XML 42 R29.htm IDEA: XBRL DOCUMENT v3.24.0.1
SUBSEQUENT EVENTS
12 Months Ended
Dec. 31, 2023
Subsequent Events [Abstract]  
SUBSEQUENT EVENTS SUBSEQUENT EVENTS
On January 8, 2024, the Company announced that it identified a cybersecurity incident that affected certain of the Company’s systems (the “Cybersecurity Incident”). Upon detecting unauthorized activity, the Company promptly took steps to contain and remediate the Cybersecurity Incident and initiated an investigation. The Cybersecurity Incident has now been contained. Based on the Company’s investigation findings to date, during the Cybersecurity Incident, an unauthorized third party gained access to certain sensitive personal information of approximately 16.9 million individuals stored in the Company’s systems. The Company has notified applicable regulators as required and is in the process of notifying individuals in accordance with applicable law and is offering credit monitoring and identity protection services at no charge to those individuals whose sensitive personal information was identified as potentially being subject to unauthorized access.

The Company believes that the cybersecurity incident will have a material impact on its first quarter 2024 results but does not expect the incident to have a material impact on full year 2024 results. Specifically, among other things, the Company expects to record in the first quarter of 2024 approximately $12 to $17 million of expenses related to the Cybersecurity Incident, net of expected insurance recovery. The Company maintains cybersecurity insurance coverage to limit its exposure to losses such as those related to the Cybersecurity Incident. While the Company will be seeking reimbursement of some of the costs, expenses, and losses stemming from the Cybersecurity Incident by submitting claims to the Company’s cybersecurity insurers, the exact timing and amount of any such reimbursements is not known at this time.

Litigation and Claims

To date, the Company has been named as a defendant in approximately 20 putative class action cases alleging harm from the Cybersecurity Incident and seeking various remedies, including monetary and injunctive relief. Additional lawsuits and claims related to the Cybersecurity Incident may be asserted by or on behalf of others seeking damages or other related relief, and government inquiries and/or investigations may be received or commenced. While the Company believes there are defenses to the lawsuits filed to date, the Company also believes it is reasonably possible that it could incur losses associated with these proceedings. However, at this time, it is not possible to estimate the amount of any loss or range of possible loss that might result from adverse judgments, settlements, penalties or other resolutions of such proceedings based on the early stage thereof, the fact that alleged damages have not been specified, the uncertainty as to the certification of a class or classes and the size of any certified class, as applicable, and the lack of resolution on significant factual and legal issues. The Company will continue to evaluate information as it becomes known and will record an estimate for losses at the time or times when it is both probable that a loss has been incurred and the amount of the loss is reasonably estimable. Losses associated with any adverse judgments, settlements, penalties or other resolutions of such proceedings could be material to the Company’s business, results of operations, financial condition or cash flows in future periods. In addition, defending against such lawsuits and allegations has resulted in and will likely continue to result in substantial costs and a diversion of management’s attention and resources.
The Company has evaluated subsequent events through the date of issuance of the financial data included herein. Other than the event discussed above, there have been no subsequent events during such period that would require disclosure in this report or would be required to be recognized in the consolidated financial statements as of December 31, 2023.