The 4-Day Edge: Why Wall Street Monitors 8-K Filings in Real Time
Research & Analysis

The 4-Day Edge: Why Wall Street Monitors 8-K Filings in Real Time

8K Intel ResearchMar 16, 202613 min read

On February 21, 2024, UnitedHealth Group filed a Form 8-K with the SEC disclosing that a ‘suspected nation-state associated cyber security threat actor’ had gained access to Change Healthcare systems. Within hours, institutional investors had already repositioned. By the time mainstream financial media covered the story, the stock had moved. The breach ultimately affected 190 million people and cost UnitedHealth $3.1 billion in response costs.

This is the power of the 8-K filing. But the real question is: which 8-Ks actually break news — and which ones just confirm what institutions already know?

While quarterly 10-Q and annual 10-K reports arrive on a predictable schedule, the 8-K is the SEC’s breaking news form. It can land at any moment — disclosing acquisitions, CEO departures, cybersecurity breaches, earnings surprises, and bankruptcy filings. But not all 8-Ks are created equal. Academic research reveals a nuanced picture: for some categories, institutional investors already know. For others, the EDGAR filing is genuinely the first public disclosure.

What Makes the 8-K Different

The SEC created Form 8-K in 1936 as the mechanism for ‘current’ reports — filings triggered by extraordinary corporate events rather than the calendar. For decades, companies had a generous 10–15 day window to file. That changed dramatically.

After the Enron and WorldCom scandals, the Sarbanes-Oxley Act of 2002 mandated ‘real time issuer disclosure.’ In 2004, the SEC finalized sweeping reforms: the number of mandatory reportable items expanded from 9 to approximately 20, and the filing deadline was compressed to just 4 business days. Today, the form covers 33 items across nine categories — from M&A agreements (Item 1.01) to cybersecurity incidents (Item 1.05, added December 2023) to CEO departures (Item 5.02).

The most commonly filed items — Item 2.02 (Results of Operations) and Item 7.01 (Reg FD Disclosure) — are filed the same day as the triggering event over 80% of the time. This isn’t quarterly data you can plan around. This is real-time corporate intelligence.

FORM 8-K BY THE NUMBERS

33Reportable Items
4Business Days to File
11%of All EDGAR Filings
80%+Filed Same Day

REGULATORY EVOLUTION

90 Years of 8-K Reform

1936

SEC creates Form 8-K under the Securities Exchange Act of 1934. Filing deadline: 10–15 days. Limited to a handful of extraordinary corporate events.

2002

Sarbanes-Oxley Act passes in response to Enron and WorldCom. Section 409 mandates ‘real time issuer disclosure’ of material changes in financial condition.

2004

Major reform: reportable items expand from 9 to ~20. Filing deadline compressed to 4 business days. New limited safe harbor for good-faith filing delays.

2023

SEC adds Item 1.05: material cybersecurity incidents must be disclosed within 4 business days. DOJ delay provision for national security. 55 incidents reported in the first year.

The Academic Evidence: A More Nuanced Picture

The most cited research on 8-K filings paints a more complex picture than the simple ‘monitor EDGAR, beat Wall Street’ narrative. Here’s what three landmark studies actually found — and what it means for individual investors.

STUDY 1 — THE HONEST PICTURE

‘Who Pays Attention to SEC Form 8-K?’

Ben-Rephael, Da, Easton & Israelsen — The Accounting Review, 2022

This landmark study reveals a critical nuance: for many 8-K categories, significant price discovery occurs before the filing even hits EDGAR. Institutional investors, measured by Bloomberg terminal activity ($20k+/year subscriptions), act on the event date — often triggered by corporate press releases that Bloomberg distributes within seconds. Retail investors, measured by Google Trends, primarily react on the filing date, driven by media coverage. By that point, institutions have already positioned themselves. But here’s the crucial detail the headlines miss: the study found this pre-filing advantage varies dramatically by filing type. For Items 2.02 (earnings) and 7.01 (Reg FD), which are filed same-day 80%+ of the time, press releases precede or accompany the 8-K. But for Item 5.02 (executive changes), institutional attention actually increases between the event and filing dates — suggesting the 8-K itself sometimes carries genuinely new information.

