The Tool Desk
Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Some links on this page are affiliate links: if you buy through them we may earn a commission, at no extra cost to you.
The SEC did not fine Flagstar for failing to publish every technical detail of a data breach. It penalized the company for disclosures the agency found misleading: known disruption and the exfiltration of customer information were described in narrower or hypothetical terms. For investors, the distinction matters. Companies can report an incident while an investigation is still underway, but they should be clear about what they know, what remains uncertain, and how the incident may affect the business.
What happened at Flagstar
On December 16, 2024, the Securities and Exchange Commission announced a settlement with Flagstar Bancorp, now Flagstar Financial, over statements about a late-2021 Citrix-related cyber incident. The SEC said the incident disrupted the bank’s network, encrypted data, and resulted in the exfiltration of personally identifiable information associated with approximately 1.5 million people.
The SEC’s order focused on how the company described the incident and its risks:
Recommended Free Tools
- In its March 1, 2022 Form 10-K, Flagstar used risk-factor language saying cyberattacks may interrupt operations or compromise customer information, although the SEC said those types of events had already occurred.
- A June 17, 2022 customer notice described unauthorized “access,” while the SEC said the company knew the incident had involved network disruption and customer-data exfiltration.
- The SEC said an August 9, 2022 Form 10-Q repeated materially misleading characterizations.
- The SEC also found deficient disclosure controls: information about the incident was not adequately brought to the people responsible for evaluating materiality and disclosure.
Flagstar agreed to pay a $3.55 million civil penalty and to a cease-and-desist order, without admitting or denying the SEC’s findings. The agency characterized the violations as negligent; the settlement should not be recast as a finding that the company intentionally committed fraud. The SEC’s order provides the underlying findings.
#1 Best Overall
The problem is a misleading impression, not an unfinished investigation
A company need not have a final forensic report before it can make a truthful disclosure. The important distinction is between incomplete information and wording that makes known facts sound hypothetical, less serious, or different from what they are.
| Situation | What the wording should convey |
|---|---|
| Known facts | State material known facts accurately—for example, that unauthorized access occurred, systems were disrupted, or data was exfiltrated, as applicable. |
| Unresolved scope | Say what is not yet known, such as the exact number of affected people or the complete categories of data involved. |
| Misleading framing | Do not describe a realized event only as something that “may” happen, or call known exfiltration merely “access” if that leaves readers with a materially false impression. |
Terms such as “limited,” “isolated,” or “no significant impact” can be appropriate only when the company has a sound basis for them and they do not obscure important known facts. If the investigation is incomplete, the disclosure should identify that uncertainty rather than offer unsupported reassurance.
The broader SEC message was also visible in its October 2024 actions involving Unisys, Avaya, Check Point and Mimecast. The agency alleged that those companies had minimized or described known intrusions in misleading ways; penalties ranged from $990,000 to $4 million. The cases involve separate companies, facts and orders, but share a concern about how known cyber events and risks are described. The SEC’s announcement summarizes those actions.
What current SEC rules require
Flagstar’s conduct arose under older disclosure requirements. A more specific SEC cybersecurity rule took effect in December 2023. Under Form 8-K Item 1.05, a reporting company must disclose a cybersecurity incident that it determines is material. The disclosure must describe the material aspects of the incident’s nature, scope and timing, and its material impact or reasonably likely material impact on the company, including its financial condition and results of operations.
Generally, the Form 8-K is due within four business days after the company determines the incident is material. That period does not automatically start on the day an incident is discovered. But the company must make its materiality determination without unreasonable delay; it should not postpone the assessment simply to wait for a complete forensic picture. See the SEC’s final rule and the Federal Register rule text.
Not every cyber incident requires an Item 1.05 filing. The trigger is a determination that the incident is material. Materiality is not limited to a known dollar loss or an immediate effect on quarterly earnings. Companies should consider the incident’s full context and whether it could significantly alter the total mix of information available to a reasonable investor. Relevant factors can include:
Rank #3
- Effects on financial condition, results of operations, costs or liquidity.
