Ransomware in 8-K filings: how companies describe encryption, data theft and extortion

What these four filings are

This guide reads four filings side by side and asks the same four questions of each: was data encrypted, was data taken, was money demanded, and how did the attacker get in. It then looks at what the two amendments in the set add to the original account. The four filings are short, and the wording of each is quoted or closely paraphrased below.

Brandywine Realty Trust filed a Form 8-K/A signed May 28, 2024, and its explanatory note says the amendment exists to provide supplemental information under Item 1.05. ENGlobal Corporation's Amendment No. 1, signed January 27, 2025, says it supplements the original Form 8-K and should be read together with it. Data I/O Corporation's Form 8-K, signed September 10, 2025, refers back to an earlier filing dated August 21, 2025 and says its ransomware incident occurred on August 16, 2025. Jewett-Cameron Trading Company's Form 8-K, signed October 21, 2025, says the company learned of the intrusion on October 15, 2025.

Every statement below belongs to the company that filed it. This guide reports what the companies said and does not test it against outside facts.

How the filings describe encryption

Each filing is taken in turn, because the companies use different words.

Brandywine's amendment says the detected occurrences consisted of a third party's unauthorized access to, and deployment of encryption to, part of the company's internal corporate IT systems, together with the exfiltration of certain files.

Jewett-Cameron describes a similar act and adds a second tool. Its filing says the company believes a third party gained access and deployed encryption and monitoring software to part of its internal corporate IT systems.

ENGlobal uses plainer language. Its amendment says the preliminary investigation revealed that a threat actor illegally accessed the company's IT system and encrypted some of its data files.

Data I/O uses the label itself. Its filing says the company experienced a ransomware incident on certain of its internal IT systems.

What the filings say about stolen data

On data theft, the filings split between a confirmed taking of files and a looser account of access.

Brandywine's amendment says its investigation, including the assessment of how much personal information is in the exfiltrated information, remained ongoing as of the amendment.

Jewett-Cameron says it is still investigating how much sensitive information was compromised, even though it ascertained that certain information was exfiltrated. The filing also says it is believed the threat actors exfiltrated images of video meetings and computer screens that may contain sensitive company information. On personal data, the company says it has no current evidence that personally identifiable information of employees, customers, suppliers or vendors was compromised, while its review continues.

ENGlobal's amendment uses the word access, not exfiltration. It says the incident involved the threat actor's access to a portion of the IT system that contained sensitive personal information.

What the filings say about extortion demands

In this set, a payment threat appears in the Jewett-Cameron filing. The company says the threat actors threatened to release the exfiltrated information publicly if the company does not provide them with a monetary payment.

That filing also records how the company first learned of the matter: the threat actor claimed to have unlawfully accessed certain company information and data.

The filing is the earliest in time of the four, signed six days after October 15, 2025, and it states that the full scope, nature and impact of the incident were not yet completely known. The Brandywine, ENGlobal and Data I/O passages quoted in this guide do not describe a demand, so this guide makes no statement about whether one was made in those cases.

What the filings say about the initial access vector

Only one filing in the set names a cause. Data I/O says that, through ongoing discovery and investigation efforts, it determined the incident was not targeted and originated as a vulnerability of a commercially available third-party firewall service provider.

Data I/O's wording matters for how to read it: the company presents this as a finding reached through investigation, not as part of the first report. The filing refers back to the August 21, 2025 report, and this September 10, 2025 text is the one that states the determination.

Jewett-Cameron points to an entry point without naming it. It says it has taken additional cybersecurity measures, including closing off the point of unlawful access and bolstering its cyber defensive capabilities.

The Brandywine and ENGlobal amendments quoted above describe unauthorized or illegal access by a third party or threat actor. The passages cited here do not say how that access was gained.

What follow-up filings change

Three of these four filings are updates or later reports, and the changes they make are mostly about recovery, not about the attack.

Brandywine's amendment states that, as of its date, the company believes the third party has been removed from its IT systems, access to the affected information has been restored, and the procedures performed confirmed the completeness and integrity of the impacted information. It also says the incident had not had a material impact on the company's financial condition or results of operations.

ENGlobal's amendment gives a duration the reader would not get from a first notice: access to portions of business applications, including financial and operating reporting systems, was limited for approximately six weeks. It then says operations were fully restored and the company believes the threat actor no longer has access.

Data I/O's September 10, 2025 filing adds a cost figure. As of September 9, 2025, it says estimated costs for remediation, restoration and investigation are expected to total approximately $388,000 in expenses in the quarter ending September 30, 2025, and will likely have a material impact on its results.

Read together, the follow-ups in this set give three kinds of new information: an updated status of the investigation, the state of recovery, and a financial effect. Materiality conclusions differ between the filings, and each reflects that company's own assessment on its own date.