Commitments and Contingencies

3 Months Ended

Mar. 31, 2023

Commitments and Contingencies Disclosure [Abstract]

Commitments and Contingencies

Commitments and Contingencies

We conduct our lending operations under the provisions of various federal and state laws, implementing regulations, and insurance regulations. Changes in the current regulatory environment, or the interpretation or application of current regulations, could impact our business.

The Company is subject to various legal proceedings, claims and administrative proceedings arising in the ordinary course of its business, some of which are expected to be covered by liability insurance. Management makes assumptions and estimates concerning the likelihood and amount of any potential loss relating to these matters using the latest information available. The Company records a liability for litigation if an unfavorable outcome is probable and the amount of loss or range of loss can be reasonably estimated. If an unfavorable

outcome is probable the Company accrues the best estimate within the range. If no amount within the range is a better estimate than any other amount, the Company accrues the minimum amount within the range. If an unfavorable outcome is probable the Company discloses the nature of the litigation and indicates that an estimate of the loss or range of loss cannot be made. If an unfavorable outcome is reasonably possible the Company discloses the nature and estimate of the possible loss of the litigation. The Company does not disclose information with respect to litigation where an unfavorable outcome is considered to be remote or where the estimated loss (whether on the merits or by virtue of the existence of collectible insurance) would not be material. Based on current expectations, such matters, both individually and in aggregate, are not expected to have a material adverse effect on the liquidity, results of operations, business or financial condition of the Company.

As previously disclosed, the Company suffered a cyber-attack against certain systems within the Company's network environment on or about November 17, 2022. The attack temporarily affected operations and caused delays in originating and servicing loans and investments at some locations. During the incident, the attackers had access to personally identifiable information ("PII") of certain Company employees, customers, and investors. The incident which only affected systems, was limited to the Company's on-site file directory system, but not its off-site core operating system. Full lending and investing operations were restored within days of the incident, and the Company provided notifications to all potentially-affected individuals. As of May 15, 2023, the Company is named as a defendant in one consolidated consumer class action suit (originally began as five separate cases alleging harm from the cyber-attack). The Company maintains a cyber insurance policy that we expect indemnify the company for the majority of the costs of investigation, remediation, business interruption, and costs pertaining to the breach.

The Company incurred investigation and remediation costs totaling $2.8 million as of March 31, 2023. This amount is recognized in the Company's consolidated statements of financial position as receivable from the insurance company in miscellaneous assets. A recovery of $2.4 million from the cyber insurance policy was received in April 2023. Additional insurance recoveries from the cyber insurance policy are expected; however, the Company is currently unable to estimate the timing and amount of such recoveries.