11. Commitments and Contingencies
Leases
We have operating leases for corporate offices, subleased offices and certain equipment and furniture. As of December 31, 2025, we did not have any operating leases that had not yet commenced.
Release from Washington, DC lease
In February 2025, we made a one-time cash release payment of $28.0 million to the lessor in connection with a release from our lease for office space in Washington, DC (which was acquired as part of our acquisition of EVERFI in December 2021). Due to our Remote-Flexible workforce strategy, we had not used the office space since February 2023 and had subleased a portion of the space. During the year ended December 31, 2025, we recorded a loss on lease termination of $24.3 million in general and administrative expense.
The following table summarizes the components of our lease expense:
Year ended 
 December 31,
(dollars in thousands)202520242023
Operating lease cost(1)
$
1,833 
$
6,430 
$
8,812 
Variable lease cost
842 
1,131 
1,431 
Sublease income
(1,755)
(3,400)
(3,356)
Net lease cost
$
920 
$
4,161 
$
6,887 
(1)Includes short-term lease costs, which were immaterial.
During the years ended December 31, 2024 and 2023, we recorded noncash impairment charges of $3.1 million and $5.6 million, respectively, against certain operating lease ROU assets. These impairment charges resulted from our entry into subleases for different portions of our Washington, DC office location, which we closed in February 2023 to align with our Remote-Flexible workforce strategy. These charges are reflected in general and administrative expense on the statements of comprehensive income (loss).
Maturities of our operating lease liabilities as of December 31, 2025 were as follows:
Years ending December 31,
(dollars in thousands)
Operating leases
2026
$
1,918 
2027
1,888 
2028
1,718 
2029
1,007 
2030
504 
Thereafter
— 
Total lease payments
7,035 
Less: Amount representing interest
(871)
Present value of future payments
$
6,164 
Our ROU assets and lease liabilities are included in the following line items in our consolidated balance sheet:
(dollars in thousands)December 31,
2025
December 31,
2024
Operating leases
Operating lease ROU assets
$
4,630 
$
26,554 
Accrued expenses and other current liabilities
$
1,559 
$
4,489 
Operating lease liabilities, net of current portion
4,605 
34,186 
Total operating lease liabilities
$
6,164 
$
38,675 
The weighted average remaining lease terms and discount rates were as follows:
(dollars in thousands)December 31,
2025
December 31,
2024
December 31,
2023
Operating leases
Weighted average remaining lease term (years)
3.8
7.3
7.7
Weighted average discount rate
7.31 
%
4.53 
%
4.70 
%
Supplemental cash flow information related to leases was as follows:
Year ended 
 December 31,
(dollars in thousands)202520242023
Cash paid for amounts included in the measurement of lease liabilities:
Operating cash flows from operating leases
$
2,024 
$
7,511 
$
10,983 
Right-of-use assets obtained in exchange for lease obligations (non-cash):
Operating leases
3,705 
— 
2,765 
Other commitments
The term loans under the 2024 Credit Facilities require periodic principal payments. The balance of the term loans and any amounts drawn on the revolving credit loans are due upon maturity of the 2024 Credit Facilities in April 2029. The Real Estate Loans also require periodic principal payments and the balance of the Real Estate Loans are due upon maturity in April 2038.
We have contractual obligations for third-party technology used in our solutions and for other services we purchase as part of our normal operations. In certain cases, these arrangements require a minimum annual purchase commitment by us. As of December 31, 2025, the remaining aggregate minimum purchase commitment under these arrangements was approximately $164.0 million through 2030.
Solution and service indemnifications
In the ordinary course of business, we provide certain indemnifications of varying scope to customers against claims of intellectual property infringement made by third parties arising from the use of our solutions or services. We have not identified any losses that might be covered by these indemnifications
Legal proceedings
We are subject to legal proceedings and claims that arise in the ordinary course of business, as well as certain other non-ordinary course proceedings, claims and investigations, as described below. We record an accrual for a loss contingency when it is both probable that a material liability has been incurred and the amount of the loss can be reasonably estimated. If only a range of estimated losses can be determined, we accrue an amount within the range that, in our judgment, reflects the most likely outcome; if none of the estimates within that range is a better estimate than any other amount, we accrue the low end of the range. For proceedings in which an unfavorable outcome is reasonably possible but not probable and an estimate of the loss or range of losses arising from the proceeding can be made, we disclose such an estimate, if material. If such a loss or range of losses is not reasonably estimable, we disclose that fact. We review any such loss contingency accruals at least quarterly and adjust them to reflect the impacts of negotiations, settlements, rulings, advice of legal counsel and other information and events pertaining to a particular case. We recognize insurance recoveries, if any, when they are probable of receipt. All associated costs due to third-party service providers and consultants, including legal fees, are expensed as incurred.
Legal proceedings are inherently unpredictable. However, we believe that we have valid defenses with respect to the legal matters pending or threatened against us and intend to defend ourselves vigorously against all claims asserted. It is possible that our consolidated financial position, results of operations or cash flows could be materially negatively affected in any particular period by an unfavorable resolution of one or more of such legal proceedings.
