2023-12-22 First American Financial Corp Cybersecurity Incident

Page last updated on April 17, 2024

First American Financial Corp initially disclosed a cybersecurity incident in an SEC 8-K filing on 2023-12-22 12:13:25 EST.

Company Summary

First American Financial Corporation is an American financial services company which provides title insurance and settlement services to the real estate and mortgage industries.

The First American Family of Companies’s core business lines include title insurance and closing/settlement services; title plant management services; title and other real property records and images; valuation products and services; home warranty products; property and casualty insurance; and banking, trust and investment advisory services. With total revenue of $5.8 billion in 2017, the company offers its products and services directly and through agents.

In June 2010, First American Financial Corporation was established when First American split its businesses to create First American Financial Corporation which provides title and settlement services to the real estate and mortgage industry, and CoreLogic, specializing in real estate information.

Incident Details

Material: Yes
Is Breach: TRUE
Records Compromised: Unknown
Data Types Impacted: No Data Types Tracked (yet)

Compromised Date: 2023-12-20
Detected Date:
Disclosure Date: 2023-12-22
Contained Date: 2023-12-29
Recovered Date: 2024-01-12

Attack Goal: Unknown

Costs: No Costs Tracked (yet)

Filings

8-K filed on 2023-12-22

First American Financial Corp filed an 8-K at 2023-12-22 12:13:25 EST
Accession Number: 0000950170-23-072513

Item 8.01 Other Events.

First American Financial Corporation (the “Company”) recently identified unauthorized activity on certain of its information technology systems. Upon detection of the unauthorized activity, the Company took steps in an effort to contain, assess and remediate the incident. On December 20, 2023, the Company elected to isolate systems from the Internet.

The Company is working diligently to restore those systems and resume normal operations as soon as possible, but cannot estimate the duration or extent of the disruption at this time. The Company has retained leading experts, is working with law forcement and notified certain regulatory authorities.

During the disruption, the Company’s primary website may be inaccessible or inoperative. The Company has created a special website for communications about the incident at the following URL: www.firstamupdate.com. Please access that site for further information.

The Company is also assessing the impact of the incident and whether it may have a material impact on its financial condition and results of operations, which at this point cannot be determined.

8-K filed on 2023-12-29

First American Financial Corp filed an 8-K at 2023-12-29 16:25:05 EST
Accession Number: 0000950170-23-073848

Explanatory Note.

This Amendment No. 1 amends the Current Report on Form 8-K filed by First American Financial Corporation (the “Company”) with the Securities and Exchange Commission on December 22, 2023 (the “Original Report”).

Item 1.05 Material Cybersecurity Incidents.

As disclosed in the Original Report, the Company recently identified unauthorized activity on certain of its information technology systems. Upon detection of the unauthorized activity, the Company took steps in an effort to contain, assess and remediate the incident. On December 20, 2023, the Company elected to isolate systems from the Internet. The Company has retained leading experts, worked with law enforcement and notified certain regulatory authorities

As of the date of this filing, the Company believes it has contained the incident. The Company is in the process of restoring access to its systems and resuming normal business operations.

Though the incident is still under investigation, the Company believes the perpetrator of the activity accessed certain Company systems, exfiltrated data and encrypted data on certain non-production systems.

The Company continues to assess whether the incident will have a material impact on the Company’s financial condition or results of operations, which at this point cannot be determined.

8-K/A filed on 2024-01-12

First American Financial Corp filed an 8-K/A at 2024-01-12 16:27:42 EST
Accession Number: 0000950170-24-004247

Explanatory Note.

This Amendment No. 2 amends the Current Report on Form 8-K filed by First American Financial Corporation (the “Company”) with the Securities and Exchange Commission (the “SEC”) on December 22, 2023 (the “Original Report”) and Amendment No. 1 thereto filed by the Company with the SEC on December 29, 2023 (“Amendment No. 1”).

Item 1.05 Material Cybersecurity Incidents.

As disclosed in the Original Report, the Company identified unauthorized activity on certain of its information technology systems. Upon detection, the Company acted to contain, assess and remediate the incident. On December 20, 2023, the Company elected to isolate systems from the Internet. The Company retained leading experts, worked with law enforcement and notified certain regulatory authorities.

The Company believes it has contained the incident and has resumed business operations.

As a result of the incident, certain transactions that would have been consummated in the fourth quarter of 2023 were delayed and, consequently, revenue from those transactions will not be recognized until the first quarter of 2024. Certain other transactions that would have been consummated in the fourth quarter of 2023 were moved to other providers, which resulted in a loss of revenue. In addition, the Company recognizes revenue from its agents when a notice of title policy issuance is received. As a result of the incident, receipt of notices of the issuance of certain title policies have been delayed and, as a result, related revenue that would have been recognized in the fourth quarter of 2023 will not be recognized until the first quarter of 2024. In the fourth quarter of 2023 the Company also incurred one-time expenses as a result of the incident.

While the Company expects the incident to have a material impact on the fourth quarter of 2023 results of operations, the Company does not believe the incident will have a material impact on the Company’s overall financial condition or on its ongoing results of operations.

Company Information