Forensic · 8-K concepts

What is a buried 8-K? Material disclosures hiding under Item 8.01

Public companies file Form 8-K to disclose material events. Each event has a specific item code: 1.05 for cyber, 5.02 for officer departures, 2.06 for impairments, and so on. Item 8.01 — 'Other Events' — is supposed to be a catch-all for the rest. In practice, it's where filers sometimes bury news they don't want highlighted.

The structure of an 8-K

Every 8-K has a header listing which items the filer is reporting. A clean filing might say "Item 5.02: Departure of Directors or Certain Officers" — anyone scanning would immediately know an officer left. But if the same departure is filed under Item 8.01 with a vague title like "Press Release Issued," it's effectively hidden from automated trackers.

The buried-events pattern

Across a sample of 4,251 8-K filings, roughly 7.3% of Item 8.01 filings contained body-text language matching a more specific item code that the filer didn't actually report. The most common buried items:

• 1.05 (Cybersecurity Incidents) — phrases like "ransomware," "unauthorized access," "threat actor" appearing under 8.01 instead of 1.05
• 5.02 (Officer Departures) — "resigned," "stepped down," "no longer serve" appearing in 8.01 announcements without a 5.02 tag
• 1.01 (Material Definitive Agreement) — actual merger/acquisition language under 8.01 instead of 1.01

Why filers do it

Some reasons are innocent: drafters genuinely think Item 8.01 covers it. Others are less innocent: the SEC's EDGAR full-text search indexes filings by item code, and analysts often filter by code. Burying under 8.01 means fewer eyes on the disclosure. It's not strictly a violation — the SEC has interpretive guidance suggesting filers use the most specific applicable item, but enforcement is rare.

How to spot a buried event yourself

Open the 8-K filing on SEC EDGAR. Read the actual body text, not just the item header. If you find language describing cyber, officer changes, mergers, or bankruptcy that isn't tagged with the corresponding item code, you've found a buried event.

What this looks like in practice

Forensic's body-text classifier scans every 8-K for keyword patterns under Item 8.01 and flags discrepancies. If a 5.02-style officer departure is hiding under 8.01, the algorithm catches it and surfaces it as a "buried_cyber" or "buried_officer_departure" signal.

Run a forensic check on any US-listed ticker for free: filingfirehose.com/forensic. Examples of tickers with buried-event flags in our database are linked below.