SEC 8-K Item 1.05 cybersecurity incident filings, October 2026
Quick answer, Oct 29, 2026As of 29 October 2026, one 8-K filing used Item 1.05 to disclose a material cybersecurity incident between 1 and 29 October 2026, by SEC EDGAR full-text search. A second October filing used Item 8.01 for a cybersecurity disclosure without that materiality judgment. November 2026 is a partial month and is not counted here.
Window and method
- Window: 1 October 2026 through 29 October 2026, filing dates on EDGAR.
- Search: EDGAR full-text search for the exact phrase "Item 1.05" on Form 8-K (and 8-K/A), then a filing-by-filing read to confirm the item reports an incident, not a boilerplate reference. The Item 8.01 count below comes from Distributed Risk's
list_cyber_incident_filingstool, which reads the same EDGAR source. - Cut-off: 29 October 2026, 12:00 ET.
- November 2026: UNKNOWN. The month is partial.
Count
| Item | Filings, 1–29 Oct 2026 | Note |
|---|---|---|
| 8-K, Item 1.05 (material cybersecurity incident) | 1 | Full-text match; one filing confirmed on review as a cybersecurity Item 1.05 disclosure. One other full-text hit was an audit-committee charter attachment, excluded. |
| 8-K, Item 8.01 (other events; cyber disclosure) | 1 | Filed by Quest Diagnostics on 22 October 2026. |
| 8-K/A amending an earlier Item 1.05 | 0 | None matched for the window. |
Totals cover filing dates only and do not reconcile against incident event dates, which can be earlier.
The filings
Item 1.05, material cybersecurity incident
- Park Dental Partners, Inc., 8-K filed 13 October 2026 · CIK 0002069604 · accession 0001104659-26-115541. The desk note is Park Dental Partners, Item 1.05, a material cybersecurity incident.
Item 8.01, other events, cyber disclosure
- Quest Diagnostics Incorporated, 8-K filed 22 October 2026 · CIK 0001022079 · accession 0000947871-26-000941. The desk note is Quest Diagnostics, Item 8.01.
Caveats
- Full-text search returns boilerplate too. A filing that cites "Item 1.05" in a risk factor or an exhibit (for example, an audit committee charter) still matches the phrase. Each candidate was read before counting.
- November 2026. The month runs 1–30 November 2026; the next cut will be dated the first business day of December. This note is not a projection.
- Reporting choice. Item 1.05 is for incidents the company has judged material. Item 8.01 is used for incidents reported without that judgment. The two read differently; see SEC 8-K Item 1.05 cybersecurity incident disclosures.
- Not a universe. The SEC rule covers public reporting companies subject to Regulation S-K Item 106 and Form 8-K. Private companies, foreign private issuers on 6-K and smaller reporting companies with different timelines are outside this count.
From the record to the decision
Each counted filing is on the desk with the company's own statement, what it supports for the reader it is written for (a cyber underwriter, a credit committee, a sanctions or deal team), what would change the call, and numbered sources. Filter the desk by that reader.
An AI assistant can pull the same count against the live source with list_cyber_incident_filings on the Distributed Risk MCP server. The filings are read again every 30 minutes.
Questions
Why only one Item 1.05 in a full month? Item 1.05 asks the company to say the incident is material. Many public companies file Item 8.01 or wait for an amendment. Both filings and the amendment are in the count method above.
Does this count public and private companies? Public reporting companies only; the SEC rule applies to Form 8-K filers.
When is the next cut? The first business day of December 2026, covering 1–30 November 2026.