The 8-K goes drip…drip…drip

If you’ve ever had a leaky faucet in your house or stayed someplace with a dripping sink, you probably know how annoying the constant drip, drip, drip sound can be. It’s exactly the same when companies choose to slowly disclose information over the course of several weeks or months.

Take First American Financial Corp., for example. On Dec. 22, just before the markets closed for Christmas, the company filed this 8-K that disclosed “unauthorized activity on certain of its information technology systems”. A week later — on Dec. 29, about 30 minutes after the markets closed for the New Year’s holiday, the company put out this amended 8-K (or 8-K/A for my fellow filings geeks out there), the company said it “believes it has contained the incident” and was trying to assess whether the incident would have a material impact on its results.

Then, this past Friday, there was yet another amended 8-K filed after 4 pm est. This time, the company said it did expect the incident to have a material impact on its fourth-quarter results adding, “certain transactions that would have been consummated in the fourth quarter of 2023 were delayed and, consequently, revenue from those transactions will not be recognized until the first quarter of 2024. Certain other transactions that would have been consummated in the fourth quarter of 2023 were moved to other providers, which resulted in a loss of revenue.”

Look, we get that getting control of a cyber-security incident takes time, especially during the holidays, when work often slows to a crawl. But just like a leaky sink, it’s best to fix it quickly, instead of waiting for further damage or a hefty water bill.