Cyber Incident Feed reference | SecFeed for developers

Endpoints

/v1/form-8k/cybersecurity-incidents

GEThttps://secfeedapi.com/v1/form-8k/cybersecurity-incidents

8-K Item 1.05 feed with the item text.

Parameter	Type	Description	Example
`cik`	integer	Filer CIK. Resolve a ticker first with /v1/mapping/ticker.	`1045810`
`startDate`	string	Earliest filing date, YYYY-MM-DD, inclusive.	`2026-09-01`
`endDate`	string	Latest filing date, YYYY-MM-DD, inclusive.	`2026-10-13`
`from`	integer	Offset for paging. Default `0`.	`20`
`size`	integer	Rows per page, at most 100. Default `20`.	`2`
`text`	string	true adds the item text to each filing; false skips it for a fast, small response. Default `true`.	`false`

Every 8-K or 8-K/A that reports Item 1.05, newest first.
Item text is included by default; pass text=false when you only need the list.
Item classification covers filings from mid 2024 onward while the historical backfill runs back to 2004.
Max 100 rows per page; page with from.

/v1/form-8k

GEThttps://secfeedapi.com/v1/form-8k

8-K filings classified by item, with item text on request.

Parameter	Type	Description	Example
`item`	string	Item number to filter on, for example 1.05. Omit to get every 8-K.	`1.05`
`cik`	integer	Filer CIK. Resolve a ticker first with /v1/mapping/ticker.	`1045810`
`startDate`	string	Earliest filing date, YYYY-MM-DD, inclusive.	`2026-09-01`
`endDate`	string	Latest filing date, YYYY-MM-DD, inclusive.	`2026-10-13`
`from`	integer	Offset for paging. Default `0`.	`20`
`size`	integer	Rows per page, at most 100. Default `50`.	`2`
`text`	string	true adds the plain text of the requested item to each filing. Needs item. Default `false`.	`true`

The general 8-K endpoint. item=1.05 returns the same filings without text unless text=true.
Combine with any other item number for related events.

Request examples

Every response below is real output from the API, trimmed to the first records.

Latest incident disclosures with text

Each filing includes the Item 1.05 text. If the heading cannot be found, text is null and textError says why.

curl -H "Authorization: Bearer $SECFEED_KEY" \
  "https://secfeedapi.com/v1/form-8k/cybersecurity-incidents?size=2"

import os, requests

r = requests.get(
    "https://secfeedapi.com/v1/form-8k/cybersecurity-incidents",
    params={'size': '2'},
    headers={"Authorization": f"Bearer {os.environ['SECFEED_KEY']}"},
    timeout=60,
)
r.raise_for_status()
print(r.json())

{
  "total": 84,
  "filings": [
    {
      "accession": "0001104659-26-109813",
      "cik": 1083446,
      "company": "Astrana Health, Inc.",
      "form": "8-K",
      "filed": "2026-09-23",
      "period": "2026-09-22",
      "items": [
        {
          "item": "1.05",
          "title": "Material Cybersecurity Incidents"
        }
      ],
      "url": "https://www.sec.gov/Archives/edgar/data/1083446/000110465926109813/0001104659-26-109813-index.htm",
      "text": null,
      "textError": "'item 1-5 not found in this 8-K'"
    },
    {
      "accession": "0000885725-26-000059",
      "cik": 885725,
      "company": "BOSTON SCIENTIFIC CORP",
      "form": "8-K",
      "filed": "2026-09-08",
      "period": "2026-09-07",
      "items": [
        {
          "item": "1.05",
          "title": "Material Cybersecurity Incidents"
        }
      ],
      "url": "https://www.sec.gov/Archives/edgar/data/885725/000088572526000059/0000885725-26-000059-index.htm",
      "text": "Item 1.05 Material Cybersecurity Incidents.\n\nAs previously disclosed in a Current Report on Form 8-K filed on August 26, 2026 with the Securities and Exchange Commission, on August 25, 2026, Boston Scientific Corporation (the “Company”) identified a cybersecurity incident that af..."
    }
  ]
}

