First American, one of the largest insurance companies in the United States, suffered a malware attack that forced the company to shut some of its systems down, including its website.
At press time, the official website firstam.com was still offline, while a dedicated notification site - firstamupdate.com - was set up. There is a short notification on the latter, stating “First American has experienced a cybersecurity incident. In response, we have taken certain systems offline and are working to return to normal business operations as soon as possible. Updates will be posted to this page.”
Sadly, no additional information was posted. We reached out to the company’s representatives for more information and will update the article if we hear back from them. Usually, companies would shut down their systems in case of a ransomware attack. If this indeed was a ransomware attack, chances are the attackers also stole sensitive customer and employee information.
American financial behemoth
First American Financial Corporation is an American financial services company providing title insurance and settlement services to the real estate and mortgage industries. It was founded in 1889, and last year generated $7.6 billion in revenue. Headquartered in California, it has more than 21,000 employees.
According to a BleepingComputer report, this is not FirstAm’s first foray into cyberincidents. Roughly a month ago, it paid a $1 million penalty to settle violations of New York’s Department of Financial Services’ (DFS) Cybersecurity Regulation, for a data breach that happened in May 2019.
"As the nation's second-largest title insurance company, First American collects the personal and financial data of hundreds of thousands of individuals annually on title-related documents and stores that information in its proprietary EaglePro application," New York's DFS said. "In May 2019, First American senior management learned of a vulnerability in the application whereby any individual in possession of the link used to access EaglePro could access not only their own documents without authentication, but also those of individuals in unrelated transactions."
More from TechRadar Pro
- BlackCat strikes again - and this time it's breached a healthcare giant
- Here's a list of the best firewalls today
- These are the best endpoint protection services right now
