SEC Cybersecurity Incident Disclosures: Every Form 8-K Item 1.05 Filing Since 2023

Since the SEC’s cybersecurity incident disclosure rule took effect on December 18, 2023, public companies have filed 58 original Form 8-K Item 1.05 disclosures of material cybersecurity incidents, from 57 different companies, through 2026-09-23. Filings slowed sharply after the SEC staff steered immaterial incidents elsewhere in May 2024, then picked up again in 2026.

What is an Item 1.05 disclosure?

Under rules adopted in July 2023, a public company must file a Form 8-K under Item 1.05 when it determines that a cybersecurity incident is material. The filing is generally due four business days after that determination. The requirement began on December 18, 2023, with smaller reporting companies given an additional 180 days.

Why did filings fall after mid-2024?

Early filers used Item 1.05 for incidents they had not yet judged material. On May 21, 2024, the SEC’s Director of Corporation Finance stated that the division encourages companies to disclose such incidents under a different item, for example Item 8.01. Original Item 1.05 filings went from 17 between December 2023 and June 2024 to 24 across July 2024 through December 2025. The drop reflects a narrower definition of what gets filed under Item 1.05, not necessarily fewer incidents.

Is the pace rising again?

Yes, modestly. There were 7 original filings in the second quarter of 2026 and 7 in the third, the highest two-quarter total since the first half of 2024. Because counts are small, a few filings move the trend.

Which industries and states file most?

By business address, the most common states are CA (10), WA (7), TX (7), PA (6), FL (3). Medical device makers, software companies, and banks lead, but no single industry dominates: the 58 filings span 44 SIC codes.

How often are disclosures amended?

Companies filed 26 Item 1.05 amendments. The median gap between a company’s previous filing and its amendment was 22 days. The rule expects companies to amend once information that was not available at the time of the original filing becomes known, such as the incident’s financial impact.

Every original Item 1.05 filing, by quarter

Each entry links to the filing on SEC EDGAR. The list is a neutral record of public filings.

Frequently asked questions

What is Form 8-K Item 1.05?

A disclosure requirement, effective December 18, 2023, under which public companies must report a cybersecurity incident they determine to be material, generally within four business days of that determination.

How many companies have filed an Item 1.05?

58 original Item 1.05 filings by 57 companies from December 18, 2023 through 2026-09-23, per SEC EDGAR.

Why did Item 1.05 filings drop in 2025?

After a May 21, 2024 SEC staff statement, companies were encouraged to report incidents not yet determined to be material under Item 8.01 instead. Item 1.05 counts after mid-2024 therefore reflect a narrower set of incidents.

How often do companies amend Item 1.05 filings?

26 amendments (8-K/A) were filed, a median of 22 days after the company’s prior filing; the rule expects amendments as information that was unavailable becomes known.

Which industries file the most?

The most common SIC code among filers is 3841 (Surgical and medical instruments), with 5 filings.

Does an Item 1.05 filing mean a company did something wrong?

No. It means the company determined an incident was material to investors. It is a disclosure, not a finding of fault.

Methodology

References

1. SEC press release 2023-139, cybersecurity disclosure rules. Accessed October 2026.
2. SEC, statement on disclosure of cybersecurity incidents, May 21, 2024. Accessed October 2026.
3. SEC EDGAR full-text search. Accessed October 2026.
4. SEC, Standard Industrial Classification code list. Accessed October 2026.