Item 1.05 cyber 8-Ks in 2025-26: what 32 companies disclosed

Between 1 January 2025 and 9 October 2026, 32 public companies reported a cybersecurity incident to the SEC under Item 1.05 of Form 8-K, the item for material ones. None of those first reports named the attacker. Two gave a count of the people or accounts affected, two said when the intruder got in, and eleven said in the same filing that they did not expect a material impact on their financial condition or results. We read every filing made under the item in that period, 43 in all, together with the five earlier reports that some of these companies made under other items, and coded each first report against a list of questions written before any filing was read; five more were added during the reading and applied to all 32. This article reports what that record shows about timing, about what "material" has come to mean, and about what a report usually leaves out. The dataset and a standard-library script that recomputes every figure here ship with it.

What the item requires, and how one company's report compared with the letters and lists that followed it, is in our Conduent timeline. This piece does not repeat that; it counts.

How the set was built

EDGAR's full-text search finds phrases in filings but cannot filter by item number, so we searched 8-K filings dated 1 January 2025 to 9 October 2026 and kept every hit whose EDGAR item list includes 1.05. The phrase "Item 1.05" found all 43. Eight other phrases, run as a check ("Material Cybersecurity Incidents", "cybersecurity incident", "ransomware", "threat actor", "unauthorized third party", "cyberattack", "cybersecurity event" and "cyber incident"), found no tagged filing it had missed; the item's own caption, on its own, found 32. We then read each filer's EDGAR submissions record, whose item list is the authority, and it showed no other Item 1.05 filing by those companies in the period.

The 43 filings are 32 on Form 8-K and 11 on Form 8-K/A, from 33 companies. One of the 33, ENGlobal, was amending its report of a 2024 incident. That leaves 32 incidents reported under Item 1.05 for the first time in the period, one per company: 14 in 2025, and 18 in the first nine months of 2026.

Four business days, by the company's own calendar

General Instruction B.1 of the form sets the clock: "A report pursuant to Item 1.05 is to be filed within four business days after the registrant determines that it has experienced a material cybersecurity incident." The filing shows only one date that could mark that determination, the cover page's "Date of Report (Date of earliest event reported)". Counted from that date, with weekends and the federal holidays on OPM's schedules left out, all 31 reports that carry their own cover date were filed within four business days: two on the cover date itself, five a business day later, and eight each at two, three and four. The 32nd, Stryker's, is an amendment and carries the date of the report it amends.

The cover date is the company's choice, though, and what it marks changed between the two years. In 2025, six of the 14 first reports put the day of discovery or of the outage on the cover, and none said in words when the company decided the incident was material. In 2026, ten reports gave the day of that decision, and all ten put the same day on the cover:

All dates are 2026. Where a report gives both days, the decision came 2 to 21 days after discovery, and every filing followed the decision within one to four business days.

Measured from discovery instead, the spread is wider. Twenty-eight of the 32 first reports give a day of discovery or onset; the median report was filed 9.5 days after it, and the three longest gaps were Conduent's 91 days, BayFirst Financial's 77 and F5's 67. Each has its explanation in the record. BayFirst was notified on 14 August 2025 of "a cybersecurity incident experienced by a third-party provider of marketing services", and the provider confirmed customer data was exposed on 28 October, the date on BayFirst's cover. F5 learned of "a highly sophisticated nation-state threat actor" on 9 August 2025, and its report says "On September 12, 2025, the U.S. Department of Justice determined that a delay in public disclosure was warranted pursuant to Item 1.05(c) of Form 8-K". It is the only report in the set that mentions the national-security delay.

Material, but not to the numbers

Item 1.05(a) asks a company to "describe the material aspects of the nature, scope, and timing of the incident, and the material impact or reasonably likely material impact on the registrant, including its financial condition and results of operations." We coded what each first report says about that impact.

The 2026 column is the change. Ten of the 18 first reports filed in 2026 say the incident is not expected to have a material impact on financial condition or results, and eight of those ten say, in the same filing, that the company decided the incident is or may be material. Fourteen 2026 reports state such a decision in words (ten with a date, two without, and two that call the incident "reportable" rather than material), against none in 2025, and ten of the fourteen tie it to the data rather than to money or operations. CB Financial Services "determined the event to be material" on 7 May 2026 "due to the volume and sensitive nature of the non-public information at issue". Navient reached its decision "in light of the volume and sensitivity of the information involved", and the next sentence of its report says it "does not believe the incident has had, or is reasonably likely to have, a material impact on its financial condition or results of operations."

