COMMITMENTS AND CONTINGENCIES

12 Months Ended

Dec. 31, 2020

Commitments and Contingencies Disclosure [Abstract]

COMMITMENTS AND CONTINGENCIES

COMMITMENTS AND CONTINGENCIES

Security Incident

On September 29, 2020, we filed a Current Report on Form 8-K reporting a security incident (the "Incident") involving ransomware disrupting access to some of our internal IT systems and telephone systems. There is no evidence that the environments where we host client applications were affected, and our hosting services to those clients were not interrupted. There is also no evidence of malicious activity on client networks associated with the Incident. We contained the Incident and recovered from it, resuming normal operations with our clients. We will continue to deploy supplemental remediation efforts as necessary.

As part of our immediate response to the Incident, we (1) shut down points of access to external systems and began investigating and remediating the problem; (2) engaged outside IT security and forensics experts to conduct a detailed review and help securely restore

affected systems; (3) implemented targeted monitoring systems to supplement the systems we already had in place; and (4) notified law enforcement. We have cooperated with their investigation throughout.

We promptly notified our clients of the Incident and provided timely updates to our clients through direct communications and updates to our website.

Although we believe we have contained and recovered from the Incident, and that we have taken and will continue to take appropriate remediation steps, we are subject to risk and uncertainties as a result of the Incident. We believe we are in the final phases of our investigation, but there can be no assurance as to what the ongoing impact of the Incident will be, if any. The Incident caused an interruption in parts of our business. We have made insurance claims for lost revenue related to the Incident, (primarily software services revenue) for the year ended December 31, 2020. Insurance reimbursements pertaining to lost revenue represent a contingent gain and any recovery of these revenues will be recorded when received. We do not expect such gains to be material. We incurred $4.2 million in costs associated with the Incident as of December 31, 2020. As of December 31, 2020, we have recorded $1.1 million of accrued insurance recoveries and received $2.4 million of insurance recoveries related to the Incident. The recorded costs consisted primarily of payments to third-party service providers and consultants, including legal fees, and enhancements to our cybersecurity measures. It is expected that we will continue to incur costs related to our response, remediation, and investigatory efforts relating to the Incident. We maintain cybersecurity insurance coverage in an amount that we believe is adequate.

Litigation

Other than routine litigation incidental to our business, there are no material legal proceedings pending to which we are party or to which any of our properties are subject.