Hack Brief: 885 Million Sensitive Financial Records Exposed Online

  Back to News

After a solid decade of nonstop corporate data breaches and exposures, you'd think large organizations would have at least fixed the most basic and obviously damaging types of data mishandling. But there's clearly still a long way to go. On Friday, independent security journalist Brian Krebs revealed that the real estate and title insurance giant First American had 885 million sensitive customer financial records, going back to 2003, exposed on its website for anyone to access. And while there isn't currently evidence that anyone actually found and stole the information, it was so easy to grab—and so obviously valuable to scammers—that it's hard to rule out that possibility.

The Hack

Krebs reports that the exposed records included Social Security numbers, driver's license images, bank account numbers and statements, mortgage and tax documents, and wire transaction receipts—an absolute treasure trove for any scammer or identity thief. An attacker who figured out the format of the company's document URLs could have input any "record number" they wanted—beginning with "000000075," according to Krebs—and pull up the documents associated with that customer case. First American took down the site that populated the records at 2 pm ET on Friday. Krebs notified the company of the situation earlier this week.

“First American has learned of a design defect in an application that made possible unauthorized access to customer data," the company said in a statement.

The company took immediate action to address the situation and shut down external access to the application. We are currently evaluating what effect, if any, this had on the security of customer information. We will have no further comment until our internal review is completed.”

 

First American did not answer questions from WIRED about how long the records were exposed online. The company says it has hired a forensic firm to assess whether customer data was ever stolen. First American, which is based in Santa Ana, California, is a Fortune 500 company with more than 18,000 employees.

Who's Affected

Well, lots of people! First American is the top title insurance firm in the United States, which means the company is often party to both the buyer and lender sides of real estate transactions across the country. And the detailed financial and personal information involved in closings potentially involves information about both buyers and sellers.

While the hope is that the data was never actually stolen, millions of people may have been impacted if it was. If you've bought or sold a house in the past several years, there's a decent chance First American had a hand in it.

 

How Serious Is This?

The First American exposure is a major incident, because it underscores just how little progress many institutions have made on locking down customer data. Perfect security is impossible, but the stakes are incredibly high and many large organizations still overlook basic errors.

The good news is that exposed data does not necessarily mean stolen data. There's a chance that no one stumbled across this trove before the company had the chance to secure it. But unlike other data leaks of similar scale, which largely involve password and username combinations, the data in the First American haul would have devastating long-term consequences for potential victims.

If you’re a First American customer or think you were party to a transaction that also involved the company there isn’t a lot you can do to protect yourself against the possibility that your data was stolen as a result of this exposure. But watch your bank and credit card statements for suspicious activity. Consider purchasing credit monitoring or, better yet, avail yourself of a free credit monitoring offer from another security incident your data was involved in. By this point, you've almost certainly qualified for it. You can also consider a credit freeze.

Security practitioners always hope that major security incidents, like the notorious Equifax breach, will be a wake up call to all companies. But the consequences for such missteps are only first starting to appear. On Wednesday, for example, Moody’s downgraded its ratings outlook for Equifax. A spokesperson said, “It’s the first time that cyber has been a named factor in an outlook change." Until other dramatic economic motivators emerge, disasters like First American, or worse, will continue.


This content has been reproduced from its original source.

SHARE:

  Back to News

How Title Fraud Works

Thieves simply change ownership of your home from YOU to THEM. Then they TAKE OUT LOANS on your home and just disappear - leaving YOU with the payments and a mountain of legal bills.

Click to see if your home's title has been compromised.
Get your FREE TITLE SCAN and COMPREHENSIVE TITLE REPORT (a $100 value FREE with sign up)

Sign Up Today

Speak to a live agent
(800) 899-6268

Money Back Guarantee

"I've been a Home Title Lock customer for 2 years. Their customer service is excellent and I most appreciate the comfort that comes from knowing that I will be immediately alerted and assisted if anyone ever attempts to fraudulently use my title."

Read more of our reviews


Property ownership is not just the American dream, it's also the most flexible financial tool to build family prosperity. Home Title Lock ensures that your assets are protected against Title Fraud and Title Thieves.

Find Out More


Watch This Now

Sign Up Today


You Need Home Title Lock to Protect Your Property

Thirty years ago we started creating the largest database of property records in the United States. Today, that database has 6.1 billion property records. We protect your property value and ownership from on-line threats both foreign and domestic.

Get Protected

Speak to a live agent
(800) 899-6268

Today's System Isn't Protecting You From Title Theft

"People think there's somebody that's checking your signature. Nobody is checking any of these things. Nobody is looking out for you but you."

— Matthew Cox (Convicted Home title Thief)
  • County clerk won’t call you if someone changes title on your home
  • Homeowners insurance doesn’t cover home title theft
  • Credit card or traditional identity protection doesn’t cover home title theft
Protect Yourself today, with Home Title Lock.
  • 24/7 monitoring of your Title
  • Instant alerts if we detect tampering with your title or mortgage
  • Up to $1,000,000* in legal fees and expert fees on your behalf

How Easily Title Fraud Occurs

EVERYTHING is stored online in the cloud - including your home's title information

1

Domestic and international thieves scour online records for homes with equity. It could be the home you live in, your vacation home, a home of an elderly relative, or rental property you own.

2

Once they change your home's ownership from YOU to THEM, they re-file the Quitclaim Deed for your home with the proper authorities so it appears your home has been legally sold.

3

They take out personal loans through banks and online lenders using all your home's equity. You likely won't know you're a victim until you start receiving late payments or foreclosure notices.

Click to see if your home's title has been compromised.
Get your FREE TITLE SCAN and COMPREHENSIVE TITLE REPORT (a $100 value FREE with sign up)

Sign Up  

Speak to a live agent
(800) 899-6268

Title Fraud is NOT COVERED by



Your Bank


Legal Trust


Homeowners Insurance


Identity Theft Protection
Signing Up Is Easy - Start Your Subscription Today

Title Lock alerts help you detect property fraud before it's too late.
Create your account for only pennies per day.

Sign Up Today
#1 Leader in Home Title Protection