Commitments and Contingencies
Legal Proceedings
The Company is subject to various legal proceedings, claims, and litigation arising in the ordinary course of business. Although the outcomes of such matters cannot be predicted with certainty, the Company believes that resolution of all such pending matters will not, either individually or in the aggregate, have a material adverse effect on its business, operating results, cash flows, or financial condition. However, given the inherent unpredictability of litigations, arbitrations, claims, inquiries, investigations and proceedings, it is possible that an adverse outcome in certain matters could have a material adverse effect on our business, operating results, cash flows, or financial condition in any future period. In addition, there can be no assurance that material losses will not be incurred from claims where potential losses have not yet been determined to be probable or possible and reasonably estimable.
On February 23, 2022, a purported class action lawsuit captioned Lozada v. TaskUs, Inc. et al. (No. 22-cv-1479-JPC), was filed in the United States District Court for the Southern District of New York against the Company, our Chief Executive Officer, our President, and our Chief Financial Officer. The complaint alleged that the registration statement filed in connection with the Company’s initial public offering (“IPO”) and the Company’s second and third quarter 2021 earnings calls contained materially false and misleading information in violation of the federal securities laws. On October 20, 2022, the court entered an order appointing Humberto Lozada as lead plaintiff in the lawsuit. On December 16, 2022, lead plaintiff filed an amended complaint, alleging additional misstatements in certain of the Company’s 2021 earnings releases filed on Form 8-K and at an investor conference, and asserting additional securities claims, including against members of TaskUs’s Board of Directors as well as BCP FC Aggregator L.P. The complaint sought unspecified damages and an award of costs and expenses, including reasonable attorneys’ fees, as well as equitable relief. On February 17, 2023, TaskUs and the other named defendants filed a motion to dismiss. On October 16, 2023, the plaintiffs voluntarily dismissed with prejudice certain claims based on certain theories of liability. On February 24, 2025, the Company entered into a Stipulation and Agreement of Settlement (the “Settlement Agreement”), which the Court preliminarily approved on June 13, 2025. A settlement hearing took place on October 16, 2025. On December 4, 2025, the Court granted final approval of the settlement and entered a judgment pursuant to the settlement. The Settlement Agreement includes a combined payment by defendants of $17.5 million, inclusive of plaintiffs’ attorneys’ fees and expenses, and a full and complete release of all claims. The Company's insurance retention and policies fully funded the settlement amount in July 2025. The defendants entered into the Settlement Agreement solely to eliminate the burden, expense, uncertainty, and risk of further litigation and have denied, and continue to deny, any and all allegations of liability or wrongdoing.
On January 15, 2025, putative TaskUs stockholder James Eaton filed a derivative lawsuit in the Court of Chancery of the State of Delaware, captioned Eaton v. Maddock, et al. (C.A. No. 2025-0043-NAC), purportedly on behalf of the Company against certain current and former members of its Board of Directors. Eaton previously delivered a demand pursuant to 8 Del. C. §220 on TaskUs on July 3, 2024, which the Company responded to on September 16, 2024. The Eaton complaint includes allegations similar to those in the Lozada case and asserts a claim for breach of fiduciary duty. In particular, the complaint alleges that TaskUs’s public filings included misstatements regarding its low employee attrition rate and high Glassdoor rating in the lead-up periods to the Company’s IPO and secondary public offering in October 2021 (“SPO”). The complaint includes one count for breach of fiduciary duty and alleges that because of TaskUs’s breach, the Company has suffered damages in the form of: (1) legal fees associated with the Lozada litigation; (2) loss of reputation and goodwill; (3) costs associated with investigations into the misstatement allegations; (4) money used to facilitate the IPO and SPO; (5) insider profits derived from the IPO and SPO; and (6) loss of Company revenue and profits. On June 5, 2025, the parties moved to stay the action, which the Court granted on June 6, 2025. The Company is unable to predict, with a reasonable degree of certainty, the likely outcome of this litigation.
On March 6, 2025, putative TaskUs stockholder Kalvin Tucker filed a derivative lawsuit in the United States District Court for the Southern District of New York, captioned Tucker v. Dixit, et al. (No. 25-cv-01875), purportedly on behalf of the Company against certain current and former members of its Board of Directors. The Tucker complaint includes allegations that are substantially similar to those in the Eaton case and asserts claims for contribution, breach of fiduciary duty, aiding and abetting breaches of fiduciary duty, unjust enrichment, and waste. On June 10, 2025, the parties moved to stay the action, which the Court granted on June 11, 2025. The Company is unable to predict, with a reasonable degree of certainty, the likely outcome of this litigation.