Security incident
As previously disclosed, we are subject to risks and uncertainties as a result of a ransomware attack against us in May 2020 in which a cybercriminal removed a copy of a subset of data from our self-hosted environment (the "Security Incident"). Based on the nature of the Security Incident, our research and third party (including law enforcement) investigation, we do not believe that any data went beyond the cybercriminal, has been misused, or has been disseminated or otherwise made available publicly.
As a result of the Security Incident, we have been subject to certain legal proceedings and claims and could be the subject of additional legal proceedings, claims, inquiries and investigations in the future that might result in adverse judgments, settlements, fines, penalties or other resolution. To limit our exposure to losses related to claims against us, including data breaches such as the Security Incident, we maintain $50 million of insurance above a $250 thousand deductible payable by us. As noted below, this coverage reduced our financial exposure related to the Security Incident in prior years.
We recorded expenses related to the Security Incident as follows:
Years ended December 31,
(dollars in thousands)20252024
2023
Security Incident expenses
$
3,104 
$
13,700 
$
53,426 
The following summarizes our cumulative expenses, insurance recoveries recognized and insurance recoveries paid as of:
(dollars in thousands)December 31,
2025
December 31,
2024
December 31, 2023
Cumulative gross expense
$
178,235 
$
175,131 
$
161,431 
Cumulative offsetting insurance recoveries recognized
(50,000)
(50,000)
(50,000)
Cumulative net expense
$
128,235 
$
125,131 
$
111,431 
Cumulative offsetting insurance recoveries paid
$
(50,000)
$
(50,000)
$
(50,000)
Recorded expenses have consisted primarily of payments to third-party service providers and consultants, including legal fees, settlement of governmental investigations, settlements of customer claims and accruals for certain loss contingencies. Not included in the expenses discussed above were costs associated with enhancements to our cybersecurity program. We present expenses and insurance recoveries related to the Security Incident in general and administrative expense on our consolidated statements of comprehensive income (loss) and as operating activities on our consolidated statements of cash flows. Total costs related to the Security Incident exceeded the limit of our insurance coverage during the first quarter of 2022. For the year ended December 31, 2025, we incurred net pre-tax expense of $3.1 million related to the Security Incident for ongoing legal fees and recorded accruals for loss contingencies of $1.1 million. Also, for the year ended December 31, 2025, we had net cash outlays of $4.6 million related to the Security Incident for ongoing legal fees and $1.8 million paid during the third quarter of 2025 related to previously recorded accruals for loss contingencies related to the Security Incident. As of December 31, 2025, we do not have any recorded liabilities for loss contingencies related to the Security Incident.
As previously disclosed, during the three months ended September 30, 2025, we paid an insignificant settlement amount to the plaintiffs in the previously disclosed multi-district litigation filed in the United States District Court of South Carolina. On September 22, 2025, that court issued an order definitively closing that case. As a result, all customer constituent class actions related to the Security Incident are now resolved and closed. In addition, as previously reported, insurance companies representing various customers’ interests through subrogation claims contacted us, and certain insurance companies filed subrogation claims in court, two of which remain pending and are the only customer claims currently unresolved. For more information about the completed government investigations and related actions, see Note 11 to our audited consolidated financial statements contained in our Annual Report on Form 10-K filed with the SEC on February 21, 2025 and Note 8 to our unaudited, condensed consolidated financial statements contained in our Quarterly Report on Form 10-Q filed with the SEC on April 30, 2025.

Historical Timeline

Fiscal YearFiled
2025Feb 18, 2026Showing above
2024Feb 21, 2025
2023Feb 21, 2024
2022Feb 24, 2023
2021Mar 1, 2022
2020Feb 23, 2021
2019Feb 20, 2020
2018Feb 20, 2019
2017Feb 20, 2018
2016Feb 22, 2017
2015Feb 24, 2016

About Commitments Disclosures

Commitments and contingencies disclosures catalog a company's off-balance-sheet obligations and legal exposures — purchase commitments, guarantee arrangements, pending litigation, and regulatory proceedings. These items represent potential future cash outflows that may not appear as liabilities on the balance sheet until they become probable and estimable.

Key signals: litigation reserves and disclosed loss ranges quantify management's estimate of legal exposure, but unquantified "reasonably possible" losses often represent the larger risk. Watch for changes in language around pending cases — shifts from "remote" to "reasonably possible" or increases in estimated loss ranges signal deteriorating outcomes. Unconditional purchase obligations and take-or-pay contracts create fixed cost structures that reduce operational flexibility. Guarantee arrangements for subsidiaries or joint ventures can create cascading obligations. Compare the total commitment schedule against projected free cash flow to assess whether the company can meet its obligations without additional financing.