A cyber incident prices on quantification, not on disclosure — and the first estimate is half the truth

Claim

(1) The day-one move is noise

Case	Day-one move	Eventual cost
Applied Materials	+0.04%	$250M deferred, fully recovered
UnitedHealth	+1.0%	$3.09B
Merck	−0.6%	~$700M+
Norsk Hydro	−0.7%	$74–85M — closed above the pre-attack price on day two
Cencora	−0.8%	~$0 disclosed
Johnson Controls	−1.1%	~$59M net
Henry Schein	−2.1%	$350–400M + permanent customer loss
Stryker	−3.6%	~$335–425M, one quarter
BSX	−3.3%	unknown, live

UnitedHealth rose on the day it disclosed the most expensive corporate cyberattack on record. The day-one reaction has no correlation with the outcome. Do not read it, and do not let a client read it.

(2) The market pays for certainty, and quantification usually rallies the stock

• Henry Schein's worst single day was −15.6% — the day it filed a Form 12b-25 saying it could not file its 10-Q on time. Then it rose +8.2% on the day it finally quantified the damage at $350–400M of lost sales and $0.55–0.75 of EPS.
• Clorox fell on the 8-K (−0.5%), again on "material" (−3.0%), again on the range (−5.2%), troughed at the earnings print — and rose +6.6% the next day.
• Both stocks recovered their pre-attack price within two months to roughly a year, long before the business recovered.

The tradeable event is the quantification. The disclosure is not.

(3) The first estimate is roughly half

• UnitedHealth: $1.35–1.6B initial → $3.09B final, +109%.
• Henry Schein needed a second guidance cut nine months after the first.
• Merck told the SEC the impact "has not been material" while claiming $1.4B from its insurers — accounting materiality is not economic loss.

Therefore an Item 8.01 filing saying "the Company has not yet determined whether the incident is reasonably likely to have a material impact" conveys nothing. UnitedHealth's initial 8-K said the same thing and was off by $3.09B. Treat it as the absence of information, not as comfort.

How to apply

1. Never trade or re-rate on the disclosure day. Write the scenario ladder, set the probabilities, and wait for the quantification event — the next conference appearance, the 8-K/A, or the print.
2. Identify the quantification venue and put it in triggers. For BSX it was the Wells Fargo conference on 2026-09-10, ahead of the 2026-10-28 print. That date, not the attack date, is the recheck.
3. Treat an Item 8.01 filing as "materiality undetermined," never as "not material." Watch for a later 8-K/A re-filing under Item 1.05 — that amendment is the quantification event. Stryker did exactly this on 2026-04-09, four weeks after the attack.
4. A Form 12b-25 is the real headline risk, and it is under-priced because it sounds administrative. It signals the attack reached the financial-reporting stack — a control-environment problem. Henry Schein, Johnson Controls and MKS all filed one; JCI's forced a re-run of its ICFR assessment. Check whether the company has debt covenants requiring timely reporting or a pending deal on a bank bridge, because a 12b-25 lands directly on both.
5. Assume the first number roughly doubles when building the bear case for an operational attack. (Exfiltration-only events, e.g. Cencora, do not follow this — they cost roughly what is first said.)
6. Insider silence after disclosure is legally compelled, not a signal. Officers are barred from trading while the financial impact is undetermined. An absent Form 4 before quantification means nothing; a purchase after quantification means a great deal.

What would falsify this

A series of incidents where the disclosure-day move predicted the eventual cost, or where quantification days were consistently negative. One counter-example does not overturn a ten-case cluster; a pattern of them would.

Related

• [[pattern-supply-outage-is-availability-not-quality]] — the operational twin: what the damage actually is, as opposed to when it gets priced.
• [[pitfall-gate-cleared-by-adjective-not-arithmetic]] — "has not determined materiality" is an adjective standing in for a number.

History

• 2026-08-26 — written during /analyze BSX, from ten cyber incidents with dated price series and disclosed costs.