An 8-K cyber incident is a public company's mandatory disclosure of a cybersecurity breach that a reasonable investor would consider important to a decision about the company's stock. The Securities and Exchange Commission requires this disclosure under Item 1.05 of Form 8-K, a rule that governs what gets reported, how fast, and under what narrow exceptions.
The rule sounds simple on paper but has produced real disputes over timing, wording, and intent. Court rulings and settlements since 2023 show the SEC enforcing it unevenly, and companies still misjudging what "material" means under pressure. Understanding the actual timeline and the traps other companies have hit is the fastest way to know what a disclosure means when you read one.
Table of Contents
- When did this rule take effect, and what's the actual clock?
- What has to be in the filing?
- Are there valid reasons to delay disclosure?
- How has the SEC actually enforced this, and where has it lost?
- What this means when you're reading a company's 8-K
- Frequently Asked Questions
When did this rule take effect, and what's the actual clock?
The SEC adopted Item 1.05 on July 26, 2023, and set incident-reporting compliance to begin December 18, 2023, with smaller reporting companies given until June 15, 2024, according to the SEC's July 2023 press release. Any material cybersecurity incident discovered by a covered company after those dates falls under the rule. The four-business-day deadline that gets cited most often is frequently misunderstood. It does not start when a company discovers an intrusion — it starts when the company determines the incident is material, according to the SEC's final rule release.
That materiality determination itself has no fixed deadline, but the same release requires it be made "without unreasonable delay" after discovery. In practice, this means the real clock is two-stage: an open-ended but accountable period to assess materiality, followed by a hard four-business-day filing window once that assessment concludes. If new facts surface after the original filing — a bigger scope, a different financial impact, a changed root cause — the company must file an amended 8-K within four business days of learning that new information, per the same SEC release. An 8-K filed on day one is not necessarily the final word on an incident.
What has to be in the filing?
Item 1.05 requires three specific elements: the incident's nature, its scope, and its timing. The filing must also describe the incident's material impact, or reasonably likely material impact, on the company's financial condition and results of operations, according to the SEC's rule release. This is narrower than it sounds.
The rule does not require technical detail that could help an attacker, and it does not require a company to disclose its remediation playbook. It requires a business-impact statement a shareholder could use. A filing that names the breach but omits any discussion of financial consequence has not satisfied the standard — the materiality analysis is the substantive part, not the announcement that something happened.
Are there valid reasons to delay disclosure?
There is exactly one. A delay is permitted only if the U.S. Attorney General determines, in writing, that immediate disclosure would pose a substantial risk to national security or public safety, according to the SEC's final rule release. This is a specific, documented federal law-enforcement determination — not a judgment call a company or its counsel can make unilaterally, and not available simply because an investigation is ongoing.
Several common assumptions about what excuses disclosure turn out to be wrong. SEC staff guidance states that paying a ransom does not eliminate the duty to assess and disclose materiality, and an attacker appearing to halt an intrusion does not either, according to the SEC's Compliance & Disclosure Interpretation 104B.07. The same guidance states that insurance reimbursement does not automatically render an incident immaterial. A company that stops the bleeding, pays to make the problem disappear, or gets reimbursed by its carrier still has to run the materiality analysis as if none of that happened.
How has the SEC actually enforced this, and where has it lost?
Enforcement so far has been uneven, and the record shows the rule is still being tested in real disputes rather than applied mechanically. On October 22, 2024, the SEC settled charges against four companies — Unisys, Check Point Software, and former public companies Mimecast and Avaya Holdings — over disclosures tied to the 2020 SolarWinds/SUNBURST intrusion, with combined penalties of nearly $7 million: $4 million from Unisys, $1 million from Avaya, $995,000 from Check Point, and $990,000 from Mimecast, according to a Willkie Farr & Gallagher client alert. That action was not unanimous.
Commissioners Hester Peirce and Mark Uyeda dissented, arguing the SEC was second-guessing good-faith materiality judgments with hindsight and "regulating by enforcement," noting that none of the four companies had actually failed to disclose the incidents, according to a BCLP analysis. The SEC's broader, more aggressive case — filed in October 2023 against SolarWinds and its chief information security officer, the first to allege scienter (knowing or reckless intent) over a cyber disclosure — fared worse in court. A Southern District of New York judge dismissed most of the claims on July 18, 2024, finding they relied on "hindsight and speculation." On November 20, 2025, the SEC and SolarWinds jointly stipulated to dismiss the remaining claims with prejudice, with neither side admitting wrongdoing, according to a Winston & Strawn summary. The settlements and the dismissal together show a regulator willing to penalize disclosure language it finds misleading, but not yet able to make an individual-liability, fraud-based theory stick in front of a judge.
What this means when you're reading a company's 8-K
A filed Item 1.05 8-K is a materiality conclusion, not a full incident report. The scope described in the first filing can change — expect amendments if the company learns more, and read any later 8-K/A as the more complete account.
- Check the date gap between an incident becoming public (through a leak, a vendor notice, or security researchers) and the 8-K filing date — a long gap raises the question of when materiality was actually determined, not just when the filing clock started.
- Look for a specific financial-impact statement, not just a description of what happened; a filing light on business impact may get amended later.
- Don't assume a ransom payment, a quick lockout of the attacker, or cyber insurance coverage explains an absence of disclosure — none of those three removes the underlying duty.
- Treat the SolarWinds outcome as a sign that enforcement risk centers on language and timing judgment calls, not on the simple fact that a breach occurred.
Frequently Asked Questions
Does every company have to file an 8-K after any cyberattack?
No — only when the company determines the incident is material; immaterial incidents don't trigger Item 1.05.
Can a company wait until it fully understands a breach before filing?
No — the materiality determination must happen without unreasonable delay, and the four-business-day filing clock starts once that determination is made, per the SEC's rule release.
Does paying a ransom stop the disclosure requirement?
No — SEC guidance states that paying a ransom does not eliminate the duty to assess and disclose materiality, per the SEC's C&DI 104B.07.
You Might Also Like
- Cybersecurity — Triple Extortion Explained: Timeline, Exposure, and Response
- Cybersecurity — SEC Cyber Disclosure Security Review: Entry Point, Impact, and Lessons
- Cybersecurity — City Government Hack Response Checklist: Passwords, Accounts, and Credit