Disclosure of Cybersecurity Incidents under Art. 17 MAR

333 Abstract The increasing frequency and sophistication of cybersecurity incidents pose significant risks for listed companies. Under Article 17 of the Market Abuse Regulation (MAR), issuers must disclose inside information, including cybersecurity incidents, if such events are likely to have a significant impact on the price of their financial instruments. This obligation presents three major challenges. First, determining whether an incident meets the materiality threshold remains a complex exercise, as it requires assessing the potential market impact of cyber threats. Second, disclosure may expose an issuer’s vulnerabilities. To mitigate this risk, issuers may delay disclosure under Article 17 (4) MAR, provided that three cumulative conditions are met—the most critical being the ability to ensure the confidentiality of the incident while postponing its disclosure. Third, cybersecurity incidents often trigger parallel reporting obligations under different regulatory frameworks, such as the General Data Protection Regulation (GDPR). The interplay between Article 17 MAR and the GDPR creates significant legal tensions, as mandatory notification requirements under data protection law may conflict with an issuer’s ability to maintain confidentiality while postponing disclosure. Finally, this paper examines whether the Listing Act will result in substantive changes to the disclosure framework for cybersecurity incidents.