Lumos Insight Platform.

The threat actors used these previously compromised VaultSync credentials to make automated login attempts against the Insight Platform. Where individual users had reused the same username-and-password combination across both VaultSync and Lumos, the attackers were able to gain unauthorized access to those users' Lumos accounts. No vulnerability in Lumos's own systems, infrastructure, or authentication mechanisms was exploited; the unauthorized access was achieved solely through the use of valid user credentials that had been compromised externally.

During the approximately three-and-a-half-day attack window, Lumos's systems recorded approximately 2.16 million login attempts associated with the credential-stuffing campaign. Of those attempts, 11,438 unique user accounts were successfully accessed by the threat actors, representing a success rate of approximately 0.53%. The 11,438 affected accounts spanned 847 distinct enterprise customer tenants out of the approximately 4,200 total enterprise customer tenants on the Lumos Insight Platform.

Detection and Containment

Lumos's security information and event management ("SIEM") platform, WatchTower, provided by Aegis Security Solutions, Inc., triggered automated anomaly alerts at approximately 14:22 UTC on June 15, 2024. The alerts were based on the detection of abnormal volumetric login patterns — specifically, a sustained and unusually high rate of failed authentication attempts originating from a geographically dispersed set of IP addresses — as well as geographic IP anomalies indicating login attempts from regions inconsistent with the established usage patterns of the affected user accounts.

Upon receipt of the WatchTower alerts, Lumos's Security Operations Center ("SOC") initiated its incident response protocol and began an immediate investigation. The SOC confirmed that the anomalous login activity was consistent with a credential-stuffing attack at approximately 16:08 UTC on June 15, 2024. The SOC escalated the incident to Lumos's Chief Information Security Officer, who activated the Company's full incident response plan and engaged outside counsel and Palisade Digital Forensics.

By 20:30 UTC on June 15, 2024, Lumos executed the following containment measures to halt the attack and prevent any further unauthorized access:

• Global Password Reset: Lumos initiated a forced password reset for all approximately 286,000 registered Insight Platform users, requiring every user to create a new password before regaining access to the Platform. This measure was taken out of an abundance of caution to protect all users, not only those whose accounts had been accessed during the attack.

• IP Address blocking: Lumos identified and permanently blocked all 1,247 unique source IP addresses associated with the credential-stuffing attack. The IP addresses were primarily geolocated to Eastern Europe and Southeast Asia. These addresses were added to Lumos's global IP relistlist and shared with Aegis Security Solutions for incorporation into broader threat intelligence feeds.

These containment measures effectively terminated the attack. No further unauthorized access attributable to this credential-stuffing campaign has been detected since the implementation of containment at 20:30 UTC on June 15, 2024.

Impact to [Customer Legal Name]

Based on the findings of Lumos's internal investigation and the independent forensic analysis conducted by Palisade Digital Forensics, [NUMBER] user accounts associated with [Customer Legal Name]'s tenant on the Lumos Insight Platform were among the 11,438 accounts that were accessed during this incident, out of [TOTAL NUMBER] total Lumos accounts held by users affiliated with [Customer Legal Name].

A list of the specific user accounts within [Customer Legal Name]'s tenant that were accessed during the incident is available upon request. Lumos is prepared to provide this information to [Customer Legal Name]'s designated security or compliance contact through a secure channel, subject to appropriate verification of the requesting individual's authority.

3. Forensic Investigation Findings

As noted above, Lumos retained Palisade Digital Forensics, Inc. to conduct a comprehensive, independent forensic investigation of the security incident. Palisade is a nationally recognized digital forensics and incident response firm with extensive experience investigating cybersecurity incidents across the financial services, technology, and healthcare sectors. Palisade's investigation included a thorough review of Lumos's server logs, authentication records, network traffic data, session activity records, and infrastructure configuration files, as well as targeted analyses of the accounts that were accessed during the attack.

Palisade completed its final forensic investigation report on July 15, 2024. The key conclusions of the investigation are as follows:

• No Compromise of Lumos Internal Systems: The investigation found no evidence of any compromise of Lumos's internal systems, databases, application infrastructure, or network environment. All unauthorized access was accomplished solely through the use of valid user credentials that were obtained externally from the VaultSync breach. The threat actors did not exploit any software vulnerability, misconfiguration, or architectural weakness in the Lumos Insight Platform.

• No Malware or Persistence Mechanisms: The investigation found no evidence that any malware, backdoors, web shells, or other persistence mechanisms were deployed in or through any of the accessed accounts. There was no indication that the threat actors attempted to establish persistent access to the Platform or to any user account.

• No Lateral Movement or Privilege Escalation: The investigation found no evidence of lateral movement within the Lumos platform environment. The threat actors did not attempt to escalate privileges, access administrative functions, or move beyond the individual user accounts to which they gained access using the compromised credentials. Each unauthorized session was confined to the single user account into which the credential-stuffing attempt was successful.

• No Evidence of Bulk Data Exfiltration: The investigation found no evidence of bulk data exfiltration from the Platform. The unauthorized access sessions were predominantly short in duration, with a median session duration of 4.2 seconds per session. This duration profile is consistent with automated credential validation — a pattern in which threat actors use bots to confirm the validity of a credential pair and then move on — rather than with manual data harvesting, browsing, or exfiltration activity.

• Review of Extended Sessions: A small subset of 137 accounts exhibited session durations exceeding 30 seconds. Palisade conducted an individual review of the server logs, HTTP request records, and API call history for each of these 137 accounts. No evidence of data download activity, screenshot capture, API-based data retrieval, or any other form of data access or extraction was detected in any of these accounts. Palisade concluded that the extended session durations were likely attributable to latency in automated bot processing rather than to manual human interaction with the accounts.

