---
title: "Material cybersecurity incidents: every Form 8-K filed under Item 1.05 (the SEC"
method: GET
path: "/v1/regulatory/cyber-incidents"
---

# Material cybersecurity incidents: every Form 8-K filed under Item 1.05 (the SEC

`GET /v1/regulatory/cyber-incidents`

## Request

- Base URL: `https://api.alphanume.com`
- URL: `https://api.alphanume.com/v1/regulatory/cyber-incidents`
- Auth: one of:
  - API key in header `X-API-Key`
  - HTTP bearer

Material cybersecurity incidents: every Form 8-K filed under Item 1.05 (the SEC
cyber-disclosure rule, live since 2023-12-18) plus its 8-K/A amendments -- the
entire population, ~80 filings and growing. One row per filing, with FOUR distinct
date roles kept rigorously separate: incident discovered, materiality determined
(both extracted from prose, with day/month/quarter precision enums), disclosed and
amended (both structural EDGAR dates, never model-guessed) -- plus the intervals
between them (investigation time, compliance-clock time, total latency).

Flags are three-state: 1 = filing says yes, 0 = filing says no, NULL = filing does
not say -- never collapsed. Amendments are separate rows linked to their original
(original_accession_number, days_original_to_amendment); an incident with three
8-K/As is four rows. materiality_determined_date is sparse (~15% fill) because
most filings simply do not state one. days_determination_to_disclosure is CALENDAR
days; the SEC's deadline is four BUSINESS days -- adjust before compliance claims.

Requires an Alphanume Pro API key. A 403 PRO_SUBSCRIPTION_REQUIRED or
DATE_RANGE_RESTRICTED error means the key's plan does not cover the request --
it does not mean the data is missing.

## Query parameters

- `ticker` string
- `cik` string
- `is_amendment` string
- `attack_type` string
- `amended_flag` string
- `data_compromised_flag` string
- `operations_disrupted_flag` string
- `third_party_incident_flag` string
- `refused` string
- `date` string
- `date_gte` string
- `date_lte` string
- `date_gt` string
- `date_lt` string
- `updated_since` string
- `cursor_date` string
- `cursor_accession` string

## Response `200`

Matching rows.

- PaginatedEnvelope
  - `count` integer, required
  - `data` object[], required
  - `has_more` boolean, required
  - `next_cursor` object, nullable, required: Keyset cursor: pass its fields back as the cursor_* query parameters to fetch the next page.

## Other responses

- `400`: Invalid or conflicting query parameters.
- `401`: Missing or unrecognized API key.
- `403`: PRO_SUBSCRIPTION_REQUIRED: the key's plan does not include API access; every endpoint requires an active Pro subscription. DATE_RANGE_RESTRICTED: a legacy free-tier key asked for dates outside its window. In both cases the data is not missing.
- `429`: Rate limit exceeded (600/min); the body carries retry_after_seconds.

---

[API](https://skmtc.dev/alphanume/apis/alphanume-api.md) · [All operations](https://skmtc.dev/alphanume/apis/alphanume-api/llms.txt) · [OpenAPI document](https://skmtc.dev/alphanume/apis/alphanume-api/revisions/2cb83f10bba4?raw)