Full text of the Exhibit D filed in Factor Cybersecurity, Inc. et al v. SecurityScorecard, Inc. et al. Text extracted from the original PDF (scanned pages converted with text recognition, so minor errors are possible).
Page 2
Benjamin J. Schladweiler
Tel 302.661.7352
Fax 302.661.7162
schladweilerb@gtlaw.com
August 10, 2026
VIA
Paul B. Keller
Brownstein Hyatt Farber Schreck, LLP
75 Rockefeller Plaza, Suite 2600B
New York, NY 10019
pkeller@bhfs.com
Re: Response to SecurityScorecard
Dear Paul:
I write on behalf of Factor Cybersecurity, Inc. (“Factor”) in response to
SecurityScorecard’s (“SSC”) July 14, 2026 letter and your following communications with Mr.
Jason Thompson. I also write to request that SSC and its CEO, Mr. Aleksandr Yampolskiy,
immediately cease and desist disseminating false, tortious and defamatory communications
concerning Factor and Mr. Thomspon, as outlined below.
SSC’s False, Tortious and Defamatory Communications:
Since Mr. Thompson resigned from SSC, SSC executives, including Mr. Yampolskiy, have
repeatedly disseminated baseless accusations against Factor, falsely accusing Factor of stealing
SSC’s intellectual property. Mr. Yampolskiy made these false accusations publicly on social media
and in communications with Factor’s employees, advisors, and business partners listed on Factor’s
website.
In his communications, Mr. Yampolskiy threatened Factor’s employees and partners with
“reputational or legal complications,” subpoenas, and other adverse actions if their association
with Factor continued. These communications appear to have been designed to frighten Factor’s
employees, advisors, and partners, discourage people from working with Factor, damage Factor’s
professional reputation, imply that anyone associated with Factor will become involved in
litigation, and interfere with Factor’s employment, advisory, investment, and commercial
relationships.
For instance, Factor advisor Tom Bain received the following threat from Mr. Yampolskiy
in May 2026:
GREENBERG TRAURIG, LLP ATTORNEYS AT LAW WWW.GTLAW.COM
222 Delaware Avenue, Suite 1600 , Wilmington, Delaware 19801 Tel: 302.661.7000 Fax 302.661.7360
Page 3
Paul B. Keller
August 10, 2026
Page 2
Similarly, in July 2026, Mr. Yampolskiy sent a message to Anders Norremo, a Factor
advisor, making similar false allegations about data theft and other defamatory statements about
Mr. Thompson.
As shown below, Mr. Yampolskiy also made disparaging comments about Factor on the
social media pages of Factor’s employees and business associates.
In total, Mr. Yampolskiy has threatened most of Factor’s associates listed on its website.
He has also made threats against other business associates of Factor.
GREENBERG TRAURIG, LLP Attorneys at Law www.gtlaw.com
Page 4
Paul B. Keller
August 10, 2026
Page 3
SSC’s copying allegations are not only false, they are implausible on their face. Mr.
Thompson never had access to SSC’s code during his employment, and SSC has yet to produce
any evidence supporting its baseless allegations such as the MDM logs in SSC’s possession that
could definitively show that such copying did not occur.
On May 15, 2026, Mr. Thompson sent a cease and desist notice to SSC’s board of directors
requesting that SSC stop contacting Factor’s employees, advisors, customers, investors, and
affiliates. SSC, however, seemingly took no action as Mr. Yampolskiy’s tortious and defamatory
conduct not only continued, but it increased.
Please confirm that SSC and Mr. Yampolskiy will immediately stop all such threatening
communications and behavior and that Mr. Yampolskiy will retract his previous defamatory
comments. If SSC refuses to do so, please provide the MDM logs in SSC’s possession. As you
know, we have sent you a draft NDA and are willing to provide evidence in Factor’s possession
in exchange for this evidence once an NDA is executed. Nonetheless, SSC is hereby on notice of
its obligation to preserve and protect all relevant documents relating to this matter, including, but
not limited to, the MDM logs.
Factor reserves all rights, including its right to bring tortious interference, defamation,
and/or other claims against SSC, should SSC’s tortious conduct continue and/or SSC’s past
defamatory statements are not rectified.
SSC Has No Rights in the Factor Mark:
SSC baselessly alleges, both in its correspondence with Mr. Thompson, and in
communications on social media and with Factor’s employees and business associates, that Factor
misappropriated the Factor mark from SSC. But, as explained below, SSC has no rights in the
Factor mark. Therefore, as explained above, SSC’s statements to the contrary are false and
defamatory and need to stop and be rectified.
Mr. Thompson founded Factor Cybersecurity, Inc. as a Delaware corporation on July 5,
2021, roughly four years before SSC filed for a trademark for the FACTOR CYBERSECURITY
mark. (Exhibit A). Moreover, Factor first began using the FACTOR mark in commerce at least as
early as June 2023, as evidenced by Mr. Thompson’s invoices sent to SSC at the time. (Exhibit B).
Moreover, Factor began using the FACTOR CYBERSECURITY mark in commerce no later than
July 17, 2025, and we can provide evidence of this once an NDA is in place.