STUDY 2

‘Does Information Intensity Matter for Stock Returns?’

Xiaofei Zhao — Management Science, 2017

Zhao used 8-K filing frequency as a measure of a firm’s material information flow and found that an information-intensity-based long-short portfolio generates a return spread of 4.3% per year, with abnormal returns of 4.4% per year after Fama-French three-factor plus momentum adjustment. The marginal return impact is highest at low information intensity and high prior volatility — meaning infrequent filers that suddenly file an 8-K create the largest price dislocations.

STUDY 3

‘Asymmetric Inefficiency in the Market Response to Non-Earnings 8-K Information’

Li — Contemporary Accounting Research, 2022

Li found that markets systematically overreact to good news but underreact to bad news in non-earnings 8-K filings. This creates a persistent mispricing pattern that informed investors can exploit — prices increase too much for positive disclosures and fail to decrease enough for negative ones, resulting in systematic overpricing for both good and bad news.

When 8-Ks Move Markets: Real-World Case Studies

The SEC’s new cybersecurity disclosure rules (Item 1.05), effective December 18, 2023, created an entirely new category of market-moving 8-Ks. In the first year alone, 55 cybersecurity incidents were reported by 54 companies. Several became front-page events that demonstrated exactly why real-time 8-K monitoring matters.

CYBERUNH

UnitedHealth / Change Healthcare

February 2024

Nation-state cyberattack disclosed via 8-K. BlackCat/ALPHV ransomware affected 190 million people. Response costs exceeded $3.1 billion in 2024 alone.

$3.1Bresponse cost
CYBERT

AT&T Data Breach

July 2024

Filed Item 1.05 8-K disclosing 109 million customer call records exfiltrated. DOJ approved an 84-day delayed filing due to national security — one of the first uses of the delay provision.

109Mrecords exposed
CYBERMGM

MGM Resorts Ransomware

September 2023

Scattered Spider/AlphV ransomware forced MGM to take systems offline. The 8-K disclosed a ‘cybersecurity issue’ that ultimately cost an estimated $100M in Adjusted Property EBITDAR for Las Vegas operations.

~$100MEBITDAR impact
CYBERCLX

Clorox Cyberattack

August 2023

Cyberattack disclosed via 8-K caused widespread product shortages across retail channels. Direct costs hit $49M in 2023 with an additional $50–60M expected in FY24.

$49M+direct costs (2023)

Where EDGAR Monitoring Actually Matters

If the Ben-Rephael study tells us that institutions act on press releases before the 8-K is filed, the natural question is: why monitor EDGAR at all? The answer lies in which categories of 8-K have no preceding press release — where the filing itself is genuinely the first public disclosure.

Cybersecurity incidents (Item 1.05) are the strongest case. In the first year of the new SEC cyber rules, less than 10% of companies issued a supplementary press release alongside their 8-K. For the vast majority, the EDGAR filing was the primary — and often only — disclosure. No Bloomberg alert, no wire service pickup. Just a filing on EDGAR that, without real-time monitoring, you wouldn’t see until the media cycle caught up hours or days later.

The same is true for many executive departures (Item 5.02) and material agreements (Item 1.01). These are also the categories with the highest market impact — the $3.1B UnitedHealth breach, the $100M MGM attack, surprise CEO exits. The filings that move markets most are often the ones with no advance warning.

FILING TYPE VALUE MATRIX

When Does the 8-K Break News?

Not all 8-K categories are equal. For some, press releases precede the filing. For others, EDGAR is the first and only public disclosure.

CYBERCybersecurity Incidents
Usually yes (<10% had PR)
High
EXECExecutive Departures
Often yes
High
M&AMaterial Agreements
Sometimes
Medium
INFOEarnings / Results
No — PR first (80%+ same-day)
Low (speed) / High (summary)
INFORegulation FD
No — simultaneous
Low (speed) / High (summary)

The Honest Case for Real-Time 8-K Monitoring

We’re not going to pretend that monitoring EDGAR gives you the same edge as a Bloomberg terminal for earnings announcements. For the most common 8-K categories — earnings and Reg FD disclosures — press releases hit institutional feeds before the 8-K is even filed. The Ben-Rephael study is clear on this point, and we respect the research.

