We have not yet seen the FCA take enforcement action against a listed company regarding cyber-related mis-statements. To date the FCA has focussed its cyber related enforcement efforts on operational failures by organisations within the financial services regulated sector. The closest we have come is the FCA's criticism of certain post-attack public statements made by a company in the financial services regulated sector for giving an inaccurate impression of the number of consumers affected by a cybersecurity breach. In the US, the court dismissed the SEC's claims related to SolarWinds' Form 8-K disclosures concerning the attack given the limited information available upon discovery of the incident and during the early stages of an investigation. Nevertheless, in other circumstances involving unjustified misstatements, it is possible to foresee a scenario where the FCA elects to take action in this area.