Itron 8-K Said No Customer System Access, Amendment Said Otherwise

Both filings report the same date of earliest event: April 13, 2026, a Monday. The original 8-K states that on that date Itron "was notified that an unauthorized third party had gained access to certain of its systems," language indicating the company learned of the intrusion from an outside party rather than detecting it itself. Itron activated its cybersecurity response plan, engaged external advisors, and proactively notified law enforcement.

The Form 8-K was accepted by EDGAR at 12:30 UTC on April 24, 2026, nine business days after the notification date, under accession number 0001193125-26-175249. " It then drew a boundary between corporate and customer environments and asserted that the customer side was clean.

On April 28, 2026, Itron filed two documents that did not mention the incident at all. The first was its Form 10-Q for the quarter ended March 31, 2026. The second was an earnings Form 8-K under Items 2.02 and 9.01, whose Exhibit 99.1 press release also contains zero occurrences of "cyber," "unauthorized," "breach," or "incident." Neither omission is remarkable on its own: the quarter had closed on March 31, before the April 13 intrusion, and a subsequent event requires disclosure only if material.

On May 1, 2026, at 12:30 UTC, Itron filed the Form 8-K/A under accession number 0001193125-26-199316. It reported no further unauthorized activity, restated that operations continued in all material respects, and then reversed the customer-hosted finding. It added a second sentence that is easily misread: "The Company has not observed any evidence that customer-facing system functionality was materially affected." Both filings were signed by Joan S. Hooper, Senior Vice President and Chief Financial Officer.

The more telling filing came later. On July 28, 2026, Itron filed its Form 10-Q for the quarter ended June 30, 2026, accession 0000780571-26-000178. " Part II, Item 1A adds no incident-related risk factor, stating in full: "For a complete list of Risk Factors, refer to Part I, Item 1A: Risk Factors of our Annual Report on Form 10-K for the fiscal year ended December 31, 2025, which was filed with the Securities and Exchange Commission on February 17, 2026." Itron applied its non-materiality conclusion consistently across every filing in the period.

Consistency is not the same as correctness, but it is the opposite of opportunism, and it should be weighed in the company's favor.

The precision of the two sentences is the entire story, so both are reproduced in full.

April 24, 2026, Form 8-K, Item 8.01: "The Company took action to remediate and remove the unauthorized activity and has not observed any subsequent unauthorized activity within its corporate systems. Further, no unauthorized activity was observed in the customer hosted portion of its systems."

May 1, 2026, Form 8-K/A, Item 8.01: "Since the filing of the Original Report, the Company has not observed any further unauthorized activity in its systems. Its operations have continued in all material respects. Based on the investigation to date, the Company has identified limited unauthorized access to certain customer-hosted systems. The Company has not observed any evidence that customer-facing system functionality was materially affected."

Three observations follow, and the third is the one that matters most to Itron's customers.

First, the operative sentence was unqualified. "No unauthorized activity was observed" is an affirmative negative finding stated flatly, eleven days into an investigation, about the one environment utility customers care most about. Two counterweights belong here in fairness. Itron qualified its materiality conclusion in the same filing, writing "While the Company's investigation and assessment of this incident is ongoing" before assessing impact.

And both 8-Ks carry a forward-looking statements section that expressly lists as a risk factor "the results of the Company's analysis of the scope and details of the incident and the discovery of new or additional information," which is precisely the eventuality that materialized. Neither counterweight fully answers the point. The Private Securities Litigation Reform Act safe harbour protects forward-looking statements, not statements of present or historical fact, and "no unauthorized activity was observed" is a statement of historical fact about what an investigation had found.

The caveats attached to the parts of the filing that were predictive. They did not attach to the part that was declarative. An investigation producing new findings is ordinary and expected, and incident response routinely overturns early conclusions. The defensible criticism is not that the finding changed. It is that this particular sentence was cast in a form that did not anticipate its changing, while the sentences around it were.

Second, the amendment is narrower than the sentence it replaces. "Limited" and "certain" are undefined. Neither the number of customer-hosted environments nor the identity of any affected customer appears anywhere.

Third, the closing sentence addresses availability, not confidentiality. "Customer-facing system functionality was materially affected" is a statement about whether systems kept working. It is not a statement about whether data in those systems was accessed, viewed, copied, or exfiltrated. Those are different questions, and as of the amendment only the first has been answered. A reader who takes the sentence as reassurance about customer data is reading something the filing does not say.

TECHNICAL ANALYSIS: ITEM 8.01 VERSUS ITEM 1.05 Both filings were made under Item 8.01. EDGAR's own items metadata field for each accession reads "8.01" and nothing else. Item 1.05 was never invoked.

The distinction matters and is widely misunderstood. Under SEC Release Nos. 33-11216 and 34-97989, effective September 5, 2023, Item 1.05 of Form 8-K applies where "the registrant experiences a cybersecurity incident that is determined by the registrant to be material." Form 8-K General Instruction B.1 provides: "A report pursuant to Item 1.05 is to be filed within four business days after the registrant determines that it has experienced a material cybersecurity incident." The clock runs from the materiality determination, not from the incident or its discovery.

Filing under Item 8.01 was therefore not improper. Item 1.05 applies by its own terms only to incidents the registrant determines to be material. Itron determined this one was not, so no Item 1.05 clock ever started, and the nine business days between notification and the original filing violated no deadline. Item 8.01 is the catch-all and carries no trigger.

Two structural consequences follow, and the first is narrower than it is usually described. Item 1.05 carries a completion duty, not a rolling duty to update. " That duty fills in information a registrant flagged as unavailable when it filed. It does not require amendment every time findings evolve.

So Itron's May 1 amendment was not compelled by Item 1.05's completion instruction, which was never engaged. That is worth recording in the company's favor. " Those duties arise from the antifraud provisions and attach to what a company said, not to the Item number above it. Filing the amendment was the right call on any reading.

The second consequence goes to the corporate-versus-customer boundary the original filing drew. In the adopting release, the Commission addressed incidents on third-party systems: "we note the centrality of the materiality determination: whether an incident is material is not contingent on where the relevant electronic systems reside or who owns them.

That passage cuts both ways, which is why it belongs here in full. The Commission was addressing registrants whose own data sits on someone else's system. Itron is in the opposite posture: it is the service provider. The reasoning still travels, because the principle is that architecture does not settle materiality, and the express contemplation that disclosure may be required "by neither" is a direct acknowledgment that a provider-side incident can be immaterial to the provider.

What the passage forecloses is treating the corporate-versus-customer line as though it answered the question by itself. Materiality turns on impact on the registrant, and Itron has consistently answered that in the negative.

Nothing has been disclosed. This section exists to state that plainly rather than to fill it.

• No data category has been named in any filing. Not customer records, not utility operational data, not meter telemetry, not employee information, not credentials, not source code.
• No record count, file count, or data volume has been given by Itron or any other party.
• No affected customer has been identified, and the number of customer-hosted environments involved is undisclosed.
• No filing states whether data in the customer-hosted systems was accessed, viewed, copied, or exfiltrated. The amendment addresses functionality only.
• Itron said on April 24 that it was "evaluating what legal filings and regulatory notifications might be required," and the amendment repeated that this evaluation "remains ongoing." No notification determination has since been announced in its EDGAR filings.

Readers should treat the absence of figures as absence of disclosure, not as evidence of small scale. Neither inference is available on this record.