Tracking SEC 8-K Item 1.05 cybersecurity incident disclosures
Quick answer, Oct 28, 2026As of 28 October 2026, an 8-K Item 1.05 filing means a public company judged a cybersecurity incident material. Item 8.01 reports are made without that judgment. The Distributed Risk MCP tool list_cyber_incident_filings lists both, newest first, with company, tickers, filing and event dates, industry code and the EDGAR filing link.
Item 1.05 and Item 8.01
Item 1.05 is the Form 8-K item for material cybersecurity incidents: the company is saying it judged the incident material. Item 8.01 (other events) is where companies also report incidents without that judgment. The two read differently, so a tracker should show which item a filing used.
List them
list_cyber_incident_filings on the Distributed Risk MCP server returns filings newest first, with the company, tickers, filing and event dates, items, state, industry code and the EDGAR filing. By default it includes Item 1.05 and Item 8.01; Item 8.01 can be excluded. The filings are read again every 30 minutes. Source: SEC EDGAR full-text search.
claude mcp add --transport http distributed-risk https://www.distributedrisk.com/mcp
What to read in a filing
- Which item, and the date of the event against the date of the filing.
- What the company says it has contained, and what it says it does not yet know.
- What it says about operations, customers or data.
- Whether a later amendment (8-K/A) updates the first filing.
Example
Two recent desk notes show the difference: Park Dental Partners, Item 1.05, a material cybersecurity incident (13 October 2026) and Quest Diagnostics, Item 8.01 (22 October 2026). Each note states what is on the record, what it supports for the reader it is written for, and what would change the call.
Questions
Who uses this? Deal teams, credit committees and cyber underwriters who need to know when a counterparty or portfolio company discloses an incident.
Is a filing a finding of fault? No. It is the company's own statement.