- 59 Form 8-K reports of material cybersecurity incidents, from 57 companies, between December 18, 2023 and October 14, 2026.
- 18 were filed in 2026 through October 14, against 15 in all of 2025 and 24 in 2024.
- Manufacturers account for 19 of the 57 companies. Of the 5 medical instrument makers that filed, 4 filed in 2026.
- 19 of the 57 companies filed at least one amendment, a median 22 days after the first report.
Reports fell in 2025 and rose again in 2026
Since December 18, 2023, a public company that judges a cybersecurity incident material must report it on Form 8-K under Item 1.05 within four business days of that judgment. Smaller reporting companies have had to since June 15, 2024.
Through October 14, 2026, 57 companies filed 59 such reports. Of these companies, 2 filed more than one.
Companies filed 24 reports in 2024 and 15 in 2025. In 2026 through October 14 they filed 18.
The busiest quarter was the first quarter of 2024, with 9. The quietest was the first quarter of 2025, with 2. In the second quarter and the third quarter of 2026 there were 7 each, the most since the first quarter of 2024.
On May 21, 2024, SEC staff said Item 1.05 is for incidents a company has judged material. They encouraged companies to report other incidents under a different item, such as Item 8.01. Of the 59 reports, 17 came in the 5 months before that statement and 42 in the 29 months after it.
One in three filers is a manufacturer
Of the 57 companies, 19 are manufacturers by SEC industry code. Finance, insurance and real estate companies account for 13, and services companies for 13.
The most common single industry code is 3841, surgical and medical instruments, with 5 companies. Of those 5, 4 filed in 2026.
Software, data processing and IT services companies account for 5.
About half the filers are large companies, and one in three amended
Of the 57 companies, 28, or 49%, are large accelerated filers. That is the SEC's class for companies with a public float of, generally, $700 million or more. They include Microsoft, UnitedHealth Group, AT&T, Amgen and Boston Scientific.
Of the rest, 13 are accelerated filers and 11 are non-accelerated filers. The other 5 are emerging growth companies with no filer status listed. Counted separately, 16 of the 57 are smaller reporting companies.
A company that does not yet have all the required information about an incident must say so in its report. It must then file an amendment once it has that information. Of the 57 companies, 19 filed at least one amendment. The first amendment came a median 22 days after the original report. The range was 7 days to 158 days. In all, 20 companies filed 26 amendments. Of these companies, 1 had no original Item 1.05 report.
What the data does not tell us
Only incidents judged material. Item 1.05 covers incidents a company has judged material to its business. Each company makes that judgment itself. Incidents a company judged not material, or had not yet judged, are not counted here, including those reported voluntarily under Item 8.01.
Why Item 8.01 is not counted. A search of Item 8.01 filings for the phrase "cybersecurity incident" also returns merger, debt and earnings filings that use the phrase in passing. Item 8.01 filings are not counted.
Whom it counts. The count covers public companies that file Form 8-K. Foreign private issuers, which file Form 6-K instead, are not included. Nor are private companies or government bodies. Each report is dated by its filing date, not by the date of the incident.
Industry and size. Industry is the company's primary SIC code as EDGAR lists it, grouped into SIC divisions. Filer status is the one EDGAR lists on October 14, 2026, which may differ from the company's status when it filed. This edition uses filings as of October 14, 2026.
What it means for a technology leader
- Vendors. Software, data processing and IT services companies make up 5 of the 57 companies that reported a material incident.
- Peers. Reports come from every size of public company: 28 large accelerated filers and 16 smaller reporting companies.
- Follow-up. One in three companies filed an amendment after the first report, a median 22 days later.
Each with its source
57 public companies filed 59 reports of material cybersecurity incidents between December 18, 2023 and October 14, 2026.
SEC EDGAR, Form 8-K filings under Item 1.05. CIOPages CIOnomics, Cyber Incidents, Q4 2026.
Item 1.05 is not a voluntary disclosure, and it is by definition material because it is not triggered until the registrant determines the materiality of an incident.
SEC, Cybersecurity Risk Management, Strategy, Governance, and Incident Disclosure, Release No. 33-11216, July 26, 2023. CIOPages CIOnomics, Cyber Incidents, Q4 2026.
If a company chooses to disclose a cybersecurity incident for which it has not yet made a materiality determination, or a cybersecurity incident that the company determined was not material, the Division of Corporation Finance encourages the company to disclose that cybersecurity incident under a different item of Form 8-K (for example, Item 8.01).
Erik Gerding, Director, SEC Division of Corporation Finance, statement of May 21, 2024. CIOPages CIOnomics, Cyber Incidents, Q4 2026.
The report and its data
The report (PDF) and the data appendix (Excel): every chart, every figure and the series behind them, sent to your work email.
How this was put together
Every count comes from SEC EDGAR, downloaded on October 14, 2026. Filings were found with EDGAR full-text search for "Item 1.05" and for "Material Cybersecurity Incidents" in Forms 8-K and 8-K/A filed since December 18, 2023, keeping only filings that EDGAR lists under Item 1.05. Each filer's EDGAR submission history was then checked for Item 1.05 filings the search missed. It added none. Industry and filer status come from the same records. No figure is estimated or modeled by CIOPages.
| Measure | Agency | Series | Frequency | Latest |
|---|---|---|---|---|
| Form 8-K and 8-K/A filings under Item 1.05, Material Cybersecurity Incidents | Securities and Exchange Commission | EDGAR full-text search | Each filing | |
| Each filer's SIC code, filer status and filing history | Securities and Exchange Commission | EDGAR submissions API (data.sec.gov) | Each filing | |
| Item 1.05 rule and compliance dates | Securities and Exchange Commission | Release No. 33-11216 | One time | |
| Staff statement on Item 1.05 and Item 8.01 | Securities and Exchange Commission | Statement, Division of Corporation Finance | One time |
One story a week about the technology economy, built from government data. Or get the month’s stories in The Throughline, our monthly newsletter.