What a data breach costs a public company: what four filings do and do not show

What the question asks and what the filings contain

The question is how public companies report the cost of a cyber incident in later 10-K and 10-Q filings. That covers incident expenses, insurance recoveries and litigation accruals. We were given four primary documents. They are Aflac's annual report for fiscal 2025, Aflac's quarterly report for the period ended September 30, 2026, Carnival's quarterly report for the period ended August 31, 2026, and Cushman & Wakefield's quarterly report for the period ended September 30, 2026.

The text supplied from these four filings does not contain a disclosure of the cost of a cyber incident. It has no incident expense figure, no insurance recovery and no litigation accrual tied to a breach. This guide says what the documents show and what they do not. It does not fill the gap from outside knowledge.

Aflac: filing metadata only

The Aflac 10-K was filed on February 25, 2026, for the fiscal year ended December 31, 2025. The text supplied for it is the machine-readable header and tagging block, not the narrative sections. The header identifies the period as the calendar year 2025.

The Aflac 10-Q was filed on November 5, 2026, for the quarter ended September 30, 2026. The supplied text is likewise a tagging block. It labels the document as a third-quarter 2026 filing for the registrant.

Neither excerpt includes a risk factor, a note on contingencies or a management discussion passage. Nothing in the supplied Aflac text describes a cyber incident or its cost. We cannot report how Aflac accounts for such costs from these excerpts.

Carnival: a tag for a data security incident, without the text

Carnival's 10-Q for the quarter ended August 31, 2026, was filed on September 29, 2026. Its supplied text includes the financial statements and the start of the notes, and it is cut off in Note 2.

The most relevant item is in the tagging metadata. The filing's list of reporting elements includes a member named for a data security incident case, dated April 30, 2026. It sits beside a member for a COVID-19 case.

That tag shows the filing's data is organised to carry a data security incident matter. It does not say what the matter is, what it cost, whether any insurance applies, or whether any amount was accrued. The narrative note on contingencies is not in the supplied text. We therefore do not state any dollar amount for that matter.

What the supplied text does show is how Carnival frames its estimates. The company's note says its interim statements require management to make estimates and assumptions that affect reported amounts. It adds that those estimates can change.

The note also says interim results are not a full-year guide. The interim-versus-annual caveat is general language. It is not specific to cyber costs.

Carnival points readers to its annual report for the audited statements. The note refers to the joint annual report that was filed on January 27, 2026.

Where such costs could sit on Carnival's statements

The supplied income statement does not break out any cyber line. It reports a single line for selling and administrative expense. For the nine months ended August 31, 2026, that line is 2,621 million dollars, against 2,442 million dollars in the same period of 2025.

It also reports a line for other income and expense. For the nine months ended August 31, 2026, that line is an expense of 60 million dollars, against an expense of 4 million dollars a year earlier.

The filing text we were given does not say that either line includes costs from a data security incident. A reader cannot tell from these excerpts how much, if any, of those amounts relates to one.

On the balance sheet, the contingencies caption appears as a heading with no amount. It sits between other long-term liabilities and shareholders' equity.

This is why the question is hard to answer from statements alone. The balance sheet shows that a contingencies caption exists, but the amounts and the explanation sit in the notes. The notes in the Carnival excerpt stop before they reach contingencies.

Cushman & Wakefield: contingencies and claim categories

Cushman & Wakefield's 10-Q for the quarter ended September 30, 2026, was filed on November 4, 2026. Its supplied text covers the cover page, the balance sheet, the income statement and the statement of comprehensive income, and it cuts off in the middle of that last statement.

The balance sheet carries a commitments and contingencies caption that points to a note. The text of Note 11 is not in the excerpt. We cannot say whether it covers a cyber incident.

The filing's tagging block lists claim categories used elsewhere in the report. They include errors and omissions claims and workers' compensation, each tagged as of September 30, 2026, and December 31, 2025.

Those tags show that the company reports certain claim liabilities by category. They do not mention a cyber incident, and they do not show an insurance recovery.

The income statement also has a restructuring line. For the quarter ended September 30, 2026, restructuring, impairment and related charges appear as 6.5 in the supplied text. The column placement of that figure is not clear from the extracted text. Nothing in the excerpt ties that charge to a cyber matter.

What the documents do not show

Across the four documents, we found none of the following in the text supplied:

• a stated dollar amount of incident response, forensic, legal or notification expense for a cyber incident;
• an insurance recovery, a receivable for expected recovery, or a retention or deductible for a cyber event;
• a litigation accrual, a reasonably possible loss range or a statement that a loss cannot be estimated for a breach-related lawsuit.

The only direct signal is Carnival's data security incident tag, dated April 30, 2026. A reader who wants the cost story for that matter would need the contingencies note of Carnival's 10-Q and the corresponding passages of its annual report. Those passages were not in the material given to us.

Readers tracking cyber costs can still use these filings as a map. They show where the information would be found: in a contingencies note, in tagged case members, and in the interim statements that carry the amounts. Aflac's filings, as supplied, give no basis for any statement about cyber costs.