In summary, the forensic investigation confirmed that Lumos's platform infrastructure, databases, encryption mechanisms, and access controls were not breached, compromised, or circumvented. The incident was limited to individual account-level access achieved through the use of externally compromised credentials, and the investigation found no evidence that any data was actually exfiltrated, downloaded, or misused during the unauthorized sessions.

4. Information Potentially Accessed

Although the forensic investigation found no evidence of data exfiltration, Lumos recognizes that each account that was accessed was potentially viewable to the unauthorized party during the duration of the session. For each accessed account, the following categories of information were potentially viewable:

• User Profile Information: The user's full name, email address, job title, employer name, and telephone number. Telephone number data was populated in approximately 68.4% of affected accounts; the remaining 31.6% of affected accounts did not have a telephone number on file.

• Dashboard Configurations and Saved Analytics Queries: Each user's personalized dashboard configurations, including custom analytics views, saved query parameters, data visualization preferences, and report templates. These configurations may reflect proprietary business data, strategic priorities, or analytical methodologies belonging to the enterprise customer, and Lumos recognizes the sensitivity of this information from a competitive and business confidentiality standpoint.

• Partial Financial Data (Subset of Accounts): In approximately 2,614 of the 11,438 total affected accounts across all enterprise customers, the user had enabled a "Quick View" feature that cached partial portfolio data on the user's profile page. For those accounts, the unauthorized party potentially had access to partial financial account numbers (last four digits only), account balances, and asset allocation summaries. This Quick View feature has since been permanently disabled across the Platform, as described in Section 5 below.

Importantly, no Social Security numbers, full financial account numbers, payment card numbers, CVV codes, PINs, or other highly sensitive financial identifiers were stored in user-facing profile pages or otherwise accessible via the Insight Platform user interface. The Insight Platform's architecture is designed so that highly sensitive identifiers are stored exclusively in encrypted back-end databases that are not exposed to the user-facing application layer.

Lumos will separately inform [Customer Legal Name] of the specific number of its affiliated user accounts, if any, that had Quick View data cached at the time of the incident. This information is available upon request and can be provided through a secure channel to [Customer Legal Name]'s designated security or compliance contact.

5. Remediation Measures Taken by Lumos

In response to this incident, Lumos has implemented a comprehensive set of security enhancements and remediation measures designed to prevent the recurrence of a credential-stuffing attack and to substantially strengthen the authentication and access security controls on the Insight Platform. These measures are described below.

Immediate Actions (June 15–16, 2024)

• Global Password Reset: On June 15, 2024, Lumos initiated a mandatory global password reset for all approximately 286,000 registered Insight Platform users. All users were required to create new passwords meeting enhanced complexity requirements (minimum 14 characters, including uppercase, lowercase, numeric, and special characters) before regaining access to the Platform. This reset was completed on June 15, 2024.

• IP Address blocking: On June 15, 2024, Lumos permanently blocked all 1,247 unique source IP addresses identified as being associated with the credential-stuffing attack. These addresses were added to Lumos's global IP relistlist and reported to relevant threat intelligence sharing organizations.

• Permanent Disabling of Quick View Feature: On June 16, 2024, Lumos permanently disabled the "Quick View" cached data feature across the entire Platform. This feature, which allowed users to view a summary of partial portfolio data from their profile page, had been identified as presenting an unnecessary incremental risk in the context of account-level compromise. All previously cached Quick View data has been purged from user profile pages and is no longer accessible through the user interface.

Enhanced Security Controls (June–July 2024)

• Advanced Bot Detection and CAPTCHA: On July 8, 2024, Lumos deployed advanced bot-detection and CAPTCHA challenge mechanisms on the Insight Platform login page. These mechanisms use behavioral analysis, device fingerprinting, and challenge-response protocols to identify and block automated login attempts, significantly reducing the effectiveness of credential-stuffing and brute-force attacks against the Platform.

• Mandatory Multi-Factor Authentication (MFA): On July 22, 2024, Lumos completed the rollout of mandatory multi-factor authentication for all Insight Platform user accounts. All users are now required to enroll in MFA — using either a time-based one-time password (TOTP) authenticator application or a hardware security key — as a condition of continued Platform access. This measure ensures that possession of a valid username and password alone is no longer sufficient to access any account on the Platform.

• Enhanced Rate Limiting: Lumos has reduced the rate-limiting threshold on authentication endpoints from 100 login attempts per minute to 10 login attempts per minute per source IP address. This measure substantially constrains the throughput of any future automated credential-testing campaign.

• Credential Screening Service: Lumos has integrated a credential-screening service that automatically checks user passwords against databases of credentials known to have been exposed in prior data breaches. This check is performed both at the time of login and at the time of any password change. If a user's credentials are found to appear in a known breach compilation, the user is immediately alerted and required to select a new, unique password before proceeding.

Lumos believes that the combination of these immediate and longer-term remediation measures represents a substantial and meaningful enhancement to the security posture of the Insight Platform. In particular, the mandatory MFA requirement directly addresses the credential-reuse risk that was exploited in this incident, ensuring that compromised credentials alone cannot be used to access any account on the Platform going forward.

6. Individual Notifications and Credit Monitoring

Lumos is sending individual breach notification letters directly to all 11,438 affected individual users, including all users affiliated with [Customer Legal Name] whose accounts were accessed during the incident. These individual notifications are being sent concurrently with this enterprise customer notification, on August 5, 2024.

