Business Context and Reporting Period
Company: Paycom Software, Inc.
Filing Type: Form 8-K (Current Report)
Date of Report: July 20, 2023
Event: Disclosure of a cybersecurity incident involving a third-party vendor (Progress Software Corporation) and its MOVEit file transfer software.
Key Financial Metrics
This filing is a current report regarding a specific event and does not contain financial statements. Consequently, the filing text does not provide clear values for revenue, profit, cash flow, margins, debt, or liquidity.
Material Changes and Incident Details
- Incident Source: A vulnerability in Progress Software's MOVEit file transfer software, disclosed on May 31, 2023.
- Scope of Impact: An unauthorized third party downloaded files from the MOVEit server used by Paycom for limited secure file transfers.
- Data Compromised:
- Personally identifiable information (PII) of less than 0.4% of all persons on behalf of whom the Company stored client data during the year ended December 31, 2022.
- Employee records of approximately 127 former and current clients (approximately 0.7% of the Company's client base as of December 31, 2022).
- A limited number of Company employee records containing PII.
- Operational Status: There has been no interruption to the Company's systems, services, or business operations. The Company's core HR and payroll software application was not impacted.
Outlook, Management Commentary, and Risks
- Management Response: The Company promptly deployed cybersecurity defenses, patched the software, and engaged independent cybersecurity forensic experts.
- Financial Impact Assessment: The Company does not currently believe the Vendor Incident will have a material adverse effect on its business, operations, or financial results.
- Contingencies: The Company is evaluating potential remediation expenses and other liabilities. It is in the process of contacting affected clients directly.
- Risks: Forward-looking statements regarding the impact of the incident are subject to business and economic risks, and actual results could differ materially.
Investor Verification Checklist
- Verify the specific types of PII accessed to assess potential regulatory notification requirements.
- Monitor future filings for updates on remediation costs and potential litigation liabilities.
- Confirm the timeline for notifying affected clients and the status of the forensic investigation.
- Review the Company's broader cybersecurity risk disclosures in its most recent Form 10-K and 10-Q.