288 Public Companies Filed Material Cyber Incidents in First Year Under SEC 8-K Rules

Between December 2023 and November 2024, 288 public companies filed material cybersecurity incidents under the SEC's new Item 1.05 of Form 8-K, creating the first standardized dataset of breach disclosure since the rule took effect. The volume runs roughly 24 filings per month, establishing a baseline for how frequently corporate boards now judge cyber events to meet the materiality threshold. The rule, adopted in July 2023, requires disclosure within four business days of determining an incident is material—no delay for investigation completion, no waiting for remediation.

The filings reveal a disclosure taxonomy that separates careful operators from reactive ones. Companies filing within the four-day window demonstrate pre-incident preparation: board-level cyber risk committees, materiality frameworks drafted with outside counsel, incident response playbooks that include SEC timelines. Late filers—those beyond four days or seeking repeated extensions—signal either poor governance or incidents severe enough to paralyze decision-making. The SEC has not yet published enforcement actions under the new rule, but the clock started December 2023. Expect selective enforcement by Q2 2025, targeting either serial late filers or companies whose post-incident facts contradict their initial 8-K narratives.

For allocators, the dataset introduces a new diligence dimension. A portfolio company filing under Item 1.05 triggers three questions: Was the filing timely? Does the language suggest operational containment or ongoing exposure? What second-order costs—regulatory, litigation, customer attrition—will surface in subsequent quarters? The rule also creates asymmetry. Private companies and non-filers face no equivalent disclosure mandate, meaning public market participants now carry a transparency tax that private peers avoid. Family offices and fund managers rotating into private credit or direct investments should price this advantage: operational failures stay quiet longer in private hands.

The 288-filing baseline also establishes a screening threshold. Any company filing two or more material incidents within twelve months deserves elevated scrutiny—not because breaches are rare, but because repeat materiality determinations suggest either weak perimeter defenses or a low board threshold for disclosure. Both are allocation red flags. The rule does not require disclosure of non-material incidents, so companies filing frequently are either genuinely compromised at scale or interpreting materiality conservatively. The latter is preferable but uncommon.

Watch for three follow-on developments through mid-2025. First, the SEC will likely publish guidance clarifying materiality standards after reviewing the first year's filings—expect this by June. Second, plaintiff's counsel will begin citing 8-K disclosures as evidence in securities litigation, particularly where stock prices fell post-filing. Third, cyber insurers will adjust pricing models using the dataset, penalizing sectors or companies with elevated filing frequency. Insurers already request copies of filed 8-Ks during renewal underwriting.

The rule's first year delivered exactly what the SEC intended: a public record of how often corporate America gets breached at a scale boards deem material. The number is 288, and it will rise.