In contrast, we have seen no evidence that SSC ever used the FACTOR
CYBERSECURITY mark in commerce. Indeed, when SSC filed for its trademark, it claimed that
it intended to use the mark in commerce, not that it had actually used the mark. SSC’s trademark
filing in July 2025 coincides with Mr. Thompson’s resignation that same month. Thus, it appears
SSC filed for this trademark for the improper purpose of keeping it from Factor, and not because
it actually intended to use the mark in commerce. If you have evidence showing SSC’s commercial
use of the FACTOR CYBERSECURITY mark, please provide it. Otherwise, we assume no such
evidence exists.
GREENBERG TRAURIG, LLP Attorneys at Law www.gtlaw.com
Page 5
Paul B. Keller
August 10, 2026
Page 4
SSC alleges that it owns the FACTOR CYBERSECURITY mark because it was allegedly
“Work Product” that Mr. Thompson “developed in connection with” his work at SSC. But SSC
has provided no evidence of this. Indeed, the evidence demonstrates Mr. Thompson’s incorporated
Factor Cybersecurity, Inc. as a Delaware corporation before his employment as SSC’s Chief
Marketing & Strategy Officer and before he signed the Contractor Agreement. Moreover, the
Contractor Agreement is governed by New York law, which makes clear that intellectual property
that an employ develops on his own is not assignable to an employer even when there is an
assignment agreement that states otherwise. See NY LABOR LAW 203-F.
In your July 14 letter, SSC claims that Mr. Thompson signed SSC’s Employee Proprietary
Information and Inventions and Non-Competition Agreement. Contrary to SSC’s assertions, we
understand that Mr. Thompson never signed such an agreement. If you have documentary evidence
to the contrary, please provide it at your earliest convenience.
For these reasons, we demand that SSC (1) immediately cease from claiming that it owns
the mark, (2) immediately cease and desist all use of the FACTOR CYBERSECURITY name and
mark in any form, (3) at Factor’s election, either withdraw and abandon Application Serial Nos.
99/294,626 and 99/279,649, or execute an assignment of the applications transferring all rights,
title and interest to the applications and underlying marks to Factor, and (4) confirm in writing,
within ten (10) business days of the date of this letter that you have done so.
Requests for Return of SSC’s Alleged Property
In July 2026, a year after Mr. Thompson resigned from Factor, SSC claimed that “[o]ur
records reflect that you have not returned your Company-issued laptop or other Company property
in your possession.” SSC has not provided these “records” or described what “other Company
property” could possibly be in Mr. Thompson’s possession.
You provided the serial number for a laptop that was allegedly provided to Mr. Thompson
for the first time last week and we are currently investigating whether Mr. Thompson has
possession of a laptop with that serial number. Mr. Thompson is not in possession of any other
potential SSC-property. Even if Mr. Thompson has a “Company-issued laptop,” that laptop would
not be operable because SSC presumably prevented Mr. Thompson from accessing it after his
resignation. Again, to the extent SSC continues to press its baseless claims of intellectual property
misappropriation and theft, we request that SSC provide the MDM logs for that laptop.
You claim that the laptop Mr. Thompson previously provided to FTI Consulting was not
SSC property, yet you have yet to return it or confirm that FTI Consulting did not image the
computer. Please do so promptly. As you admit, this computer is not SSC’s and thus you have no
rights to it. We reserve all rights should SSC fail to do so.
SSC’s Allegations Concerning Mr. Thompson’s Public Statements
In your July 16, 2026 communication with Mr. Thompson, you claim that he made
“unsupported” statements “concerning SSC” in “recent LinkedIn postings and other public
GREENBERG TRAURIG, LLP Attorneys at Law www.gtlaw.com
Page 6
Paul B. Keller
August 10, 2026
Page 5
communications,” and you asked him to cease “publishing, republishing, or amplifying false,
misleading, harassing, or defamatory statements concerning SSC, its officers, directors,
employees, business partners, or other affiliated persons.”
Contrary to your assertions, Mr. Thompson’s statements are not defamatory and are
supported by documents in Mr. Thompson’s and SSC’s possession and by third party witnesses.
As a non-limiting example, there is ample evidence and witnesses who would testify concerning
SSC’s efforts to improperly obtain information about competitor products, including BitSight,
Black Kite, and others. Josh Fazio, a former SecurityScorecard employee, is a witness to Mr.
Yampolskiy’s conduct and his unauthorized access to BitSight. In July 2025, Mr. Fazio received
a blocked, voice-masked telephone call that was witnessed by his wife where the caller stated
words to the effect of “if you help Jason Thompson, we will kill you.” SSC has evidence that
would confirm whether this call came from Mr. Yampolskiy, and we demand that you preserve all
such evidence, including but not limited to Mr. Yampolskiy’s phone records.
Nonetheless, Mr. Thompson already told you he will “refrain from making any further
public commentary until” the issues discussed in this letter are resolved “[s]o long as you keep
Yampolskiy in check.” We remain open to such a compromise.
* * *
We are happy to discuss these issues with you. We look forward to your response.
