Cyber Related Matters	6 Months Ended
May 31, 2026
Health Care Organizations [Abstract]
Cyber Related Matters	Cyber Related Matters MOVEit Vulnerability As previously disclosed, on the evening of May 28, 2023, we learned that our MOVEit Transfer (the on-premise version) and MOVEit Cloud (a cloud-hosted version of MOVEit Transfer) products were attacked by a threat actor who compromised and exfiltrated personal data from various customer-controlled MOVEit Transfer environments (the "MOVEit Vulnerability"). As a result of the MOVEit Vulnerability, we are party to certain class action lawsuits filed by individuals who claim to have been impacted by the exfiltration of data from the environments of our MOVEit Transfer customers, which have been centralized in multi-district litigation in the District of Massachusetts (the "MDL"). The MDL has also consolidated an insurance subrogation complaint (where an insurer is seeking recovery for expenses incurred on behalf of its insured in connection with the MOVEit Vulnerability) and, as of the date of this filing, one customer cross-claim. Motions to dismiss were filed and partially granted in July 2025, then further partially granted in January 2026 in response to our motions for reconsideration. In all, the court has dismissed, in whole or in part, 23 of the 33 claims asserted by the bellwether plaintiffs in the MDL. The court has ordered the conclusion of fact discovery by September 29, 2026, and that the filing of class certification briefing will begin on August 28, 2026, and continue into the fourth quarter of 2026. The MDL is not expected to conclude within the next twelve months. As previously disclosed, we have also cooperated with inquiries and investigations from various governmental authorities, a number of which have been formally closed and, as of the date of this filing, have not resulted in any prosecution or enforcement actions. Expenses Incurred and Future Costs During the three and six months ended May 31, 2026, we incurred net costs of approximately $1.3 million and $2.6 million, respectively, related to the MOVEit Vulnerability. The costs recognized are net of insurance recoveries of $2.4 million and $3.4 million for the three and six months ended May 31, 2026, respectively. During the three and six months ended May 31, 2025, we incurred net costs of approximately $0.7 million and $1.5 million, respectively, related to the MOVEit Vulnerability. The costs recognized are net of insurance recoveries of $0.6 million and $1.3 million for the three and six months ended May 31, 2025, respectively. The timing of recognizing insurance recoveries may differ from the timing of recognizing the associated expenses. We expect to continue to incur legal and professional services expenses associated with the MOVEit Vulnerability in future periods. We will recognize these expenses as services are received, net of insurance recoveries. While a loss from these matters is reasonably possible, we cannot reasonably estimate a range of possible losses at this time, particularly while the foregoing matters remain ongoing. Furthermore, with respect to the MDL, alleged damages have not been specified, there is uncertainty as to the likelihood of a class or classes being certified or the ultimate size of any class if certified, and there are significant factual and legal issues to be resolved. With respect to the governmental inquiries and investigations, we are currently unable to reasonably estimate any possible adverse judgments, settlements, fines, or penalties. Therefore, we have not recorded a loss contingency liability for the MOVEit Vulnerability as of May 31, 2026. Insurance Coverage During the period when the MOVEit Vulnerability occurred, we maintained $15.0 million of cybersecurity insurance coverage, which has reduced our exposure to expenses and liabilities arising from these events. As of May 31, 2026, we have approximately $1.1 million of remaining cybersecurity insurance coverage under the applicable policy. We will pursue recoveries to the maximum extent available under our insurance policies.

As previously disclosed, on the evening of May 28, 2023, we learned that our MOVEit Transfer (the on-premise version) and MOVEit Cloud (a cloud-hosted version of MOVEit Transfer) products were attacked by a threat actor who compromised and exfiltrated personal data from various customer-controlled MOVEit Transfer environments (the "MOVEit Vulnerability"). As a result of the MOVEit Vulnerability, we are party to certain class action lawsuits filed by individuals who claim to have been impacted by the exfiltration of data from the environments of our MOVEit Transfer customers, which have been centralized in multi-district litigation in the District of Massachusetts (the "MDL"). The MDL has also consolidated an insurance subrogation complaint (where an insurer is seeking recovery for expenses incurred on behalf of its insured in connection with the MOVEit Vulnerability) and, as of the date of this filing, one customer cross-claim. Motions to dismiss were filed and partially granted in July 2025, then further partially granted in January 2026 in response to our motions for reconsideration. In all, the court has dismissed, in whole or in part, 23 of the 33 claims asserted by the bellwether plaintiffs in the MDL. The court has ordered the conclusion of fact discovery by September 29, 2026, and that the filing of class certification briefing will begin on August 28, 2026, and continue into the fourth quarter of 2026. The MDL is not expected to conclude within the next twelve months.

During the three and six months ended May 31, 2026, we incurred net costs of approximately $1.3 million and $2.6 million, respectively, related to the MOVEit Vulnerability. The costs recognized are net of insurance recoveries of $2.4 million and $3.4 million for the three and six months ended May 31, 2026, respectively. During the three and six months ended May 31, 2025, we incurred net costs of approximately $0.7 million and $1.5 million, respectively, related to the MOVEit Vulnerability. The costs recognized are net of insurance recoveries of $0.6 million and $1.3 million for the three and six months ended May 31, 2025, respectively. The timing of recognizing insurance recoveries may differ from the timing of recognizing the associated expenses.

We expect to continue to incur legal and professional services expenses associated with the MOVEit Vulnerability in future periods. We will recognize these expenses as services are received, net of insurance recoveries. While a loss from these matters is reasonably possible, we cannot reasonably estimate a range of possible losses at this time, particularly while the foregoing matters remain ongoing. Furthermore, with respect to the MDL, alleged damages have not been specified, there is uncertainty as to the likelihood of a class or classes being certified or the ultimate size of any class if certified, and there are significant factual and legal issues to be resolved. With respect to the governmental inquiries and investigations, we are currently unable to reasonably estimate any possible adverse judgments, settlements, fines, or penalties. Therefore, we have not recorded a loss contingency liability for the MOVEit Vulnerability as of May 31, 2026.

During the period when the MOVEit Vulnerability occurred, we maintained $15.0 million of cybersecurity insurance coverage, which has reduced our exposure to expenses and liabilities arising from these events. As of May 31, 2026, we have approximately $1.1 million of remaining cybersecurity insurance coverage under the applicable policy. We will pursue recoveries to the maximum extent available under our insurance policies.