First American Financial

firstam.com

CONFIRMED

First American Financial filed the very first SEC Form 8-K Item 1.05 disclosure under the SEC mandate following an unauthorized network intrusion that disabled title portals.

Observable Status CONFIRMED

Industry / Sector Financial Services

Incident Classification Network Intrusion & Disruption

Attributed Threat Actor Unknown / Unattributed

Affected Population 44,000 records

First Seen 2023-12-20

Last Updated 2024-01-16

Compromised Data Classes:

Title Insurance Records Escrow Documents Customer Identifiers

Statutory Regulatory Filings:

U.S. Securities and Exchange Commission (SEC): Form 8-K Item 1.05 (Material Cybersecurity Incidents) (0001472787-23-000072)

OPEN WEIGHTS TELEMETRY • DETERMINISTIC CONFIDENCE

Confidence & Source Corroboration

98% CONFIDENCE

1. Primary Authority CONFIRMED BY REGULATOR Base weight: 65%

2. Evidence Specificity +23% Statutory Filing Verified

3. Corroboration Curve +7% 2 independent domains

4. Timeline & Staleness +3% 3 milestones logged

Corroborated Source Domains:

firstam.com sec.gov

STATUTORY REGULATORY DISCLOSURES

Official Regulatory Filings & Legal Compliance Records

1 Verified Statutory Filing

Regulatory Ground Truth Standard: The disclosures below represent formal statutory filings and enforcement records submitted to government regulatory authorities (SEC, State Attorneys General, HHS OCR, CISA). In accordance with repository principles, this data is captured exactly as filed by the reporting entity and is never modified, overridden, or synthesized by AI models.

U.S. Securities and Exchange Commission (SEC)

Form 8-K Item 1.05 (Material Cybersecurity Incidents)

CONFIRMED BY REGULATOR

Docket / Accession ID 0001472787-23-000072

Statutory Filing Date 2023-12-20

Disclosed Impact 44,000 records

Evidence Standard Regulatory Ground Truth

Statutory Filing Details & Summary (Preserved As Filed):

Item 1.05 Material Cybersecurity Incident disclosure filed by First American Financial Corporation regarding cybersecurity incident leading to isolation of systems and disruption of title and closing operations.

View Official Regulatory Filing Document https://www.sec.gov/Archives/edgar/data/1472787/000147278723000072/faf-20231220.htm

Technical Forensic Briefing

Incident Overview

First American Financial filed the very first SEC Form 8-K Item 1.05 disclosure under the SEC mandate following an unauthorized network intrusion that disabled title portals.

Compromised Assets & Data Scope

Primary Data Classes: Title Insurance Records, Escrow Documents, Customer Identifiers.
Disclosed Affected Population: Approximately 44,000 individuals or records.

Statutory Disclosures & Compliance

Statutory filing submitted to SEC (Form 8-K (Item 1.05)) under accession 0001472787-23-000072.

Milestone Timeline (3 events logged)

2023-12-20 18:00 UTC

CONFIRMED BY TARGET

First American detects unauthorized cybersecurity activity and isolates systems, taking email, title production, and web portals offline.

Source: First American Cybersecurity Advisory

2023-12-22 17:15 UTC

CONFIRMED BY REGULATOR

First American files SEC Form 8-K Item 1.05—marking the landmark first-ever disclosure under the SEC's material cybersecurity disclosure mandate.

Source: SEC EDGAR 8-K Item 1.05 (Adsh 0001472787-23-000072)

2024-01-16 16:45 UTC

CONFIRMED BY REGULATOR

Form 8-K Item 1.05 amendment confirms core title and escrow transaction systems are restored and operational.

Source: SEC EDGAR 8-K/A Item 1.05 (Adsh 0001472787-24-000003)

Have updated information or a new verifiable source?

This incident record is a flat Markdown file tracked in Git. Propose an update or add a milestone via Pull Request.

Propose Update via GitHub