After the 8-K: how later 10-Q and 10-K filings report the end of a cyber incident

Most companies that report a cyber incident on Form 8-K never file a second 8-K about it. The ending turns up instead in a later quarterly or annual report, usually as one sentence saying the incident had no material impact. In this log, 28 of the 56 incidents with an Item 1.05 filing have only that first 8-K. For the seven companies below, the closing statement came 111 to 722 days after the 8-K.

Key facts:

• 56 incidents in this log carry an Item 1.05 Form 8-K, and 28 of them have only that one 8-K on record (log count, November 8, 2026).
• The seven later filings read for this guide sit in three places: the financial statement notes of a 10-Q, the risk factors of a 10-K, and Item 1C (Cybersecurity) of a 10-K.
• All seven say the incident did not have a material impact, or that the company did not believe it did. None of the seven gives a dollar cost.
• The gap from 8-K to closing statement runs from 111 days (Sensata) to 722 days (B. Riley).

How often does a cyber incident 8-K get a second 8-K?

About half the time, in this log. Each incident entry records how many filings it carries. Of the 56 entries whose form includes Item 1.05, 28 record a second 8-K: an 8-K/A amendment, or a voluntary Item 8.01 filing before or after the Item 1.05 report. The other 28 record only the first filing. The count is taken from the entries' own fields on November 8, 2026. An entry counts as having a single filing when it lists no update and no amendment.

The form itself only asks for an amendment when information missing from the first filing later becomes known. A company that did not know everything at the start must file an amendment within four business days after it determines that information, or after the information becomes available. A company that decides nothing new needs saying files nothing further on Form 8-K. Its later view of the incident then appears in its periodic reports. The guide to 8-K/A amendments covers the companies that did amend.

Where does the outcome appear instead?

In three places, and it helps to know all three before searching a 10-K.

1. Item 1C, Cybersecurity, of the annual report. Regulation S-K Item 106 asks every annual report to describe whether risks from cybersecurity threats, including previous incidents, have materially affected the company or are reasonably likely to. Many companies answer with a stock sentence. Some name the incident.
2. Risk factors. Companies often reuse their own incident as the example of a cyber risk. The example can carry an outcome with it, as HPE's and B. Riley's did.
3. Notes to the financial statements in a 10-Q. A note headed Subsequent events, Commitments and contingencies or Cybersecurity incident sometimes states the result for the quarter, as Radiant's and Sensata's did.

What did seven companies' later filings say?

Company	8-K	Later filing quoted	Days after the 8-K	What it says
Sensata Technologies	Apr 9, 2025	10-Q, Jul 29, 2025	111	Ransomware temporarily affected operations; no material impact for the quarter and half-year
AT&T	Jul 12, 2024	10-K, Feb 12, 2025	215	No cybersecurity risk, including previous incidents, materially affected 2024
Radiant Logistics	Mar 20, 2024	10-Q, Nov 12, 2024	237	Investigation complete; no material impact on operations or finances
Hewlett Packard Enterprise	Jan 24, 2024	10-K, Dec 19, 2024	330	Investigated and remediated; no material impact to date
National Presto Industries	Mar 6, 2025	10-K, Mar 13, 2026	372	Forensic investigation found no material impact
Zoomcar	Jun 13, 2025	10-K, Jul 14, 2026	396	External security assessment completed; internal controls enhanced
B. Riley Financial	Apr 8, 2024	10-K, Mar 31, 2026	722	Temporary interruption of Targus operations; not believed material at the time

The passages behind each row, all from the filings themselves:

Sensata's note is the shortest route to an answer. Its second-quarter 10-Q says the April ransomware incident temporarily affected operations but had no material impact on results for the three and six months.

AT&T's answer is the generic Item 1C sentence, which covers previous incidents without naming the call-records theft. Its risk factors name the incident separately, so a reader has to put the two sentences together.

Radiant's 10-Q note is the plainest statement in the set that an investigation had ended. HPE put its answer inside a risk factor. National Presto answered in Item 1C a year after the outage.

Zoomcar's later filing reports work finished rather than a verdict on materiality. B. Riley's only looks back.

What did the incidents cost, when a later filing gave a number?

Most later filings give a verdict on materiality, not a dollar figure. The thirteen entries below do have a number from a later 10-Q or 10-K, and the numbers measure different things: response costs, lost profit, lost cash flow or lost sales. Read the "what it measures" column before comparing rows.