Individual notification letters are being delivered via email to each affected user's registered email address on the Lumos Insight Platform. For approximately 1,612 individuals across all affected enterprise customer tenants whose email addresses bounced, were returned as undeliverable, or were flagged as potentially compromised during the incident response process, individual notification letters are being sent via U.S. first-class mail to the mailing address on file for the affected user.

As part of its commitment to supporting affected individuals, Lumos is offering all 11,438 affected users 24 months of complimentary credit monitoring and identity theft protection services through Sentinel Identity Services, Inc. ("Sentinel"). The Sentinel service includes daily credit monitoring across all three major credit bureaus, identity theft insurance coverage, dark-web monitoring for the individual's personal information, and access to Sentinel's dedicated identity restoration specialists. Each affected individual will receive a unique activation code and detailed enrollment instructions in his or her individual notification letter.

[Customer Legal Name] does not need to take any action to notify its affected employees or users. Lumos is handling all individual notifications directly and is providing affected individuals with all of the information and resources they need to protect themselves. However, Lumos respectfully requests that [Customer Legal Name] consider the following supportive measures:

• Encouraging affected users within your organization to promptly enroll in the complimentary credit monitoring services being offered by Lumos through Sentinel Identity Services.

• Reminding all employees and users to reset any other online accounts where they may have reused the same username-and-password combination that was used for their Lumos Insight Platform account.

• Encouraging employees and users to remain vigilant for signs of identity theft, phishing attempts, or other suspicious activity, and to report any such activity to their organization's information security team and to Lumos.

A copy of the template individual breach notification letter being sent to affected users affiliated with [Customer Legal Name] is enclosed with this letter for your reference.

7. Regulatory and Compliance Notifications

Lumos is filing breach notification reports with the Attorneys General of 34 U.S. states and territories in accordance with applicable state breach notification statutes. These filings have been prepared with the assistance of outside counsel, Calderwood & Harkness LLP, and are being submitted on a rolling basis between August 1, 2024, and August 5, 2024. Lumos has made these filings in all jurisdictions in which affected users are believed to reside and in which applicable law requires notification to the state Attorney General.

In addition, because a subset of affected users are located in the United Kingdom, Lumos filed a personal data breach notification with the UK Information Commissioner's Office ("ICO") on June 18, 2024, within the 72-hour notification window required under the UK General Data Protection Regulation ("UK GDPR"). The ICO acknowledged receipt of the notification and conducted a preliminary review. On August 22, 2024, Lumos received a no-further-action letter from the ICO, indicating that the ICO does not intend to take any enforcement action in connection with this incident based on the information provided.

As of the date of this letter, Lumos has not received any enforcement action, formal inquiry, civil investigative demand, or request for additional information from any state Attorney General, the Federal Trade Commission ("FTC"), the ICO, or any other regulatory authority in connection with this incident. Should [Customer Legal Name] receive any regulatory inquiry or third-party request related to this incident, Lumos asks that [Customer Legal Name] promptly notify Lumos so that we may coordinate an appropriate response.

8. Commitment to Data Security and Ongoing Monitoring

Lumos takes the security of its customers' data with the utmost seriousness and recognizes the trust that [Customer Legal Name] places in the Insight Platform as a critical component of your business operations. Protecting the confidentiality, integrity, and availability of customer data is foundational to Lumos's mission and to the value we strive to deliver to every customer.

While the credential-stuffing attack vector exploited in this incident leveraged externally compromised credentials rather than any vulnerability in Lumos's own systems or infrastructure, Lumos has used this incident as an opportunity to substantially enhance its authentication and access security controls. The measures described in Section 5 of this letter — including mandatory multi-factor authentication, advanced bot detection, enhanced rate limiting, and credential screening — represent a significant strengthening of the Platform's defenses against credential-based attacks.

Lumos will continue to actively monitor the Insight Platform for any signs of further unauthorized access or anomalous activity. In addition to its standard, ongoing security monitoring program, Lumos is conducting a dedicated 60-day post-incident monitoring period, during which the SOC is applying heightened detection thresholds and conducting daily manual reviews of authentication logs for the accounts that were accessed during the incident. This post-incident monitoring period is expected to conclude on approximately August 14, 2024.

Lumos is committed to continued investment in platform security, and we will provide [Customer Legal Name] with updates on any material developments related to this incident. Lumos is also prepared to provide [Customer Legal Name] with a copy of Lumos's updated SOC 2 Type II report, which will reflect the enhanced security controls implemented in response to this incident, upon its completion later this year.

9. Dedicated Point of Contact

For any questions, concerns, or requests for additional information regarding this incident and its impact on [Customer Legal Name]'s users, please do not hesitate to contact the following dedicated point of contact:

Fiona Albrecht Director of Customer Success Lumos Analytics Inc. 450 Folsom Street, Suite 1200 San Francisco, CA 94105

Phone: [Direct Phone Number]

Email: [Email Address]

Fiona and her team are available to schedule a call or meeting at your convenience to discuss the incident in greater detail, answer any technical or operational questions, review the list of affected accounts within [Customer Legal Name]'s tenant, and coordinate any internal communications that [Customer Legal Name] may wish to make to its own workforce, board of directors, clients, or other stakeholders. We understand that [Customer Legal Name] may have its own notification and reporting obligations, and we are fully prepared to support you in meeting those obligations.

For any inquiries of a legal or regulatory nature, [Customer Legal Name] may also contact Allison Cho, General Counsel & Chief Privacy Officer, at the address set forth below.

