TEMPLATE — FOR ADAPTATION ACROSS JURISDICTIONS Drafted by Calderwood & Harkness LLP
LUMOS ANALYTICS INC. 450 Folsom Street, Suite 1200 San Francisco, CA 94105
August 5, 2024
[First Name] [Last Name] [Street Address Line 1] [Street Address Line 2] [City], [State] [Zip Code]
[For U.S. Mail Version Only — Omit for Email Delivery]
Re: Notice of Data Security Incident
Dear [First Name] [Last Name]:
1. Introduction and Purpose of This Letter
We are writing to inform you about a data security incident involving the Lumos Insight Platform, a product of Lumos Analytics Inc. ("Lumos," "we," "us," or "our"). At Lumos, we take the privacy and security of the personal information entrusted to us seriously, and we deeply value the trust you place in our platform and our team. We are providing this notice to explain what happened, what information was involved, the steps we have taken and continue to take in response to the incident, and the resources available to you — including complimentary credit monitoring and identity theft protection services that we are offering at no cost to you for a period of twenty-four (24) months.
We encourage you to read this letter carefully and to take advantage of the protective measures described below.
[INSERT STATE-SPECIFIC INTRODUCTORY LANGUAGE, IF REQUIRED BY [STATE] LAW, e.g., statutory citation. For example, for Colorado residents: "This notice is being provided pursuant to the Colorado Consumer Protection Act, C.R.S. § 6-1-716." For Connecticut residents: "This notice is being provided pursuant to Conn. Gen. Stat. § 36a-701b." Etc.]
2. What Happened
Between approximately June 12, 2024, and June 15, 2024, Lumos experienced what is known as a "credential-stuffing" attack targeting the Lumos Insight Platform. In a credential-stuffing attack, unauthorized actors obtain username and password combinations that were exposed in unrelated, third-party data breaches, and then use automated tools to attempt to log in to other online services where individuals may have reused the same or similar credentials. Credential-stuffing attacks exploit the common practice of reusing passwords across multiple online services and are not the result of a compromise of the targeted service's own systems.
Based on our investigation, the credentials used in this attack did not originate from Lumos's own systems. Rather, the unauthorized actors obtained the username and password pairs from a breach of an unrelated third-party service. The unauthorized actors then used automated tools and scripts to attempt to log in to Lumos Insight Platform accounts using these compromised credential pairs.
On June 15, 2024, Lumos's security monitoring systems detected unusual login activity on the Lumos Insight Platform, including a significant spike in failed and successful login attempts originating from a concentrated set of IP addresses. Lumos's security operations team promptly investigated and confirmed the incident. Upon confirmation, Lumos took immediate containment steps, including forcing a global password reset for all registered users of the Lumos Insight Platform and blocking the source IP addresses associated with the unauthorized activity.
Following containment, Lumos promptly engaged outside legal counsel at Calderwood & Harkness LLP and a leading independent digital forensics firm to conduct a thorough investigation of the scope and nature of the incident. The forensic investigation determined that the unauthorized actors successfully accessed approximately 11,438 individual user accounts on the Lumos Insight Platform during the window of unauthorized activity between June 12 and June 15, 2024. We regret to inform you that your account was among those accessed during this period.
Importantly, the investigation found no evidence that Lumos's internal systems, databases, or infrastructure were compromised as a result of this incident. There was no evidence that malware was installed on Lumos's systems, and no evidence that the unauthorized actors were able to move laterally beyond the individual user accounts they accessed. The attack was limited in scope to the exploitation of reused credentials to access individual user-facing account pages on the Lumos Insight Platform.
3. What Information Was Involved
Based on the findings of the forensic investigation, the following categories of personal information were accessible within your Lumos Insight Platform account and may have been viewable by the unauthorized actors during the period of unauthorized access:
• Your full name;
• Your email address;
• Your job title;
• Your employer name; and
• Your phone number (if a phone number was populated in your account profile).
[FOR ACCOUNTS WITH QUICK VIEW FEATURE ENABLED: In addition, your account contained cached dashboard data that included partial financial account numbers (last four digits only), account balance information, and asset allocation summaries. This data was displayed through the "Quick View" feature on your account profile page, which presented a summarized snapshot of linked financial information for convenience. As described below in Section 4, the Quick View feature has been permanently disabled.]
We want to clarify that no Social Security numbers, full financial account numbers, or payment card data were stored in or accessible through user-facing profile pages on the Lumos Insight Platform. These categories of sensitive financial information were not exposed as part of this incident.