Incidents since a date, list only

text=false returns the filings without extracting text, which is much faster for monitoring.

curl -H "Authorization: Bearer $SECFEED_KEY" \
  "https://secfeedapi.com/v1/form-8k/cybersecurity-incidents?startDate=2026-09-01&size=2&text=false"

import os, requests

r = requests.get(
    "https://secfeedapi.com/v1/form-8k/cybersecurity-incidents",
    params={'startDate': '2026-09-01', 'size': '2', 'text': 'false'},
    headers={"Authorization": f"Bearer {os.environ['SECFEED_KEY']}"},
    timeout=60,
)
r.raise_for_status()
print(r.json())

{
  "total": 3,
  "filings": [
    {
      "accession": "0001104659-26-109813",
      "cik": 1083446,
      "company": "Astrana Health, Inc.",
      "form": "8-K",
      "filed": "2026-09-23",
      "period": "2026-09-22",
      "items": [
        {
          "item": "1.05",
          "title": "Material Cybersecurity Incidents"
        }
      ],
      "url": "https://www.sec.gov/Archives/edgar/data/1083446/000110465926109813/0001104659-26-109813-index.htm"
    },
    {
      "accession": "0000885725-26-000059",
      "cik": 885725,
      "company": "BOSTON SCIENTIFIC CORP",
      "form": "8-K",
      "filed": "2026-09-08",
      "period": "2026-09-07",
      "items": [
        {
          "item": "1.05",
          "title": "Material Cybersecurity Incidents"
        }
      ],
      "url": "https://www.sec.gov/Archives/edgar/data/885725/000088572526000059/0000885725-26-000059-index.htm"
    }
  ]
}

The same filings through the general endpoint

The general 8-K endpoint with item=1.05 returns the same filings without text by default.

curl -H "Authorization: Bearer $SECFEED_KEY" \
  "https://secfeedapi.com/v1/form-8k?item=1.05&size=2"

import os, requests

r = requests.get(
    "https://secfeedapi.com/v1/form-8k",
    params={'item': '1.05', 'size': '2'},
    headers={"Authorization": f"Bearer {os.environ['SECFEED_KEY']}"},
    timeout=60,
)
r.raise_for_status()
print(r.json())

{
  "total": 84,
  "filings": [
    {
      "accession": "0001104659-26-109813",
      "cik": 1083446,
      "company": "Astrana Health, Inc.",
      "form": "8-K",
      "filed": "2026-09-23",
      "period": "2026-09-22",
      "items": [
        {
          "item": "1.05",
          "title": "Material Cybersecurity Incidents"
        }
      ],
      "url": "https://www.sec.gov/Archives/edgar/data/1083446/000110465926109813/0001104659-26-109813-index.htm"
    },
    {
      "accession": "0000885725-26-000059",
      "cik": 885725,
      "company": "BOSTON SCIENTIFIC CORP",
      "form": "8-K",
      "filed": "2026-09-08",
      "period": "2026-09-07",
      "items": [
        {
          "item": "1.05",
          "title": "Material Cybersecurity Incidents"
        }
      ],
      "url": "https://www.sec.gov/Archives/edgar/data/885725/000088572526000059/0000885725-26-000059-index.htm"
    }
  ]
}

Response fields

Field	Type	Meaning
`total`	integer	Exact number of matching 8-K filings.
`filings[]`	array	Matching 8-K and 8-K/A filings, newest first.
`filings[].accession`	string	EDGAR accession number.
`filings[].cik`	integer	Filer CIK.
`filings[].company`	string	Filer name.
`filings[].form`	string	8-K or 8-K/A.
`filings[].filed`	string	Filing date, YYYY-MM-DD.
`filings[].period`	string	Date of the earliest event reported (conformed period of report).
`filings[].items[]`	array	Every item the filing reports, not only the one you filtered on.
`filings[].items[].item`	string	Item number, for example 1.05.
`filings[].items[].title`	string	Official item title.
`filings[].url`	string	Filing index page on sec.gov.
`filings[].text`	string or null	Plain text of the requested item. Present when text is on; null when the item could not be located.
`filings[].textError`	string	Only present when text extraction failed, with the reason.