Both halves of that pairing rest on what the SEC's disclosure staff wrote in May 2024. The Director of the Division of Corporation Finance wrote that "companies should consider qualitative factors alongside quantitative factors", and that "There also may be cases in which a cybersecurity incident is so significant that a company determines it to be material even though the company has not yet determined its impact". For an incident a company chooses to disclose before deciding it is material, or after deciding it is not, the same statement says "the Division of Corporation Finance encourages the company to disclose that cybersecurity incident under a different item of Form 8-K (for example, Item 8.01)." Five of the 32 incidents went that way first, as the section on what came before and after shows.

Two 2026 reports avoid the word. 8x8 "has determined this incident is reportable under Item 1.05 of Form 8-K due to the nature of the information accessed", and Park Dental Partners is "treating this as a reportable event" "due to the possible access of patient data".

What the reports say, and what they leave out

The two counts are Zoomcar's "approximately 8.4 million users" and Coupang's "up to 33 million customer accounts". The two start dates are River Financial's ("On or about June 16, 2026, an unauthorized threat actor gained access to the network environment") and 8x8's ("This unauthorized access occurred between June 11 and 12, 2026"). The two cost figures are Coinbase's estimate of "approximately $180 million to $400 million relating to remediation costs and voluntary customer reimbursements" and Bitcoin Depot's "preliminary estimate of loss of approximately $3.665 million" for bitcoin moved out of its wallets.

The seven routes the reports do name are mostly people. Three are social engineering: iRhythm says "the affected data was obtained through social engineering", AdaptHealth describes "a successful social engineering attack that compromised a user session associated with a third-party contractor", and Astrana describes "a series of social engineering attempts in which threat actors, impersonating Company personnel and spoofing the Company's main corporate telephone number, contacted certain employees". Two are insiders: at Coinbase the actor obtained data "by paying multiple contractors or employees working in support roles outside the United States", and at Coupang "a former employee may have obtained" the data. One is a third-party integration with 8x8's Salesforce system. The seventh has no intruder at all: CB Financial Services' report describes "an internal incident involving the handling of certain non-public customer information using an unauthorized artificial intelligence-based software application", and lists customer names, Social Security numbers and dates of birth among the information disclosed.

The third parties in the other reports are a marketing provider (BayFirst), a software vendor (The Oncology Institute), third-party-hosted business applications (iRhythm), a law firm hit by ransomware (Navient), and "cloud environments hosted by third-party cloud service providers" (Amgen). AdaptHealth's stolen data included "a stored password file associated with insurance billing".

Before and after the Item 1.05 report

Five of the 32 incidents were first reported to the SEC under another item: United Natural Foods, Stryker, Nutex Health and Boston Scientific under Item 8.01, and The Oncology Institute under Item 7.01. The Item 1.05 report followed after 7 days (Nutex), 13 (Boston Scientific), 17 (United Natural Foods), 29 (Stryker) and 197 (The Oncology Institute, whose November 2025 report said a cybersecurity incident at a software provider could delay its fee-for-service collections, and whose May 2026 report followed a notice that the vendor had found access to systems holding its patients' data). Nutex's Item 8.01 report of 24 August 2026 said it did "not believe that the unauthorized access has had, or is reasonably likely to have, a material impact"; a week later it filed under Item 1.05. Stryker's Item 8.01 report of 11 March said it had "not yet determined whether the incident is reasonably likely to have a material impact"; on 9 April it amended that report into Item 1.05, saying the incident "had a material impact on its operations, with resulting impact to the Company's financial results for the first quarter of 2026."

Afterwards, the form expects amendments. Instruction 2 to the item says that where the required information "is not determined or is unavailable at the time of the required filing", the company says so and then "must file an amendment" within four business days of having it. Of the 31 incidents first reported in an original Item 1.05 8-K, six have an amendment on file, and all six are among the 26 reported at least 90 days before 9 October 2026. The first amendment came 9 days after the report at West Pharmaceutical Services, 11 at River Financial, 13 at Coupang, 16 at Lee Enterprises, 37 at Nucor and 158 at Wytec International.