Lumos sincerely regrets any concern or inconvenience that this incident may cause [Customer Legal Name] and its personnel. We understand the seriousness of any unauthorized access to user accounts, and we want to assure you that Lumos has treated this incident with the highest level of urgency, transparency, and diligence. We remain fully committed to the security of the Insight Platform, to the protection of your data, and to the ongoing partnership between Lumos and [Customer Legal Name]. We are grateful for the trust you place in us, and we will continue to work to earn that trust every day.

Please do not hesitate to reach out with any questions or concerns.

Sincerely,

LUMOS ANALYTICS INC.

By: ________

Allison Cho General Counsel & Chief Privacy Officer Lumos Analytics Inc. 450 Folsom Street, Suite 1200 San Francisco, CA 94105

By: ________

Fiona Albrecht Director of Customer Success Lumos Analytics Inc. 450 Folsom Street, Suite 1200 San Francisco, CA 94105

Encl.: Copy of the template individual breach notification letter being sent to affected users affiliated with [Customer Legal Name]

INTERNAL DRAFTING NOTES — PRIVILEGED AND CONFIDENTIAL FOR LUMOS ANALYTICS INC. AND CALDERWOOD & HARKNESS LLP USE ONLY NOT TO BE INCLUDED IN FINAL SENT LETTERS

C&H Matter No.: 1008-00009

Prepared by: Rachel Bernstein, Sara Hendricks, Priscilla Wynn — Calderwood & Harkness LLP

Template Usage: This template letter is to be used for all 847 affected enterprise customer tenants receiving notification in connection with the Lumos Insight Platform credential-stuffing incident. Each letter must be customized by populating the bracketed template fields with the correct information for the specific enterprise customer.

Bracketed Field Population: All bracketed fields — including [Customer Contact Name], [Customer Contact Title], [Customer Legal Name], [Customer Street Address], [Customer City, State ZIP], [NUMBER] (of affected accounts), and [TOTAL NUMBER] (of total Lumos accounts held by the customer) — are to be populated from the master affected-accounts database maintained by Jason Haddad, CISO, and Fiona Albrecht, Director of Customer Success. The master database is stored in the Lumos incident response secure file share and is current as of July 31, 2024.

Example Populations:

Personal Outreach for Top-10 Customers: For the top-10 enterprise customers by annual contract value (including, without limitation, Cascadia National Bancorp), Fiona Albrecht is to make a personal phone call to the customer's primary designated contact in advance of, or concurrent with, the delivery of this letter. The purpose of the call is to provide advance notice, demonstrate the seriousness with which Lumos is treating this matter, and offer a real-time opportunity for the customer to ask questions.

Timing: All 847 enterprise customer notification letters are to be sent on August 5, 2024, concurrent with the delivery of individual breach notification letters to affected users and the completion of state Attorney General filings.

Escalation Protocol: Any customer inquiries involving legal issues, regulatory obligations, indemnification or liability questions, or matters requiring legal judgment are to be escalated immediately to Allison Cho, General Counsel & Chief Privacy Officer, and to Calderwood & Harkness LLP (Rachel Bernstein and Sara Hendricks) for review and response.

Approval: This template letter has been reviewed and approved by Calderwood & Harkness LLP as part of the firm's incident response engagement under C&H Matter No. 1008-00009. Any substantive modifications to the template must be reviewed and approved by C&H prior to distribution.

PRIVILEGED AND CONFIDENTIAL — ATTORNEY-CLIENT PRIVILEGE — ATTORNEY WORK PRODUCT

Enterprise Customer	Accounts Accessed	Total Lumos Accounts	Address
Cascadia National Bancorp	312	1,247	900 SW Fifth Avenue, Portland, OR 97204
Monarch Wealth Advisors, LLC	89	—	281 Trumbull Street, Suite 1400, Hartford, CT 06103
Ironbridge Insurance Holdings, Inc.	204	—	1601 Chestnut Street, Suite 2200, Philadelphia, PA 19103