Additionally, the forensic investigation found no evidence of bulk data exfiltration — that is, no evidence that user data was mass-downloaded, copied, or transferred out of the Lumos Insight Platform by the unauthorized actors. While the unauthorized actors were able to view information displayed on the accessed account profile pages, the investigation did not identify evidence of systematic harvesting or export of that data.
4. What We Are Doing
Lumos has taken the following steps in response to the incident to contain the unauthorized activity, remediate vulnerabilities, enhance the security of the Lumos Insight Platform, and reduce the risk of similar incidents in the future:
1. Immediate Containment (June 15, 2024). Upon confirming the unauthorized activity, Lumos forced a global password reset for all approximately 286,000 registered users of the Lumos Insight Platform. All active sessions were terminated, and all IP addresses associated with the unauthorized activity were immediately blocked at the network level to prevent further unauthorized access attempts from those sources.
2. Quick View Feature Disabled (June 16, 2024). Lumos permanently disabled the Quick View cached data feature across the entire Lumos Insight Platform. The Quick View feature had displayed summarized financial information, including partial account numbers, account balances, and asset allocation summaries, on user profile pages. By permanently disabling this feature, Lumos has eliminated the possibility of similar exposure of partial financial data in the future, even in the event of unauthorized account access.
3. Advanced Bot Detection (July 8, 2024). Lumos deployed advanced bot-detection and CAPTCHA technology on the Lumos Insight Platform login page to identify and prevent automated login attempts. These technologies are designed to distinguish between legitimate human users and automated scripts or bots, significantly reducing the effectiveness of credential-stuffing and other automated attack techniques.
4. Mandatory Multi-Factor Authentication (July 22, 2024). Lumos implemented mandatory multi-factor authentication ("MFA") for all Lumos Insight Platform accounts. MFA adds an additional layer of security beyond passwords by requiring users to verify their identity through a second factor, such as a one-time code sent to a registered mobile device or generated by an authenticator application, each time they log in. This measure substantially reduces the risk that compromised credentials alone could be used to gain unauthorized access to an account.
5. Rate Limiting. Lumos reduced the permitted rate of login attempts per source IP address on the Lumos Insight Platform to further limit the effectiveness of automated credential-stuffing attacks. This rate-limiting measure ensures that high-volume login attempts from a single source are automatically throttled and blocked before they can succeed at scale.
6. Credential Screening. Lumos integrated a credential-screening service into the Lumos Insight Platform's authentication workflow. This service checks user passwords against databases of credentials known to have been compromised in third-party breaches at the time of login and at the time of any password change. If a user's credentials are found in a known breach database, the user is immediately alerted and prompted to select a new, unique password before being permitted to proceed.
7. Forensic Investigation. Lumos engaged a leading independent digital forensics firm, under the direction of outside legal counsel, to conduct a thorough and comprehensive investigation of the incident, including its scope, origin, timeline, and impact. The findings of that investigation have informed the remediation measures described in this letter and Lumos's broader security enhancement efforts.
8. Law Enforcement and Regulatory Notifications. Lumos has notified applicable regulatory authorities as required by law and has cooperated with those authorities in connection with their review of the incident. Lumos has also reported the incident to the Federal Bureau of Investigation's Internet Crime Complaint Center.
[INSERT STATE-SPECIFIC AG CONTACT INFORMATION: The Attorney General of [State] can be contacted at: [AG Office Name], [Address], [Phone Number], [Website]. For example, for California residents: "The California Office of the Attorney General can be contacted at: Office of the Attorney General, California Department of Justice, Attn: Public Inquiry Unit, P.O. Box 944255, Sacramento, CA 94244-2550; Phone: (800) 952-5225; Website: https://oag.ca.gov."]
5. What You Can Do
Although no action on your part is required, we strongly recommend that you take the following steps to help protect yourself and your personal information:
1. Change Passwords. Although Lumos has already reset your Lumos Insight Platform password, we recommend that you change the passwords on any other online accounts or services where you may have used the same or a similar username and password combination. When creating new passwords, use unique, strong passwords that include a combination of uppercase and lowercase letters, numbers, and special characters. Avoid reusing passwords across multiple online services.
2. Enable Multi-Factor Authentication. We encourage you to enable multi-factor authentication ("MFA") wherever it is available on your online accounts, including email, banking, social media, and other services. MFA provides an important additional layer of security by requiring a second form of verification beyond your password, making it significantly more difficult for unauthorized actors to access your accounts even if they obtain your password.
