Despite this good news, Facebook still faces a third ordeal in the form of legal fallout from the Cambridge Analytica affair—which saw a rogue polling agency siphon and sell data from at least 87 million users. And that ordeal has barely begun.

A review of federal court documents shows that Facebook is facing more than three dozen class action lawsuits over Cambridge Analytica. The complaints seek damages on behalf of millions of consumers for alleged misuse of their data, or for investors who allegedly suffered losses when Facebook’s stock plummeted on news of the scandal.

While lawsuits are a matter of course for big companies, Facebook is treating the Cambridge Analytica cases as significant enough to make a special note of them in the company’s quarterly SEC report. A section titled “Legal Proceedings” had previously only cited ongoing litigation over Facebook’s botched 2012 IPO, but now includes the following paragraph (emphasis mine):

Beginning on March 20, 2018, multiple putative class actions and derivative actions were filed in state and federal courts in the United States and elsewhere against us and certain of our directors and officers alleging violations of securities laws, breach of fiduciary duties, and other causes of action in connection with the misuse of certain data by a developer that shared such data with third parties […] the events surrounding this misuse of data became the subject of U.S. Federal Trade Commission and other government inquiries in the United States, Europe, and other jurisdictions. Any such inquiries could subject us to substantial fines and costs, divert resources and the attention of management from our business, or adversely affect our business.

The lawsuits reviewed by Fortune (here’s a sample one) do not list specific dollar amounts, but rather cite damages under grounds like negligence, invasion of privacy, and violation of state consumer protection laws and the federal Stored Communications Act. Others seek recovery for investors, while further ones involve claims from state attorneys general.

Facebook has faced mass consumer lawsuits over privacy violations in the past, and has typically been able to settle them relatively cheaply by paying a few million dollars to nonprofit organizations. Such a quick resolution is unlikely in the case of the Cambridge Analytica scandal, however, given that judges have grown skeptical of settlements that do not deliver direct benefits to consumers, and because of growing scrutiny by government and media of tech companies’ privacy practices.

The worse news for Facebook is that this batch of lawsuits could be just the tip of the iceberg. As tech site The Register reported last week, Facebook’s SEC filing says it anticipates the discovery of “additional incidents of misuse of user data or other undesirable activity by third parties.” In other words, more Cambridge Analytica-style scandals (in which Facebook provided customer data to firms that then misused it) are likely on the way—and could trigger more privacy lawsuits naming Facebook.

“We believe these lawsuits are without merit, and we are vigorously defending them,” Facebook states in its SEC filing describing the Cambridge Analytica lawsuits. In reply to a request for further comment, a company spokesperson pointed to a blog post by Facebook’s Deputy General Counsel stating the incident is not a data breach.

Despite its confident pronouncement, it’s far from clear how easily Facebook can weather the legal fallout from Cambridge Analytica. While the company is a profits machine, and is sitting on more than $40 billion in cash, potential payouts to hundreds of millions of users could put a big crimp in its future earnings.

This story was updated at 7:15pm ET to include Facebook’s statement.