TheCorporateCounsel.net

In late December, Dave shared the first Form 8-K filed under the new cyber incident reporting regime. He noted “someone always must be first” to file. This unlucky company was also first to receive a comment. Hat tip to Emily Sacks-Wilner of Fenwick for sharing these first SEC comment and company response letters on disclosures under Item 1.05 of Form 8-K.

In its 8-K, the company disclosed that “the incident has had and is reasonably likely to continue to have a material impact on the Company’s business operations until recovery efforts are completed.” Relying on Instruction 2 to Item 1.05, it also stated that “the full scope, nature and impact of the unauthorized occurrences were not yet known” and the company hadn’t yet “determined whether the incident is reasonably likely to materially impact the Company’s financial condition or results of operations.”

It seems the SEC took this first filing as an opportunity to send a reminder that the amended 8-K (which must be filed to report the information called for by Item 1.05 that was not determined or available when the initial 8-K was filed) must describe the scope of the business operations impacted and the known material impacts the incident has had and those likely to continue. The comment letter continues:

In considering material impacts, please describe all material impacts. For example, consider vendor relationships and potential reputational harm related to stolen data and unfulfilled orders, as well as any impact to your financial condition or results of operations.

The company simply acknowledged the comment and noted that the amended 8-K will address these items.

– Meredith Ervine