What the SEC cybersecurity disclosure rule actually requires
The SEC's cybersecurity disclosure rule took effect December 18, 2023. It forces every public company to publicly tell investors about a material cyber incident on Form 8-K within four business days. Filings fall into two buckets: Item 1.05 (mandatory, after a materiality determination) and Item 8.01 (voluntary, "other events"). We analyzed every filing under the rule, sourced from SEC EDGAR and cross-checked against the Debevoise & Plimpton 8-K Tracker.
The four-business-day clock (Item 1.05)
A public company must file an 8-K under Item 1.05 within four business days of determining that a cybersecurity incident is material. The filing must describe the nature, scope, timing, and material impact (including reasonably likely impact) on the registrant.
- The clock starts on the materiality determination, not on discovery of the incident.
- Halliburton determined materiality in 2 days. UnitedHealth in 1 day. AT&T took 84 calendar days.
- A national-security delay may be invoked through the U.S. Attorney General. Used twice, both by AT&T in 2024.
- In our dataset: 47 mandatory filings, including the first-ever AI-root-cause 8-K.
The catch-all that sits alongside (Item 8.01)
Item 8.01 is the SEC's "other events" 8-K slot. A registrant can use it to tell investors about something material at the registrant's discretion, without making the formal materiality determination that Item 1.05 requires.
- Used as defensive disclosure: describe the incident, do not declare materiality.
- Often used for vendor-driven incidents like the CDK Global cluster (six auto dealers filed 8.01 on June 24, 2024).
- Sonic Automotive filed 8.01 first (June 24), then 1.05 eleven days later when materiality crystallized.
- In our dataset: 31 voluntary filings.
The first AI-incident 8-K (CBFV, May 2026)
CB Financial Services (CBFV) became the first SEC registrant to file an Item 1.05 8-K naming AI as the root cause of a cybersecurity incident.
The filing disclosed that unauthorized AI software exposed names, Social Security numbers, and dates of birth. The market reaction was a measured -1.16% day-after move, drifting to -3.30% by T+5 as the disclosure was digested.
That muted reaction is a function of issuer size, not subject matter. The next AI-incident 8-K to land at a tech-platform issuer or a regulated lender will price very differently.
What changes when AI is the root cause: the diligence question for boards shifts from "was the vendor patched" to "what was the AI system permitted to do, with what data, and who reviewed it." Mayer Brown's 2025 review estimates AI-enabled phishing or vishing was present in approximately 16% of cyber incidents. Single-incident AI filings will become a category.
Read more: Cherry Hill Advisory's AI Governance & Emerging Risk practice walks audit committees through what to inventory, classify, and report on before the next AI 8-K lands at your name.
Two headline findings every board needs to know
Two years of filings yield one structural finding about how the market prices these disclosures, and one inflection point that just occurred.
Stock prices move on cyber disclosures. Two-thirds traded down.
Of the 73 filings with verified day-after stock-price data, 48 (66%) closed down the next trading day. Cybersecurity, tech, and crypto vendors averaged a -6.6% single-day move; diversified mid- and large-caps absorbed disclosures at roughly flat (-0.1% average). The variance is enormous. The strongest predictor of a measured reaction is the strength of controls before the incident and the speed of the disclosure response after. Controls and a proactive disclosure posture are no longer optional.
The first 8-K naming AI as the root cause has been filed. A new disclosure category begins now.
CB Financial Services (CBFV) filed the first Item 1.05 8-K naming AI as the root cause of an incident: unauthorized AI software exposed names, Social Security numbers, and dates of birth. Day-after move was -1.16%. The muted reaction is a function of issuer size, not subject matter. The next AI-incident 8-K at a tech platform or regulated lender will price very differently. The time to build AI governance and control is before the disclosure, not after.
How the market actually reacts to a cyber 8-K
Market reactions cluster into three distinct archetypes. The driver is what the issuer sells, not the size of the breach. Averages below reflect 73 filings with verified day-after stock-price moves.
Cybersecurity, tech & crypto vendors
Trust is part of the product. The market reads the disclosure as a direct hit to the customer-retention thesis. Single-day declines of 7% or more are the norm, not the exception.
Diversified mid- and large-caps
Many revenue streams mean the market treats the disclosure as a contained, insurable, one-time event. Real P&L impact tends to arrive later in quarterly results, not at the initial 8-K.
Micro-caps and nano-caps
Thin daily volume means individual prints swing wildly in both directions. Look at peer-set behavior and operational impact instead of trusting any single day's tape.
Five strategic insights from two years of filings
Before the raw data, here is what we learned. Each insight is grounded in the filings catalogued at the bottom of this page.
The market is pricing these disclosures.
With verified stock-price data on 73 of 78 filings, two-thirds (66%, 48 of 73) closed down the next trading day. The mean day-after move was -1.1% across the full set, but -6.6% for cybersecurity and tech vendors and -0.1% for diversified large-caps. The dispersion is the story. The market is asking whether trust is part of the product.
The materiality clock is faster than the discovery clock.
