CVR Energy 8-K listed as cyber incident disclosure, details not confirmed

What happened

A headline on SEC EDGAR, dated 2026-11-03, says that CVR Energy, Inc. discloses a cyber incident in an SEC Form 8-K filing.

The document at that link is Exhibit 2.1 of the filing, and it is not an incident notice. According to the SEC EDGAR exhibit, it is an Equity and Asset Purchase Agreement “dated as of November 2, 2026”, between several Marathon Petroleum entities as sellers and CVR Energy, Inc. as purchaser. The same exhibit says the agreement covers refinery, pipeline and related assets and interests, including St. Paul Park Refining Co. LLC.

According to SEC EDGAR, the exhibit’s table of contents includes a section titled “IT Infrastructure and Privacy” (Section 5.22) among the sellers’ representations and warranties. The excerpt provided does not show that this section describes any incident.

The source does not confirm the following:

• whether a cyber incident occurred at all
• the date or nature of any incident
• the systems, data or customers affected
• the attacker, cause or entry point
• any operational or financial impact

No independent outlet has reported on this, and CVR Energy’s own description of any incident is not confirmed in the source provided.

Am I affected?

Not confirmed. The source names no software product, version, service or data set tied to a cyber incident, so there is nothing to check against your own environment.

What to do now

1. Open the filing on SEC EDGAR. Check whether the main 8-K document, and not this exhibit, contains a cyber incident disclosure.
2. Do not treat the “cyber incident” label as established until CVR Energy states it in the filing itself.
3. Watch for an amended filing or a statement from CVR Energy. This advisory will be updated if one appears.

Sources

• SEC EDGAR: CVR Energy Inc, Exhibit 2.1, Equity and Asset Purchase Agreement (listed as a cyber incident disclosure in an SEC Form 8-K filing)