What the amendments added varies. Nucor's says the incident "has not had a material impact, and is not reasonably likely to have a material impact" on its business operations, financial condition or results. Coupang's says that while about 33 million accounts were accessed, "the perpetrator only saved limited data from approximately 3,000 customer accounts", and adds vouchers worth about 1.685 trillion won, or $1.2 billion. Wytec's says "The authorities have closed this investigation and were unable to identify the source". River Financial filed four amendments between 6 and 30 July 2026; the last still says "River has not yet confirmed whether the incident is reasonably likely to materially impact its business or financial condition."

Seven first reports promised an amendment, and River Financial is the only one of the seven with an amendment on file. That is not a finding of a late filing, since the instruction starts its clock when the information is determined and the record does not show when that is. It does mean that a reader waiting for an 8-K/A may wait a long time, because later facts can arrive somewhere else. Lee Enterprises reported in a results release that "We incurred $2 million in restoration costs in the quarter related to the cyber incident". United Natural Foods estimated in an outlook release that "the cyber incident will impact fiscal 2025 net sales by approximately $350 to $400 million". Nutex said in a press release filed under Item 8.01 on 11 September 2026 that "the unauthorized third party has published on its website the data that was allegedly obtained", and that "the Company's assessment of the materiality of this event, as set forth in the August 31, 2026 8-K, has not changed."

What a defender takes from the record

The decision starts the clock, and the decision is now usually about data. Ten of the 14 decisions stated in 2026 rest on the data involved: its volume, its sensitivity, its nature, or its disclosure. Where a report gives both days, the decision came 2 to 21 days after discovery. A company can judge volume and sensitivity quickly only if it already knows what each system holds: how many records, of which kinds, about whom. That inventory is the control that turns days of reconstruction into a short meeting. It has to exist before an incident; in the Conduent record, assembling it afterwards took most of a year.

Assume you will not be told when it started. Two reports in 32 give the start of access. If your own scoping depends on a start date, the evidence is your logs, not the filing, and only logs kept longer than the intruder's stay can answer it. Eight reports mention ransomware or encryption; the controls that interrupt each stage of that pattern are in our kill-chain mapping.

People and third parties are where these reports say it came in. Social engineering appears three times, insiders twice, and a vendor, contractor or hosted service in seven reports. Two filings spell out their remedies: Astrana describes "resetting affected credentials, restricting remote access tools, restoring certain systems from clean backups, and enhancing monitoring, logging, and detection capabilities", and AdaptHealth "disabling the compromised user account, resetting affected credentials, and implementing additional access controls". A help desk that verifies callers out of band closes the route Astrana described, and push prompts paired with a help-desk pretext have settings that stop them. AdaptHealth's route was a compromised user session, and a session is a logged-in user, which is why absolute timeouts and rotation matter as much as passwords.

An approved-tools list now has to cover AI tools. CB Financial Services' incident needed no intruder: customer data left through an unapproved application, and the volume and sensitivity of that data made it material. An inventory of sanctioned AI services, egress controls that see uploads to unsanctioned ones, and a rule about which data classes may go into any of them are the controls this kind of incident calls for.

Read a counterparty's 8-K as the first document, and know where the rest will be. Expect no attacker, no count and no start date. Expect the materiality reason to be the data. Look for an 8-K/A, and also for the company's results releases and any later Item 8.01 report: in this set, later facts arrived in all three.

Limitations

• The set is what EDGAR's full-text search and the filers' own submissions records show. A filing tagged 1.05 whose text contains none of the nine phrases would be missed; the eight check phrases found nothing the first had not.
• The codes are our reading of each first report. A "no" means the report does not say it, not that it did not happen. Every coded answer was checked against the filing's own words.
• Cover dates and discovery days are the companies' own. The Oncology Institute's discovery day is the day a vendor's administrator told it that systems holding patient data had been reached, not the day it first learned of the vendor's incident.
• Business days exclude weekends and the federal holidays on OPM's schedules. The form's rule speaks of a "holiday on which the Commission is not open for business", and we assumed the SEC closes on federal holidays.
• Amendments are counted to 9 October 2026, and later ones will change the rates.
• Item 1.05 applies only to companies that report to the SEC. Breaches elsewhere surface, if at all, in state breach lists and regulators' portals.
• In May 2025 five banking and securities trade groups petitioned the SEC to rescind the item ("We respectfully request that the SEC rescind Item 1.05", petition 4-856). It is in the current Form 8-K, and filings under it continued through 23 September 2026, the last in this set.

