Commitments and Contingencies

3 Months Ended

Mar. 31, 2025

Commitments and Contingencies Disclosure [Abstract]


8. Commitments and Contingencies

Leases

We have operating leases for corporate offices and subleased offices. As of March 31, 2025, we did not have any operating leases that had not yet commenced.

Release from Washington, DC lease

In February 2025, we made a one-time cash release payment of $28.0 million to the lessor in connection with a release from our lease for office space in Washington, DC (which was acquired as part of our acquisition of EVERFI in December 2021). Due to our remote-first workforce strategy, we had not used the office space since February 2023 and had subleased a portion of the space. During the three months ended March 31, 2025, we recorded a loss on lease termination of $24.3 million in general and administrative expense.

The following table summarizes the components of our lease expense:


	Three months ended March 31,
(dollars in thousands)		2025		2024
Operating lease cost(1)		$	716	$	1,986
Variable lease cost		198		313
Sublease income		(959)		(698)
Net lease cost		$	(45)	$	1,601

(1)Includes short-term lease costs, which were immaterial.

Maturities of our operating lease liabilities as of March 31, 2025 were as follows:






Years ending December 31, (dollars in thousands)	Operating leases
2025 - remaining	$	901
2026	1,040
2027	1,012
2028	776
2029	—

Thereafter	—
Total lease payments	3,729
Less: Amount representing interest	(261)
Present value of future payments	$	3,468

Other commitments

The term loans under the 2024 Credit Facilities require periodic principal payments. The balance of the term loans and any amounts drawn on the revolving credit loans are due upon maturity of the 2024 Credit Facilities in April 2029. The Real Estate Loans also require periodic principal payments and the balance of the Real Estate Loans are due upon maturity in April 2038.

We have contractual obligations for third-party technology used in our solutions and for other services we purchase as part of our normal operations. In certain cases, these arrangements require a minimum annual purchase commitment by us. As of March 31, 2025, the remaining aggregate minimum purchase commitment under these arrangements was approximately $194.7 million through 2029.

Solution and service indemnifications

In the ordinary course of business, we provide certain indemnifications of varying scope to customers against claims of intellectual property infringement made by third parties arising from the use of our solutions or services. We have not identified any losses that might be covered by these indemnifications.

Legal proceedings

We are subject to legal proceedings and claims that arise in the ordinary course of business, as well as certain other non-ordinary course proceedings, claims and investigations, as described below. We make a provision for a loss contingency when it is both probable that a material liability has been incurred and the amount of the loss can be reasonably estimated. If only a range of estimated losses can be determined, we accrue an amount within the range that, in our judgment, reflects the most likely outcome; if none of the estimates within that range is a better estimate than any other amount, we accrue the low end of the range. For proceedings in which an unfavorable outcome is reasonably possible but not probable and an estimate of the loss or range of losses arising from the proceeding can be made, we disclose such an estimate, if material. If such a loss or range of losses is not reasonably estimable, we disclose that fact. We review any such loss contingency provisions at least quarterly and adjust them to reflect the impacts of negotiations, settlements, rulings, advice of legal counsel and other information and events pertaining to a particular case. We recognize insurance recoveries, if any, when they are probable of receipt. All associated costs due to third-party service providers and consultants, including legal fees, are expensed as incurred.

Legal proceedings are inherently unpredictable. However, we believe that we have valid defenses with respect to the legal matters pending or threatened against us and intend to defend ourselves vigorously against all claims asserted. It is possible that our consolidated financial position, results of operations or cash flows could be materially negatively affected in any particular period by an unfavorable resolution of one or more of such legal proceedings.

Security incident

As previously disclosed, we are subject to risks and uncertainties as a result of a ransomware attack against us in May 2020 in which a cybercriminal removed a copy of a subset of data from our self-hosted environment (the "Security Incident"). Based on the nature of the Security Incident, our research and third party (including law enforcement) investigation, we do not believe that any data went beyond the cybercriminal, has been misused, or has been disseminated or otherwise made available publicly.

As a result of the Security Incident, we are currently subject to certain legal proceedings, claims and investigations, as discussed below, and could be the subject of additional legal proceedings, claims, inquiries and investigations in the future that might result in adverse judgments, settlements, fines, penalties or other resolution. To limit our exposure to losses related to claims against us, including data breaches such as the Security Incident, we maintain $50 million of insurance above a $250 thousand deductible payable by us. This coverage reduced our financial exposure related to the Security Incident in prior years. See our Annual Report on Form 10-K filed with the SEC on February 21, 2025 for more information regarding the Security Incident.

