Incident & Disclosure Desk
Which companies have disclosed a security incident to investors, and what did they say?
This log records each disclosure from the filing itself: SEC Form 8-K Item 1.05 filings since the item took effect on December 18, 2023 (exclusions are listed on the method page), plus notable incident disclosures made under Items 7.01 and 8.01 before and after that date. Since October 2026 it also records data breach notices filed with state attorneys general and regulator releases on security incidents. Each entry links the filing or notice, tracks follow-up filings, and notes who held the security seat only where the CISO Tribune record shows it.
- Incidents in the log
- 130
- Filed under Item 1.05
- 56
- Follow-up filings tracked
- 57
- Companies
- 130
Latest disclosures
All 130 incidents| 2026-10-29 |  Bangkok Bank | Financial services | State breach notice (California AG) | 2026-08-12 | 78 | 0 |
| 2026-10-29 |  Del Monte Foods | Consumer & retail | State breach notice (California AG) | 2026-02-09 | 262 | 0 |
| 2026-10-28 |  Photon Health | Technology | State breach notice (California AG) | 2026-08-21 | 68 | 0 |
| 2026-10-28 |  Troutman Pepper Locke | Legal & professional services | State breach notice (California AG) | 2026-08-07 | 82 | 0 |
| 2026-10-27 |  Baker & McKenzie | Legal & professional services | State breach notice (California AG) | — | — | 0 |
| 2026-10-27 |  Directed Trust Company | Financial services | State breach notice (California AG) | 2026-07-07 | 112 | 0 |
| 2026-10-27 |  Hitec Group USA | Consumer & retail | State breach notice (California AG) | 2026-09-19 | 38 | 0 |
| 2026-10-27 |  Sarku Japan | Hospitality & entertainment | State breach notice (California AG) | 2026-09-07 | 50 | 0 |
| 2026-10-27 |  Tradier Brokerage | Financial services | State breach notice (California AG) | 2026-09-03 | 54 | 0 |
| 2026-10-26 |  Frontline Education | Education | State breach notice (California AG) | 2026-08-14 | 73 | 0 |
| 2026-10-23 |  Apollo Management Holdings | Financial services | State breach notice (California AG) | — | — | 0 |
| 2026-10-23 |  Navigate360 | Education | State breach notice (California AG) | 2026-03-18 | 219 | 0 |
- Bangkok Bank2026-10-29State breach notice (California AG)Financial services
- Del Monte Foods2026-10-29State breach notice (California AG)Consumer & retail
- Photon Health2026-10-28State breach notice (California AG)Technology
- Troutman Pepper Locke2026-10-28State breach notice (California AG)Legal & professional services
- Baker & McKenzie2026-10-27State breach notice (California AG)Legal & professional services
- Directed Trust Company2026-10-27State breach notice (California AG)Financial services
- Hitec Group USA2026-10-27State breach notice (California AG)Consumer & retail
- Sarku Japan2026-10-27State breach notice (California AG)Hospitality & entertainment
- Tradier Brokerage2026-10-27State breach notice (California AG)Financial services
- Frontline Education2026-10-26State breach notice (California AG)Education
- Apollo Management Holdings2026-10-23State breach notice (California AG)Financial services
- Navigate3602026-10-23State breach notice (California AG)Education
Disclosures by month
Month the company filed its first disclosure, from December 2023, when Item 1.05 took effect. Earlier entries are on the incidents page.
| Month | Disclosures |
|---|---|
| 2026-10 | 42 |
| 2026-09 | 10 |
| 2026-08 | 2 |
| 2026-07 | 3 |
| 2026-06 | 3 |
| 2026-05 | 1 |
| 2026-04 | 1 |
| 2026-03 | 3 |
| 2026-02 | 1 |
| 2026-01 | 0 |
| 2025-12 | 1 |
| 2025-11 | 1 |
| 2025-10 | 3 |
| 2025-09 | 0 |
| 2025-08 | 2 |
| 2025-07 | 0 |
| 2025-06 | 2 |
| 2025-05 | 2 |
| 2025-04 | 2 |
| 2025-03 | 1 |
| 2025-02 | 1 |
| 2025-01 | 0 |
| 2024-12 | 2 |
| 2024-11 | 1 |
| 2024-10 | 1 |
| 2024-09 | 0 |
| 2024-08 | 2 |
| 2024-07 | 3 |
| 2024-06 | 1 |
| 2024-05 | 4 |
| 2024-04 | 3 |
| 2024-03 | 3 |
| 2024-02 | 4 |
| 2024-01 | 4 |
| 2023-12 | 2 |
Analysis
September 2026: 10 disclosed incidents logged, up from 2 in AugustThe log holds 10 entries for September 2026, against 2 in August. A look at forms, sectors, and the 76-day median from detection to disclosure.
Two years of SEC cyber incident disclosures: what companies actually said56 Item 1.05 incidents from December 2023 to September 2026: a median six days from detection to first 8-K, a shift toward health care, and the materiality date.
85 Form 8-K/8-K-A filings EDGAR itself codes under Item 1.05, built directly from EDGAR’s own full-text search, including filers not yet written up here.
98 FTC cases and proceedings tagged under the FTC’s own “Data Security” topic, back to 2000, built directly from the FTC’s own case listing.
213 federal data-breach class actions consolidated under an “In re” caption since 2022, built directly from CourtListener’s own RECAP archive.
Guides
All guides
Why a CPA or advisory firm sent you a breach letter: Mercadien, Aldrich, OpportuneWhat breach letters from Mercadien, Aldrich Services and Opportune say about why they held your data, what was exposed, and what they offer.
Law firm breach notices: what three firms' social engineering incidents say about client dataThree law firm notices filed in October 2026 describe social engineering, files taken, blank data fields and 24-month monitoring offers.
One Metabase vulnerability, three notices: what two filings showPoppins Payroll names a Metabase flaw; Blueberry Pediatrics filed a breach record. What the two documents say on data, notification and timing.
How to read an entry
Dates are as each filing states them. Where a filing gives no detection date, the field is blank rather than estimated. The security seat field comes from the CISO Tribune record and implies nothing about the incident.