Stryker Corporation filed a Form 8-K/A with the US Securities and Exchange Commission (SEC) on 10 April 2026 disclosing the March MDM compromise as a material cybersecurity incident, acknowledging a hit to Q1 2026 earnings while maintaining full-year guidance1. The 8-K/A is the amendment form listed companies file to update a previously reported event; Stryker had filed an initial disclosure in March and the April filing added the material-impact conclusion.
Materiality is the test the SEC's 2023 cyber disclosure rule turns on. Since the rule took effect, every publicly traded US company has had four business days from determining an incident is material to file an 8-K describing its nature, scope and timing. Stryker's lawyers had to decide that a credential-only attack, with no ransomware demand, no encrypted files and no exfiltrated customer data proven at scale, nevertheless met the threshold. Their answer, filed in black and white to the SEC, is that it did.
The filing matters because disclosure counsel at every Fortune 1000 company now has a precedent. Before Stryker, the working assumption inside many general-counsel offices was that a material 8-K attached to a cyber incident meant ransomware, data theft at scale or operational shutdown. Stryker's 8-K/A reframes the threshold: an attack that required no malware, left no ransom note and compromised no customer records was still material because the business disruption and remediation cost were severe enough to move the quarter's numbers. For boards with proxy statements on the line, that reframes which incidents the disclosure committee has to escalate.