Company	Incident	Figure	What it measures	Insurance reported	Filing
United Natural Foods	Network intrusion, June 2025	About $400 million	Sales lost in fiscal 2025	$40 million	10-K, Oct 1, 2025; 10-Q, Jun 9, 2026
MKS Instruments	Ransomware, February 2023	About $160 million	Revenue lost in the first quarter of 2023	Not stated	10-K for 2023
Clorox	Attack on IT systems, August 2023	About $57 million	Incremental expenses, nine months to March 31, 2024	Partly offset; amount not stated	10-Q, Apr 30, 2024
Sonic Automotive	CDK Global outage, June 2024	About $47.2 million	Pre-tax income lost in 2024	$50.0 million	10-K for 2025
Halliburton	Intrusion and data theft, August 2024	$35 million, later $25 million	Charge in Q3 2024, less a $10 million release in 2025	Not stated	10-Qs, Nov 7, 2024 and Oct 23, 2026
F5	BIG-IP source code theft, 2025	$26.5 million	Response costs, nine months to June 30, 2026	$5.3 million	10-Q, Aug 6, 2026
Rackspace Technology	Hosted Exchange ransomware, December 2022	$11.1 million	Incident expenses, 2022 and 2023	$10.0 million	10-Ks for 2022 and 2023
Lee Enterprises	Network attack, February 2025	$10.5 million	Cash flows lost, fiscal 2025	Not stated	10-K, Nov 26, 2025
SouthState	Bank network incident, February 2024	About $8.3 million	Incident costs, 2024	Not stated	10-K for 2024
Krispy Kreme	IT intrusion, November 2024	$6.8 million	Remediation costs, first three quarters of fiscal 2025	$9.3 million (business interruption)	10-Q, Nov 6, 2025
Key Tronic	Intrusion and plant shutdown, May 2024	About $2.3 million	Incident expenses, fiscal 2024	Not stated	10-K, Oct 15, 2024
Bassett Furniture	Encryption and plant shutdown, July 2024	About $1 million to $2 million	Sales lost to the shutdown	$698 thousand (later 10-Q)	10-K, Feb 10, 2025
Data I/O	Ransomware, August 2025	About $388,000	Remediation costs, third quarter of 2025	Not stated	10-K for 2025

The passages behind each figure:

UNFI's figure is sales, the largest in the table, and its own estimate of the profit effect is smaller. Its annual report puts lost sales at about $400 million and the hit to Adjusted EBITDA at about $50 million. A later 10-Q records $40 million of insurance proceeds in fiscal 2026 to May 2. MKS gives a revenue figure for one quarter, about $160 million, and about $15 million of net costs for the year.

Clorox states its amounts in millions and gives a running total. Halliburton booked a $35 million "Cybersecurity incident" charge in the third quarter of 2024, then released $10 million of it in 2025. Krispy Kreme's insurance recoveries in one quarter exceeded its remediation costs for three.

Sonic's is the largest profit figure, and it is an estimate of profit lost, not money spent. The 2025 annual report says the CDK outage cut 2024 income before taxes by about $47.2 million, including about $13.4 million of extra compensation. The same report records $10.0 million of cyber insurance proceeds at the end of 2024 and $40.0 million in 2025.

F5 reports a running total of response costs each quarter. Its 10-Q for the quarter to June 30, 2026 gives $26.5 million for nine months and $5.3 million of insurance recoveries.

Rackspace's 2023 annual report gives both years' expenses and the insurance. Its 2022 report also took a $129 million goodwill charge it tied mainly to the incident, which is left out of the table because it is a write-down, not a cost.

Lee counts the incident in cash. SouthState puts its cost inside a merger and severance expense line. Key Tronic gives one line for the fiscal year.

Bassett's figure is sales, stated in thousands of dollars. Data I/O's is a single quarter of remediation.

Some companies answer the cost question without a number. Crimson Wine Group's 2025 annual report says its recorded costs were limited to its insurance deductibles and were not material. Crimson's entry has the rest. Cencora reports a restructuring line "mostly" from its incident without saying how much, so it is not in the table either. Upbound Group gives a figure that measures something else again: $13.3 million of incremental estimated fraudulent contract losses in its Acima segment for the nine months to September 30, 2026, from lease-to-own agreements it believes were opened with information taken in the incidents. It is a fraud loss, not a cost of responding to the breach, so it stays out of the table.

Two patterns show in the thirteen rows. Insurance varies widely: at Sonic, Rackspace and Krispy Kreme the reported proceeds came close to or above the stated cost, while F5's $5.3 million is about a fifth of its $26.5 million. And the figure arrives late, because the costs are spread across quarters. F5's first quarterly figure came in a 10-Q filed 113 days after its 8-K, and Sonic's insurance total took until the annual report filed 20 months after the outage.

What happens when the company stops filing?

