Track 8-K cybersecurity incident disclosures (Item 1.05)

Find every 8-K Item 1.05 material cybersecurity incident disclosure, with the item text, and follow companies that file updates.

Since December 2023, public companies must disclose a material cybersecurity incident on Form 8-K under Item 1.05, generally within four business days of deciding it is material. SecFeed classifies every 8-K by item, so these disclosures are one query away.

Get Item 1.05 filings with text

import os
import requests

BASE = "https://secfeedapi.com"
HEADERS = {"Authorization": f"Bearer {os.environ['SECFEED_KEY']}"}

r = requests.get(f"{BASE}/v1/form-8k", params={"item": "1.05", "text": "true", "startDate": "2026-01-01"},
                 headers=HEADERS, timeout=120)
r.raise_for_status()
data = r.json()
print("Item 1.05 filings since 2026-01-01:", data["total"])

by_company = {}
for f in data["filings"]:
    by_company.setdefault(f["company"], []).append(f["filed"])
repeat = {c: d for c, d in by_company.items() if len(d) > 1}
print(len(by_company), "companies,", len(repeat), "filed more than one Item 1.05 8-K")

for f in [x for x in data["filings"] if x.get("text")][:5]:
    text = (f.get("text") or "").replace("\n", " ")
    print(f["filed"], f["company"])
    print("   ", text[:170])

Output:

Item 1.05 filings since 2026-01-01: 24
19 companies, 2 filed more than one Item 1.05 8-K
2026-09-08 BOSTON SCIENTIFIC CORP
    Item 1.05 Material Cybersecurity Incidents.  As previously disclosed in a Current Report on Form 8-K filed on August 26, 2026 with the Securities and Exchange Commission,
2026-09-01 Park Dental Partners, Inc.
    Item 1.05 Material Cybersecurity Incidents.  On August 28, 2026, Park Dental Partners, Inc. (“we” or the “Company”) identified unauthorized access to its computer network
2026-08-31 Nutex Health Inc.
    Item 1.05 Material Cybersecurity Incidents.  As disclosed in Item 8.01 of a Current Report on Form 8-K filed with the Securities and Exchange Commission on August 24, 202
2026-07-31 AMGEN INC
    Item 1.05 Material Cybersecurity Incidents.  In July 2026, Amgen Inc. (the "Company") identified unauthorized activity involving data stored in cloud environments hosted 
2026-07-30 River Financial Corp
    ITEM 1.05 Material Cybersecurity Incidents.  Since the date of the original filing, River's investigation has progressed. River has determined that an unauthorized threat

Companies often file an initial 8-K and then amendments or follow ups as the investigation progresses, which is why some appear more than once.

The shortcut endpoint

/v1/form-8k/cybersecurity-incidents returns the same filings with the item text included by default:

r = requests.get(f"{BASE}/v1/form-8k/cybersecurity-incidents", params={"startDate": "2026-01-01"},
                 headers=HEADERS, timeout=120)

What Item 1.05 text contains

The rule asks for the material aspects of the incident's nature, scope and timing, and its material or reasonably likely material impact, including on financial condition and results of operations. In practice the text usually covers when the company detected unauthorized access, which systems were involved, whether it engaged outside experts and law enforcement, and whether operations were disrupted.

Some incidents are filed under other items

Companies that consider an incident not material, or not yet material, often disclose it under Item 8.01 (other events) or Item 7.01 instead. To catch those, run a full text search for phrases such as "unauthorized access" restricted to 8-K filings.

Ideas

• A vendor risk monitor: alert when a supplier or customer files Item 1.05
• A dataset of incident disclosures for security research
• Measure the days between detection date in the text and the filing date

Next steps

• Cybersecurity Incidents API
• Form 8-K Events API
• Form 8-K dataset