8-K: Inotiv Settles Lawsuits, Faces New Cyber Claims

Inotiv, Inc. announced settlements for securities class action and derivative lawsuits totaling $8.75 million, while facing new privacy class actions related to a recent cybersecurity incident and exploring debt refinancing.

Summary

• Inotiv, Inc. (NOTV) entered into a Stipulation and Agreement of Settlement on September 25, 2025, to resolve the securities class action In re Inotiv, Inc. Securities Litigation.
• The settlement involves a cash payment of $8,750,000 to the putative class, which is expected to be fully funded by available insurance.
• The company also reached an agreement in principle on September 25, 2025, to settle two consolidated derivative actions, In re Inotiv Stockholder Derivative Litigation and Whitfield v. Gregory C. Davis, et al.
• As part of the derivative settlement, Inotiv will receive $2,490,000 from insurers to contribute to the securities class action cash payment.
• The derivative settlement also mandates corporate governance measures for at least five years, including separate CEO and Board Chairperson roles, a fully independent Board Chairperson, M&A due diligence guidelines, and a disclosure committee.
• Attorneys' fees for the derivative actions, not exceeding $2,250,000, are expected to be funded by insurance and are subject to court approval.
• The company anticipates increasing its recorded liability and related receivable for these actions from $10.0 million to $11.0 million as of September 30, 2025.
• Three new privacy class actions (Doyal v. Inotiv, Inc., Merrell v. Inotiv, Inc., Wagner v. Inotiv, Inc.) have been filed against Inotiv related to the 2025 Cybersecurity Incident, alleging harm from impacted private information and seeking unspecified damages and injunctive relief.
• The 2025 Cybersecurity Incident continues to cause business disruptions, though most networks and systems have been restored; the full scope and financial impact are still under investigation and not yet determined to be material.
• Inotiv has engaged Perella Weinberg Partners to explore potential debt refinancing alternatives as part of a strategic review of its capital structure.

Sentiment

Score: 3

Explanation: The settlement of existing lawsuits reduces uncertainty, and insurance coverage for these costs is a positive. However, the emergence of new privacy class actions, ongoing business disruptions from a cybersecurity incident with unknown material impact, and the need to explore debt refinancing indicate significant operational and financial challenges. The overall sentiment is negative due to persistent legal and operational headwinds.

Positives

• Settlement of the securities class action and derivative actions eliminates uncertainty, burden, and expense of protracted litigation.
• The cash payment for the securities class action ($8,750,000) is expected to be fully funded by available insurance.
• Attorneys' fees for the derivative actions (up to $2,250,000) are also expected to be funded by available insurance.
• The company has restored availability and access to most of its networks and systems following the 2025 Cybersecurity Incident.
• Inotiv continues to accept and execute requests for delivery of its products and services despite cybersecurity disruptions.

Negatives

• The company will make a cash settlement payment of $8,750,000 for the securities class action.
• The company anticipates increasing its recorded liability and related receivable for the class action and derivative actions from $10.0 million to $11.0 million as of September 30, 2025.
• Three new privacy class actions have been filed against the company related to the 2025 Cybersecurity Incident, seeking unspecified monetary damages and injunctive relief.
• The 2025 Cybersecurity Incident has caused, and is expected to continue to cause, disruptions to certain business operations.
• The timeline for completion of cybersecurity restoration efforts is not yet known.
• The full scope, nature, and impacts, including operational and financial impacts, of the cybersecurity incident are not yet known, and it has not been determined if it will have a material impact.

Risks

• The Proposed Securities Settlement and Proposed Derivative Settlement may not have the expected impact, including fully resolving the actions.
• Inability to satisfy all conditions of the Proposed Securities Settlement and Proposed Derivative Settlement on the anticipated timeline or at all.
• The Proposed Securities Settlement and Proposed Derivative Settlement may not be approved by the applicable courts.
• The settlements may require more activity or expense than expected, potentially affecting the company's related recorded liability.
• Inability to overcome any objections or appeals regarding the Proposed Securities Settlement and Proposed Derivative Settlement.
• Inability to successfully implement the corporate governance measures set forth in the Proposed Derivative Settlement.
• Ongoing disruptions of the company's systems as a result of the 2025 Cybersecurity Incident.
• Unfavorable results from the company's analysis of the scope and details of the data accessed by the threat actor.
• Release by the threat actor of any of the company's data, including third-party data, or the use of such data for fraudulent purposes.
• Potential adverse impact of the cybersecurity incident on the company's results of operations (revenue, operating income, cash flows) and financial condition (liquidity).
• Litigation related to the 2025 Cybersecurity Incident.
• Potential adverse effects on the company's relationships with customers, suppliers, and other third parties due to the 2025 Cybersecurity Incident.
• Reputational risk related to the 2025 Cybersecurity Incident.
• Regulatory scrutiny of the 2025 Cybersecurity Incident.
• Inability to refinance existing indebtedness on acceptable terms, or at all.
• Unsatisfactory resolution of pending and any future litigation or other disagreements with others.

Future Outlook

The company expects the securities class action cash payment and derivative action attorneys' fees to be fully funded by available insurance. It anticipates increasing its recorded liability and related receivable for these actions to $11.0 million by September 30, 2025. Corporate governance measures, including separate CEO and Board Chairperson roles, an independent Board Chairperson, M&A due diligence guidelines, and a disclosure committee, will be instituted and maintained for at least five years. The 2025 Cybersecurity Incident is expected to continue causing disruptions, and its full operational and financial impacts are still under investigation. The company is exploring potential debt refinancing alternatives.