LUMOS ANALYTICS INC. 450 Folsom Street, Suite 1200 San Francisco, CA 94105
August 5, 2024
[Customer Contact Name] [Customer Contact Title] [Customer Legal Name] [Customer Street Address] [Customer City, State ZIP]
Re: Notice of Security Incident Affecting Lumos Insight Platform User Accounts Associated with [Customer Legal Name]
Dear [Customer Contact Name]:
1. Purpose and Overview of Notification
Lumos Analytics Inc. ("Lumos" or the "Company") is writing to notify [Customer Legal Name] ("[Customer Legal Name]" or "Customer") of a security incident involving unauthorized access to certain user accounts on the Lumos Insight Platform (the "Platform" or "Insight Platform"). Lumos deeply values its relationship with [Customer Legal Name] and is committed to full transparency regarding this matter and its potential impact on your organization and your personnel.
The purpose of this letter is to provide [Customer Legal Name] with a detailed account of the incident, including the nature and timeline of the unauthorized access, the categories of data that were potentially affected, the comprehensive remediation measures Lumos has undertaken in response, and the steps being taken to support the individual users whose accounts were accessed. We want to ensure that [Customer Legal Name] has all of the information necessary to evaluate this incident in the context of your organization's own security, compliance, and risk management frameworks.
In connection with this incident, Lumos has engaged Calderwood & Harkness LLP as outside breach response counsel to advise on all legal, regulatory, and notification obligations arising from the incident. Lumos has also retained Palisade Digital Forensics, Inc. ("Palisade"), a nationally recognized independent forensic investigation firm, to conduct an independent, thorough investigation of the incident, including a full review of server logs, authentication records, network traffic data, and affected user accounts. The findings of Palisade's investigation are summarized in Section 3 of this letter.
This enterprise notification is being sent concurrently with individual breach notification letters that Lumos is delivering directly to all affected individual users, including those users affiliated with [Customer Legal Name]. Further details regarding the individual notification process and the complimentary credit monitoring and identity theft protection services being offered to affected users are set forth in Section 6 below.
2. Description of the Incident
Nature of the Attack
Between approximately June 12, 2024, at 02:14 UTC, and June 15, 2024, at 19:47 UTC, one or more threat actors conducted a credential-stuffing attack against the Lumos Insight Platform. A credential-stuffing attack is a form of cyberattack in which an adversary uses automated tools to inject large volumes of username-and-password pairs — typically obtained from unrelated, previously disclosed data breaches — into the login page of a targeted service. The attack exploits the common practice of credential reuse, whereby individuals use the same or similar username and password combinations across multiple online services.
In this instance, the threat actors utilized username-and-password pairs that were obtained from an unrelated, third-party data breach involving VaultSync Technologies, Inc. ("VaultSync"), a consumer cloud storage provider. VaultSync publicly disclosed its own security breach on May 28, 2024, acknowledging that a database containing user credentials had been exfiltrated from its systems in a separate and unrelated cyberattack. The compromised VaultSync credentials were subsequently made available on underground forums and dark-web marketplaces, where they were acquired by the threat actors who carried out the credential-stuffing attack against the Lumos Insight Platform.
The threat actors used these previously compromised VaultSync credentials to make automated login attempts against the Insight Platform. Where individual users had reused the same username-and-password combination across both VaultSync and Lumos, the attackers were able to gain unauthorized access to those users' Lumos accounts. No vulnerability in Lumos's own systems, infrastructure, or authentication mechanisms was exploited; the unauthorized access was achieved solely through the use of valid user credentials that had been compromised externally.
During the approximately three-and-a-half-day attack window, Lumos's systems recorded approximately 2.16 million login attempts associated with the credential-stuffing campaign. Of those attempts, 11,438 unique user accounts were successfully accessed by the threat actors, representing a success rate of approximately 0.53%. The 11,438 affected accounts spanned 847 distinct enterprise customer tenants out of the approximately 4,200 total enterprise customer tenants on the Lumos Insight Platform.
Detection and Containment
Lumos's security information and event management ("SIEM") platform, WatchTower, provided by Aegis Security Solutions, Inc., triggered automated anomaly alerts at approximately 14:22 UTC on June 15, 2024. The alerts were based on the detection of abnormal volumetric login patterns — specifically, a sustained and unusually high rate of failed authentication attempts originating from a geographically dispersed set of IP addresses — as well as geographic IP anomalies indicating login attempts from regions inconsistent with the established usage patterns of the affected user accounts.
Upon receipt of the WatchTower alerts, Lumos's Security Operations Center ("SOC") initiated its incident response protocol and began an immediate investigation. The SOC confirmed that the anomalous login activity was consistent with a credential-stuffing attack at approximately 16:08 UTC on June 15, 2024. The SOC escalated the incident to Lumos's Chief Information Security Officer, who activated the Company's full incident response plan and engaged outside counsel and Palisade Digital Forensics.
By 20:30 UTC on June 15, 2024, Lumos executed the following containment measures to halt the attack and prevent any further unauthorized access:
• Global Password Reset: Lumos initiated a forced password reset for all approximately 286,000 registered Insight Platform users, requiring every user to create a new password before regaining access to the Platform. This measure was taken out of an abundance of caution to protect all users, not only those whose accounts had been accessed during the attack.
• IP Address blocking: Lumos identified and permanently blocked all 1,247 unique source IP addresses associated with the credential-stuffing attack. The IP addresses were primarily geolocated to Eastern Europe and Southeast Asia. These addresses were added to Lumos's global IP relistlist and shared with Aegis Security Solutions for incorporation into broader threat intelligence feeds.
These containment measures effectively terminated the attack. No further unauthorized access attributable to this credential-stuffing campaign has been detected since the implementation of containment at 20:30 UTC on June 15, 2024.
Impact to [Customer Legal Name]
Based on the findings of Lumos's internal investigation and the independent forensic analysis conducted by Palisade Digital Forensics, [NUMBER] user accounts associated with [Customer Legal Name]'s tenant on the Lumos Insight Platform were among the 11,438 accounts that were accessed during this incident, out of [TOTAL NUMBER] total Lumos accounts held by users affiliated with [Customer Legal Name].
