← Artículos y guías sobre fraude, ciberseguridad, privacidad y PLD

SEC cyber incident rule: what 8-K Item 1.05 filings reveal

Since December 2023, US public companies must report material cyber incidents in four business days. What the 8-K filings show and lessons for boards.

2026-10-18

Since December 18, 2023, US-listed companies have had to tell investors about a material cybersecurity incident within four business days of determining that it is material, using Item 1.05 of Form 8-K. Nearly three years in, the filings offer a rare public record of how companies experience and describe cyberattacks, and some clear lessons about what regulators expect.

What the rule requires

Item 1.05 of Form 8-K: disclose the material aspects of an incident's nature, scope and timing, and its material or reasonably likely material impact, including on financial condition and operations.
The clock: four business days from the materiality determination, not from detection.
Updates: information not available at the time of filing is added later through amendments.
Annual disclosure: companies also describe their cyber risk management, strategy and governance in their annual report.

The May 2024 clarification

Early on, many companies filed under Item 1.05 even when they had not concluded an incident was material. On May 21, 2024, the SEC's Division of Corporation Finance issued a statement saying Item 1.05 should be reserved for material incidents, and that voluntary disclosure of other incidents should go under Item 8.01. If an incident first disclosed as immaterial later becomes material, the company must file under Item 1.05 within four business days of that new determination.

The effect was immediate. According to a Debevoise & Plimpton review of the first year, 17 companies filed under Item 1.05 before the statement and 9 after it, while Item 8.01 filings went from 6 to 28.

What companies have reported

The Debevoise analysis of the first 26 Item 1.05 filers found:

Indicator (first year of Item 1.05)	Finding
Companies filing under Item 1.05	26
Reported access to or loss of data	about 77% (20 companies)
Disclosed operational disruption	about 65%
Named a threat actor	about 23% (6 companies)
Filed at least one amendment	about 50% (13 companies)
Average time from detection to filing	about 7.9 business days (median 4.5)
Disclosed paying a ransom	none

Only seven companies identified a material impact in their initial filing, and two more did so in amendments. In other words, most companies filed while the full impact was still unknown.

Volume is falling

A count of all cybersecurity-related 8-Ks (Items 1.05, 8.01 and 7.01) by Board Cybersecurity shows a peak of 64 in 2023, then 55 in 2024 and 32 in 2025. Through April 19, 2026, there were 8. The 2023 and 2024 peaks were driven by supply chain waves, when one third-party breach triggered filings by many customers: MOVEit in 2023 (Genworth, Jackson Financial, Corebridge and regional banks), and CDK Global and Snowflake in 2024 (auto dealers such as AutoNation, Penske and Lithia; Live Nation, Advance Auto Parts and AT&T). The analysis cautions that fewer filings do not necessarily mean fewer incidents, only fewer crossing the materiality threshold.

What the filings say about attackers

Only about a quarter of first-year filers named a threat actor. Three initially pointed to a possible nation-state actor, and one later amended its filing to attribute the attack to a cybercrime group instead. That pattern shows how uncertain attribution is in the first days of an incident.

The enforcement backdrop

October 2024: the SEC settled with Unisys, Avaya, Check Point and Mimecast over how they described the impact of the SolarWinds-related intrusion, for about $7 million in total.
December 2024: Flagstar Bancorp paid a $3.5 million penalty; the SEC found its disclosure of a 2021 incident misleading and its controls lacking guidance on materiality.
July 2024: a federal judge dismissed most of the SEC's claims against SolarWinds, rejecting the use of internal accounting controls rules to police cybersecurity controls.
November 20, 2025: the SEC, SolarWinds and its CISO stipulated to dismiss the remaining case with prejudice, without admission of wrongdoing.

Under Chairman Paul Atkins, the SEC replaced its Crypto Assets and Cyber Unit with a Cyber and Emerging Technologies Unit (CETU) in February 2025. A compliance analysis by Vaquill reports no new cybersecurity disclosure or controls actions in fiscal 2025. Still, law firm commentary published by the Harvard Law School Forum stresses that the Form 8-K and 10-K cyber rules remain fully in effect.

Lessons for companies and boards

Separate detection from materiality. The four-day clock starts at the materiality determination. Document when and how that decision was made, and who made it.
Look beyond dollars. The SEC staff has said materiality includes qualitative factors such as reputational harm, customer and vendor relationships, competitiveness and litigation or regulatory risk.
Use the right item. Item 1.05 for material incidents; Item 8.01 or a press release for voluntary disclosure of others.
Plan for amendments. Half of first-year filers updated their disclosure. Build that into the incident response playbook.
Connect the teams. Incident response, legal, investor relations and the disclosure committee must talk in real time.
Watch your vendors. The biggest filing waves came from third-party breaches. Contracts should guarantee timely notice.
Vet public statements. The SolarWinds saga showed that security statements outside SEC filings can also create liability.