SEC EDGAR (8-K cyber filings)

https://efts.sec.gov/LATEST/search-index?q=%22Item+1.05%22&forms=8-K

US public-company breach disclosures via Item 1.05; primary source. Use the EDGAR full-text search API at https://efts.sec.gov/LATEST/search-index?q=...&forms=8-K with date range parameters (&dateRange=custom&startdt=YYYY-MM-DD&enddt=YYYY-MM-DD). Best query strings: q=%22Item+1.05%22 (most precise, only material cyber incidents) or q=%22cybersecurity+incident%22 (broader). The API returns metadata only (no doc_text); drill into each match's per-company filing index at https://www.sec.gov/cgi-bin/browse-edgar?action=getcompany&CIK=<CIK>&type=8-K to read the actual filing. Cite the per-filing URL (e.g. /Archives/edgar/data/<CIK>/<accession>/...). | 2026-06-20 full audit (v2.62): live=Y, drill=Y. FETCH → api: `python3 tools/fetch_source.py sec-edgar 8k <startdt> <enddt> 1.05` (returns Item 1.05 hits w/ filing_url) then bridge `url <filing_index>` to find the .htm doc, then bridge `url <doc.htm>` to read the Item 1.05 body. AVOID: The documented efts.sec.gov ...search-index API URL returns metadata only (no doc text); don't expect the body there. Use the sec-edgar subcommand for discovery, then drill the per-filing .htm. WebFetch on efts JSON is unnecessary.. | 2026-07-05 admiralty audit: A (was HIGH), SEC's official EDGAR system; Item 1.05 8-Ks are first-party regulatory breach disclosures by the companies, i.e. primary-authority ground truth. Justified A: government regulator + legally-accountable first-party filings. Status stays active. | 2026-09-29: health flag was a false positive (metadata-only JSON envelope under the alnum floor); `sec-edgar 8k` (default Item 1.05, trailing 14 d) is the correct content-check command, verified live: 1 hit in the last 14 d (Astrana Health, 2026-09-23), 17 hits 2026-07-01..2026-09-29. An empty 14-day window is a normal quiet result, not a failure; widen with `sec-edgar 8k <start> <end> 1.05`. (2026-09-29T2134Z-audit) | 2026-10-18 (S4): `sec-edgar 8k <start> <end> 1.05` is the clean sweep; item 8.01 is too noisy, and a full-text query through `url --direct` on efts.sec.gov with q, dateRange=custom, startdt and enddt is the better supplement. | 2026-10-24 (S4): `sec-edgar 8k 2026-10-21 2026-10-24 1.05` returns 0 hits; the full-text supplement `url --direct 'https://efts.sec.gov/LATEST/search-index?q=%22cybersecurity%20incident%22%20OR%20%22unauthorized%20access%22&forms=8-K&dateRange=custom&startdt=2026-10-21&enddt=2026-10-24'` works and found the Quest Diagnostics 8-K (item 8.01). Recipe confirmed, not a failure.