SEC Cybersecurity Incident Disclosure Statistics 2026: Item 1.05 Filings
CyberReviewed Research Desk ·
Our analysts counted all 85 Form 8-K and 8-K/A filings that public companies made under Item 1.05, the SEC's material cybersecurity incident item, from December 18, 2023, when the requirement took effect, to October 28, 2026. The filings show how often companies report a material cyber incident to investors as of Q4 2026, which industries file, and how long they take to update the first report.1
Key Findings
- Public companies filed 59 original Item 1.05 Form 8-Ks for material cybersecurity incidents from December 18, 2023 to October 28, 2026, from 57 companies.
- Original filings fell from about 3.3 a month before the SEC staff statement of May 21, 2024 to about 1.4 a month after it.
- Companies filed 18 original Item 1.05 reports from January 1 to October 28, 2026, up from 13 in the same period of 2025.
- Manufacturers made 20 of the 59 original filings, 33.9%, and makers of surgical and medical instruments made 5.
- Amendments to Item 1.05 filings came a median of 22 days after the original filing.
When a public company suffers a serious cyberattack, investors learn about it through a short filing called a Form 8-K. Since December 2023, SEC rules have required a company to file one under Item 1.05 within four business days of deciding that an incident is material, meaning a reasonable investor would care about it.3 Early on, many companies filed under Item 1.05 before they had decided, and in May 2024 the SEC's Division of Corporation Finance asked them to use Item 8.01, the item for other events, for incidents that were not, or not yet, material.4 So the count of Item 1.05 filings is now a count of incidents that companies themselves call material.
Our analysts searched SEC EDGAR full-text search for every Form 8-K and 8-K/A that lists Item 1.05 among its items, from December 18, 2023 to October 28, 2026.2 We kept 59 original filings and 26 amendments, and recorded each filer's industry code and state from EDGAR. We then compared our count with three trackers: Debevoise & Plimpton's two-year update, SecureResearch's incident tracker, and The Uptime Report.567
In the following sections, we compare Item 1.05 filings by quarter, before and after the SEC staff statement, against voluntary Item 8.01 disclosures, by industry, by amendment timing, and for the companies that filed in 2026.
How Many Material Cyber Incident Filings Companies Make Each Quarter
We start with the plain count of Item 1.05 filings by quarter, which shows how the volume has moved since the rule took effect.
| Quarter | Original filings | Amendments |
|---|---|---|
| 2023 Q4 | 2 | 1 |
| 2024 Q1 | 9 | 6 |
| 2024 Q2 | 6 | 4 |
| 2024 Q3 | 6 | 4 |
| 2024 Q4 | 3 | 0 |
| 2025 Q1 | 2 | 2 |
| 2025 Q2 | 6 | 1 |
| 2025 Q3 | 3 | 0 |
| 2025 Q4 | 4 | 1 |
| 2026 Q1 | 3 | 1 |
| 2026 Q2 | 7 | 2 |
| 2026 Q3 | 7 | 4 |
| 2026 Q4 | 1 | 0 |
| All quarters | 59 | 26 |
Source: CyberReviewed analysis of SEC EDGAR Form 8-K and 8-K/A filings.12
Source: CyberReviewed analysis of SEC EDGAR filings.1 Chart: CyberReviewed.
Key Findings
- The busiest quarter was the first full one, the first quarter of 2024, with 9 original filings. The second and third quarters of 2026 had 7 each, the most since then.
- By year, companies filed 2 originals in the last two weeks of 2023, 24 in 2024, 15 in 2025, and 18 so far in 2026.
- Two companies filed twice: Data I/O and Park Dental each reported two separate incidents, which is why 59 filings come from 57 companies. A count this small moves with a few large attacks, so a single busy quarter says little about the next.
How the SEC Staff Statement of May 2024 Changed Filing Rates
The SEC staff statement of May 21, 2024 asked companies to stop using Item 1.05 for incidents they had not judged material, so we split the filings at that date and compared monthly rates.
| Period | Months | Original filings | Filings per month |
|---|---|---|---|
| December 18, 2023 to May 20, 2024 | 5.1 | 17 | 3.3 |
| May 21, 2024 to October 28, 2026 | 29.2 | 42 | 1.4 |
Source: CyberReviewed analysis of SEC EDGAR filings;1 SEC, statement by Erik Gerding, May 21, 2024.4
Source: CyberReviewed analysis of SEC EDGAR filings.1 Chart: CyberReviewed.
