How 8-K/A amendments change an incident disclosure

What this guide compares

A first incident 8-K is written while an investigation is still running. An 8-K/A is where the company reports what the investigation found. This guide reads two original-and-amendment pairs side by side and records what moved between them. Every statement below comes from the filings themselves, and the quoted passages show where.

The first pair is Cencora, Inc. Its Amendment No. 1 says it amends the Form 8-K filed with the SEC on February 27, 2024. The amendment is signed July 31, 2024.

The second pair is Fidelity National Financial, Inc. (FNF). Its Amendment No. 2, signed January 9, 2024, says it amends the report filed on November 21, 2023. It also refers to an earlier amendment. The text of the November 30, 2023 amendment is not among the documents reviewed here, so this guide does not describe it.

The original FNF filing was made under a different item from Cencora's. FNF reported its first notice under Item 8.01, "Other Events." Cencora's original used Item 1.05, "Material Cybersecurity Incidents."

Cencora: what changed about the data

The original Cencora filing was short on data detail. It said only that data had left the company's systems and that some of it might be personal.

The amendment makes two changes. First, the amount of data grew. The company says its investigation found more than it first identified.

Second, the amendment names the data types, where the original said only "personal information." The company says the review confirmed personally identifiable information (PII) and protected health information (PHI). It also says where most of it sits.

The amendment does not give a number of affected people. It describes notification activity without a count. It says notices have gone out for the PII and PHI found so far, to individuals and to regulators. A reader looking for a headcount will not find one in this amendment.

Cencora: what changed about scope and impact

The clearest shift in the Cencora pair is the financial-impact statement. In the original, the company had not reached a conclusion.

In the amendment, it had. That is a move from "not yet determined" to a stated belief, with the same wording used for the test in both filings.

The amendment also adds a status line on containment and remediation, which the original did not carry.

FNF: from credentials to 1.3 million people

The original FNF filing described what the company then knew about the intrusion. It said an outside party had reached its systems and taken credentials. It also described the effect of its own response.

On materiality, the original left the question open.

Amendment No. 2 adds the method and the data outcome. The company says the intruder deployed malware and took data.

It also adds the headcount that Cencora's amendment lacks. The company says it notified its affected customers, state attorneys general and regulators, and a stated number of consumers. The figure is described as "approximately" and as "potentially impacted" consumers, not as confirmed victims.

FNF: dates, containment and legal exposure

The original FNF filing gave no dates for containment or the end of the investigation. Amendment No. 2 supplies them. The company's account of its own response now includes a containment date.

The amendment also gives the date the forensic work ended.

It also states the last day the company confirmed activity by the intruder, which is a separate date from containment. Reading the three dates together, the amendment separates the end of the intruder's confirmed activity (November 20, 2023), the date of containment (November 26, 2023) and the close of the forensic investigation (December 13, 2023).

The amendment adds a legal item that the original did not have.

On materiality, the original's open question is closed in the amendment.

How to read an amendment against its original

Across both pairs, the amendments filled in the same gaps. This guide checks four items in each amendment:

• Data types. Cencora moved from "personal information" to PII and PHI. FNF moved from stolen credentials to exfiltrated data.
• People affected. FNF gave a number. Cencora's amendment gave none.
• Scope of systems and operations. Both amendments update the status of the response. Cencora added containment and remediation language. FNF added the dates of containment, restoration of services and the last confirmed activity.
• Financial materiality. Both companies moved from an open question in the original to a stated belief in the amendment.

Two cautions come from the documents themselves. First, the two amendments differ in form: Cencora's is Amendment No. 1 and FNF's is Amendment No. 2, so an amendment is not necessarily the only follow-up. Second, both amendments include forward-looking statement sections that note the investigation could produce more information. The Cencora filing says the company continues to review the data and will make further notifications if needed. The FNF filing lists "the Company's potential discovery of additional information" among its risk factors.

An 8-K/A therefore reads as a dated update to the first disclosure. It does not read as a final account.