Form 8-K and 8-K/A filings, March 1 – August 18, 2026. Sorted by disclosure date, most recent first.
| Company / Ticker | Reported at | Incident details | Source filing | |
|---|---|---|---|---|
| 1 | Levi Strauss & Co.LEVI | 2026-08-07 (8-K, Item 8.01) | Detected an incident in which an unauthorized third party used social engineering to gain access to three employees' company-issued computers. Preliminary findings indicate certain corporate information was accessed and exfiltrated. The Company believes rapid response contained and terminated the access and that no consumer data was impacted. No business interruption; notifications to affected parties and regulators as appropriate. | 8-K Item 8.01View filing ↗ |
| 2 | IEH CorporationIEHC | 2026-08-06 (8-K, Item 8.01) | On August 4, 2026 discovered a threat actor had gained unauthorized access to an employee's Microsoft 365 mailbox via a phishing attack using a fake Microsoft document-sharing link and credential-harvesting page. Accessible content included emails, attachments, customer communications, purchase orders, engineering documentation and potentially export-controlled technical information. No evidence of exfiltration or outbound email; account secured and malicious mailbox rules disabled. | 8-K Item 8.01View filing ↗ |
| 3 | Amgen Inc.AMGN | 2026-07-31 (8-K, Item 1.05) | In July 2026 identified unauthorized activity involving data stored in third-party-hosted cloud environments. Data exfiltrated includes proprietary data, patient protected health information and other information. No identified impact to products, manufacturing operations, financial reporting systems or ability to meet patient needs. Declared material July 29 based on the volume and potential sensitivity of the affected files. | 8-K Item 1.05View filing ↗ |
| 4 | HealthStream, Inc.HSTM | 2026-07-29 (8-K, Item 8.01) | Detected that an unauthorized third party accessed a limited portion of files on its corporate file server; forensics specialists engaged and law enforcement notified. Employee information, billing information of certain customers and vendors, corporate and legal information, and data belonging to roughly 75 credentialing customers that had been copied to corporate file servers were accessed and/or exfiltrated. No customer-facing systems compromised, no evidence of PHI access, no encryption and no service interruption. | 8-K Item 8.01View filing ↗ |
| 5 | Analog Devices, Inc.ADI | 2026-07-29 (8-K, Item 8.01) | On June 23, 2026 identified unauthorized access to certain Company systems; incident response activated, external cybersecurity experts engaged and law enforcement notified. Certain files were exfiltrated, with scope still under review and no evidence of public release or fraudulent use. Operations were not interrupted and the incident was not believed reasonably likely to be material. Separately, on July 26 ADI began assessing public reports of an unrelated cybersecurity matter. | 8-K Item 8.01View filing ↗ |
| 6 | Five Below, Inc.FIVE | 2026-07-22 (8-K, Item 8.01) | On July 15, 2026 identified anomalous activity on an employee's company-issued computer. Investigation found that on July 14 a threat actor used social engineering to gain unauthorized access to that computer and exfiltrated a number of files. Believed limited to that employee's environment, with no personally identifiable information accessed and other systems, platforms and data unaffected. No material impact expected. | 8-K Item 8.01View filing ↗ |
| 7 | Clover Health InvestmentsCLOV | 2026-07-17 (8-K, Item 8.01) | On July 4, 2026 became aware of anomalous login activity. A threat actor used social engineering to access three non-managerial health plan employee accounts in member visit-scheduling and broker-facing sales roles, which had access to certain PII and PHI but not to corporate financial or claims systems. Access believed contained and terminated; scope of accessed data still under investigation. No material impact expected. | 8-K Item 8.01View filing ↗ |
| 8 | The Coca-Cola CompanyKO | 2026-07-16 (8-K, Item 8.01) | Announced that wholly owned dairy subsidiary fairlife, LLC identified unauthorized third-party access to a portion of its systems, including production-related systems, in connection with a ransomware event. Incident response and business continuity protocols activated; outside advisors engaged and law enforcement notified. Product quality and safety not impacted, but fairlife's U.S. production operations were temporarily suspended (Canada unaffected). Materiality undetermined. | 8-K Item 8.01View filing ↗ |
| 9 | SR Bancorp, Inc. (Somerset Regal Bank)SRBK | 2026-07-10 (8-K, Item 8.01) | Vendor incident at Mercadien, P.C. CPAs, which provides internal audit-related services to the Bank. An unauthorized actor accessed and acquired files on Mercadien's servers containing Bank customer data including names, Social Security numbers, account numbers, identification documents and dates of birth. The Bank's own systems, operations, payment systems and core IT were not involved. Notifications are being made through Mercadien. | 8-K Item 8.01View filing ↗ |
| 10 | AdaptHealth Corp.AHCO | 2026-07-02 (8-K, Item 1.05) | A social engineering attack compromised a third-party contractor's user session, giving a threat actor access to cloud-based business applications including internal patient management systems and document storage. On June 15, 2026 the actor claimed to hold Company data; exfiltration was confirmed, including a stored insurance-billing password file, patient PII and PHI. Declared material June 27. No SSNs or payment card data in the affected systems. | 8-K Item 1.05View filing ↗ |