Key Findings
- The monthly rate after the statement is about 43% of the rate before it, a drop of about 57%.
- Debevoise & Plimpton counted 29 companies that filed under Item 1.05 in the two years after the statement, to May 21, 2026. Our count for the same window is 30 original filings by 29 companies, a match.5
- The statement did not change the law. It clarified that Item 1.05 is for incidents a company has judged material, which means today's filings carry more weight for investors than the early ones did.4
How Often Companies Disclose Incidents Without Calling Them Material
Most cyber incidents that companies tell investors about are not filed under Item 1.05, so we looked at two trackers that also count voluntary Item 8.01 disclosures.
| Month | All disclosures and updates | Material (Item 1.05) |
|---|---|---|
| January | 0 | 0 |
| February | 2 | 2 |
| March | 6 | 2 |
| April | 7 | 2 |
| May | 7 | 4 |
| June | 5 | 3 |
| July | 14 | 7 |
| August | 6 | 1 |
| September | 8 | 3 |
| October | 3 | 1 |
| January to October 27 | 58 | 25 |
Source: SecureResearch, SEC cyber incident tracker, updated October 27, 2026.6
Source: SecureResearch.6 Chart: CyberReviewed.
Key Findings
- Debevoise & Plimpton counted 50 companies that disclosed a cyber incident under Item 8.01 in the two years to May 21, 2026, against 29 under Item 1.05. Only 5 used both, and each filed under Item 8.01 first.5
- SecureResearch counts 170 cyber incident disclosures and updates by 119 companies since the rule took effect, 83 of them under Item 1.05.6 Its 25 material filings in 2026 match our count of 18 originals and 7 amendments this year.
- Item 1.05 is under review. In January 2026 the SEC asked for comments on all of Regulation S-K, and banking trade associations and the Society for Corporate Governance asked it to repeal Item 1.05.5
Which Industries File Item 1.05 Reports
Attackers do not target every industry equally, and some industries have more public companies than others, so we grouped the original filings by the industry code each company reports to the SEC.
| Industry division | Original filings | Share |
|---|---|---|
| Manufacturing | 20 | 33.9% |
| Services | 14 | 23.7% |
| Finance, insurance, and real estate | 13 | 22.0% |
| Retail trade | 5 | 8.5% |
| Transportation, communications, and utilities | 4 | 6.8% |
| Wholesale trade | 2 | 3.4% |
| Mining | 1 | 1.7% |
| All filings | 59 | 100.0% |
Source: CyberReviewed analysis of SEC EDGAR filings and filer SIC codes.1
Source: CyberReviewed analysis of SEC EDGAR filings.1 Chart: CyberReviewed.
Key Findings
- The most common single industry code was 3841, surgical and medical instruments, with 5 filings, including Boston Scientific, West Pharmaceutical Services, iRhythm Technologies, and UFP Technologies. Prepackaged software (7372) and state commercial banks (6022) had 4 each.
- Companies based in California made 10 of the filings, followed by Washington and Texas with 7 each and Pennsylvania with 6.
- The Uptime Report counted 44 different industry codes among filers through September 23, 2026, so no single industry dominates the list.7
How Long Companies Take to Amend an Item 1.05 Filing
A company that does not yet know an incident's full impact when it first files must amend its Form 8-K once it does, so we measured how long companies took to file each amendment.4
| Time to amendment | Amendments |
|---|---|
| 14 days or fewer | 5 |
| 15 to 30 days | 8 |
| 31 to 60 days | 8 |
| 61 to 90 days | 2 |
| More than 90 days | 2 |
| All measured | 25 |
Source: CyberReviewed analysis of SEC EDGAR filings.1
Source: CyberReviewed analysis of SEC EDGAR filings.1 Chart: CyberReviewed.
Key Findings
- 20 of the 57 filing companies filed at least one amendment, 26 amendments in all. River Financial filed 4.
- The median gap from an original filing to an amendment was 22 days, the same median The Uptime Report found.7 Most amendments, 21 of 25, came within 60 days.
