Cybersecurity’s Rough Week: HAKY’s Rally and the Income Tradeoff

A week of major cyber disclosures puts HAKY in focus: its recent rally, covered-call income tradeoffs, and how it compares with HACK, CIBR, BUG, and IHAK.

A compromised technology supplier. A breach at a WordPress services provider. Two critical flaws in a widely used web programming language. The week ending October 23, 2026 gave businesses several urgent reminders that cybersecurity spending is about keeping operations running.

It also brought a sharp rise in HAKY, the Amplify HACK Cybersecurity Covered Call ETF. For income investors, that creates a question worth asking before chasing the move: how much cybersecurity upside are you willing to exchange for cash distributions?

Three developments that put cybersecurity back in focus

These are disclosures and updates from October 17–23. Some underlying activity began earlier; publication dates are not necessarily attack dates.

1. ConnectWise: trusted access became the attack route

In an October 21 report, Microsoft attributed the recently disclosed ConnectWise supply-chain compromise to China-state-aligned actor Storm-0940. Microsoft described the use of ARTEX, an AI-driven penetration-testing framework, to accelerate attacks. Compromised application credentials allowed access attempts against Microsoft 365 environments through permissions already granted to those applications.

Microsoft stressed that a successful sign-in does not, by itself, establish that customer data was stolen. The wider campaign included instances where attackers reached privileged cloud access in under three hours. Read Microsoft’s investigation.

The investment connection is broader than antivirus: identity protection, application permissions, cloud monitoring, and incident response all matter when attackers can misuse an existing trusted connection.

2. TeamUpdraft: one vendor breach can reach customer websites

TeamUpdraft disclosed unauthorized access to its website over October 17–18. Its October 19 announcement and subsequent updates said its customer database, including connection keys, was believed to have been accessed. Attackers used UpdraftCentral connections to create accounts and install malicious plugins on connected sites. The company revoked old connection keys through an emergency update and urged customers to check for suspicious activity.

TeamUpdraft distinguished the incident from a compromise of the UpdraftPlus plugin’s downloads and said self-hosted UpdraftCentral was unaffected. Read the company’s incident notice.

For investors, this illustrates the risk that accompanies outsourced administration and backup tools. A useful service can also be a powerful access point.

3. PHP: urgent security fixes for widely used web software

On October 21, the PHP project released security updates for two critical vulnerabilities that could allow unauthenticated remote code execution. The fixes covered supported PHP 8.2, 8.3, 8.4, and 8.5 branches, and the project urged immediate updating.

A vulnerable installation is not the same thing as a confirmed victim. Still, the releases created an urgent patch-management task for organizations using affected versions. Read PHP’s release announcements.

Why this matters to the investment theme

Our investment interpretation: incidents like these reinforce the case for recurring spending on identity, cloud security, vulnerability management, and recovery. AI can compress the time defenders have to respond, while interconnected suppliers can spread exposure across many customers.

That is a demand argument, not an earnings forecast. Customers can consolidate vendors, security companies face competition, and an expensive stock can fall despite a growing addressable market. A cybersecurity vendor can also suffer its own damaging incident.

Nor do the reports establish why ETF prices moved. Interest rates, technology-stock sentiment, company news, positioning, and valuations can influence the same week’s trading.

HAKY’s recent rise: put dates and definitions on the numbers

HAKY closed at $32.84 on October 23, up 3.99% that session, according to Amplify’s fund page. Compared with the $30.10 October 16 close in Quiver Quantitative’s price history, that is a 9.10% closing-price increase over the week: ($32.84 ÷ $30.10 − 1) × 100.

This calculation excludes distributions and reinvestment. It is a price change, not a total-return figure or evidence that the cyber incidents caused the gain.

For a longer comparison, the issuers reported the following cumulative NAV performance through September 30, 2026:

These are issuer-reported NAV performance figures, separate from the October price calculation. HAKY trailed HACK by 3.27 percentage points over three months and 11.57 points over six months. Do not add a fund’s distribution rate to its reported performance. Past performance does not predict future results.