Halliburton determined materiality in 2 days. UnitedHealth in 1 day. AT&T took 84 calendar days (with the first-ever DOJ national-security delay invoked on May 9 and June 5, 2024). The disclosure timing shows up in the tape: AT&T closed near flat (-0.27%) after 84 days of preparation; Halliburton dropped 3.99% with a 2-day determination. Pre-document your materiality framework: the determination clock is the one you control.
Vendor incidents drive Item 8.01.
The CDK Global cluster (six auto dealers filing within one trading day on June 24, 2024) is the clearest pattern in the voluntary-disclosure set. Third-party risk programs need four-business-day-aware notification protocols from key vendors so issuers can run their own materiality clock from the moment the vendor confirms.
AI-incident disclosures have started.
Only 1 of 78 filings names AI as root cause (CBFV, May 11, 2026, the first ever). But Mayer Brown's 2025 review estimates AI-enabled phishing or vishing was present in approximately 16% of cyber incidents. The AI-incident wave is just beginning. Build AI governance now.
Industry concentration is the leading indicator.
Healthcare and healthtech, automotive retail, industrial and manufacturing, and tech vendors themselves cluster the filings. Map your peer set's 8-K filings. You are the next risk. If three of your top ten competitors have filed within twelve months, your incident is not a question of if, but when.
Six cases where the SEC cyber rule has bitten hardest
Six filings that anchor the two-year record, chosen for the magnitude of the operational, financial, or regulatory consequence.
UnitedHealth Group / Change Healthcare
UNH · Filed Feb 22, 2024 · Item 1.05
Change Healthcare subsidiary hit by ALPHV/BlackCat ransomware. HHS OCR confirmed 192.7M individuals affected: the largest US healthcare breach on record. $22M ransom paid. Day-after move actually positive (+0.87%), but T+5 turned to -5.44% as scope became clear. FY24 P&L hit grew to $3.09B through quarterly results.
AT&T (national-security delay)
T · Filed Jul 12, 2024 · Item 1.05
Snowflake/ShinyHunters breach exposed call and text records of nearly all wireless customers. First-ever DOJ national-security delay invoked (May 9 + June 5, 2024). Market reaction near flat at disclosure (-0.27%); recovered to +1.38% by T+5. Striking restraint given scale, attributable to the 84-day pre-disclosure window.
Coinbase
COIN · Filed May 15, 2025 · Item 1.05
Insider-enabled access by overseas contractors. 69,461 customers exposed (Maine AG filing). $180 to $400M estimated remediation; $20M extortion demand received. Close $263.41, then $244.44, then $271.95 (T+5). One of the rare cases that recovered fully within a week.
F5 Networks (BRICKSTORM / CISA ED 26-01)
FFIV · Filed Oct 15, 2025 · Item 1.05
China-nexus UNC5221 actor using BRICKSTORM malware. Source code and vulnerability information exfiltrated. Triggered CISA Emergency Directive 26-01. Close $343.17, then $330.75, then $297.84 (T+5). The single largest T+5 decline in the verified dataset.
Johnson Controls
JCI · Filed Mar 13, 2026 · Item 1.05
Incident dated March 11, 2026. Day-after move essentially flat (-0.26%), but Q1 2026 revenue $6.02B vs $6.34B consensus (4.4% miss); adjusted EPS $2.60 vs $2.98 consensus (-8.5% YoY), explicitly attributed to the cyber incident. The industrial-large-cap absorbs the disclosure but still misses earnings.
Halliburton
HAL · Filed Aug 23, 2024 · Item 1.05
RansomHub attack; unauthorized access; systems taken offline. Day-after -3.99%, T+5 -8.94%, harder than the diversified-large-cap average. $35M Q3 expense; $0.02 EPS impact. Materiality determined within 2 days, the fastest in the dataset.
How Cherry Hill Advisory helps
Two years of filings show three places where boards, audit committees, internal audit and risk teams, and CISOs need help most. We work in all three.
AI governance and control
The first AI-incident 8-K has been filed. Boards now need to know which AI systems are deployed, with what data, under whose control. We help you build the inventory and the controls before your name is in the next filing.
- AI inventory, classification, and data-flow mapping
- Model risk, third-party AI, and shadow-AI program design
- Board reporting and AI committee charters aligned to SEC disclosure expectations
- Independent assurance over the AI control environment
Cybersecurity risk and SEC disclosure controls
The materiality clock is faster than the discovery clock. We help you pre-document the framework so the four-business-day window is workable, not a fire drill. Third-party risk programs get rebuilt around the same clock.
- Materiality framework documentation and tabletop exercises
- SEC cyber disclosure controls and 8-K stress-testing
- Third-party risk and vendor notification protocols (CDK-aware)
- SOC 2 readiness, SOX cyber, and audit-committee reporting
Incident response (Day-zero through post-mortem)
When the incident lands, the first 96 hours decide the disclosure narrative, the regulator's posture, and the stock-price reaction. We sit alongside legal and the CISO to make the materiality call, draft the 8-K, and run the post-incident review.
- Day-zero materiality determination support
- 8-K narrative drafting and disclosure-counsel coordination
- Post-incident root-cause and control-gap review
- Audit-committee and board briefings during and after the incident
Not sure where to start?
A 30-minute conversation with a former CAE or Big Four practitioner. No deck, no pitch.
Talk to Cherry Hill