3. Monitor Financial Accounts. We recommend that you regularly review your bank statements, credit card statements, and other financial account statements for any unauthorized transactions or suspicious activity. If you identify any transactions or activity that you did not authorize, report them to your financial institution immediately. Prompt reporting of unauthorized activity can help minimize any potential harm and may be required to limit your liability under applicable law.
4. Review Credit Reports. We encourage you to obtain free copies of your credit reports from each of the three major nationwide credit reporting agencies — Harborview Enterprises, Penrose Group, and Penmark Enterprises — and to review them carefully for any accounts or inquiries that you do not recognize. Under federal law, you are entitled to one free credit report per year from each of the three agencies. You may obtain your free credit reports by visiting www.annualcreditreport.com, or by calling 1-877-322-8228, or by mailing a request to Annual Credit Report Request Service, P.O. Box 105281, Atlanta, GA 30348-5281.
5. Consider a Fraud Alert or Credit Freeze. You may wish to consider placing an initial fraud alert or a security freeze (also known as a credit freeze) on your credit file with each of the three major credit reporting agencies. An initial fraud alert is free and lasts for one year (or seven years for identity theft victims who provide a valid identity theft report). When a fraud alert is in place, potential creditors must take additional steps to verify your identity before opening a new account in your name. A security freeze prohibits credit reporting agencies from releasing your credit report to potential new creditors without your express authorization. A security freeze is free to place and to lift. To place a fraud alert or a security freeze, you may contact each of the three major credit reporting agencies using the information below:
Harborview Enterprises P.O. Box 105069 Atlanta, GA 30348-5069
Phone: 1-800-685-1111
Website: www.Harborview Enterprises.com
Penrose Group P.O. Box 2002 Allen, TX 75013
Phone: 1-888-397-3742
Website: www.Penrose Group.com
Penmark Enterprises P.O. Box 2000 Chester, PA 19016
Phone: 1-800-680-7289
Website: www.Penmark Enterprises.com
Please note that if you place a security freeze on your credit file, you may need to temporarily lift the freeze if you wish to apply for new credit, a loan, insurance, a rental property, or certain types of employment, as the requesting party may need access to your credit report. You can temporarily or permanently lift a freeze by contacting the relevant credit reporting agency using the information above.
6. Be Vigilant Against Phishing. Be cautious of unsolicited emails, text messages, phone calls, or other communications that request your personal information or direct you to a website that asks for personal information. Phishing attacks may attempt to exploit public awareness of a data security incident to trick individuals into divulging sensitive information. Lumos will never ask you for your password via email, text message, or phone call. If you receive a suspicious communication claiming to be from Lumos, please do not respond and contact us directly using the information provided in Section 7 of this letter.
7. File a Report with the FTC. If you believe you are a victim of identity theft or if you wish to obtain additional guidance on steps you can take to protect yourself, you may contact the Federal Trade Commission ("FTC") at:
Federal Trade Commission 600 Pennsylvania Avenue NW Washington, DC 20580 Website: www.identitytheft.gov
Phone: 1-877-438-4338 (1-877-ID-THEFT)
The FTC's website provides comprehensive resources on identity theft prevention, detection, and recovery, including step-by-step instructions for creating a personalized identity theft recovery plan.
[INSERT ADDITIONAL STATE-SPECIFIC RIGHTS AND RESOURCES AS REQUIRED. For example:
For California residents: "California residents may obtain additional information about their rights under California law from the California Office of the Attorney General at (800) 952-5225 or at https://oag.ca.gov. The California Office of Privacy Protection provides resources and guidance on identity theft at https://oag.ca.gov/privacy."
For New York residents: "New York residents may contact the New York Attorney General's Office at (800) 771-7755 or at https://ag.ny.gov. New York residents may also contact the New York Department of State Division of Consumer Protection at (800) 697-1220 or at https://dos.ny.gov/consumer-protection. Under New York law, you may also obtain a security freeze free of charge. You have a right to obtain a copy of your police report regarding identity theft."
For Maryland residents: "Maryland residents may obtain information about steps to avoid identity theft from the Maryland Attorney General's Office at (410) 576-6300 or at https://www.marylandattorneygeneral.gov."
Additional state-specific language should be inserted for Iowa, Massachusetts, North Carolina, Oregon, Washington, and other states with specific notification requirements. Refer to the Calderwood & Harkness jurisdictional matrix for applicable provisions.]
