An 8-K cyber incident disclosure, filed under Item 1.05, tells you that a public company decided an incident was material. The SEC rule requires it to describe the nature, scope and timing of the incident and its likely effect. Filing is due four business days after that materiality decision, not after discovery.
What the rule says
According to the SEC press release on its 2023 cybersecurity rules, registrants must report any cybersecurity incident they determine to be material. The report covers the significant features of the incident's nature, scope and timing, and its actual or likely significant effect on the company. The filing is due four business days after the materiality determination. The release also notes that the Attorney General can delay disclosure when immediate disclosure would seriously endanger national security or public safety, after notifying the Commission in writing.
The clock starts at materiality
This is the detail people miss. The four days run from the company's determination that the incident is material. So a filing can appear well after the intrusion began or was noticed. Do not read the filing date as the discovery date.
Read in this order
- Find the date the incident was discovered, if stated.
- Find the date of the materiality determination, if stated.
- Read the description of scope: which systems, which data, whether operations were affected.
- Read the statement about effect. Companies may say they have not yet determined the full impact.
- Look for later amendments. Initial filings are often updated as the investigation continues.
What the filing may not tell you
It may not name the data types or the number of affected people. It may not say how the intruder got in. It may not give indicators you can search for. Those are usually not required in the 8-K.
Annual disclosures are separate
The same rules require annual descriptions, in the Form 10-K, of how the company assesses and manages cybersecurity risk, the board's oversight and management's role. Those tell you about process, not about a given incident.
If you are a customer or supplier
Read the filing for statements about customer data and third parties, then use your contract's notification clause and your own exposure checks. A filing is not a notice to you.
Quick check
Does an 8-K mean customer data was stolen?
Not necessarily. It means the company judged the incident material. Read the scope section and wait for customer notices.
Are private companies covered by this rule?
The rule described here applies to registrants with the SEC. Private companies have other duties, so check contracts and local law.
Sources
Last reviewed: 19 October 2026.