A list of the specific user accounts within [Customer Legal Name]'s tenant that were accessed during the incident is available upon request. Lumos is prepared to provide this information to [Customer Legal Name]'s designated security or compliance contact through a secure channel, subject to appropriate verification of the requesting individual's authority.
3. Forensic Investigation Findings
As noted above, Lumos retained Palisade Digital Forensics, Inc. to conduct a comprehensive, independent forensic investigation of the security incident. Palisade is a nationally recognized digital forensics and incident response firm with extensive experience investigating cybersecurity incidents across the financial services, technology, and healthcare sectors. Palisade's investigation included a thorough review of Lumos's server logs, authentication records, network traffic data, session activity records, and infrastructure configuration files, as well as targeted analyses of the accounts that were accessed during the attack.
Palisade completed its final forensic investigation report on July 15, 2024. The key conclusions of the investigation are as follows:
• No Compromise of Lumos Internal Systems: The investigation found no evidence of any compromise of Lumos's internal systems, databases, application infrastructure, or network environment. All unauthorized access was accomplished solely through the use of valid user credentials that were obtained externally from the VaultSync breach. The threat actors did not exploit any software vulnerability, misconfiguration, or architectural weakness in the Lumos Insight Platform.
• No Malware or Persistence Mechanisms: The investigation found no evidence that any malware, backdoors, web shells, or other persistence mechanisms were deployed in or through any of the accessed accounts. There was no indication that the threat actors attempted to establish persistent access to the Platform or to any user account.
• No Lateral Movement or Privilege Escalation: The investigation found no evidence of lateral movement within the Lumos platform environment. The threat actors did not attempt to escalate privileges, access administrative functions, or move beyond the individual user accounts to which they gained access using the compromised credentials. Each unauthorized session was confined to the single user account into which the credential-stuffing attempt was successful.
• No Evidence of Bulk Data Exfiltration: The investigation found no evidence of bulk data exfiltration from the Platform. The unauthorized access sessions were predominantly short in duration, with a median session duration of 4.2 seconds per session. This duration profile is consistent with automated credential validation — a pattern in which threat actors use bots to confirm the validity of a credential pair and then move on — rather than with manual data harvesting, browsing, or exfiltration activity.
• Review of Extended Sessions: A small subset of 137 accounts exhibited session durations exceeding 30 seconds. Palisade conducted an individual review of the server logs, HTTP request records, and API call history for each of these 137 accounts. No evidence of data download activity, screenshot capture, API-based data retrieval, or any other form of data access or extraction was detected in any of these accounts. Palisade concluded that the extended session durations were likely attributable to latency in automated bot processing rather than to manual human interaction with the accounts.
In summary, the forensic investigation confirmed that Lumos's platform infrastructure, databases, encryption mechanisms, and access controls were not breached, compromised, or circumvented. The incident was limited to individual account-level access achieved through the use of externally compromised credentials, and the investigation found no evidence that any data was actually exfiltrated, downloaded, or misused during the unauthorized sessions.
4. Information Potentially Accessed
Although the forensic investigation found no evidence of data exfiltration, Lumos recognizes that each account that was accessed was potentially viewable to the unauthorized party during the duration of the session. For each accessed account, the following categories of information were potentially viewable:
• User Profile Information: The user's full name, email address, job title, employer name, and telephone number. Telephone number data was populated in approximately 68.4% of affected accounts; the remaining 31.6% of affected accounts did not have a telephone number on file.
• Dashboard Configurations and Saved Analytics Queries: Each user's personalized dashboard configurations, including custom analytics views, saved query parameters, data visualization preferences, and report templates. These configurations may reflect proprietary business data, strategic priorities, or analytical methodologies belonging to the enterprise customer, and Lumos recognizes the sensitivity of this information from a competitive and business confidentiality standpoint.
• Partial Financial Data (Subset of Accounts): In approximately 2,614 of the 11,438 total affected accounts across all enterprise customers, the user had enabled a "Quick View" feature that cached partial portfolio data on the user's profile page. For those accounts, the unauthorized party potentially had access to partial financial account numbers (last four digits only), account balances, and asset allocation summaries. This Quick View feature has since been permanently disabled across the Platform, as described in Section 5 below.
Importantly, no Social Security numbers, full financial account numbers, payment card numbers, CVV codes, PINs, or other highly sensitive financial identifiers were stored in user-facing profile pages or otherwise accessible via the Insight Platform user interface. The Insight Platform's architecture is designed so that highly sensitive identifiers are stored exclusively in encrypted back-end databases that are not exposed to the user-facing application layer.
Lumos will separately inform [Customer Legal Name] of the specific number of its affiliated user accounts, if any, that had Quick View data cached at the time of the incident. This information is available upon request and can be provided through a secure channel to [Customer Legal Name]'s designated security or compliance contact.
5. Remediation Measures Taken by Lumos
In response to this incident, Lumos has implemented a comprehensive set of security enhancements and remediation measures designed to prevent the recurrence of a credential-stuffing attack and to substantially strengthen the authentication and access security controls on the Insight Platform. These measures are described below.
Immediate Actions (June 15–16, 2024)
• Global Password Reset: On June 15, 2024, Lumos initiated a mandatory global password reset for all approximately 286,000 registered Insight Platform users. All users were required to create new passwords meeting enhanced complexity requirements (minimum 14 characters, including uppercase, lowercase, numeric, and special characters) before regaining access to the Platform. This reset was completed on June 15, 2024.