- Companies use amendments to report impact they could not determine at first, so investors who read only the first filing may miss the cost of an incident.4
Which Companies Filed Item 1.05 Reports in 2026
We list every original Item 1.05 filing made in 2026 so readers can see the companies behind the count.
| Filing date | Company | Industry (SIC) | State |
|---|---|---|---|
| February 24 | UFP Technologies | Surgical and medical instruments | Massachusetts |
| March 20 | Trio-Tech International | Special industry machinery | California |
| March 27 | CareCloud | Prepackaged software | New Jersey |
| April 8 | Bitcoin Depot | Finance services | Georgia |
| May 11 | CB Financial Services | State commercial banks | Pennsylvania |
| May 11 | West Pharmaceutical Services | Surgical and medical instruments | Pennsylvania |
| May 22 | The Oncology Institute | Offices of doctors | California |
| June 15 | iRhythm Technologies | Surgical and medical instruments | California |
| June 23 | 8x8 | Computer processing and data preparation | California |
| June 25 | River Financial | State commercial banks | Alabama |
| July 2 | AdaptHealth | Home health care services | Pennsylvania |
| July 2 | Navient | Security brokers and dealers | Virginia |
| July 31 | Amgen | Biological products | California |
| August 31 | Nutex Health | Business services | Texas |
| September 1 | Park Dental | Health services | Minnesota |
| September 8 | Boston Scientific | Surgical and medical instruments | Massachusetts |
| September 23 | Astrana Health | Management consulting services | California |
| October 13 | Park Dental | Health services | Minnesota |
Source: CyberReviewed analysis of SEC EDGAR filings.1
Source: CyberReviewed analysis of SEC EDGAR filings.1 Chart: CyberReviewed.
Key Findings
- Companies with medical instrument, health services, or biological products industry codes made 9 of the 18 filings in 2026, including Amgen, Boston Scientific, and AdaptHealth.
- Park Dental filed twice, on September 1 and October 13, for separate incidents.
- Filings through October 28, 2026 numbered 18, more than the 15 filed in all of 2025.
What the Item 1.05 Filing Counts Mean
A material cyber incident filing is rare. Only 57 companies have filed one in nearly three years, and most incidents that companies disclose go under Item 8.01 instead.5 For an investor, that makes each Item 1.05 filing a signal that the company itself expects the incident to affect its business.
The rule may not last in its current form. Industry groups have asked the SEC to repeal Item 1.05 as part of its review of Regulation S-K, and the SEC has not yet acted.5
So if you hold or research a public company that discloses a cyber incident, check which Form 8-K item it used and read the amendments that follow, since that is where the cost usually appears.
Sources
- CyberReviewed, analysis of Form 8-K and 8-K/A filings listing Item 1.05 on SEC EDGAR, December 18, 2023 to October 28, 2026, with filer SIC codes and states, conducted October 2026
- SEC EDGAR full-text search, Form 8-K and 8-K/A filings, accessed October 28, 2026
- SEC, SEC Adopts Rules on Cybersecurity Risk Management, Strategy, Governance, and Incident Disclosure by Public Companies, July 26, 2023
- SEC, Erik Gerding, Disclosure of Cybersecurity Incidents Determined To Be Material and Other Cybersecurity Incidents, May 21, 2024
- Debevoise & Plimpton, Cybersecurity Incident Disclosure Form 8-K Tracker: Two-Year Update, May 21, 2026
- SecureResearch, SEC cyber incident tracker, updated October 27, 2026
- The Uptime Report, SEC cybersecurity incident disclosures under Form 8-K Item 1.05, data through September 23, 2026
Methodology
We queried SEC EDGAR full-text search for Form 8-K and 8-K/A filings containing "Item 1.05", "Material Cybersecurity Incidents", or "cybersecurity incident" filed from December 18, 2023 to October 28, 2026, removed duplicate accession numbers, and kept only filings whose EDGAR item list includes Item 1.05. That left 59 original 8-K filings and 26 8-K/A amendments. Industry divisions come from each filer's SIC code as listed on EDGAR, grouped by the standard SIC divisions. Months in the before-and-after comparison are calendar days divided by 30.44. Amendment timing measures days from an original filing to each 8-K/A that follows it; one Stryker amendment had no matching original in the window and is excluded, so 25 gaps are measured. We calculated products, differences, and ratios from the published values. SecureResearch and Debevoise counts are taken as published and cover different windows from ours. No currency conversion was needed.