- Disruption to operations, business continuity or critical systems.
- Exfiltration or compromise of sensitive information.
- Consequences for customers, vendors or other business relationships.
- Reputational harm, competitiveness, litigation or regulatory exposure.
An incident at a cloud provider or other third party is not automatically immaterial because the affected data is hosted elsewhere. The SEC has said a significant breach of a registrant’s data does not become immaterial solely because it resides on a third-party system.
Quick wins for a faster PC:
Clear out junk files and repair common Windows errorsFree Scan →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Repair Windows errors before they cause bigger problemsFix Now →Companies can disclose before they know the full scope
A company may not yet know the exact number of affected individuals, all data categories involved, final remediation costs or the incident’s ultimate operational effects when it assesses materiality. That uncertainty does not, by itself, justify delaying the assessment. An initial filing can describe the material facts known at the time and clearly identify what remains under investigation. Later, the company should amend or update its disclosures when material information becomes available or changes the account.
A useful early disclosure is candid rather than falsely conclusive: it distinguishes confirmed facts from unresolved questions, avoids implying that an absence of a known impact is proof that no impact exists, and explains material effects that have occurred or are reasonably likely. Investors generally need that decision-useful account—not a finished technical postmortem.
Truthful disclosure does not mean publishing an attacker’s playbook
The SEC rule does not require a company to reveal every technical detail. The rule recognizes that specific information about response plans, systems, networks, devices or vulnerabilities may be withheld when disclosure would impede response or remediation. Companies can protect sensitive defensive information while still describing the material nature and impact of an incident accurately.
That is the balance: tell investors the material facts and explain uncertainty; do not publish unnecessary details that could make systems less secure. The rule also provides a limited filing delay when the U.S. attorney general determines that immediate disclosure would pose a substantial risk to national security or public safety. It is not a general exception that a company can invoke on its own whenever disclosure is inconvenient.
A practical disclosure process
Flagstar’s order underscores that accurate wording depends on sound controls for getting incident facts to the people who make disclosure decisions. A company’s process should connect security, legal, finance and communications teams rather than leave any one group to assess the incident in isolation.
Best Value
- Set ownership before an incident. Define who declares an incident, gathers technical facts, leads the materiality assessment, approves public disclosures and escalates issues to the general counsel, CFO, CEO, board committee and investor-relations team.
- Maintain a time-stamped fact record. Track when the incident was discovered and, if known, when access began; the systems involved; whether systems were disrupted, encrypted or unavailable; whether data was accessed, altered or exfiltrated; and the operational, financial, customer and regulatory effects. For each material fact, record its source and confidence level.
- Separate confirmed facts, assumptions and unknowns. Keep the assessment specific enough to support decisions without treating an inference as a verified fact. Record what is still being investigated, including data categories, affected population and impact.
- Make the materiality decision promptly. Consider operational and qualitative consequences as well as quantifiable financial effects. Document the decision, its rationale, who made it and when; do not wait for complete certainty merely because the investigation continues.
- Reconcile communications. Compare the Form 8-K, periodic reports, customer notices, breach notifications, website statements and media responses. Different audiences may have different legal disclosure requirements and timelines, but one account should not materially contradict or misleadingly narrow another.
- Plan for follow-up. Assign responsibility for monitoring material developments and assessing whether an amendment or later update is needed.
Before approving a draft, ask: Does it accurately state what happened? Does it distinguish known facts from uncertainty? Does it describe material business impact or reasonably likely impact? Could a reasonable reader get a false impression from an omitted fact or a reassuring phrase? Is the language consistent with other statements already made? Are any technical details unnecessary and risky to disclose?
The original CSO Online headline called Flagstar the latest SEC fine when it was published on December 17, 2024, one day after the SEC announcement. That was a time-specific description, not a reliable present-day ranking. Later SEC filings—including iRhythm’s June 2026 filing and West Pharmaceutical Services’ initial filing and amendment—illustrate that companies can report known facts while investigations continue. Those filings are not SEC findings of wrongdoing.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
