First American Financial Pays Farcical $500K Fine
Summary: First American Financial Corp. agreed to pay the SEC a penalty of less than $500,000 to settle an investigation into a May 2019 disclosure that its website exposed more than 800 million documents, some dating back 16 years. The SEC's proceeding found that an internal audit had flagged the same vulnerability about five months before KrebsOnSecurity reported it, but a clerical error logged the issue as level 2 low risk instead of level 3 medium risk, and the company missed even the 90-day remediation deadline without requesting a CISO waiver.
Why it matters: The SEC's action turned on disclosure, not the breach itself: First American's 8-K stated it had no prior indication of the vulnerability, and the fine for that statement came to roughly $0.000625 per exposed document. The New York Department of Financial Services case is still open, and it counts each exposed record as a separate violation at up to $1,000 apiece.
Read the original at Krebs on Security ↗
- Topics
- Data Breaches
- Related
- TSMC employee data breach linked to cloud provider Cyber Risks · Nov 15, 2026Data Breach at La Poste Subsidiary Maileva Affects 22 Million People in France Cyber Risks · Nov 15, 2026City of Osaka warns of data breach impacting 1 million as Japan reels from dozens of cyber incidents Cyber Risks · Nov 13, 2026