• IP Address blocking: On June 15, 2024, Lumos permanently blocked all 1,247 unique source IP addresses identified as being associated with the credential-stuffing attack. These addresses were added to Lumos's global IP relistlist and reported to relevant threat intelligence sharing organizations.
• Permanent Disabling of Quick View Feature: On June 16, 2024, Lumos permanently disabled the "Quick View" cached data feature across the entire Platform. This feature, which allowed users to view a summary of partial portfolio data from their profile page, had been identified as presenting an unnecessary incremental risk in the context of account-level compromise. All previously cached Quick View data has been purged from user profile pages and is no longer accessible through the user interface.
Enhanced Security Controls (June–July 2024)
• Advanced Bot Detection and CAPTCHA: On July 8, 2024, Lumos deployed advanced bot-detection and CAPTCHA challenge mechanisms on the Insight Platform login page. These mechanisms use behavioral analysis, device fingerprinting, and challenge-response protocols to identify and block automated login attempts, significantly reducing the effectiveness of credential-stuffing and brute-force attacks against the Platform.
• Mandatory Multi-Factor Authentication (MFA): On July 22, 2024, Lumos completed the rollout of mandatory multi-factor authentication for all Insight Platform user accounts. All users are now required to enroll in MFA — using either a time-based one-time password (TOTP) authenticator application or a hardware security key — as a condition of continued Platform access. This measure ensures that possession of a valid username and password alone is no longer sufficient to access any account on the Platform.
• Enhanced Rate Limiting: Lumos has reduced the rate-limiting threshold on authentication endpoints from 100 login attempts per minute to 10 login attempts per minute per source IP address. This measure substantially constrains the throughput of any future automated credential-testing campaign.
• Credential Screening Service: Lumos has integrated a credential-screening service that automatically checks user passwords against databases of credentials known to have been exposed in prior data breaches. This check is performed both at the time of login and at the time of any password change. If a user's credentials are found to appear in a known breach compilation, the user is immediately alerted and required to select a new, unique password before proceeding.
Lumos believes that the combination of these immediate and longer-term remediation measures represents a substantial and meaningful enhancement to the security posture of the Insight Platform. In particular, the mandatory MFA requirement directly addresses the credential-reuse risk that was exploited in this incident, ensuring that compromised credentials alone cannot be used to access any account on the Platform going forward.
6. Individual Notifications and Credit Monitoring
Lumos is sending individual breach notification letters directly to all 11,438 affected individual users, including all users affiliated with [Customer Legal Name] whose accounts were accessed during the incident. These individual notifications are being sent concurrently with this enterprise customer notification, on August 5, 2024.
Individual notification letters are being delivered via email to each affected user's registered email address on the Lumos Insight Platform. For approximately 1,612 individuals across all affected enterprise customer tenants whose email addresses bounced, were returned as undeliverable, or were flagged as potentially compromised during the incident response process, individual notification letters are being sent via U.S. first-class mail to the mailing address on file for the affected user.
As part of its commitment to supporting affected individuals, Lumos is offering all 11,438 affected users 24 months of complimentary credit monitoring and identity theft protection services through Sentinel Identity Services, Inc. ("Sentinel"). The Sentinel service includes daily credit monitoring across all three major credit bureaus, identity theft insurance coverage, dark-web monitoring for the individual's personal information, and access to Sentinel's dedicated identity restoration specialists. Each affected individual will receive a unique activation code and detailed enrollment instructions in his or her individual notification letter.
[Customer Legal Name] does not need to take any action to notify its affected employees or users. Lumos is handling all individual notifications directly and is providing affected individuals with all of the information and resources they need to protect themselves. However, Lumos respectfully requests that [Customer Legal Name] consider the following supportive measures:
• Encouraging affected users within your organization to promptly enroll in the complimentary credit monitoring services being offered by Lumos through Sentinel Identity Services.
• Reminding all employees and users to reset any other online accounts where they may have reused the same username-and-password combination that was used for their Lumos Insight Platform account.
• Encouraging employees and users to remain vigilant for signs of identity theft, phishing attempts, or other suspicious activity, and to report any such activity to their organization's information security team and to Lumos.
A copy of the template individual breach notification letter being sent to affected users affiliated with [Customer Legal Name] is enclosed with this letter for your reference.
7. Regulatory and Compliance Notifications
Lumos is filing breach notification reports with the Attorneys General of 34 U.S. states and territories in accordance with applicable state breach notification statutes. These filings have been prepared with the assistance of outside counsel, Calderwood & Harkness LLP, and are being submitted on a rolling basis between August 1, 2024, and August 5, 2024. Lumos has made these filings in all jurisdictions in which affected users are believed to reside and in which applicable law requires notification to the state Attorney General.
In addition, because a subset of affected users are located in the United Kingdom, Lumos filed a personal data breach notification with the UK Information Commissioner's Office ("ICO") on June 18, 2024, within the 72-hour notification window required under the UK General Data Protection Regulation ("UK GDPR"). The ICO acknowledged receipt of the notification and conducted a preliminary review. On August 22, 2024, Lumos received a no-further-action letter from the ICO, indicating that the ICO does not intend to take any enforcement action in connection with this incident based on the information provided.
As of the date of this letter, Lumos has not received any enforcement action, formal inquiry, civil investigative demand, or request for additional information from any state Attorney General, the Federal Trade Commission ("FTC"), the ICO, or any other regulatory authority in connection with this incident. Should [Customer Legal Name] receive any regulatory inquiry or third-party request related to this incident, Lumos asks that [Customer Legal Name] promptly notify Lumos so that we may coordinate an appropriate response.