6. Complimentary Credit Monitoring and Identity Theft Protection Services
To help protect you and provide you with additional peace of mind, Lumos is offering you twenty-four (24) months of complimentary credit monitoring and identity theft protection services through Sentinel Identity Services, Inc. ("Sentinel"), at no cost to you. These services are being provided at Lumos's expense and include the following:
• Credit Monitoring: Daily monitoring of your credit file at all three major credit reporting agencies (Harborview Enterprises, Penrose Group, and Penmark Enterprises), with alerts sent to you whenever key changes are detected in your credit file, such as new account openings, credit inquiries, or changes to your personal information.
• Identity Theft Alerts: Real-time alerts for suspicious activity associated with your personal information, including potential misuse of your Social Security number, changes to your address on file with credit agencies, and other indicators of potential identity theft.
• Identity Restoration Support: If you become a victim of identity theft, Sentinel provides access to dedicated identity restoration specialists who will work with you to help resolve identity theft issues, including assisting with filing disputes, contacting creditors and financial institutions, and navigating the recovery process.
To enroll in the complimentary credit monitoring and identity theft protection services, please follow the instructions below:
Online Enrollment: Visit: [Sentinel Identity Services enrollment website URL] Enter your unique Activation Code (provided below) when prompted.
Phone Enrollment: Call toll-free: [Dedicated toll-free number] A Sentinel enrollment specialist will guide you through the enrollment process. Please have your unique Activation Code ready.
Mail Enrollment: Write to: Sentinel Identity Services, Inc. 1200 Peachtree Street NE, Suite 600 Atlanta, GA 30309 Include your full name, mailing address, and unique Activation Code in your correspondence.
Your Unique Activation Code: [ACTIVATION CODE]
Please keep this Activation Code confidential. Each recipient of this notice has been assigned a unique Activation Code that is required for enrollment. This code may only be used once and is valid for one enrollment.
Enrollment Deadline: You must enroll by [Date — 90 days from the date of this notice] to take advantage of these complimentary services. We encourage you to enroll promptly.
These credit monitoring and identity theft protection services are provided to you entirely at no cost. You will not be required to provide a credit card number or any payment information to enroll, and you will not be automatically enrolled in any paid services at the end of the complimentary period.
7. For More Information
If you have questions about this incident, need assistance enrolling in the complimentary credit monitoring and identity theft protection services, or would like to speak with a member of our team, please contact us through any of the following dedicated resources:
Dedicated Toll-Free Number: [Phone number] Available Monday through Friday, 6:00 AM to 6:00 PM Pacific Time
Dedicated Email Address: [Email address] Responses will be provided within one (1) business day.
Mailing Address: Lumos Analytics Inc. 450 Folsom Street, Suite 1200 San Francisco, CA 94105
Attn: Privacy Office
[FOR ENTERPRISE CUSTOMER-ASSOCIATED RECIPIENTS: If you are associated with an enterprise customer account and have questions regarding your organization's relationship with Lumos or any actions your organization may be taking in response to this incident, you may also contact Fiona Albrecht, Director of Customer Success, through the dedicated resources listed above. Ms. Albrecht and her team are available to address enterprise-specific inquiries and coordinate with your organization's information security and privacy teams as needed.]
Our dedicated incident response team is prepared to assist you and to answer any questions you may have. Please do not hesitate to reach out.
8. Closing
We sincerely regret any inconvenience or concern this incident may cause you. Protecting the security and privacy of your personal information is a responsibility we take seriously, and we recognize that this incident may have caused you worry or frustration. We want you to know that we are committed to earning and maintaining your trust, and we are taking meaningful, concrete steps to strengthen the security of the Lumos Insight Platform and to prevent a similar incident from occurring in the future.
We appreciate your patience and understanding, and we encourage you to take advantage of the protective measures and complimentary services described in this letter.
Sincerely,
LUMOS ANALYTICS INC.
By: ________
Allison Cho General Counsel & Chief Privacy Officer Lumos Analytics Inc.
APPENDIX: INTERNAL DRAFTING NOTES PRIVILEGED & CONFIDENTIAL — ATTORNEY WORK PRODUCT NOT FOR DISTRIBUTION TO NOTIFICATION RECIPIENTS
TEMPLATE — FOR ADAPTATION ACROSS JURISDICTIONS
Prepared by: Calderwood & Harkness LLP
Rachel Bernstein, Partner Sara Hendricks, Of Counsel Priscilla Wynn, Associate
Client: Lumos Analytics Inc.