8-K items

Item	Title
1.01	Entry into a Material Definitive Agreement
1.02	Termination of a Material Definitive Agreement
1.03	Bankruptcy or Receivership
1.04	Mine Safety
1.05	Material Cybersecurity Incidents
2.01	Completion of Acquisition or Disposition of Assets
2.02	Results of Operations and Financial Condition
2.03	Creation of a Direct Financial Obligation
2.04	Triggering Events That Accelerate a Financial Obligation
2.05	Costs Associated with Exit or Disposal Activities
2.06	Material Impairments
3.01	Notice of Delisting or Failure to Satisfy a Listing Rule
3.02	Unregistered Sales of Equity Securities
3.03	Material Modification to Rights of Security Holders
4.01	Changes in Registrant's Certifying Accountant
4.02	Non-Reliance on Previously Issued Financial Statements
5.01	Changes in Control of Registrant
5.02	Departure or Appointment of Directors or Officers; Compensatory Arrangements
5.03	Amendments to Articles or Bylaws
5.04	Temporary Suspension of Trading Under Employee Benefit Plans
5.05	Amendments to the Code of Ethics
5.06	Change in Shell Company Status
5.07	Submission of Matters to a Vote of Security Holders
5.08	Shareholder Director Nominations
6.01	ABS Informational and Computational Material
7.01	Regulation FD Disclosure
8.01	Other Events
9.01	Financial Statements and Exhibits

How to

How do I monitor new incident disclosures?

Poll the feed with text=false and a recent startDate, then fetch text only for new accession numbers.

curl -H "Authorization: Bearer $SECFEED_KEY" \
  "https://secfeedapi.com/v1/form-8k/cybersecurity-incidents?startDate=2026-09-01&size=2&text=false"

How do I read what the company disclosed?

Use the default text=true; the text field holds Item 1.05 in plain text.

curl -H "Authorization: Bearer $SECFEED_KEY" \
  "https://secfeedapi.com/v1/form-8k/cybersecurity-incidents?size=2"

How do I find amended incident reports?

Companies often update an incident in an 8-K/A; check the form field of each row.

curl -H "Authorization: Bearer $SECFEED_KEY" \
  "https://secfeedapi.com/v1/form-8k/cybersecurity-incidents?size=2&text=false"

How do I get all incidents for one company?

Add the company's cik.

curl -H "Authorization: Bearer $SECFEED_KEY" \
  "https://secfeedapi.com/v1/form-8k/cybersecurity-incidents?cik=885725&text=false"

How do I count disclosures in a period?

Set startDate and endDate and read total; use text=false so the call is fast.

curl -H "Authorization: Bearer $SECFEED_KEY" \
  "https://secfeedapi.com/v1/form-8k/cybersecurity-incidents?startDate=2026-07-01&endDate=2026-09-30&size=2&text=false"

Why is text null on some rows?

Some filings word the heading differently or put the disclosure in an exhibit; textError explains, and url links to the filing.

curl -H "Authorization: Bearer $SECFEED_KEY" \
  "https://secfeedapi.com/v1/form-8k/cybersecurity-incidents?size=2"

How do I see the other items in the same filing?

items lists them; incident 8-Ks often also report 7.01 or 8.01.

curl -H "Authorization: Bearer $SECFEED_KEY" \
  "https://secfeedapi.com/v1/form-8k/cybersecurity-incidents?size=2&text=false"

How do I search incident 8-Ks with the filing query syntax?

Use items:"1.05" in /v1/filings; that also lets you combine with ticker or sic.

curl -H "Authorization: Bearer $SECFEED_KEY" \
  "https://secfeedapi.com/v1/filings?query=formType:%228-K%22%20AND%20items:%221.05%22&size=2"

Errors

Dates are not validated: a malformed startDate or endDate matches nothing instead of returning 400, so use YYYY-MM-DD.
textError appears on a row when the item heading could not be found in the filing text; the filing itself is still listed.

Try it with your own key

500 free calls a month.

Get free API key →