Form 8-K
We note the statement you experienced a cybersecurity incident that, as of the date of the filing, did not have a material impact on your operations. Please advise us as to why you determined to file under Item 1.05 of Form 8-K given the statement that you have not yet determined whether the incident is reasonably likely to materially impact your financial condition or results of operations.
On July 26, 2023, the Commission adopted rules that require public companies to disclose material cybersecurity incidents under Item 1.05 of Form 8-K (the "Cybersecurity Rules"), with such disclosure rules going into effect as of December 18, 2023 (the "Effective Date"). As disclosed in the Form 8-K, which was filed approximately two months following the Effective Date, the Company learned on February 21, 2024 that data from its information systems had been exfiltrated (the "incident").Read in the reply ↗Rest of the answer
At the time the Company filed the Form 8-K, on February 27, 2024, the investigation into the incident and corresponding materiality analysis remained ongoing. Nonetheless, the Company believed that disclosing the incident to the public was appropriate in light of the policy underpinning the Cybersecurity Rules1 and prevailing market practice following the Effective Date.
Following the May 21, 2024 clarifying statement by Erik Gerding, Director of the Division of Corporation Finance, the Company understands that while companies should not be discouraged from voluntarily disclosing cybersecurity incidents for which they have not yet made a materiality determination, such disclosure should be made in another manner, such as under Item 8.01 of Form 8-K.2 The Company acknowledges this clarifying
__________________________________
1 The Commission noted in the Adopting Release for the Cybersecurity Rules that evidence suggests companies may be underreporting cybersecurity incidents. See Adopting Release, p. 8, citing Bitdefender, Whitepaper: Bitdefender 2023 Cybersecurity Assessment (Apr. 2023), available at https://businessresources.bitdefender.com/bitdefender-2023-cybersecurity-assessment.
2 https://www.sec.gov/news/statement/gerding-cybersecurity-incidents-05212024#_ftn1 statement and advises the Staff that it will consider all applicable guidance, together with the Adopting Release for the Cybersecurity Rules and Item 1.05 of Form 8-K, in determining whether and when to file future Current Reports on Form 8-K under Item 1.05.
Further, the Company respectfully advises the Staff that its investigation into the incident and corresponding materiality analysis remains ongoing and that it will file an amendment to the Form 8-K when it has determined whether the incident is reasonably likely to materially impact the Company’s financial condition or results of operations.
* * *
We understand that the Company and its management are responsible for the accuracy and adequacy of our disclosures, notwithstanding any review, comments, action or absence of action by the Staff.
Also in this review: closing letter, 2024-11-01