Material Cybersecurity Incidents

Added by the SEC in 2023. Filed within four business days of determining that a cybersecurity incident is material. Discloses the nature, scope, timing, and material impact (or reasonably likely impact) on the registrant.

Recent disclosures

• September 23, 2026, 7:30 AM ET ASTH Astrana Health, Inc. cyber

  Astrana Health discloses cybersecurity incident; data possibly accessed via social engineering

• September 8, 2026, 6:15 AM ET BSX BOSTON SCIENTIFIC CORP cyber

  Boston Scientific cyber incident to materially hit Q3 and FY 2026 results; will miss guidance

• September 1, 2026, 4:05 PM ET PARK Park Dental Partners, Inc. cyber

  Park Dental Partners reports unauthorized network access; possible patient data compromise

• September 1, 2026, 7:00 AM ET NVCR NovoCure Ltd cyber

  NovoCure discloses cyber incident exposing patient ID numbers and contact info

• August 31, 2026, 4:25 PM ET NUTX Nutex Health Inc. cyber

  Nutex Health confirms data exfiltration in cyber incident; faces class action lawsuit

• July 31, 2026, 4:03 PM ET AMGN AMGEN INC cyber

  Amgen reports material cybersecurity incident with data exfiltration from cloud environments

• July 30, 2026, 11:40 AM ET RVRF River Financial Corp cyber

  River Financial reports cybersecurity incident with unauthorized data access; investigation ongoing

• July 21, 2026, 5:42 PM ET UPBD UPBOUND GROUP, INC. cyber

  Upbound Group reports cyber incidents leading to $13M fraudulent contract losses in Acima segment

• July 17, 2026, 12:20 PM ET RVRF River Financial Corp cyber

  River Financial discloses four class action lawsuits over cybersecurity incident; impact undetermined

• July 10, 2026, 2:30 PM ET RVRF River Financial Corp cyber

  River Financial discloses data breach; two class action lawsuits filed

• July 6, 2026, 9:54 AM ET RVRF River Financial Corp cyber

  River Financial updates cybersecurity incident: data potentially impacted, PII under review, no account compromise yet.

• July 2, 2026, 4:15 PM ET NAVI NAVIENT CORP cyber

  Navient discloses ransomware attack at third-party law firm exposing borrower data

• July 2, 2026, 4:01 PM ET AHCO AdaptHealth Corp. cyber

  AdaptHealth reports material cybersecurity incident; patient data exfiltrated via social engineering

• June 25, 2026, 4:52 PM ET RVRF River Financial Corp cyber

  River Financial discloses ransomware attack; investigation ongoing, impact undetermined

• June 23, 2026, 5:10 PM ET EGHT 8X8 INC /DE/ cyber

  8x8 discloses cyber breach via Klue Labs Salesforce integration; customer data exfiltrated

• June 15, 2026, 4:30 PM ET IRTC iRhythm Holdings, Inc. cyber

  iRhythm discloses cyber incident with data exfiltration; threat actor demanded payment

• May 22, 2026, 4:30 PM ET TOI Oncology Institute, Inc. cyber

  Oncology Institute patient data accessed in Vendor cybersecurity incident; operations sustained

• May 20, 2026, 4:04 PM ET WST WEST PHARMACEUTICAL SERVICES INC cyber

  West Pharmaceutical provides update on May 4 cyberattack; fully operational, no material financial impact

• May 11, 2026, 5:06 PM ET WST WEST PHARMACEUTICAL SERVICES INC cyber

  West Pharmaceuticals discloses material cyberattack; data exfiltrated, systems encrypted on May 4 2026

• May 11, 2026, 4:15 PM ET CBFV CB Financial Services, Inc. cyber

  CB Financial Services discloses material cyber incident exposing customer SSNs and DOBs

• April 9, 2026, 7:59 PM ET SYK STRYKER CORP cyber

  Stryker says cyber incident materially impacted Q1 operations and financial results; full-year guidance unchanged

• April 8, 2026, 7:59 PM ET BTM Bitcoin Depot Inc. cyber

  Bitcoin Depot loses ~50.9 BTC ($3.7M) in cybersecurity incident; deems event material

• March 27, 2026, 7:59 PM ET CCLD CareCloud, Inc. cyber

  CareCloud reports cybersecurity incident affecting patient data in one EHR environment

• March 20, 2026, 7:59 PM ET TRT TRIO-TECH INTERNATIONAL cyber

  Trio-Tech reports ransomware incident at Singapore subsidiary; data potentially exposed

• February 24, 2026, 6:59 PM ET UFPT UFP TECHNOLOGIES INC cyber

  UFP Technologies detects cyber incident; data exfiltrated, systems mostly restored