C&H Matter No.: 1008-00009
Jurisdictional Customization Instructions
The following instructions must be followed by the notification deployment team before any version of this letter is sent to any recipient, whether by email or U.S. mail:
1. State-Specific Bracketed Fields. Bracketed fields appear throughout the body of the letter and are marked with the prefix "[INSERT" or "[FOR." Each bracketed field must be populated with the applicable state-specific statutory language, Attorney General contact information, and any additional disclosures required under the law of the recipient's state of residence before the letter is sent. Refer to the Calderwood & Harkness Jurisdictional Notification Matrix (Document No. SC-2024-04187-JNM, dated July 30, 2024) for the complete set of state-specific requirements and approved language for each jurisdiction.
2. Jurisdictional Coverage. Customized versions of this letter must be prepared for all 42 states plus the District of Columbia and Puerto Rico that require individual notification. Each jurisdiction's version must incorporate all mandatory elements identified in the Jurisdictional Notification Matrix, including but not limited to: statutory citations in the introduction; Attorney General contact information in Section 4; and state-specific rights and resources in Section 5.
3. Quick View Conditional Paragraph (Section 3). For the 2,614 recipients whose Lumos Insight Platform accounts had the Quick View feature enabled and whose accounts therefore contained cached dashboard data including partial financial account numbers (last four digits only), account balance information, and asset allocation summaries, the conditional paragraph in Section 3 marked "[FOR ACCOUNTS WITH QUICK VIEW FEATURE ENABLED]" must be included in the letter. For all recipients whose accounts did not have the Quick View feature enabled, that paragraph must be omitted. The notification deployment team must cross-reference the Quick View user list (Document No. SC-2024-04187-QVL, dated July 22, 2024) to determine which recipients require the conditional paragraph.
4. Delivery Method. The primary delivery method for this notification is email. For the 1,612 individuals whose email addresses bounced during the initial test send or were flagged as potentially compromised during the forensic investigation, this letter must be sent via U.S. first-class mail to the recipient's last known mailing address. The U.S. mail version includes the addressee block at the top of the letter; the email version omits the addressee block and the notation "[For U.S. Mail Version Only — Omit for Email Delivery]."
5. Total Notification Population. The total notification population is 11,438 individuals.
6. Target Send Date and Statutory Deadlines. The target send date for all notifications is August 5, 2024. This date falls within all applicable statutory deadlines based on the determination date of July 15, 2024:
• Most restrictive deadlines: Colorado (C.R.S. § 6-1-716(2): 30 days from determination) = August 14, 2024; Florida (Fla. Stat. § 501.171(4)(a): 30 days from determination) = August 14, 2024.
• Maryland: (Md. Code, Com. Law § 14-3504(c)(2): 45 days from discovery) = August 29, 2024.
• All other jurisdictions: Comply with "expedient" or "without unreasonable delay" standards, which are satisfied by the August 5 send date (21 days from determination).
7. Enterprise Customer Notifications. Separate business-to-business notification letters to enterprise customers whose end users were affected by the incident are being sent concurrently under a separate template (Document No. SC-2024-04187-B2B). The enterprise customer notification template has been reviewed and approved separately.
8. Enterprise Contact Reference (Section 7). The reference to Fiona Albrecht, Director of Customer Success, in Section 7 should be included only for recipients who are associated with an enterprise customer account, as identified in the enterprise customer user mapping (Document No. SC-2024-04187-ECM, dated July 28, 2024). For recipients who are individual (non-enterprise) users of the Lumos Insight Platform, the Fiona Albrecht reference should be omitted.
9. International Notifications — Coordination.
• United Kingdom (814 UK-resident affected users): Individual notification letters for UK-resident users are being sent concurrently under a separate UK-specific template that complies with the requirements of the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. The UK notifications have been prepared in coordination with Harmon Watts & Kendrick LLP, our UK data protection counsel. The UK template is a separate document and should not be confused with this U.S. template.
• European Union (47 EU-resident affected users): Individual notification letters for EU-resident users are also being sent concurrently as a precautionary measure, using a separate EU-specific template that complies with the requirements of the General Data Protection Regulation (EU GDPR). These notifications are also being coordinated with Harmon Watts & Kendrick LLP.
10. Quality Control. Before any version of this letter is sent, it must be reviewed by a member of the Calderwood & Harkness team to confirm that all bracketed fields have been properly populated, the Quick View conditional paragraph has been correctly included or omitted as applicable, the correct delivery method has been selected, and the unique Activation Code has been properly generated and inserted.
END OF TEMPLATE AND DRAFTING NOTES Calderwood & Harkness LLP — Matter No. 1008-00009 PRIVILEGED & CONFIDENTIAL — ATTORNEY WORK PRODUCT