Cybersecurity Incidents: What 916 SEC 8-K Filings Reveal
On March 11, 2026, Stryker Corporation filed its first 8-K disclosing a cybersecurity incident that disrupted its global Microsoft environment — one of 916 material cybersecurity 8-K disclosures filed with the SEC in the past 12 months. But the initial 8-K is the least financially informative disclosure in the entire lifecycle. Cross-company analysis of four non-tech companies — a medical device maker, a donut chain, a mortgage lender, and a hospital system — reveals that the most financially specific SEC disclosures appear 12–24 months after the incident. Insurance recoveries of $21.5M to $35M, class action consolidations, and settlement disclosures mark the true cost — and they arrive long after the headlines fade.