Then there is no later report to look in. A scan of the EDGAR filing lists of all 56 Item 1.05 filers in this log (November 8, 2026) found six whose own record ends, or passes to another filer, after the incident. In none of the six does a later filing tie the event that ended the record to the incident.

Company	Item 1.05 8-K	What happened to the record	Last word on the incident
iLearningEngines	Nov 18, 2024	Chapter 11 filed Dec 20, 2024; delisted from Nasdaq	The 8-K itself
ENGlobal	Dec 2, 2024	Chapter 11 filed Mar 5, 2025; delisted from Nasdaq	An 8-K/A
Bitcoin Depot	Apr 8, 2026	Chapter 11 filed May 17, 2026 for a wind-down; delisted from Nasdaq	The 8-K itself
Wytec International	Aug 29, 2025	Form 15 filed Jul 1, 2026	An 8-K/A
Frontier Communications	Apr 18, 2024	Acquired by Verizon Jan 20, 2026; Form 15	A 10-Q, Oct 28, 2025
Navient	Jul 2, 2026	Reorganized under Navient Holdings Oct 28, 2026; Form 15 for the old stock	A 10-Q, Aug 7, 2026

The three bankruptcies are the starkest cases. Bitcoin Depot's Chapter 11 filing came 39 days after its Item 1.05 report and aimed at an orderly wind-down and a sale of assets. iLearningEngines filed on December 20, 2024, and ENGlobal on March 5, 2025, and neither filed another 10-Q or 10-K. For all three, the Item 1.05 report, or one amendment, is the whole public record of the incident.

The other three end more quietly. Wytec filed Form 15 to end the registration of its common stock under Section 12(g). Frontier became a wholly owned subsidiary of Verizon. Navient merged into a subsidiary of a new parent, Navient Holdings, so any later word on its incident would come from the new filer. For a reader tracking an incident, the practical step is the same in each case: check the filing list for a Form 15, a Form 25 or an 8-K under Item 1.03 or Item 2.01 before concluding that a company simply chose not to follow up.

What do the later filings leave out?

Mostly the numbers. None of the seven filings quoted here gives a cost for the incident, an insurance recovery, or a final count of people affected. None of them says how the attacker got in where the 8-K had not said. The 8-K's open questions usually stay open.

A finding of no material impact is the company's own judgment, under the same standard it used when it filed under Item 1.05 in the first place. The phrase does not mean nothing happened. Sensata, National Presto and B. Riley each describe operations that were interrupted.

How do you find the follow-up for a company?

1. Open the company's filing list on EDGAR and note every 10-Q and 10-K filed after the 8-K date.
2. In each one, search for the month and year of the incident, such as April 2025, and for the words previously disclosed. Companies often point back to their own 8-K, as HPE's annual report does.
3. Read Item 1C of each annual report, then the risk factors, then the notes on subsequent events, commitments and contingencies, or the incident itself.
4. Check for an 8-K/A on the same filing list, and for a Form 15, a Form 25 or an 8-K under Item 1.03 (bankruptcy) or Item 2.01 (a completed acquisition), which mean the record may have ended or moved to another filer. If one exists, it supersedes the first filing's facts; see the Form 8-K Item 1.05 glossary entry for what an amendment must contain.

Each incident entry on this site lists the later filings it has read, in its sources and in a later-filings section where there is one.

FAQ

Do companies have to amend an 8-K after a cyber incident?

Only when information that was not known or not determined at the time of the first filing becomes available. The amendment is due within four business days after the company determines it. Many companies never amend: in this log, 28 of 56 Item 1.05 incidents have only the first 8-K.

Where do companies report whether a cyber incident was material after the 8-K?

In Item 1C of the next annual report, which asks whether past incidents materially affected the company, and sometimes in a 10-Q note or a risk factor. Of the seven companies in the table, two answered in a 10-Q note, three in Item 1C of a 10-K (AT&T without naming the incident), and two in risk factors.

How long after the 8-K does the follow-up come?

In the seven cases here, 111 to 722 days. A 10-Q note can come within one quarter, as Sensata's did. An annual report statement waits for the next fiscal year end, which put National Presto's and Zoomcar's answers about a year after the event.

What happens to a cyber incident disclosure if the company goes bankrupt?

Usually nothing more is filed about it. In this log, iLearningEngines, ENGlobal and Bitcoin Depot each filed for Chapter 11 after their Item 1.05 reports and filed no later 10-Q or 10-K, so the first 8-K, or one amendment, is all the public record holds. None of their bankruptcy filings mentions the incident.

Does no material impact mean the attack had no effect?

No. It is the company's judgment that the effect was not material to its finances or operations as a whole. Several of the same filings describe operations, or a subsidiary's business, being temporarily interrupted.