But here’s what the research also shows: for cybersecurity breaches, executive departures, and material agreements — filing categories that are growing rapidly and carry enormous market impact — the 8-K filing on EDGAR is frequently the first and only public disclosure. No press release. No Bloomberg alert. In the first year of the SEC’s cyber rules, less than 10% of companies issued a separate press release. For these filings, real-time EDGAR monitoring isn’t a nice-to-have. It’s the only way to know.

That’s what 8K Intel is built for. We poll SEC EDGAR every 15 seconds, use AI to summarize the filing with sentiment analysis, and push it to your phone — all within 60 seconds. For earnings filings, our AI summary helps you understand the full document faster than reading it yourself. For cybersecurity incidents, executive changes, and material agreements, we get you the news before anyone else even knows it exists.

THE FILINGS THAT MATTER

Know what matters. When it matters.

For cybersecurity breaches, executive departures, and material agreements, the 8-K filing is often the first public disclosure. 8K Intel monitors EDGAR every 15 seconds, summarizes with AI, and delivers to your phone — all within 60 seconds. Free during beta.

Download on the App StoreGet it on Google Play

REFERENCES & SOURCES

Citations

Academic Research

[1] Ben-Rephael, A., Da, Z., Easton, P. & Israelsen, R. (2022). ‘Who Pays Attention to SEC Form 8-K?’ The Accounting Review, 97(5), 59-87.

[2] Zhao, X. (2017). ‘Does Information Intensity Matter for Stock Returns? Evidence from Form 8-K Filings.’ Management Science, 63(5), 1382-1404.

[3] Li, Q. (2022). ‘Asymmetric Inefficiency in the Market Response to Non-Earnings 8-K Information.’ Contemporary Accounting Research, 39(3).

SEC & Regulatory Sources

[4] SEC (2004). ‘Additional Form 8-K Disclosure Requirements and Acceleration of Filing Date.’ Release No. 33-8400.

[5] SEC (2023). ‘Cybersecurity Risk Management, Strategy, Governance, and Incident Disclosure.’ Release No. 33-11216.

[6] SEC Division of Corporation Finance (2024). ‘Cybersecurity Incidents’ Staff Guidance, May 21, 2024.

[7] SEC Investor Bulletin: ‘How to Read an 8-K.’ investor.gov.

Incident Reports & Analysis

[8] UnitedHealth Group (2024). 8-K Filing, Feb 21, 2024. Change Healthcare cybersecurity incident disclosure.

[9] AT&T (2024). 8-K Filing (Item 1.05), July 12, 2024. Customer call records data breach disclosure.

[10] MGM Resorts (2023). 8-K Filing, Sept 2023. Cybersecurity incident — Scattered Spider/AlphV ransomware.

[11] Clorox Company (2023). 8-K Filing, Aug 2023. Cyberattack causing operational disruption.

Data & Industry Reports

[12] sec-api.io (2023). ‘Analyzing SEC EDGAR Filing Trends and Patterns from 1994 to 2022.’

[13] SEC (2023). ‘Number of EDGAR Filings by Form Type.’ sec.gov/data-research.

[14] Debevoise & Plimpton (2025). ‘Lessons Learned: One Year of Form 8-K Material Cybersecurity Incident Filings.’

[15] Dorsey & Whitney (2004). ‘SEC Expands and Accelerates Form 8-K Reporting.’

[16] Greenberg Traurig (2025). ‘SEC Cybersecurity Disclosure Trends 2025 Update on Corporate Reporting Practices.’

[17] ICR Inc. ‘What is an 8-K and How Do You Read One?’

[18] Wang, W. (2020). ‘Demand for Information and Stock Returns: Evidence from EDGAR.’ University of Connecticut.

← Back to all posts