First American Financial isolates systems from the internet and later reports data exfiltration

First American Financial, the title insurance and settlement company, disclosed on December 22, 2023 that it had found unauthorized activity on some of its IT systems and had taken systems offline. Its Item 1.05 filing gives no detection date; the first dated step is the decision to isolate systems from the internet on December 20.

First filing

The company said it could not yet estimate how long the disruption would last, set up a separate website for updates, and could not yet say whether the incident would be material to its finances.

Amendments

The first 8-K/A, filed December 29, 2023, reported that the incident appeared contained and described what the intruder did.

The second, filed January 12, 2024, turned to money. Some fourth-quarter 2023 transactions slipped into the next quarter, others went to competitors, and the company booked one-time costs. First American expected a material effect on fourth-quarter results but not on its overall financial condition.

Open questions

None of the three filings gives a count of affected customers or names who was behind the activity.