The 4-Day Edge: Why Wall Street Monitors 8-K Filings in Real Time
On February 21, 2024, UnitedHealth Group filed a Form 8-K with the SEC disclosing that a ‘suspected nation-state associated cyber security threat actor’ had gained access to Change Healthcare systems. Within hours, institutional investors had already repositioned. By the time mainstream financial media covered the story, the stock had moved. The breach ultimately affected 190 million people and cost UnitedHealth $3.1 billion in response costs.
This is the power of the 8-K filing. But the real question is: which 8-Ks actually break news — and which ones just confirm what institutions already know?
While quarterly 10-Q and annual 10-K reports arrive on a predictable schedule, the 8-K is the SEC’s breaking news form. It can land at any moment — disclosing acquisitions, CEO departures, cybersecurity breaches, earnings surprises, and bankruptcy filings. But not all 8-Ks are created equal. Academic research reveals a nuanced picture: for some categories, institutional investors already know. For others, the EDGAR filing is genuinely the first public disclosure.
What Makes the 8-K Different
The SEC created Form 8-K in 1936 as the mechanism for ‘current’ reports — filings triggered by extraordinary corporate events rather than the calendar. For decades, companies had a generous 10–15 day window to file. That changed dramatically.
After the Enron and WorldCom scandals, the Sarbanes-Oxley Act of 2002 mandated ‘real time issuer disclosure.’ In 2004, the SEC finalized sweeping reforms: the number of mandatory reportable items expanded from 9 to approximately 20, and the filing deadline was compressed to just 4 business days. Today, the form covers 33 items across nine categories — from M&A agreements (Item 1.01) to cybersecurity incidents (Item 1.05, added December 2023) to CEO departures (Item 5.02).
The most commonly filed items — Item 2.02 (Results of Operations) and Item 7.01 (Reg FD Disclosure) — are filed the same day as the triggering event over 80% of the time. This isn’t quarterly data you can plan around. This is real-time corporate intelligence.
FORM 8-K BY THE NUMBERS
REGULATORY EVOLUTION
90 Years of 8-K Reform
SEC creates Form 8-K under the Securities Exchange Act of 1934. Filing deadline: 10–15 days. Limited to a handful of extraordinary corporate events.
Sarbanes-Oxley Act passes in response to Enron and WorldCom. Section 409 mandates ‘real time issuer disclosure’ of material changes in financial condition.
Major reform: reportable items expand from 9 to ~20. Filing deadline compressed to 4 business days. New limited safe harbor for good-faith filing delays.
SEC adds Item 1.05: material cybersecurity incidents must be disclosed within 4 business days. DOJ delay provision for national security. 55 incidents reported in the first year.
The Academic Evidence: A More Nuanced Picture
The most cited research on 8-K filings paints a more complex picture than the simple ‘monitor EDGAR, beat Wall Street’ narrative. Here’s what three landmark studies actually found — and what it means for individual investors.
STUDY 1 — THE HONEST PICTURE
‘Who Pays Attention to SEC Form 8-K?’
Ben-Rephael, Da, Easton & Israelsen — The Accounting Review, 2022
STUDY 2
‘Does Information Intensity Matter for Stock Returns?’
Xiaofei Zhao — Management Science, 2017
STUDY 3
‘Asymmetric Inefficiency in the Market Response to Non-Earnings 8-K Information’
Li — Contemporary Accounting Research, 2022
When 8-Ks Move Markets: Real-World Case Studies
The SEC’s new cybersecurity disclosure rules (Item 1.05), effective December 18, 2023, created an entirely new category of market-moving 8-Ks. In the first year alone, 55 cybersecurity incidents were reported by 54 companies. Several became front-page events that demonstrated exactly why real-time 8-K monitoring matters.
UnitedHealth / Change Healthcare
February 2024
Nation-state cyberattack disclosed via 8-K. BlackCat/ALPHV ransomware affected 190 million people. Response costs exceeded $3.1 billion in 2024 alone.
AT&T Data Breach
July 2024
Filed Item 1.05 8-K disclosing 109 million customer call records exfiltrated. DOJ approved an 84-day delayed filing due to national security — one of the first uses of the delay provision.
MGM Resorts Ransomware
September 2023
Scattered Spider/AlphV ransomware forced MGM to take systems offline. The 8-K disclosed a ‘cybersecurity issue’ that ultimately cost an estimated $100M in Adjusted Property EBITDAR for Las Vegas operations.
Clorox Cyberattack
August 2023
Cyberattack disclosed via 8-K caused widespread product shortages across retail channels. Direct costs hit $49M in 2023 with an additional $50–60M expected in FY24.
Where EDGAR Monitoring Actually Matters
If the Ben-Rephael study tells us that institutions act on press releases before the 8-K is filed, the natural question is: why monitor EDGAR at all? The answer lies in which categories of 8-K have no preceding press release — where the filing itself is genuinely the first public disclosure.