We recorded expenses and offsetting insurance recoveries related to the Security Incident as follows:


	Three months ended March 31,
(dollars in thousands)		2025		2024
Gross expense		$	2,180	$	10,323
Offsetting insurance recoveries		—		—
Net expense		$	2,180	$	10,323

The following summarizes our cumulative expenses, insurance recoveries recognized and insurance recoveries received as of:


(dollars in thousands)	March 31, 2025		December 31, 2024
Cumulative gross expense	$	177,311	$	175,131
Cumulative offsetting insurance recoveries recognized	(50,000)		(50,000)
Cumulative net expense	$	127,311	$	125,131

Cumulative offsetting insurance recoveries received	$	(50,000)	$	(50,000)

Recorded expenses have consisted primarily of payments to third-party service providers and consultants, including legal fees, settlement of the previously disclosed SEC investigation, multi-state Attorneys General investigation and Attorney General of the State of California investigation, settlements of customer claims and accruals for certain loss contingencies. Not included in the expenses discussed above were costs associated with enhancements to our cybersecurity program. We present expenses and insurance recoveries related to the Security Incident in general and administrative expense on our unaudited, condensed consolidated statements of comprehensive income and as operating activities on our unaudited, condensed consolidated statements of cash flows. Total costs related to the Security Incident exceeded the limit of our insurance coverage during the first quarter of 2022. We expect to continue to incur expenses related to our response to the Security Incident, resolution of legal proceedings, claims and investigations, including those discussed below, and our efforts to further enhance our cybersecurity measures. For the three months ended March 31, 2025, we incurred net pre-tax expenses of $2.2 million related to the Security Incident, which included $1.1 million for ongoing legal fees and additional accruals of loss contingencies of $1.1 million. During the three months ended March 31, 2025, we had net cash outlays which were insignificant related to the Security Incident for ongoing legal fees and the settlement of putative consumer class actions cases in Canada discussed below. In line with our policy, legal fees are expensed as incurred.

As of March 31, 2025, we have recorded approximately $1.6 million in aggregate liabilities for loss contingencies based primarily on recent negotiations with certain plaintiffs and customers related to the Security Incident that we believed we could reasonably estimate in accordance with our loss contingency procedures described above. Our liabilities for loss contingencies are recorded in accrued expenses and other current liabilities on our unaudited, condensed consolidated balance sheets. It is reasonably possible that our estimated actual losses may change in the near term for those matters, but

we believe that they are not reasonably likely, either separately or in the aggregate, to have a material adverse impact on our results of operations, cash flows or financial condition.

There may be other Security Incident-related matters, which could, separately or in the aggregate, result in an adverse judgment, settlement, fine, penalty or other resolution, the amount, scope and timing of which we are currently unable to predict.

Customer claims. We believe that substantially all specific requests from customers for reimbursement of expenses incurred by them related to the Security Incident, have been fully resolved and closed or are inactive and have been abandoned by the customers. We also believe that substantially all reservations of the right to seek expense recovery in the future that we received from customers or their attorneys in the U.S., U.K. and Canada related to the Security Incident, none of which resulted in claims submitted to us, have been abandoned by the customers and that all claims or proposed claims on behalf of a number of U.K. data subjects received by us, have been fully resolved and closed or are inactive and have been abandoned by the data subjects. In addition, insurance companies representing various customers’ interests through subrogation claims contacted us, and certain insurance companies filed subrogation claims in court, all of which are now considered by us to be resolved or inactive and abandoned by the insurance companies.

Customer constituent class actions. Presently, we are a defendant in cases in U.S. federal courts (which have been consolidated under multi district litigation to a single federal court) alleging harm from the Security Incident. The plaintiffs in these cases generally claim to have been harmed by alleged actions and/or omissions by us in connection with the Security Incident and assert a variety of common law and statutory claims seeking monetary damages, injunctive relief, costs and attorneys’ fees and other related relief.

On May 14, 2024, the United States District Court for the District of South Carolina issued a memorandum opinion and order that, among other things, denied the multi district litigation plaintiffs' motion for class certification. On July 30, 2024, the Fourth Circuit Court of Appeals denied the plaintiffs' petition for permission to appeal the Court's ruling. While this litigation remains ongoing, we believe that it is not reasonably likely to have a material adverse impact on our results of operations, cash flows or financial condition.

In December 2024 and January 2025, judges in Ontario and British Columbia, respectively, approved a settlement between us and plaintiffs in putative consumer class actions cases in Canada. In January 2025, the insignificant settlement was paid to Canadian charities designated in the settlement agreement as cy pres recipients.

Governmental investigations. As previously disclosed, we are subject to an ongoing investigation by the U.S. Department of Health and Human Services. We also responded to inquiries from the Office of the Australian Information Commissioner in September 2020 and the Office of the Privacy Commissioner of Canada in October 2020. Although we have not received notices of the termination of any of these inquiries and investigations, we believe that these matters are no longer active.

For more information about the completed government investigations and related actions, see Note 11 to our audited consolidated financial statements contained in our Annual Report on Form 10-K filed with the SEC on February 21, 2025.