CIOnomics · Cyber Incidents
Cyber Incidents
Material cybersecurity incidents public companies report to the SEC on Form 8-K.
Quarterly · Sources: SEC filings
- 59 Form 8-K reports of material cybersecurity incidents, from 57 companies, between December 18, 2023 and October 14, 2026.
- 18 were filed in 2026 through October 14, against 15 in all of 2025 and 24 in 2024.
- Manufacturers account for 19 of the 57 companies. Of the 5 medical instrument makers that filed, 4 filed in 2026.
- 19 of the 57 companies filed at least one amendment, a median 22 days after the first report.
Every edition
From the latest issue
57 public companies filed 59 reports of material cybersecurity incidents between December 18, 2023 and October 14, 2026.
SEC EDGAR, Form 8-K filings under Item 1.05. CIOPages CIOnomics, Cyber Incidents, Q4 2026.
Item 1.05 is not a voluntary disclosure, and it is by definition material because it is not triggered until the registrant determines the materiality of an incident.
SEC, Cybersecurity Risk Management, Strategy, Governance, and Incident Disclosure, Release No. 33-11216, July 26, 2023. CIOPages CIOnomics, Cyber Incidents, Q4 2026.
If a company chooses to disclose a cybersecurity incident for which it has not yet made a materiality determination, or a cybersecurity incident that the company determined was not material, the Division of Corporation Finance encourages the company to disclose that cybersecurity incident under a different item of Form 8-K (for example, Item 8.01).
Erik Gerding, Director, SEC Division of Corporation Finance, statement of May 21, 2024. CIOPages CIOnomics, Cyber Incidents, Q4 2026.
One story a week about the technology economy, built from government data. Or get the month’s stories in The Throughline, our monthly newsletter.