Item 1.05 cyber 8-Ks in 2025-26: what 32 companies disclosed
Thirty-two companies reported a cyber incident under Item 1.05, the item for material ones, from January 2025 to October 2026. We read all 43 filings.
The breach record
Seven breaches this site has read from filings and the public catalogue, newest disclosure first. Each count is the record’s own, with the day it was read.
Disclosed is Conduent’s Form 8-K filing date, and for catalogue entries the date Have I Been Pwned loaded the data.
| Breach | Disclosed | Records | Counted as | Primary record |
|---|---|---|---|---|
| June 2026 Stealer Logs | 56,278,397 | addresses | Have I Been Pwned | |
| Synthient Stealer Log Threat Data | 182,962,095 | addresses | Have I Been Pwned | |
| Data Troll Stealer Logs | 109,532,219 | addresses | Have I Been Pwned | |
| Conduent Business Services | 62,224,658 | people | Form 8-K; count from the HHS breach portal | |
| ALIEN TXTBASE Stealer Logs | 284,132,969 | addresses | Have I Been Pwned | |
| Stealer Logs, Jan 2025 | 71,039,833 | addresses | Have I Been Pwned | |
| Stealer Logs Posted to Telegram | 26,105,473 | addresses | Have I Been Pwned |
Sources: SEC EDGAR; HHS Office for Civil Rights breach portal, read 7 October 2026; Have I Been Pwned public breaches endpoint, read 23 September 2026. Each breach name links to our reporting.
Also in the breach record
62.2M
people in the federal health-breach count; the first letters went out 268 days after discovery
Conduent breach timeline, read from the 8-K and the notices20.7%
of the addresses loaded in 2025 and 2026 are in entries flagged as stealer logs
Stealer logs in the breach record: one address in five1,036
breaches in the public catalogue, holding 17.8 billion loaded addresses
The breach record in one spreadsheet: what 1,036 breaches show
Addresses in the public catalogue, by year of breach
Email addresses in the breaches dated to each year, in billions. 2026 runs to 19 September and is drawn in grey.
What leaks
Share of the breaches in the catalogue that exposed each kind of data, by the year the breach is dated.
| Data class | Before 2017 (%) | 2017 onward (%) |
|---|---|---|
| Passwords | 87.4 | 55.6 |
| Names | 27.2 | 64.9 |
| Phone numbers | 15.2 | 44.8 |
| Physical addresses | 15.2 | 34.9 |
| Dates of birth | 26.5 | 27.8 |
| Government issued IDs | 1.9 | 2.9 |
Source: the same 1,036 breaches. Read in The breach record in one spreadsheet.
Attack and defense
- Session tokens: what a stolen cookie can do, and what limits it
- Ransomware kill chain mapped to the controls that interrupt each step
- SQL injection for people who write queries: mechanism, fix, test
- Credential stuffing: how it works, how logs show it, how to slow it
- Phishing that beats MFA: adversary-in-the-middle for defenders