XML 32 R21.htm IDEA: XBRL DOCUMENT v3.10.0.1
Commitments and Contingencies
9 Months Ended
Jun. 30, 2018
Commitments And Contingencies Disclosure [Abstract]  
Commitments and Contingencies

15.   Commitments and Contingencies

We are involved, from time to time, in various claims and lawsuits incidental to the conduct of our business in the ordinary course. We carry insurance coverage in such amounts in excess of our self-insured retention as we believe to be reasonable under the circumstances and that may or may not cover any or all of our liabilities in respect of these matters. We do not believe that the ultimate resolution of these matters will have a material adverse impact on our consolidated financial position, cash flows or results of operations.

Data Security Incidents

In the fiscal year ended September 30, 2014, we disclosed that we had experienced a data security incident (the “2014 data security incident”). In the fiscal year ended September 30, 2015, we disclosed that we had experienced a second data security incident (the “2015 data security incident” and, together with the 2014 data security incident, the “data security incidents”). The data security incidents involved the unauthorized installation of malicious software (malware) on our information technology systems, including our point-of-sale systems that, we believe, may have placed at risk certain payment card data for some transactions. The costs that the Company has incurred to date in connection with the data security incidents include professional advisory fees and legal costs and expenses relating to investigating and remediating the data security incidents and the settlement of prior assessments by payment card networks.

During the three months ended June 30, 2018, we received an assessment from a payment card network in connection with the 2015 data security incident and recognized $7.9 million of expenses.  The assessment is based on the network’s claims against the Company’s acquiring banks for costs that it asserts its issuing banks incurred in connection with the 2015 data security incident, including incremental counterfeit fraud losses and non-ordinary course operating expenses, such as card reissuance costs.   The Company’s estimated probable loss related to the claims made by payment card networks in connection with the data security incidents are based on currently available information. The Company disputes the validity of the payment card network’s claims and intends to contest them vigorously.

The Company may incur additional costs and expenses related to the data security incidents in future periods. These costs and expenses may result from liabilities related to (i) claims by payment card networks, (ii) governmental or third party investigations, proceedings or litigation, (iii) legal and other fees necessary to defend against any potential liabilities or claims, and (iv) further investigatory and remediation costs. As of June 30, 2018, the scope of these additional costs and expenses, or a range thereof, beyond amounts management has determined to be probable, cannot be reasonably estimated and, while we do not anticipate that these additional costs and expenses or liabilities would have a material adverse impact on our business, financial condition and operating results, these additional costs and expenses could be significant.