8. Commitment to Data Security and Ongoing Monitoring
Lumos takes the security of its customers' data with the utmost seriousness and recognizes the trust that [Customer Legal Name] places in the Insight Platform as a critical component of your business operations. Protecting the confidentiality, integrity, and availability of customer data is foundational to Lumos's mission and to the value we strive to deliver to every customer.
While the credential-stuffing attack vector exploited in this incident leveraged externally compromised credentials rather than any vulnerability in Lumos's own systems or infrastructure, Lumos has used this incident as an opportunity to substantially enhance its authentication and access security controls. The measures described in Section 5 of this letter — including mandatory multi-factor authentication, advanced bot detection, enhanced rate limiting, and credential screening — represent a significant strengthening of the Platform's defenses against credential-based attacks.
Lumos will continue to actively monitor the Insight Platform for any signs of further unauthorized access or anomalous activity. In addition to its standard, ongoing security monitoring program, Lumos is conducting a dedicated 60-day post-incident monitoring period, during which the SOC is applying heightened detection thresholds and conducting daily manual reviews of authentication logs for the accounts that were accessed during the incident. This post-incident monitoring period is expected to conclude on approximately August 14, 2024.
Lumos is committed to continued investment in platform security, and we will provide [Customer Legal Name] with updates on any material developments related to this incident. Lumos is also prepared to provide [Customer Legal Name] with a copy of Lumos's updated SOC 2 Type II report, which will reflect the enhanced security controls implemented in response to this incident, upon its completion later this year.
9. Dedicated Point of Contact
For any questions, concerns, or requests for additional information regarding this incident and its impact on [Customer Legal Name]'s users, please do not hesitate to contact the following dedicated point of contact:
Fiona Albrecht Director of Customer Success Lumos Analytics Inc. 450 Folsom Street, Suite 1200 San Francisco, CA 94105
Phone: [Direct Phone Number]
Email: [Email Address]
Fiona and her team are available to schedule a call or meeting at your convenience to discuss the incident in greater detail, answer any technical or operational questions, review the list of affected accounts within [Customer Legal Name]'s tenant, and coordinate any internal communications that [Customer Legal Name] may wish to make to its own workforce, board of directors, clients, or other stakeholders. We understand that [Customer Legal Name] may have its own notification and reporting obligations, and we are fully prepared to support you in meeting those obligations.
For any inquiries of a legal or regulatory nature, [Customer Legal Name] may also contact Allison Cho, General Counsel & Chief Privacy Officer, at the address set forth below.
Lumos sincerely regrets any concern or inconvenience that this incident may cause [Customer Legal Name] and its personnel. We understand the seriousness of any unauthorized access to user accounts, and we want to assure you that Lumos has treated this incident with the highest level of urgency, transparency, and diligence. We remain fully committed to the security of the Insight Platform, to the protection of your data, and to the ongoing partnership between Lumos and [Customer Legal Name]. We are grateful for the trust you place in us, and we will continue to work to earn that trust every day.
Please do not hesitate to reach out with any questions or concerns.
Sincerely,
LUMOS ANALYTICS INC.
By: ________
Allison Cho General Counsel & Chief Privacy Officer Lumos Analytics Inc. 450 Folsom Street, Suite 1200 San Francisco, CA 94105
By: ________
Fiona Albrecht Director of Customer Success Lumos Analytics Inc. 450 Folsom Street, Suite 1200 San Francisco, CA 94105
Encl.: Copy of the template individual breach notification letter being sent to affected users affiliated with [Customer Legal Name]
INTERNAL DRAFTING NOTES — PRIVILEGED AND CONFIDENTIAL FOR LUMOS ANALYTICS INC. AND CALDERWOOD & HARKNESS LLP USE ONLY NOT TO BE INCLUDED IN FINAL SENT LETTERS
C&H Matter No.: 1008-00009
Prepared by: Rachel Bernstein, Sara Hendricks, Priscilla Wynn — Calderwood & Harkness LLP
Template Usage: This template letter is to be used for all 847 affected enterprise customer tenants receiving notification in connection with the Lumos Insight Platform credential-stuffing incident. Each letter must be customized by populating the bracketed template fields with the correct information for the specific enterprise customer.
Bracketed Field Population: All bracketed fields — including [Customer Contact Name], [Customer Contact Title], [Customer Legal Name], [Customer Street Address], [Customer City, State ZIP], [NUMBER] (of affected accounts), and [TOTAL NUMBER] (of total Lumos accounts held by the customer) — are to be populated from the master affected-accounts database maintained by Jason Haddad, CISO, and Fiona Albrecht, Director of Customer Success. The master database is stored in the Lumos incident response secure file share and is current as of July 31, 2024.
Example Populations:
Personal Outreach for Top-10 Customers: For the top-10 enterprise customers by annual contract value (including, without limitation, Cascadia National Bancorp), Fiona Albrecht is to make a personal phone call to the customer's primary designated contact in advance of, or concurrent with, the delivery of this letter. The purpose of the call is to provide advance notice, demonstrate the seriousness with which Lumos is treating this matter, and offer a real-time opportunity for the customer to ask questions.
Timing: All 847 enterprise customer notification letters are to be sent on August 5, 2024, concurrent with the delivery of individual breach notification letters to affected users and the completion of state Attorney General filings.
Escalation Protocol: Any customer inquiries involving legal issues, regulatory obligations, indemnification or liability questions, or matters requiring legal judgment are to be escalated immediately to Allison Cho, General Counsel & Chief Privacy Officer, and to Calderwood & Harkness LLP (Rachel Bernstein and Sara Hendricks) for review and response.
Approval: This template letter has been reviewed and approved by Calderwood & Harkness LLP as part of the firm's incident response engagement under C&H Matter No. 1008-00009. Any substantive modifications to the template must be reviewed and approved by C&H prior to distribution.
PRIVILEGED AND CONFIDENTIAL — ATTORNEY-CLIENT PRIVILEGE — ATTORNEY WORK PRODUCT
Enterprise Customer | Accounts Accessed | Total Lumos Accounts | Address
Cascadia National Bancorp | 312 | 1,247 | 900 SW Fifth Avenue, Portland, OR 97204
Monarch Wealth Advisors, LLC | 89 | — | 281 Trumbull Street, Suite 1400, Hartford, CT 06103
Ironbridge Insurance Holdings, Inc. | 204 | — | 1601 Chestnut Street, Suite 2200, Philadelphia, PA 19103

LUMOS ANALYTICS INC. 450 Folsom Street, Suite 1200 San Francisco, CA 94105

LUMOS ANALYTICS INC.

Record

Parties

Dates

Amounts