First American Corporation, a title insurance firm, experienced a data breach in May 2019. The breach exposed sensitive documents online due to a website design error. In response, the company took its systems offline and later reached a settlement with regulators. Another cyberattack occurred in December 2023, affecting company data. First American Financial is currently working on restoring access to its systems and resuming normal business operations.

How many accounts were compromised?

The breach impacted data related to 885 million customer records.

What data was leaked?

The data exposed in the breach included bank account numbers, bank statements, mortgage records, tax documents, wire transfer receipts, Social Security numbers, and photos of driver's licenses.

How was First American Corporation hacked?

The 2019 data breach at First American Financial occurred due to an Insecure Direct Object Reference (IDOR) issue, which allowed unauthorized access to sensitive documents by simply modifying a link. Unlike the SHEIN example, there was no mention of malware or back door entry points in this case.

First American Corporation's solution

In response to the data breach, First American Financial disconnected its systems from the internet, isolated the attack, and took steps to remediate the issue. The company also brought in incident response experts, contacted law enforcement, and notified certain regulatory authorities. While specific enhanced security measures remain unclear, First American Financial has been working diligently to recover from the cyber incident and restore normal operations.

How do I know if I was affected?

First American Corporation has not publicly disclosed whether they reached out to affected users. However, if you are concerned about your data being compromised in this breach or others, you can visit HaveIBeenPwned to check your credentials.

What should affected users do?

In general, affected users should:

• Change Your Passwords: Immediately update your passwords for any accounts that may have been compromised. Make sure the new passwords are strong and unique, not previously used on any other platform.

• Reset Passwords for Other Accounts: If you've used the same or similar passwords for other online accounts, reset those as well. This is crucial as attackers often try using stolen passwords on multiple sites.

• Enable Two-Factor Authentication (2FA): Activate 2FA on any affected accounts. Consider enabling this additional security feature on all other important online accounts to significantly reduce the risk of unauthorized access.

• Monitor Your Accounts: Keep an eye on your accounts for any suspicious activity and report it immediately to the appropriate parties.

For more specific help and instructions related to First American Corporation's data breach, please contact First American Corporation's support directly.

Where can I go to learn more?

If you want to find more information on the First American Corporation data breach, check out the following news articles:

• First American Financial takes systems offline after cyber incident

• Understanding The First American Financial Data Leak: How Did It Happen And What Does It Mean?

• First American Financial confirms threat actors stole and encrypted data