State of SEC Cybersecurity Incident Disclosures

Headline findings

• Data breaches dominate cyber filings. 37% of filings confirmed data exfiltration — more than ransomware (21%) and intrusions-without-exfiltration (27%) combined.
• Markets price cyber disclosures. 41 of 61 filings (67%) traded down in the 5 trading days after an Item 1.05 8-K. Median move -2.4%; outlier drops beyond -15%.
• Companies rewrite their cyber risk factors every time. 100% of the 40 filings with both a pre-incident 10-K and a post-incident 10-K/Q had substantive cyber risk-factor changes. 88% explicitly reference the specific incident.
• Operational disruption is the norm. 69% of filings report that the incident disrupted business operations — systems offline, order processing halted, manufacturing delays.
• Named attribution is vanishingly rare. Only 1 of 70 filings named a specific threat actor — filers overwhelmingly prefer generic descriptors to named groups.
• Compliance looks strong when measured correctly. The SEC's 4-business-day clock starts at the materiality determination, not discovery. Of the 11 filings that disclose the materiality date, 82% filed within the window.

1. Incident type mix

The data_breach / unauthorized_access split is the most consequential classification in the dataset. Exfiltration triggers customer notification, state AG filings, and class action exposure in ways that uncorroborated access does not.

2. Filing cadence

Adoption peaked in Q1 2024 (15 filings) as the rule took effect, then settled to a steady ~2-3 incidents per month through 2026.

3. Data categories exposed

How often each category of sensitive data was reported as affected. Silent filings (not disclosing category) are excluded. "None disclosed" filings explicitly state no data was accessed — a useful signal for defenders tracking intrusion-only vs. data-theft incidents.

4. Operational disruption & remediation

48 of 70 filings (69%) report that the incident disrupted business operations. Most filings still show the incident ongoing or under investigation at disclosure time — consistent with the SEC's intent that disclosure happen during the incident window, not after it wraps up.

5. Disclosure timing

The histogram below shows how long companies take between discovering an incident and filing the 8-K. Median is 12 days, meaning half of filers take more than two weeks — well outside the 4-business-day SEC rule as commonly understood. Note: the rule's clock actually starts at the materiality determination, not discovery, so this histogram describes operational tempo, not compliance.

* The 4-day SEC rule applies from materiality determination, not discovery. When filers disclose the materiality date (11 filings do), 82% fall within the rule window.

6. Market reaction

Cyber disclosures move prices. 41 of 61 filings traded down in the 5 trading days after the 8-K. Median t+5 return is -2.4%, and the distribution's left tail reaches below -20% in several cases.

Largest market-adjusted drops (t+5 vs SPY)

7. Repeat filers

Companies with multiple Item 1.05 filings — most multi-filing chains are the same incident with amendments as the investigation progressed. First American, UnitedHealth, and Key Tronic each have three filings on a single incident.

8. Largest disclosures by length

Disclosure length is an imperfect but useful proxy for depth. These are the most thoroughly disclosed incidents in the corpus.

9. Financial impact when disclosed

Only 17 of 70 filings put a dollar figure on the incident in the initial disclosure. Most filers defer quantification to later periodic filings.

10. How companies rewrite cyber risk factors after an incident

The most distinctive analytic signal in this dataset. For every cyber 8-K, we looked at the same company's 10-K cyber risk-factor language before the incident and after (in their next 10-K or 10-Q).

Of the 40 filings with both pre and post periodic filings available, every single one had substantive cyber risk-factor changes, and 35 (88%) explicitly reference the specific incident.

Most-added new threat themes

AI-enabled attacks and nation-state attribution emerge as the two fastest-rising post-incident risk-factor themes across the corpus, even at companies where the specific incident wasn't AI-related or nation-state-attributed.

11. Notable incidents

Selected incidents with substantive disclosure depth. Summaries drawn from the filing text with every fact provenance-linked to its source sentence.

12. What to watch

• Filing volume has stabilized around 2-3 new incidents per month.
• AI-enabled attacks are the fastest-emerging theme in post-incident risk-factor updates.
• Supply-chain compromise appears as a new post-incident risk-factor theme even at companies not yet hit by one directly — pre-disclosure of the risk vector.
• Disclosure lag is not closing. The median discovery-to-filing gap remains 12 days, unchanged since the rule took effect.