Cybersecurity incidents (Item 1.05) are the strongest case. In the first year of the new SEC cyber rules, less than 10% of companies issued a supplementary press release alongside their 8-K. For the vast majority, the EDGAR filing was the primary — and often only — disclosure. No Bloomberg alert, no wire service pickup. Just a filing on EDGAR that, without real-time monitoring, you wouldn’t see until the media cycle caught up hours or days later.
The same is true for many executive departures (Item 5.02) and material agreements (Item 1.01). These are also the categories with the highest market impact — the $3.1B UnitedHealth breach, the $100M MGM attack, surprise CEO exits. The filings that move markets most are often the ones with no advance warning.
FILING TYPE VALUE MATRIX
When Does the 8-K Break News?
Not all 8-K categories are equal. For some, press releases precede the filing. For others, EDGAR is the first and only public disclosure.
The Honest Case for Real-Time 8-K Monitoring
We’re not going to pretend that monitoring EDGAR gives you the same edge as a Bloomberg terminal for earnings announcements. For the most common 8-K categories — earnings and Reg FD disclosures — press releases hit institutional feeds before the 8-K is even filed. The Ben-Rephael study is clear on this point, and we respect the research.
But here’s what the research also shows: for cybersecurity breaches, executive departures, and material agreements — filing categories that are growing rapidly and carry enormous market impact — the 8-K filing on EDGAR is frequently the first and only public disclosure. No press release. No Bloomberg alert. In the first year of the SEC’s cyber rules, less than 10% of companies issued a separate press release. For these filings, real-time EDGAR monitoring isn’t a nice-to-have. It’s the only way to know.
That’s what 8K Intel is built for. We poll SEC EDGAR every 15 seconds, use AI to summarize the filing with sentiment analysis, and push it to your phone — all within 60 seconds. For earnings filings, our AI summary helps you understand the full document faster than reading it yourself. For cybersecurity incidents, executive changes, and material agreements, we get you the news before anyone else even knows it exists.
THE FILINGS THAT MATTER
Know what matters. When it matters.
For cybersecurity breaches, executive departures, and material agreements, the 8-K filing is often the first public disclosure. 8K Intel monitors EDGAR every 15 seconds, summarizes with AI, and delivers to your phone — all within 60 seconds. Free during beta.
REFERENCES & SOURCES
Citations
Academic Research
[1] Ben-Rephael, A., Da, Z., Easton, P. & Israelsen, R. (2022). ‘Who Pays Attention to SEC Form 8-K?’ The Accounting Review, 97(5), 59-87.
[2] Zhao, X. (2017). ‘Does Information Intensity Matter for Stock Returns? Evidence from Form 8-K Filings.’ Management Science, 63(5), 1382-1404.
[3] Li, Q. (2022). ‘Asymmetric Inefficiency in the Market Response to Non-Earnings 8-K Information.’ Contemporary Accounting Research, 39(3).
SEC & Regulatory Sources
[4] SEC (2004). ‘Additional Form 8-K Disclosure Requirements and Acceleration of Filing Date.’ Release No. 33-8400.
[5] SEC (2023). ‘Cybersecurity Risk Management, Strategy, Governance, and Incident Disclosure.’ Release No. 33-11216.
[6] SEC Division of Corporation Finance (2024). ‘Cybersecurity Incidents’ Staff Guidance, May 21, 2024.
[7] SEC Investor Bulletin: ‘How to Read an 8-K.’ investor.gov.
Incident Reports & Analysis
[8] UnitedHealth Group (2024). 8-K Filing, Feb 21, 2024. Change Healthcare cybersecurity incident disclosure.
[9] AT&T (2024). 8-K Filing (Item 1.05), July 12, 2024. Customer call records data breach disclosure.
[10] MGM Resorts (2023). 8-K Filing, Sept 2023. Cybersecurity incident — Scattered Spider/AlphV ransomware.
[11] Clorox Company (2023). 8-K Filing, Aug 2023. Cyberattack causing operational disruption.
Data & Industry Reports
[12] sec-api.io (2023). ‘Analyzing SEC EDGAR Filing Trends and Patterns from 1994 to 2022.’
[13] SEC (2023). ‘Number of EDGAR Filings by Form Type.’ sec.gov/data-research.
[14] Debevoise & Plimpton (2025). ‘Lessons Learned: One Year of Form 8-K Material Cybersecurity Incident Filings.’
[15] Dorsey & Whitney (2004). ‘SEC Expands and Accelerates Form 8-K Reporting.’
[16] Greenberg Traurig (2025). ‘SEC Cybersecurity Disclosure Trends 2025 Update on Corporate Reporting Practices.’
[17] ICR Inc. ‘What is an 8-K and How Do You Read One?’
[18] Wang, W. (2020). ‘Demand for Information and Stock Returns: Evidence from EDGAR.’ University of Connecticut.