The dataset

_README for item-1-05-cyber-incident-reports-2025-2026.csv, one row per filing read, 48 rows:

• company, cik, form, items, accession: the filer as named in the report, its EDGAR key, the form, the item numbers EDGAR lists, and the accession number
• filed, accepted_utc, cover_date: EDGAR's filing date, its acceptance time, and the cover page's date of the earliest event reported
• role: first_report, first_report_after_other_item, first_report_by_amendment (Stryker), update_8k (Data I/O's second Item 1.05 report on the same incident), amendment, amendment_of_2024_report (ENGlobal), or earlier_report_other_item (the five earlier Item 8.01 or 7.01 reports)
• business_days_cover_to_filed: for first reports with their own cover date
• discovery_date, start_of_access: the days the first report gives, if any
• materiality_decision, decision_reason: a date, undated or reportable where the report states a decision in words, and what it ties the decision to (data, operations, consequences, none)
• material_impact: stated, not determined or not expected, for first reports and amendments
• ransomware (yes, vendor, no), and yes/no for data_taken, personal_data, disruption, third_party, access_route, law_enforcement, outside_experts, insurance, actor_named, amend_promise, prior_report, all coded on first reports only
• people_count, cost_figure: the report's own words, where it gives a number
• url, retrieved: the document on EDGAR, and the day it was read (2026-10-10)

Run it yourself

The script reads the CSV and prints every summary above with no network access. With --edgar it repeats the first step of building the set for any date range: it asks EDGAR full-text search for the nine phrases and lists each 8-K whose item list includes 1.05. The SEC asks automated clients to identify themselves, so that mode refuses to run without a --ua string giving a name and a contact address. The search is this function:

def edgar_item105_filings(since: str, until: str, ua: str, phrases=PHRASES) -> list[dict]:
    """8-K and 8-K/A filings from EDGAR full-text search whose item list includes 1.05, one per accession."""
    found = {}
    for phrase in phrases:
        start = 0
        while True:
            query = urllib.parse.urlencode({"q": f'"{phrase}"', "dateRange": "custom", "startdt": since,
                                            "enddt": until, "forms": "8-K", "from": start})
            req = urllib.request.Request("https://efts.sec.gov/LATEST/search-index?" + query,
                                         headers={"User-Agent": ua, "Accept-Encoding": "identity"})
            with urllib.request.urlopen(req, timeout=60) as resp:
                hits = json.load(resp)["hits"]
            for h in hits["hits"]:
                s = h["_source"]
                if "1.05" in (s.get("items") or []):
                    cik = int(s["ciks"][0])
                    found[s["adsh"]] = {"filed": s["file_date"], "form": s["form"], "cover": s["period_ending"],
                                        "company": s["display_names"][0], "items": ",".join(s["items"]),
                                        "index": f"https://www.sec.gov/Archives/edgar/data/{cik}/"
                                                 f"{s['adsh'].replace('-', '')}/"}
            start += len(hits["hits"])
            time.sleep(0.5)  # stay far below the SEC's ten requests a second
            if not hits["hits"] or start >= hits["total"]["value"]:
                break
    return sorted(found.values(), key=lambda f: (f["filed"], f["company"]))

python code/item-1-05-cyber-incident-reports-2025-2026.py
python code/item-1-05-cyber-incident-reports-2025-2026.py --edgar --since 2026-10-01 --until 2026-10-31 \
    --ua "Acme Security Team security@acme.test"

The offline run includes these lines:

Cover date to filing, in business days (reports with their own cover date)
  0 business days:  2  ##
  1 business days:  5  #####
  2 business days:  8  ########
  3 business days:  8  ########
  4 business days:  8  ########
  within four: 31 of 31; median 3

Measured from the dates on their own covers, every one of these reports was on time, and in 2026 most covers carried the day of the materiality decision. The interval that tells a defender more is the one before it, from discovery to decision, and a report shows it only when it gives both days, as eight of the 32 do.