Cyber attacks and disclosure obligations under MAR

Cyber attacks are a serious and growing risk. The Danish Resilience Agency (SAMSIK) assesses the threat from cyber crime against Denmark as very high, its highest level, and on 24 September 2026 raised the threat level for destructive cyber attacks from medium to high. Following a cyber attack, a listed company may know that production has stopped or customer data has been stolen before it can establish the full consequences. Its disclosure obligations must therefore be assessed while the investigation continues.

ESMA's Final Report of 16 October 2026 addresses this problem in revised guidelines on delayed disclosure under the Market Abuse Regulation ("MAR"). The guidelines will apply once published in all official EU languages. The UK Financial Conduct Authority ("FCA") also sets out its observations in the recently published Primary Market Bulletin 66, which may assist Danish issuers in applying EU MAR.

Assessing whether information about an attack is inside information

MAR Article 7 defines inside information as non-public information of a precise nature relating directly or indirectly to an issuer or financial instruments which, if made public, would be likely to have a significant effect on prices. ESMA notes that information about a severe incident may be inside information before its consequences are accurately assessed, but may not qualify if there is no information on its severity.

The FCA's observations on this assessment are more granular than ESMA's. While not every cyber incident will be inside information, the FCA considers that it may be prudent to begin from the assumption that information relating to a cyber incident could constitute inside information. The FCA identifies as relevant factors the scale and nature of the incident (for example, whether sensitive customer or commercial data has been compromised), reputational impact and any immediate or anticipated disruption to the issuer's operations or financial position. Discovery of a historical compromise can give rise to inside information even where there is no current cyber threat, and inside information may also arise after an incident is fully resolved, for example from remediation costs or a need to revise previously stated outlook or financial targets.

Distinguishing the attack from a protracted process

Under MAR Article 17(1), as recently amended by the Listing Act, inside information related to intermediate steps in a protracted process need not be disclosed while confidentiality is ensured. According to Commission Delegated Regulation (EU) 2026/789, such a process involves actions, steps or decisions spread in time which need to be performed, at least in part, by the issuer to achieve an intended objective or result. Only the final circumstances or final event must be disclosed, as soon as possible after they have occurred, if they constitute inside information.

ESMA clarifies that the issuer must first evaluate, using the list in the Delegated Regulation as support, whether inside information pertains to an intermediate step in a protracted process or to a one-off event. Cyber incidents are not on that list. In our view, the length of the investigation or recovery does not determine the classification, and known consequences such as a production shutdown or confirmed data theft will normally be information about a one-off event. If that information is inside information directly concerning the issuer, disclosure is required unless a delay is justified under Article 17(4).

Delaying disclosure while further information is obtained

MAR Article 17(4) permits delay provided that immediate disclosure is likely to prejudice the issuer's legitimate interests, the inside information is not in contrast with the issuer's latest public announcement or other type of communication on the same matter, and the issuer is able to ensure the confidentiality of that information.

ESMA's revised guidelines recognise a legitimate interest in collecting additional information about an exceptional event, for example on the effects of a major incident or cyber attack, to enable a correct assessment of the inside information by market participants. However, disclosure should take place as soon as a rough estimation of the damage is possible, without awaiting further analysis of the data or remedial actions, and can be supplemented later. ESMA recommends a case-by-case assessment of the length of the delay rather than fixed time limits, such as 48 hours for cyber incidents.

As the FCA notes, the attacker is likely to possess the same information, so confidentiality must be continually assessed, including whether the attacker would publicise it. If confidentiality can no longer be ensured, MAR Article 17(7) requires disclosure as soon as possible. Early public reassurances, for example on the issuer's website or social media, may also prevent delay if later inside information is in contrast with them.

Sharing information with authorities and customers

An issuer may need assistance from the police, cyber security authorities or forensic experts. Sharing inside information with them must be necessary and made in the normal exercise of employment, profession or duties (MAR Article 10). It requires simultaneous public disclosure unless the recipient owes a duty of confidentiality, whether based on law, regulations, articles of association or contract (Article 17(8)).

Under NIS 2, DORA, the GDPR or similar rules, the issuer may also be required to notify authorities within specific deadlines and, in some cases, customers or other affected persons without undue delay. ESMA notes that MAR disclosure obligations apply without prejudice to the notification of authorities, and that the receiving authorities are legally bound to keep the notifications confidential. Such notifications therefore do not in themselves require public disclosure, but the issuer must still assess whether MAR requires public disclosure or permits delay. Whether authorities are assisting the issuer or receiving a notification, the FCA encourages issuers to inform them that the information is or could be inside information and should be kept confidential.

Notifying customers is different. In our view, where a large number of customers must be notified, the issuer will rarely be able to ensure confidentiality, even if a general confidentiality obligation applies under the customer agreements, and public disclosure should then normally be made before or, at the latest, simultaneously with the customer notification.