A subsidiary of insurance company First American Financial Corp is facing charges from the New York Department of Financial Services (DFS) for a data breach that appears to have been going on for years. The DFS filed a data breach charge against the company on July 22, alleging that the insurance company leaked hundreds of millions of documents containing sensitive and confidential information. The data breached included Social Security numbers and bank account details.
According to DFS, the insurance company leaked data because it used a flawed system that allowed anyone to access company files. In addition, DFS claims there were no passwords or other securityin place to prevent the leak of sensitive information stored on the company's system.
This court case is the first lawsuit filed by DFS regarding compliance with regulations that went into effect in March 2017 and require banks ,as well as other financial services, to implement cybersecurity.
According to regulations, financial services licensed in New York must restrict access to sensitive data, conduct regular risk assessments, and promptly notify users of any cybersecurity incidents.
First American is accused of violating six points of the regulations. If found guilty, the insurer could be ordered to pay fines of up to $1,000 per violation. First American Title Insurance Co. is the second-largest title insurance company in the United States. A spokesman said the company would not admit or verify the allegations.
According to the charges, First American knew about the vulnerabilities in its document management system several months before they were officially disclosed in 2019 by journalist Brian Krebs. DFS said the vulnerabilities were discovered during a penetration test authorized by First American in late 2018. DFS said mismanagement and a series of administrative errors meant the company did not fix the bugs
First American pointed out that an investigation into the breach by Nebraska Insurance found that the company had adequate cybersecurity, meaning it was following and complying with New York regulations.