Management Comments

• The Company entered into the Proposed Securities Settlement to eliminate the uncertainty, burden, and expense of protracted litigation.
• The Proposed Securities Settlement does not assign or reflect any admission of wrongdoing or liability by the Company or the individual defendants, all of whom deny any wrongdoing.
• The Company agreed to the Proposed Derivative Settlement to eliminate the uncertainty, burden, and expense of protracted litigation.
• The Proposed Derivative Settlement does not assign or reflect any admission of wrongdoing or liability by the individual defendants or the Company as the nominal defendant, all of whom deny any wrongdoing.
• The Company expects the Cash Payment to be fully funded by available insurance.
• The Company expects any award of attorneys fees [for derivative actions] to be funded by available insurance.
• The 2025 Cybersecurity Incident has caused, and is expected to continue to cause, disruptions to certain business operations of the Company.
• While the Company is working diligently to restore additional affected functions and systems access, the timeline for completion of restoration efforts is not yet known.
• The Company continues to accept, and execute on, requests for delivery of its products and services.
• The Companys investigation of the 2025 Cybersecurity Incident is ongoing, and the full scope, nature and impacts, including operational and financial impacts, of the incident are not yet known.
• Accordingly, the Company has not yet determined whether the 2025 Cybersecurity Incident is reasonably likely to have a material impact on the Company.

Industry Context

The filing highlights several challenges common in today's corporate landscape. The settlement of securities and derivative class actions reflects the increasing scrutiny on corporate disclosures and governance, particularly following significant corporate events or financial performance issues. The ongoing cybersecurity incident and subsequent privacy class actions underscore the pervasive and evolving threat of cyberattacks across all industries, emphasizing the critical need for robust data security and incident response plans. Many companies are grappling with the financial and reputational fallout of such breaches. The engagement of financial advisors for debt refinancing also suggests a broader trend of companies proactively managing their capital structure in response to market conditions or operational needs.

Corporate Governance

Legal Proceedings

• Settlement of In re Inotiv, Inc. Securities Litigation, Case No. 4:22-cv-00045-PPS-JEM, a securities class action.
• Agreement in principle to settle In re Inotiv Stockholder Derivative Litigation, Case No. 4:22-cv-64-PPS-AZ, a consolidated derivative action.
• Agreement in principle to settle Whitfield v. Gregory C. Davis, et al., Case No. 79C01-2304-PL-000048, a consolidated derivative action.
• Three new putative privacy class actions filed: Doyal v. Inotiv, Inc., Case No. 4:25-cv-00046; Merrell v. Inotiv, Inc., Case No. 4:25-cv-00047; and Wagner v. Inotiv, Inc., Case No. 4:25-cv-00049, all related to the 2025 Cybersecurity Incident.

Stakeholder Impact

• Shareholders: Will receive a cash payment of $8,750,000 from the securities class action settlement (for those who purchased shares during the specified period or voted on the Envigo acquisition). All shareholders benefit from the resolution of litigation uncertainty and improved corporate governance. However, new privacy class actions and ongoing cybersecurity disruptions pose future risks.
• Management/Board: Individual defendants in the settled lawsuits deny wrongdoing but are part of the resolution. The Board will implement new corporate governance measures, including a separate and independent Board Chairperson, and M&A due diligence guidelines.
• Customers/Suppliers: Potential adverse effects on relationships due to the 2025 Cybersecurity Incident are a risk. Continued business operations despite disruptions are positive.
• Employees: The cybersecurity incident could impact internal systems and data, though the filing doesn't specify direct employee impact.
• Creditors: The exploration of debt refinancing alternatives indicates potential changes to the company's debt structure, which could impact creditors.

Next Steps

• Seek court approval for the Proposed Securities Settlement and Proposed Derivative Settlement.
• Fund the $8,750,000 cash payment for the Securities Class Action, primarily through available insurance.
• Fund attorneys' fees for the Derivative Actions (up to $2,250,000), primarily through available insurance.
• Implement and maintain corporate governance measures for at least five years, including separate CEO and Board Chairperson roles, a fully independent Board Chairperson, M&A due diligence guidelines, and a disclosure committee.
• Continue investigation into the full scope, nature, and impacts of the 2025 Cybersecurity Incident.
• Continue efforts to restore additional affected functions and systems access following the 2025 Cybersecurity Incident.
• Engage with Perella Weinberg Partners to explore potential debt refinancing alternatives.
• Address the three new privacy class actions related to the 2025 Cybersecurity Incident.

Key Dates

Recommendation

While the settlement of the securities class action and derivative lawsuits removes significant legal overhang and the associated costs are largely covered by insurance, the company faces new and substantial challenges. The emergence of three new privacy class actions related to the 2025 Cybersecurity Incident, coupled with ongoing business disruptions and an unknown material impact from the breach, introduces fresh uncertainty and potential liabilities. The need to explore debt refinancing also signals potential financial strain. The implementation of enhanced corporate governance is a positive step, but the cumulative effect of these issues suggests a period of continued operational and financial instability. A 'hold' recommendation is appropriate as investors should monitor the resolution of the cybersecurity incident, the progress of the new privacy lawsuits, and the outcome of the debt refinancing efforts before making further investment decisions.

Keywords

Inotiv, NOTV, SEC filing, 8-K, securities litigation, derivative action, settlement, cybersecurity incident, data breach, privacy class action, debt refinancing, corporate governance, financial reporting, legal proceedings