{
  "id": "case-first-american-title",
  "slug": "first-american-financial-title-breach",
  "title": "First American Financial Title Insurance Cybersecurity Incident",
  "summary": "Severe computer intrusion forcing First American Financial Corporation to shut down core title insurance, real estate transaction banking, and closing systems nationwide, causing nationwide mortgage settlement delays, disclosed under SEC Form 8-K Item 1.05.",
  "case_number": "SEC-8K-0001472787-23-000072",
  "court": "U.S. Securities and Exchange Commission EDGAR",
  "district": "C.D. Cal.",
  "country": "United States",
  "opened_at": "2023-12-20",
  "status": "settled",
  "victim_sector": "Financial Services & Real Estate",
  "victim_country": "United States",
  "loss_amount_usd": 60000000,
  "loss_amount_note": "Direct business interruption and NYDFS regulatory settlement penalty.",
  "first_seen_at": "2023-12-20T00:00:00Z",
  "last_updated_at": "2026-10-06T10:00:00Z",
  "actor_slug": "unattributed-cybercrime",
  "defendant_slugs": [],
  "cves": [],
  "techniques": [
    {
      "technique_id": "T1489",
      "evidence_excerpt": "In response to unauthorized network access, First American took certain of its systems offline to contain the activity, severing customer title plant access.",
      "evidence_locator": "First American Form 8-K Disclosures",
      "mapping_status": "reviewed",
      "mapped_by": "rule",
      "source_title": "SEC Form 8-K First American Financial",
      "source_url": "https://www.sec.gov"
    },
    {
      "technique_id": "T1078",
      "evidence_excerpt": "Threat actors accessed network shares and document storage containing escrow instructions and personal financial records.",
      "evidence_locator": "NYDFS Enforcement Consent Order",
      "mapping_status": "reviewed",
      "mapped_by": "rule",
      "source_title": "NYDFS Consent Order",
      "source_url": "https://www.dfs.ny.gov",
      "technique_name": "Valid Accounts",
      "tactic": "Defense Evasion"
    }
  ],
  "events": [
    {
      "event_type": "incident",
      "event_date": "2023-12-20",
      "description": "First American identifies unauthorized activity and isolates critical transactional network systems."
    },
    {
      "event_type": "filing",
      "event_date": "2023-12-22",
      "description": "First American files Form 8-K Item 1.05 with the SEC acknowledging material cybersecurity incident."
    },
    {
      "event_type": "restoration",
      "event_date": "2024-01-08",
      "description": "Core title processing, escrow systems, and customer portal services return to full operations."
    }
  ],
  "attack_anatomy": {
    "ground_zero": "Unauthorized intrusion into internal corporate network segments supporting core title production and escrow systems.",
    "blast_radius": "Forced nationwide shutdown of real estate closing and title insurance operations for over two weeks, leading to an SEC Form 8-K Item 1.05 filing and NYDFS consent order.",
    "kill_chain": [
      {
        "phase": "Perimeter Ingress",
        "title": "Internal Network Compromise",
        "description": "Threat actors breached internal network segments supporting title plant and escrow document repositories.",
        "technical_artifacts": [
          "Perimeter appliance logs",
          "Compromised internal accounts"
        ],
        "mitre_technique_id": "T1078"
      },
      {
        "phase": "Proactive Isolation",
        "title": "Enterprise System Shutdown",
        "description": "Upon detecting unauthorized activity, First American took core transactional systems offline to contain lateral traversal.",
        "technical_artifacts": [
          "Network isolation commands",
          "Service stop operations"
        ],
        "mitre_technique_id": "T1489"
      },
      {
        "phase": "Escrow Disruption",
        "title": "Nationwide Real Estate Settlement Freeze",
        "description": "Shutdown of title plant systems halted mortgage loan closings, wire transfers, and property deed filings across the country.",
        "technical_artifacts": [
          "Banking portal outage",
          "Offline escrow operations"
        ],
        "mitre_technique_id": "T1489"
      },
      {
        "phase": "Regulatory Disclosure",
        "title": "SEC Form 8-K Item 1.05 Filing",
        "description": "First American filed Form 8-K Item 1.05 with the SEC, acknowledging a material cybersecurity incident that disrupted customer operations.",
        "technical_artifacts": [
          "SEC Form 8-K 0001472787-23-000072"
        ],
        "mitre_technique_id": "T1078"
      },
      {
        "phase": "System Recovery",
        "title": "Phased Restoration & Regulatory Settlement",
        "description": "Core title processing and wire systems were systematically restored, followed by regulatory compliance consent agreements.",
        "technical_artifacts": [
          "Sanitized server redeployment",
          "NYDFS consent decree"
        ],
        "mitre_technique_id": "T1078"
      }
    ],
    "defensive_takeaways": [
      "Establish tested manual fallback procedures for real estate escrow and banking transactions during digital outages.",
      "Implement network microsegmentation between customer-facing closing portals and internal core title databases.",
      "Deploy automated incident containment workflows that limit blast radius without requiring nationwide network shutdown.",
      "Conduct regular tabletop simulations testing operational resiliency under total IT disconnection scenarios."
    ]
  }
}