• February 3, 2026, 6:59 PM ET WYTC WYTEC INTERNATIONAL INC cyber

  Wytec International updates on cybersecurity incident; website defaced twice, now restored

• December 29, 2025, 6:59 PM ET CPNG Coupang, Inc. cyber

  Coupang confirms 33M accounts accessed in cyber breach; to issue $1.2B in customer vouchers

• December 16, 2025, 6:59 PM ET CPNG Coupang, Inc. cyber

  Coupang discloses data breach affecting up to 33M customer accounts; former employee accessed personal data

• October 30, 2025, 7:59 PM ET BAFN BayFirst Financial Corp. other material

  BayFirst reports $18.9M Q3 loss, exits SBA 7(a) lending; customer data exposed in cyber incident

• October 21, 2025, 7:59 PM ET JCTC JEWETT CAMERON TRADING CO LTD cyber

  Jewett-Cameron discloses cyber incident with data exfiltration and extortion demand

• October 15, 2025, 7:59 PM ET FFIV F5, INC. cyber

  F5 discloses nation-state cyber breach; BIG-IP source code exfiltrated; director resigns for new role

• September 10, 2025, 7:59 PM ET DAIO DATA I/O CORP cyber

  Data I/O provides update on ransomware incident; costs estimated at $388K

• August 29, 2025, 7:59 PM ET WYTC WYTEC INTERNATIONAL INC cyber

  Wytec International reports cybersecurity incident; website defaced twice, seminar canceled

• August 21, 2025, 7:59 PM ET DAIO DATA I/O CORP cyber

  Data I/O reports ransomware incident on Aug 16; operations temporarily impacted

• June 26, 2025, 7:59 PM ET UNFI UNITED NATURAL FOODS INC cyber

  UNFI says cyber incident contained; expects material Q4 impact on net income/EBITDA

• June 20, 2025, 7:59 PM ET NUE NUCOR CORP cyber

  Nucor updates on May 2025 cyber incident; operations restored, no material impact

• June 13, 2025, 7:59 PM ET ZCAR Zoomcar Holdings, Inc. cyber

  Zoomcar discloses data breach affecting 8.4 million users’ personal data

• May 15, 2025, 7:59 PM ET COIN Coinbase Global, Inc. cyber

  Coinbase cyber incident: estimated $180M-$400M remediation costs

• May 14, 2025, 7:59 PM ET NUE NUCOR CORP cyber

  Nucor reports cybersecurity incident; halts some production, now restarting

• April 14, 2025, 7:59 PM ET CNDT CONDUENT Inc cyber

  Conduent cyber breach: personal data of clients' end-users exfiltrated; material Q1 notification costs

• April 9, 2025, 7:59 PM ET ST Sensata Technologies Holding plc cyber

  Sensata hit by ransomware on April 6; network taken offline, files exfiltrated

• March 6, 2025, 6:59 PM ET LEE LEE ENTERPRISES, Inc cyber

  Lee Enterprises reports cyberattack Feb 3; threat contained, operations partly restored, $3.7M waiver

• March 6, 2025, 6:59 PM ET NPK NATIONAL PRESTO INDUSTRIES INC cyber

  National Presto suffers system outage from cybersecurity incident on March 1

• February 18, 2025, 6:59 PM ET LEE LEE ENTERPRISES, Inc cyber

  Lee Enterprises discloses Feb 3 cybersecurity attack; core products restored, weekly/ancillary still down

• January 27, 2025, 6:59 PM ET ENGLOBAL CORP cyber

  ENGlobal discloses ransomware-like cyber incident; operations disrupted six weeks, sensitive personal info accessed

• December 11, 2024, 6:59 PM ET DNUT Krispy Kreme, Inc. cyber

  Krispy Kreme reports cyber incident on Nov 29; operations impacted, costs expected material

• December 2, 2024, 6:59 PM ET ENGLOBAL CORP cyber

  ENGlobal reports cybersecurity incident with encrypted data files; IT systems partially restricted

• November 18, 2024, 6:59 PM ET iLearningEngines, Inc. other material

  iLearningEngines discloses cyber incident, financial restatement, and CFO change

• October 23, 2024, 7:59 PM ET KRT Karat Packaging Inc. cyber

  Karat Packaging discovers unauthorized third-party access to IT systems on Oct 18

• September 3, 2024, 7:59 PM ET HAL HALLIBURTON CO cyber

  Halliburton reports unauthorized third-party access to systems on Aug 21, causing disruptions and data exfiltration

source · SEC Form 8-K instructions · see methodology