Is a cyberattack inside information? FCA guidance helps clarify

On 30 September 2026, the FCA published guidance to relevant companies (issuers) on how to manage their inside information obligations if they are subject to a cyber incident (see Primary Market Bulletin (PMB) 66). This can be a difficult topic for organisations to navigate, particularly in the early stages of an incident where its scale and impact are not yet known. 

What are the inside information obligations?

Where a company is subjected to a cyberattack, it will need to consider whether the incident triggers any notification obligations – both contractual and legal. Where the company has shares or other securities traded on a UK market and is therefore subject to the UK Market Abuse Regulation, this includes considering whether it needs to make a market announcement as a result of it having inside information. 

Inside information is (broadly speaking) information which: (i) has not been made public; (ii) is precise; (iii) relates to one or more issuers; and (iv) would be likely to move the share price of the relevant issuer if it were to be made public. 

If a company has inside information, it must announce the information to the market as soon as possible unless it can satisfy the conditions for delaying disclosure, namely:

• the information remains confidential; 
• delaying disclosure of the information would not mislead the public (broadly, create a false market in the shares); and 
• the company has a legitimate interest in delaying disclosure. An issuer may have a “legitimate interest” in delaying disclosure if, among other things, it is negotiating with a counterparty and the outcome of the negotiations would likely be jeopardised by premature disclosure.

If and when an announcement is required, if a person discloses inside information improperly, they will commit market abuse. Disclosure is proper where it is made in the normal exercise of a person’s employment, profession or duties; but there is only limited guidance on when this test will be satisfied.  

FCA guidance 

In this context, the FCA has published welcome guidance that should help issuers navigate these issues. Key points discussed in the guidance include: 

Do we have inside information?

• Assuming that information relating to a cyber incident could constitute inside information, the issuer will need  to consider the scale and nature of the incident – e.g. has sensitive client/customer or commercial data been compromised, and what is the current/anticipated disruption to the issuer’s operations or financial position? 
• Where an issuer initially concludes it does not have inside information, daily or even hourly re-assessment may be needed. In particular, the issuer should re-assess the likely impact on its operations, the likely duration of the incident, and any reputational issues that may damage customer or investor confidence.
• If an incident affects an issuer’s ability to interact with its customers or clients, and it makes proactive or reactive communications in response, it should carefully consider whether it needs to make an announcement.
• Even when an incident has been fully resolved, inside information may arise where there is a material impact on the issuer’s financial position. For example, this could include the costs and impact of remediation, increased cyber protection costs, and the need for the issuer to revise its previously stated outlook or financial targets. 
• If an issuer discovers that its systems have been compromised at some point in the past, but there is no current cyber threat, it should assess whether the information relating to the past event currently amounts to inside information, and if so, whether it can delay disclosing that information. 

Do we have to make an announcement?

If an issuer: 

• concludes it has inside information, it may take a short period of time if necessary to clarify the situation and make an accurate announcement.  
• believes there is a danger of inside information leaking before the facts and their impact can be confirmed, it may need to release a holding announcement. This may be particularly relevant for issuers in the retail sector whose apps, online and/or payment channels may be affected, causing rumours of an incident. 
• is negotiating with attackers, and the outcome of negotiations would likely be jeopardised by making an announcement, the issuer may have a “legitimate interest” in delaying disclosure. However, it will also need to consider whether (i) delaying disclosure would mislead the public; and (ii) the information remains confidential. On the latter point, the attacker is likely to possess the same inside information, so the issuer will need to assess on an ongoing basis whether it remains confidential: this is likely to depend on the identity of the attacker, the known nature and motive of the attack, and whether the attacker would publicise it. Once inside information ceases to be confidential – whether because the attacker publicises it or otherwise – the issuer must make an announcement as soon as possible. In practice, when an issuer first becomes aware of an attack, it would be well-advised to prepare a draft announcement that can be released quickly if needed.

Issuers should also note that becoming aware of vulnerabilities in their cyber defences could constitute inside information. However, the FCA says “it may be possible” to delay disclosure in such circumstances if disclosure could make the issuer a target for future attacks. 

Can we share inside information with government departments, law enforcement, regulatory or crime agencies?

An issuer may be required, requested, or choose to share knowledge of an impending or actual cyber incident with a government department, law enforcement, regulatory or crime agency in a relevant jurisdiction. In this context, the FCA notes that this “may indicate that the issuer is acting in the normal exercise of their employment, profession or duties. This may also apply to information-sharing communities set up and overseen by the NCSC for assisting others in preventing or mitigating cyber threats.”

However, if an issuer does make such a disclosure, it should inform each recipient that the information they are about to receive is or could be inside information and that they should keep it confidential. It may also be sensible to record the information that has been disclosed, whether the issuer considers it inside information, and why the issuer believes it can properly be disclosed.

Although the FCA stops short of saying that such disclosures “will not” constitute market abuse, the statements in PMB 66 suggest the FCA is unlikely to take enforcement action against an issuer that makes such a disclosure provided that (i) the issuer genuinely believes that the disclosure is either required or would help tackle cyber criminality; (ii) disclosure is made only to those individuals who have a legitimate business knowing it; (iii) only the minimum information necessary is disclosed; and (iv) the issuer takes the disclosure precautions referred to above.