Sincerely,
/s/ Benjamin J. Schladweiler
Benjamin J. Schladweiler
GREENBERG TRAURIG, LLP Attorneys at Law www.gtlaw.com
Page 8
State of Delaware
Secretary of State
Division of Corporations
Delivered 04:13 PM 07/06/2021 CERTIFICATE OF INCORPORATION
FILED 04:13 PM 07/06/2021
SR 20212634493 - FileNumber 6060040
OF
FACTOR CYBERSECURITY INC.
ARTICLE I
The name of the corporation is Factor Cybersecurity Inc. (the “Corporation”).
ARTICLE II
The address of the Corporation’s registered office in the state of Delaware is 251 Little
Falls Drive, Wilmington, New Castle County, Delaware 19808. The name of its registered agent
at such address is Corporation Service Company.
ARTICLE III
The purpose of the Corporation is to engage in any lawful act or activity for which
corporations may be organized under the Delaware General Corporation Law.
ARTICLE IV
The aggregate number of shares which the Corporation shall have authority to issue is
10,000,000 shares of capital stock all of which shall be designated “Common Stock” and have a
par value of $0.00001 per share.
ARTICLE V
The business and affairs of the Corporation shall be managed by or under the direction of
the Board of Directors. Elections of directors need not be by written ballot unless otherwise
provided in the Bylaws of the Corporation. In furtherance of and not in limitation of the powers
conferred by the laws of the state of Delaware, the Board of Directors of the Corporation is
expressly authorized to make, amend or repeal Bylaws of the Corporation.
ARTICLE VI
(A) To the fullest extent permitted by the Delaware General Corporation Law, as the
same exists or as may hereafter be amended, a director of the Corporation shall not be personally
liable to the Corporation or its stockholders for monetary damages for breach of fiduciary duty as
a director.
(B) The Corporation shall indemnify to the fullest extent permitted by law any person
made or threatened to be made a party to an action or proceeding, whether criminal, civil,
administrative or investigative, by reason of the fact that he, his testator or intestate is or was a
director or officer of the Corporation or any predecessor of the Corporation, or serves or served at
any other enterprise as a director or officer at the request of the Corporation or any predecessor to
the Corporation.
Page 9
(C) Neither any amendment nor repeal of this Article VI, nor the adoption of any
provision of the Corporation’s Certificate of Incorporation inconsistent with this Article VI, shall
eliminate or reduce the effect of this Article VI in respect of any matter occurring, or any action
or proceeding accruing or arising or that, but for this Article VI, would accrue or arise, prior to
such amendment, repeal or adoption of an inconsistent provision.
ARTICLE VII
Unless the Corporation consents in writing to the selection of an alternative forum, the
Court of Chancery of the State of Delaware shall be the sole and exclusive forum for (A) any
derivative action or proceeding asserting a claim on behalf of the Corporation, (B) any action or
proceeding asserting a claim of breach of a fiduciary duty owed by any current or former director,
officer, employee or agent of the Corporation to the Corporation or the Corporation’s stockholders,
(C) any action or proceeding asserting a claim against the Corporation arising pursuant to any
provision of the Delaware General Corporation Law or the Corporation’s Certificate of
Incorporation or Bylaws, (D) any action or proceeding asserting a claim as to which the Delaware
General Corporation Law confers jurisdiction upon the Court of Chancery of the State of
Delaware, or (E) any action or proceeding asserting a claim governed by the internal affairs
doctrine, in each case subject to said Court of Chancery having personal jurisdiction over the
indispensable parties named as defendants therein.
ARTICLE VIII
The name and mailing address of the incorporator are as follows:
Jason Thompson
31736 Marsh Island Avenue
Lewes, DE 19958
Executed on July 05, 2021.
E-signed using Clerky (37913084747 10/9e11845350920a410)
Jason Thompson, Incorporator
Page 11
e v M
# X | [ GTMOpeatingCors X | @ TryDocusignfortree X | @) Home - Google Orive X
€ > € % docs.google.comidocument/d/INGCWanOBN_kwykaPWxdUkkVOBaxvOJOIXMBOSKNYN-cledit?tab=1.0
€ June 6, 2023, 6:25AM
@ 100% ~
&«
Document tabs
@ 20230531 SecurityScorcar...
Jason O Thompson / Factor
31736 Marsh Island Avenue
Lewes, DE 19958
(206) 617-7701
Jason@factor.rocks
INVOICE
Invoice #: SSC-2023-001
Date: June 4,2023
Payable (ap@:
SecurityScorecard
1140 Avenue of the Americas
New York, NY, 10036
Please remit payment to:
By check: By wire:
Jason D Thompson Jason D Thompson
31736 Marsh Island Avenue 31736 Marsh Island Avenve
Lewes, DE 19958 Lewes, DE 19958
Routing#: 026009593
Accounts: 483060954700
B 20230531 Secwritys: X+ 4 Ask Gomini
# O & @Wok ActionRequred |
Version history
[um -
June 2023
June 6, 2023, 6:25AM i
Current versica
® Jason Thampson
> June 4,2023, 8:22PM
© Jascn Thompson
June 4, 2023, 7:55PM
® Jason Thompson