On May 27, 2025, a purported class action captioned Nelson Estrada, individually and on behalf of all others similarly situated v. TaskUs, Inc., was filed in the United States District Court for the Southern District of New York against the Company. An amended complaint was filed on September 16, 2025 that added additional plaintiffs Allen Joo, Tiba Parsa, Tim Reynolds, and Craig Burson. The amended complaint alleges that plaintiffs’ data was implicated in a Coinbase data breach announced on May 14, 2025, that the breach involved TaskUs employees providing overseas support services to Coinbase who improperly accessed information related to his account, and that a subset of the plaintiffs had cryptocurrency assets stolen in ways that they allege was related to the breach. The amended complaint asserts claims for negligence, negligent hiring/supervision, conversion, fraud, breach of implied contract, unjust enrichment, declaratory and injunctive relief, violation of the unfair and deceptive trade law statutes of various states, and violation of the California Consumer Privacy Act. Plaintiff seeks to certify a class of all persons in the United States whose personally identifiable information was compromised in the Coinbase data breach, as well as a similarly defined California sub-class, and a sub-class of individuals whose cryptocurrency assets were stolen by those who received personally identifiable information as a result of the breach. Plaintiffs request damages, pre- and post-judgment interest, attorneys’ fees, and any other relief allowable under law. On October 30, 2025, the Company filed a motion to dismiss the amended complaint, which is currently pending. The Company is unable to predict, with a reasonable degree of certainty, the likely outcome of this litigation.
On October 24, 2025, an amended complaint was filed in the consolidated proceedings captioned In re Coinbase Customer Data Security Breach Litigation in the United States District Court for the Southern District of New York. This action contains multiple proceedings that were originally filed against Coinbase and were subsequently consolidated into a single multi-district litigation. The amended complaint named the Company as a defendant, in addition to Coinbase Global, Inc., Coinbase, Inc., and ten “John Doe” defendants to represent currently unknown other entities, and alleged that plaintiffs’ data was implicated in a Coinbase data breach announced on May 14, 2025 and that the breach involved TaskUs employees providing overseas support services to Coinbase who improperly accessed information related to his account. The amended complaint asserted claims against both the Company and Coinbase for negligence, gross negligence, breach of implied contract, unjust enrichment, violations of the statutes of various states that require timely notice be provided following a data breach, and violations of the consumer protection statutes of various states. The amended complaint also brought claims for breach of fiduciary duty and declaratory judgment that are directed at Coinbase. Plaintiffs sought to certify a class of all persons in the United States whose personally identifiable information was compromised in the Coinbase data breach, as well as similarly defined sub-classes for California, Colorado, Maine, Massachusetts, New York, South Carolina, Texas, Washington, and Wisconsin. Plaintiffs requested damages, pre- and post-judgment interest, attorneys’ fees, and any other relief allowable under law. On January 15, 2026, a Consolidated Class Action Complaint was filed, removing TaskUs as a defendant. Accordingly, no claims against the Company remain in this litigation.
On September 16, 2022, a lawsuit captioned My Choice Software, LLC vs. TaskUs, Inc., Tassilo Heinrich, Shopify, Inc., Shopify Holdings (USA) Inc., Shopify (USA) Inc., Does 1-50, No. 22-cv-1710 was filed in the United States District Court, Central District of California. The complaint alleges the defendants profited off of the plaintiff's information in connection with a 2020 Shopify data breach. The complaint seeks unspecified damages and an award of costs and expenses, including reasonable attorneys’ fees, as well as equitable and injunctive relief. On February 13, 2023, the Company filed a motion to dismiss the amended complaint. In May 2023, the Court issued an Order dismissing certain parties, staying the case as to the Company and denying as moot the Company's previously filed motion to dismiss. This case is currently stayed. The Company is unable to predict, with a reasonable degree of certainty, the likely outcome of this litigation.
Indemnification
In addition, in the ordinary course of business, the Company enters into agreements of varying scope and terms pursuant to which we agree to indemnify clients, vendors and other business partners with respect to certain matters, including, but not limited to, losses arising out of breach of such agreements, cybersecurity breach, services to be provided by us or from intellectual property infringement claims made by third parties. Historically, we have not experienced significant losses on these types of indemnification obligations; however, the Company may incur significant losses related to such indemnification obligations in the future.