Hazard

US public companies

Companies that told investors they were hacked

Since 18 December 2023, any US public company that suffers a cyberattack it judges "material" must report it to the Securities and Exchange Commission on a Form 8-K, under Item 1.05, within four business days. Every filing below carries that tag. Each links to the company's own filing — the authoritative account.

Refreshed today
82 Item 1.05 filings on record
4 years covered
22 filed in 2026

A filing means the company disclosed an incident it considered material — not necessarily that data was stolen. Read the filing for what each company actually said.