| 11 | Navient CorpNAVI | 2026-07-02 (8-K, Item 1.05) | On June 8, 2026 became aware of a ransomware attack at a third-party law firm providing legal services to the Company. An unauthorized actor accessed Company-related borrower data held by the firm, including customer names, dates of birth, addresses and Social Security numbers. Incident limited to the firm's environment; no unauthorized access to Navient systems and no operational disruption. Declared material June 29. | 8-K Item 1.05View filing ↗ |
| 12 | River Financial Corp (River Bank & Trust)RVRF | 2026-06-25 (8-K, Item 1.05); four 8-K/A updates through 2026-07-30 | A threat actor gained access to River's network environment on or about June 16, 2026; identified on or about June 19 with ransomware deployed across portions of the server environment. Containment included disabling affected administrative accounts and taking systems offline. Certain operations were impacted; forensic investigation into possible PII exfiltration ongoing. Materiality not yet determined at the first filing. | 8-K Item 1.05View filing ↗ |
| 13 | 8x8, Inc.EGHT | 2026-06-23 (8-K, Item 1.05) | On June 13, 2026 was informed that a threat actor had exploited the Klue Labs third-party API integration connected to its Salesforce CRM, with unauthorized access occurring June 11-12. Exfiltrated competitively sensitive information about current, former and prospective customers, including fragmented contract and opportunity data, sales notes and business contact details. Integration disabled; no operational impact. | 8-K Item 1.05View filing ↗ |
| 14 | iRhythm Holdings, Inc.IRTC | 2026-06-15 (8-K, Item 1.05) | On June 8, 2026 identified unauthorized activity involving data on third-party-hosted business applications, obtained through social engineering. On June 9 a threat actor demanded payment not to publish proprietary data, patient PHI and other personal information; exfiltration was confirmed. Declared material June 10 given data volume. No impact to products, clinical or medical device systems, patient safety, manufacturing or financial reporting. | 8-K Item 1.05View filing ↗ |
| 15 | EVERTEC, Inc.EVTC | 2026-06-09 (8-K, Item 8.01) | On May 13, 2026 learned of potential unauthorized access to customer data. Through a third-party support platform, an unauthorized party obtained financial-institution clients' transaction records, payment card numbers of some customers and in some cases customer names and contact information, primarily affecting Puerto Rico financial institutions and their customers. Access believed terminated; no operational disruption. | 8-K Item 8.01View filing ↗ |
| 16 | Popular, Inc.BPOP | 2026-06-09 (8-K, Item 8.01) | On May 15, 2026 core processing vendor Evertec notified Popular of a cybersecurity incident affecting client data, including Banco Popular de Puerto Rico; Evertec later identified additional compromised BPPR data. Affected data includes personal information of certain BPPR customers, including debit card numbers. Popular's own systems were not accessed; enhanced fraud monitoring added and contractual recovery rights against Evertec preserved. | 8-K Item 8.01View filing ↗ |
| 17 | Orrstown Financial ServicesORRF | 2026-05-29 (8-K, Item 8.01) | On May 21, 2026 received notice from a third-party vendor that an unauthorized party had accessed sensitive personal information of certain Orrstown customers as part of a multi-organization vendor breach. Orrstown's own systems and networks were not accessed. No indication of misuse; impacted customers to be notified and offered credit monitoring. Not expected to be material. | 8-K Item 8.01View filing ↗ |
| 18 | The Oncology InstituteTOI | 2026-05-22 (8-K, Item 1.05) | Follow-up to a November 2025 voluntary disclosure about a cyber incident at a software service vendor. On May 20, 2026 Kroll, the vendor's third-party administrator, notified the Company that a third party had gained unauthorized access to certain Company information systems, including systems holding patient data. Operations continued in all material respects; credit monitoring to be offered to impacted patients. | 8-K Item 1.05View filing ↗ |
| 19 | CB Financial Services (Community Bank)CBFV | 2026-05-11 (8-K, Item 1.05) | On May 5, 2026 became aware of an internal incident in which non-public customer information was handled using an unauthorized AI-based software application. Disclosed data includes customer names, Social Security numbers and dates of birth. No disruption to operations, account access, payment systems or core IT. Declared material May 7 due to volume and sensitivity; regulators engaged and notifications underway. | 8-K Item 1.05View filing ↗ |
| 20 | West Pharmaceutical ServicesWST | 2026-05-11 (8-K, Item 1.05); amended 2026-05-20 | Detected an intrusion May 4, 2026 and on May 7 determined it had experienced a material cybersecurity attack in which data was exfiltrated and certain systems were encrypted. Systems taken offline globally for containment; law enforcement notified and external cyber-forensic experts engaged. Business operations temporarily disrupted globally; core enterprise systems restored, with shipping, receiving and manufacturing restarted at some sites. | 8-K Item 1.05View filing ↗ |
