CoStar Group SEC 8-K listed as cyber incident disclosure, details not confirmed

What happened

A headline on SEC EDGAR dated 2026-10-27 says that CoStar Group, Inc. discloses a cyber incident in an SEC Form 8-K filing. That headline is the only basis for the cyber incident claim in the material we have.

The document at that link does not describe a cyber incident. According to SEC EDGAR, it is Exhibit 10.1, an “Agreement and Plan of Merger.” The parties are CoStar Realty Information, Inc., Velocity Merger Sub, Inc., Vexcel Group, Inc. and Fortis Advisors LLC as the Stockholder Representative. It is dated as of October 27, 2026. The text we have is mostly the agreement’s table of contents.

The only security-related text in that excerpt is a table-of-contents entry, “Section 3.14 Data Privacy and Security”. The excerpt gives no incident details under that heading.

What is not confirmed:

• Whether CoStar Group has disclosed any cyber incident at all. The available filing text does not say so.
• The date, cause, entry point, affected systems, data involved or attacker. None of these appear in the source.
• Independent verification. The material available to us contains no other report of this.

Am I affected?

Not confirmed. The source names no affected products, services, customers or data. Nothing in the available text tells CoStar customers or developers to take any action.

What to do now

1. Read the full 8-K and its exhibits on SEC EDGAR. Check whether any part of the filing actually describes a cybersecurity incident.
2. Do not treat this headline as confirmation of a breach. Wait for a statement from CoStar Group before you change anything.
3. If you work with CoStar or Vexcel Group, note that the available document is a merger agreement. It does not describe a security event.

Sources

• SEC EDGAR: COSTAR GROUP, INC. discloses a cyber incident in an SEC Form 8-K filing (Exhibit 10.1, Agreement and Plan of Merger)