Nutex Health 2026: The Seven Days Between Item 8.01 and Item 1.05

On August 24, 2026, Nutex Health Inc. (NASDAQ: NUTX) told the SEC it had learned of unauthorized activity on its network. It filed that disclosure under Item 8.01 — the catch-all for other events a company chooses to report.

On August 31, seven days later, Nutex filed again. This time under Item 1.05: Material Cybersecurity Incidents. In between, on August 27, a purported class action was filed against the company in the Southern District of Texas.

The conversion from 8.01 to 1.05 is the story. It is the SEC disclosure regime working exactly as designed and exactly as uncomfortably as companies feared: a filing choice made under uncertainty, revisited a week later when the facts caught up.

Nutex Health operates micro-hospitals, specialty hospitals, and hospital outpatient departments across roughly 24 facilities in 11 to 12 states. It is publicly traded on NASDAQ under NUTX.

The first filing. On August 24, 2026, Nutex filed a Form 8-K under Item 8.01 stating it had recently learned of unauthorized activity involving data stored on its computer network. The company said it had engaged an independent third-party cybersecurity response team and forensic experts, activated its cybersecurity response plan, implemented containment measures, and notified law enforcement. It stated it did not believe the unauthorized access had had, or was reasonably likely to have, a material impact on the business.

The lawsuit. On August 27 — three days later — a purported class action captioned Haley v. Nutex Health, Inc., Case No. 4:26-cv-07197, was filed in the United States District Court for the Southern District of Texas, Houston Division.

The second filing. On August 31, Nutex filed again, this time under Item 1.05, Material Cybersecurity Incidents. The company stated that based on the current status of its investigation it believed certain information maintained on its servers was accessed and exfiltrated by an unauthorized third party, including patient and employee, credentialed provider, business and financial information that is private and/or confidential, and that the third party has threatened to post such information externally.

Nutex maintained that it had not identified any material impact on business operations or financial reporting systems. It continues to assess scope and evaluate regulatory and legal notification requirements, including notification to affected patients.

Nutex has not disclosed the initial access vector, and as of this writing no threat actor has publicly claimed the attack — unusual for an incident where the attacker has threatened publication. BleepingComputer and SecurityWeek both noted the absence of a leak-site listing.

What the filings do establish: data was accessed and exfiltrated from servers, and the third party threatened to post such information externally. That is double extortion without the encryption half, or with encryption that did not succeed. The company reported no material impact on business operations or financial reporting systems, which is consistent with a data-theft-only intrusion rather than a deployment of ransomware across production.

The absence of a public claim has two plausible explanations. Either negotiations are ongoing and the actor is withholding publication as leverage, or the actor operates without a public leak site. Both are worth watching.

For sponsors holding healthcare assets or any public portfolio company, Nutex is a compact lesson in disclosure risk as a distinct exposure from cyber risk.

The 8.01-to-1.05 conversion is a documented change in materiality judgment. Every subsequent adversary — plaintiffs' counsel, the SEC, a short seller, an acquirer's diligence team — now has a dated record of the company assessing the same incident two ways within a week. Whether that record is defensible depends entirely on whether the underlying determination was documented contemporaneously.

Litigation arrived in three days. The class action landed before the company had finished scoping the incident and before it filed under 1.05. Disclosure timing is now a litigation trigger on a timescale shorter than most forensic investigations.

Healthcare data plus public company status is the highest-friction combination. HIPAA notification obligations, state statutes across every operating jurisdiction, SEC materiality analysis, and securities litigation all run concurrently on different clocks.

For diligence: a target's incident disclosure history, and the documented basis for any materiality determination it made, belongs in the data room. Read against the SEC cybersecurity disclosure rule and the SolarWinds CISO charges, which established individual accountability for cyber disclosure accuracy.