| 21 | MiniMed Group, Inc.MMED | 2026-04-27 (8-K, Item 7.01) | Disclosed the April 24, 2026 incident at former parent Medtronic in which an unauthorized third party accessed data in certain Medtronic IT systems. MiniMed stated it is not aware of any compromise to IT systems used by its own business and does not expect a material impact. | 8-K Item 7.01View filing ↗ |
| 22 | Itron, Inc.ITRI | 2026-04-24 (8-K, Item 8.01); updated 2026-05-01 (8-K/A) and 2026-05-07 | On April 13, 2026 was informed an unauthorized third party had gained access to certain systems. Investigation, containment and remediation conducted with external cybersecurity experts. The May amendment reported no further unauthorized activity and limited unauthorized access to certain customer-hosted systems, with no evidence customer-facing functionality was materially affected. Not considered reasonably likely to be material. | 8-K Item 8.01View filing ↗ |
| 23 | ADT Inc.ADT | 2026-04-24 (8-K, Item 8.01) | Became aware on April 20, 2026 of unauthorized access to certain cloud-based environments. Terminated the access, activated its incident response plan, engaged third-party cybersecurity experts and notified law enforcement. Determined that only limited customer and prospective-customer data was accessed. Not believed reasonably likely to have a material impact; scope assessment continuing. | 8-K Item 8.01View filing ↗ |
| 24 | Medtronic plcMDT | 2026-04-24 (8-K, Item 7.01) | Announced that an unauthorized third party accessed data in certain Medtronic IT systems. Incident contained, incident response activated and external cybersecurity experts engaged. Investigation to date found no impact to products, patient safety, customer connections, manufacturing and distribution, or financial reporting systems. No material impact expected. | 8-K Item 7.01View filing ↗ |
| 25 | RCI Hospitality HoldingsRICK | 2026-04-10 (8-K, Item 8.01) | Subsidiary RCI Internet Services discovered on March 23, 2026 an incident beginning March 19, traced to an insecure direct object reference vulnerability on its IIS web server; investigation concluded April 7. Names, contact details, dates of birth, SSNs and driver's license numbers of numerous independent contractors were accessed. No customer or financial systems touched. Remediated with expanded MFA and disabled external IIS access. | 8-K Item 8.01View filing ↗ |
| 26 | Bitcoin Depot Inc.BTM | 2026-04-08 (8-K, Item 1.05) | On March 23, 2026 discovered unauthorized access to IT systems; the actor obtained credentials to digital asset settlement accounts and transferred ~50.903 Bitcoin (~$3.665M) out of Company wallets. Contained to the corporate environment; customer platforms unaffected and no evidence of customer PII exfiltration. Declared material April 6; preliminary loss estimate of $3.665M recorded. | 8-K Item 1.05View filing ↗ |
| 27 | Hasbro, Inc.HAS | 2026-04-01 (8-K, Item 8.01) | On March 28, 2026 identified unauthorized access to its network, activated incident response, proactively took certain systems offline and engaged third-party cybersecurity professionals. Business continuity plans invoked to keep taking orders and shipping product, with interim measures potentially running several weeks and causing delays. Scope undetermined; reviewing potentially impacted files for notification obligations. | 8-K Item 8.01View filing ↗ |
| 28 | CareCloud, Inc.CCLD | 2026-03-27 (8-K, Item 1.05) | On March 16, 2026 an unauthorized third party caused an ~8-hour disruption to 1 of 6 electronic health record environments in the CareCloud Health division. Contained the same day; Big Four cyber response team engaged; law enforcement notified. The affected environment stores patient information and assessment of exfiltration is ongoing. Declared material March 24 given data sensitivity. | 8-K Item 1.05View filing ↗ |
| 29 | Heritage Financial CorpHFWA | 2026-03-20 (8-K, Item 8.01) | On or about March 2, 2026 detected an incident involving an internal employee file-share server and exfiltration of files that may contain personal information. Customer accounts, customer-facing systems and operations were not impacted. Affected system taken offline; forensic firm, counsel, regulators, law enforcement and cyber insurer notified. Not determined material at filing. | 8-K Item 8.01View filing ↗ |
| 30 | Trio-Tech InternationalTRT | 2026-03-20 (8-K, Item 1.05) | Ransomware at a Singapore subsidiary identified March 11, 2026 encrypted certain files. Initially judged immaterial; on March 18 the incident escalated into unauthorized disclosure of Company data, prompting a material-event conclusion. Network proactively taken offline, Singapore law enforcement notified, cyber insurer engaged. No material operational disruption expected for the quarter. | 8-K Item 1.05View filing ↗ |
| 31 | Stryker CorpSYK | 2026-03-11 (8-K, Item 8.01); materiality confirmed 2026-04-09 (8-K/A, Item 1.05) | Identified a cybersecurity incident on March 11, 2026 that disrupted global business operations. Worked with third-party experts and law enforcement to contain and restore. On April 9 determined the incident had a material impact on operations and on Q1 2026 financial results, though not on full-year 2026 guidance. Fully operational across its global manufacturing network as of the amendment. | 8-K/A Item 1.05View filing ↗ |