What HAKY actually does

HAKY combines cybersecurity equity exposure with an actively managed options strategy. Amplify’s September fact sheet describes exposure through HACK’s underlying stocks or HACK itself, with out-of-the-money calls written on part of the portfolio. It seeks monthly distributions and targets annual option-premium income of 15% or more.

That premium target is not a guaranteed distribution rate, a guaranteed total return, or a bond coupon. HAKY launched in January 2026, so its operating record remains short.

As of September 30, Amplify displayed a 14.77% distribution rate alongside a −0.12% 30-day SEC yield. Its SEC-yield calculation excludes option income. The measures answer different questions; neither establishes that the portfolio’s companies are paying a 14.77% ordinary dividend yield. Source and definitions: Amplify.

The exchange behind the income

A covered-call seller receives a premium in exchange for giving the buyer rights to upside above a strike price on the covered exposure. If stocks rally sharply, that can limit participation. If stocks fall, the premium offers only limited offset; substantial equity losses remain possible.

HAKY can also use covered-call spreads. Its summary prospectus explains that buying a higher-strike call can improve participation in strong gains relative to a standalone written call, while reducing net premium. The portfolio’s result depends on the positions and management decisions; it does not have one permanent upside cap.

The same prospectus says distributions may include return of capital. Examine payout composition and the value of the investment together. A large cash payment alone does not tell you whether you made money.

HAKY’s lag behind HACK over the periods above is consistent with the tradeoff investors should examine, but it does not isolate how much of the gap came from calls, fees, weights, or trading decisions.

HAKY versus four other cybersecurity ETFs

The other funds below provide index-based equity exposure without HAKY’s dedicated covered-call income strategy. They are different portfolios, rather than interchangeable tickers.

Expense ratios and descriptions were checked against issuer materials on October 24, 2026. They can change. CIBR’s published ratio reflects fee breakpoints. The table compares structures and stated costs, not expected returns.

Holdings overlap deserves attention. First Trust’s October 23 list placed CrowdStrike, Fortinet, Palo Alto Networks, Cisco, and Broadcom among CIBR’s largest positions. Buying several cybersecurity ETFs can still leave repeated exposure to the same companies. Compare current holdings and weights before treating multiple funds as additional diversification.

Trading costs matter too. Amplify reported a 0.68% 30-day median bid/ask spread for HAKY, versus 0.13% for HACK, as of October 23. Those historical measures can change, but they show why the expense ratio is only part of implementation cost. Check the current spread and premium or discount to NAV when evaluating a trade. HAKY · HACK.

Use Dividend Vision to test the portfolio fit

Start with the ETF Screener to research the funds, then use Compare ETFs to examine available data side by side. Keep return periods and measurement methods consistent. Use the issuer links above for the dated figures in this article and the latest prospectuses.

If you already hold HAKY, the portfolio calendar can help place projected payments alongside your other income. A projected payout remains an estimate, and receiving it does not settle the total-return question. Our guide to SEC yield versus distribution yield explains the distinction further.

Decide what you want the cybersecurity allocation to do

For an investor seeking equity participation in the cybersecurity theme, HACK, CIBR, BUG, and IHAK offer different index approaches to examine. For an investor who values monthly cash distributions and accepts the options tradeoffs, HAKY adds another route.

This week’s incidents make the business need for cybersecurity vivid. HAKY’s rally makes the investment tempting. The decision still comes down to valuation, portfolio overlap, downside risk, and whether the income is worth the upside you may give up.

Research dated October 24, 2026. News coverage focuses on disclosures and updates from October 17–23; weekly prices end October 23; the NAV comparison ends September 30. Sources are linked beside the relevant claims. This article is educational, not personalized investment or tax advice. Distributions are not guaranteed, and all these ETFs can lose value.