NY Charges First American Financial for Massive Data Leak
Summary: New York's Department of Financial Services filed its first-ever cybersecurity enforcement action against First American Financial Corp., charging the title insurer over a website flaw that exposed roughly 885 million mortgage records dating back to 2003, available without authentication to anyone with a browser. The DFS said the weakness was introduced in a May 2014 software update, found in First American's own December 2018 penetration test, and left unfixed for six more months until KrebsOnSecurity publicized it.
Bottom line: The DFS treats each exposed record as a separate violation at up to $1,000 apiece, and First American's own logs showed more than 350,000 documents accessed without authorization by bots in an 11-month window it could review - a penalty exposure that scales with records the company could not account for before June 2018.
Read the original at Krebs on Security ↗
- Topics
- Data Breaches
- Related
- TSMC employee data breach linked to cloud provider Cyber Risks · Nov 15, 2026Data Breach at La Poste Subsidiary Maileva Affects 22 Million People in France Cyber Risks · Nov 15, 2026City of Osaka warns of data breach impacting 1 million as Japan reels from dozens of cyber incidents Cyber Risks · Nov 13, 2026