Material cybersecurity incidents: every Form 8-K filed under Item 1.05 (the SEC

Material cybersecurity incidents: every Form 8-K filed under Item 1.05 (the SEC cyber-disclosure rule, live since 2023-12-18) plus its 8-K/A amendments -- the entire population, ~80 filings and growing. One row per filing, with FOUR distinct date roles kept rigorously separate: incident discovered, materiality determined (both extracted from prose, with day/month/quarter precision enums), disclosed and amended (both structural EDGAR dates, never model-guessed) -- plus the intervals between them (investigation time, compliance-clock time, total latency).

Flags are three-state: 1 = filing says yes, 0 = filing says no, NULL = filing does not say -- never collapsed. Amendments are separate rows linked to their original (original_accession_number, days_original_to_amendment); an incident with three 8-K/As is four rows. materiality_determined_date is sparse (~15% fill) because most filings simply do not state one. days_determination_to_disclosure is CALENDAR days; the SEC's deadline is four BUSINESS days -- adjust before compliance claims.

Requires an Alphanume Pro API key. A 403 PRO_SUBSCRIPTION_REQUIRED or DATE_RANGE_RESTRICTED error means the key's plan does not cover the request -- it does not mean the data is missing.

get/v1/regulatory/cyber-incidents

Request

  • Base URL: https://api.alphanume.com
  • URL: https://api.alphanume.com/v1/regulatory/cyber-incidents
  • Auth: one of:
    • API key in header X-API-Key
    • HTTP bearer

Query parameters

tickerstring

Ticker symbol filter, e.g. 'AAPL'. Case-insensitive.

cikstring

SEC CIK number (digits only) -- the durable issuer key (3 rows have no ticker).

is_amendmentstring

1 = 8-K/A amendments only, 0 = original 8-Ks only.

attack_typestring

One of data-breach, unauthorized-access, ransomware, business-email-compromise, other, unstated.

amended_flagstring

1 = originals that were later amended, 0 = originals never amended (NULL on amendment rows themselves).

data_compromised_flagstring

1/0 three-state flag: filing states data was/was not stolen (unfiltered rows include NULL = filing does not say).

operations_disrupted_flagstring

1/0 three-state flag: filing states operations were/were not disrupted.

third_party_incident_flagstring

1/0 three-state flag: incident originated at a vendor/third party.

refusedstring

1/0: rows where the labeler declined the filing text (served with NULL extraction fields; the disclosure event is still real).

datestring

Exact date, YYYY-MM-DD. Cannot be combined with the date range parameters.

date_gtestring

Start of date range, inclusive (YYYY-MM-DD).

date_ltestring

End of date range, inclusive (YYYY-MM-DD).

date_gtstring

Start of date range, exclusive (YYYY-MM-DD).

date_ltstring

End of date range, exclusive (YYYY-MM-DD).

updated_sincestring

YYYY-MM-DD, on last_updated -- rows touched by the amendment-linkage sweep since this date.

cursor_datestring

Pagination: 'date' from next_cursor (send with cursor_accession).

cursor_accessionstring

Pagination: 'accession_number' from next_cursor (send with cursor_date).

Response

Matching rows.

countinteger required
dataobject[] required
has_moreboolean required
next_cursorobject nullable required

Keyset cursor: pass its fields back as the cursor_* query parameters to fetch the next page.

Changes

No recorded changes to this operation across all 1 revision of this API.