Cybersecurity Incidents API: 8-K Item 1.05 material cyber incident disclosures
Every 8-K Item 1.05 material cybersecurity incident disclosure since the rule took effect in December 2023, with the incident text.
curl -H "Authorization: Bearer $SECFEED_KEY" \ "https://secfeedapi.com/v1/form-8k/cybersecurity-incidents?size=2"
import os, requests
r = requests.get(
"https://secfeedapi.com/v1/form-8k/cybersecurity-incidents",
params={'size': '2'},
headers={"Authorization": f"Bearer {os.environ['SECFEED_KEY']}"},
)
print(r.json())Overview
Since December 2023 public companies must disclose a material cybersecurity incident under Item 1.05 within four business days of determining it is material. The disclosure describes the nature, scope and timing of the incident and its likely impact.
This feed collects every Item 1.05 filing with the disclosure text, a ready made dataset for security, insurance and risk teams.
What you get
Built for developers who would rather not parse EDGAR.
The feed returns 8-K and 8-K/A filings that report Item 1.05, newest first, classified from the EDGAR header of every filing.
Each result carries the text of the item itself, cut out of the filing by the Section Extractor, ready to read or send to an LLM.
The items array lists everything else in the same filing, such as 9.01 exhibits or a 7.01 Reg FD release.
Narrow by cik, startDate and endDate. Combine with the real-time stream to react the day it is filed.
Endpoints
Authenticate with Authorization: Bearer YOUR_KEY. Responses are JSON.
8-K Item 1.05 feed with the item text.
Parameters: cik, startDate, endDate
8-K filings classified by item, with item text on request.
Parameters: item (1.01...9.01), cik, startDate, endDate, text=true
Response fields
The main fields in every result. The raw filing data is always one level down.
| Field | Meaning |
|---|---|
accession, cik, company | The filing and the company that filed it. |
form, filed, period | 8-K or 8-K/A, filing date and the date of the event reported. |
items | Every item in the filing as {item, title}, for example 4.01 Changes in Registrant's Certifying Accountant. |
url | The filing index page on EDGAR. |
text | The item's text, extracted from the filing (item feeds include it; on /v1/form-8k pass text=true). |
Use cases
- Track breach disclosures across industries
- Cyber insurance underwriting research
- Third party and vendor risk monitoring
- Study disclosure timing after the 2023 rule
Datasets behind this API
The SEC forms this API reads, with live filing counts.
Every Form 8-K current report since 1993, classified by item: earnings, acquisitions, auditor changes, executive departures, cyber incidents and more.
10-KAnnual reportsEvery Form 10-K annual report filed on EDGAR since 1993, searchable by company, date and text, with sections and XBRL financials as JSON.
Tutorials
FAQ
When did Item 1.05 start?
December 18, 2023 for most companies, and June 2024 for smaller reporting companies.
Where do companies describe cyber risk management?
In 10-K Item 1C. Use the Section Extractor with item=1C.
Try the Cybersecurity Incidents free
500 API calls a month on the free plan. No sales call.