The First American Financial Corporation, one of the largest title insurance companies in the United States, revealed that a cyberattack in December 2023 exposed the personal information of around 44,000 people. The First American data breach disclosure was made in a filing with the U.S. Securities and Exchange Commission (SEC) on May 28, 2024, raising serious concerns about data security at the company.
The filing disclosed that attackers had breached some of First American’s systems and accessed sensitive data without authorization.
“As of the date of this filing, the Company’s investigation of the incident has concluded. Based upon our investigation and findings, the Company has determined that personal information pertaining to approximately 44,000 individuals may have been accessed without authorization as a result of the incident,” the company stated.
In response to the First American data breach, the company committed to notifying the affected individuals and providing them with credit monitoring and identity protection services at no cost. This proactive measure aims to mitigate the potential fallout for those whose data was compromised.
“The Company will provide appropriate notifications to potentially affected individuals and offer those individuals credit monitoring and identity protection services at no cost to them,” the company stated in filing.
First American Cyberattack: A Troubled History
The December 2023 data breach occurred just a month after First American settled a significant cybersecurity incident from 2019. On November 29, 2023, the company agreed to pay a $1 million penalty to New York State for violating cybersecurity regulations. This penalty stemmed from a May 2019 breach where the company’s proprietary EaglePro application exposed personal and financial data.
The breach allowed unauthorized access to documents without proper authentication, exposing sensitive information from hundreds of thousands of individuals.
The New York Department of Financial Services (DFS) criticized First American’s security practices, noting that the company’s senior management had been aware of the vulnerability in EaglePro. The DFS’s findings underscored the importance of robust cybersecurity measures, especially for companies handling large volumes of personal and financial data.
Industry-Wide Challenges
First American is not alone in facing cybersecurity threats. In November 2023, Fidelity National Financial, another major American title insurance provider, experienced a cybersecurity incident. The cyberattack forced Fidelity to take down some of its systems to contain the breach, causing disruptions to its business operations.
In January 2024, Fidelity confirmed in an SEC filing that the attackers had stolen data from approximately 1.3 million customers using non-self-propagating malware.
These cybersecurity reflect a broader trend of increasing cyberattacks targeting financial institutions, emphasizing the need for enhanced cybersecurity frameworks across the industry. Title insurance companies, which handle vast amounts of sensitive information, are particularly attractive targets for cybercriminals.
The Road Ahead for First American Data Breach
The latest Frist American data breach marks another challenge for the company as it strives to regain trust and enhance its cybersecurity posture. The company must address both immediate and long-term security concerns to protect against future incidents. This includes investing in advanced security technologies, conducting regular security audits, and fostering a culture of cybersecurity awareness among employees.
Moreover, regulatory scrutiny is likely to intensify. Financial institutions are expected to adhere to stringent cybersecurity standards, and any lapses can result in substantial penalties and reputational damage. First American’s recent history indicates a pressing need for the company to strengthen its defenses and ensure compliance with all regulatory requirements.
Customer Impact and Response
For the 44,000 individuals affected by the December 2023 Frist American data breach, offer of free credit monitoring and identity protection services is a critical step. These services can help detect and prevent potential misuse of their personal information. However, the emotional and psychological impact of knowing their data has been compromised cannot be understated.
Customers should remain vigilant, monitoring their financial accounts for any suspicious activity and taking advantage of the protection services offered by First American. Additionally, they should be aware of phishing attempts and other forms of cyber fraud that often follow such breaches.
Media Disclaimer: This report is based on internal and external research obtained through various means. The information provided is for reference purposes only, and users bear full responsibility for their reliance on it. The Cyber Express assumes no liability for the accuracy or consequences of using this information.