Publicly listed IT companies must immediately disclose cyberattacks as price-sensitive insider information, otherwise they face a fine under the Market Abuse Regulation.