Since December 2023, U.S. public companies must tell investors within four business days when a cyber incident is material. This tracker logs every one of those filings, classifies it, and shows who gets hit, how fast they disclose, and what it costs.
Original Item 1.05 filings per quarter, by type of incident. The dashed line marks the SEC staff guidance of May 21, 2024, which told companies to report incidents not yet judged material under Item 8.01 instead.
Filings by sector. Use the year filter to watch the mix shift: three healthcare filings in 2024 and 2025 combined, then twelve in the first nine months of 2026.
Calendar days from the date a company says it detected the incident to its Item 1.05 filing. The four-business-day clock legally starts when the company determines materiality, not at detection, which is how the tail happens.
Studies find small average stock moves after a filing, concentrated in smaller companies. The real damage shows up later, in earnings.
2024 cost of the February 2024 ransomware attack, plus another $799M booked in late 2025. About 193M people affected.
ITEM 1.05 · FEB 2024Booked in Q2 2025 after insiders were bribed to leak customer data. Coinbase refused a $20M extortion demand.
ITEM 1.05 · MAY 2025Drop in quarterly net sales after its 2023 attack, the incident that defined the stakes just before the rule took effect.
ITEM 8.01 · PRE-RULEIBM's 2025 average cost of a U.S. data breach, a record and more than double the $4.44M global average.
IBM · 2025Item 1.05 survived its first test years largely intact, but banking, telecom, and business groups are now pushing the SEC to roll it back.
New Item 1.05 requires a Form 8-K within four business days of determining an incident is material, plus annual risk management disclosure.
VF Corp files the first Item 1.05 report the same day. Smaller reporting companies follow on June 15, 2024.
The Justice Department allows AT&T to hold its filing on the theft of call and text records, the only publicly confirmed use of the delay provision.
Corporation Finance director Erik Gerding tells companies to report undetermined or immaterial incidents under Item 8.01. Voluntary filings jump.
Unisys, Avaya, Check Point, and Mimecast pay a combined $7M for downplaying the impact of the SolarWinds compromise.
SIFMA and four banking associations argue public disclosure helps attackers and conflicts with confidential reporting to regulators.
The Commission voluntarily dismisses its remaining claims against SolarWinds and its CISO, after a court threw out most of the case in 2024.
Chair Paul Atkins launches a broad review of disclosure rules. Trade groups and CTIA use it to ask for Item 1.05 to be rescinded or narrowed. No change has been proposed as of this update.
CB Financial Services reports that customer Social Security numbers were exposed when staff used an unauthorized AI application.
Search, filter, and sort all original Item 1.05 filings. Select a row for the summary and a link to the filing on EDGAR.
| Filed↓ | Company↕ | Sector↕ | Type↕ | Days to file↕ | Status at filing↕ | Amended↕ |
|---|
Scope. Every original Form 8-K filed under Item 1.05 (Material Cybersecurity Incidents) from December 18, 2023 through October 12, 2026. Amendments (8-K/A) are counted on the original filing, not as new rows. Companies that disclosed only under Item 8.01 are excluded, since the SEC treats those as voluntary.
Collection. Filings were identified with EDGAR full-text search filtered to Item 1.05, run with multiple queries per period, and cross-checked against public trackers. The final count of 58 originals and 26 amendments matches The Uptime Report's independent tally.
Classification. Sector, incident type, operational disruption, data theft, and materiality status were coded by reading each filing. Where a filing was silent, fields are left blank rather than guessed. Some threat actors and incident types (for example ALPHV/BlackCat at Change Healthcare) come from public reporting rather than the filing itself.
Status at filing reflects the original 8-K. Many companies filed under Item 1.05 while saying materiality was not yet determined, a practice the May 2024 staff guidance discouraged. Several later amended to confirm a material impact.
Days to file uses calendar days from the detection date the company reports. Where a filing gives only the incident date or a notification date, that date is used. Filings with no date are excluded from speed statistics.
Not advice. This is an independent analysis of public filings for discussion only. It is not legal or investment advice, and classifications are editorial judgments.