No estimated return to operations after First American ‘cybersecurity incident’
|
Cyberawareness, Industry News
Friday, December 22, 2023 | |
First American Financial Corp. cannot estimate how long some of its systems will remain offline after a cybersecurity incident, the company said in a Dec. 22 filing with the U.S. Securities and Exchange Commission.
In the filing, First American said it identified “unauthorized activity on certain of its information technology systems.” The company isolated some systems from the internet after taking steps to contain, assess and remediate the incident, it stated.
“The company is working diligently to restore those systems and resume normal operations as soon as possible, but cannot estimate the duration or extent of the disruption at this time,” the filing stated. “The company has retained leading experts, is working with law enforcement and notified certain regulatory authorities.”
First American also said it is “assessing the impact of the incident and whether it may have a material impact on its financial condition and results of operations, which at this point cannot be determined.”
The disruption of service right before the Christmas holiday is being felt across the real estate industry. First American’s websites are offline across its portfolio, including First American Title, DataTrace, SafeEscrow and ACI, a major provider of appraisal software.
It’s also likely to be felt in the regulatory space, Sterbcow Law Group Managing Attorney Marx Sterbcow said.
“The regulatory environment is likely to encounter massive headwind on the title IT world in 2024-25 due to all of this. The problem is that no matter how much security you have in place, it’s not enough,” he said.
It also remains to be seen how it might impact 1031 exchanges, with the end of the year quickly approaching.
Since cybercriminals never take a holiday, it is imperative that the industry stays extra vigilant at this time of year, Premier One Sales and Marketing Manager Shawn Fox told
The Title Report.
“These attacks are being attempted all day long, every day. That’s the real-life pattern. The recent news of successful attacks only reflects those events which have been discovered and disclosed,” he said. “From our perspective, everyone remains a potential target, whether it's a small five-employee title company or a larger underwriter.
“Malicious actors are constantly seeking vulnerabilities to exploit. These cyberattacks, occurring during a downturn in the market, only amplify the existing pressures and stress on all parties in the transaction. As organizations seek to wind down for the year and enjoy the holiday season, there is a greater risk that those critical security checks and balances are overlooked. We urge everyone to pay close attention and be even more diligent in your efforts to stay secure as we seek to close out the year.”
Fox recommends businesses operate under a “zero trust” policy, meaning don’t automatically trust any familiar user or device.
“Just because you have done business with this lender or Realtor for years doesn’t mean they haven’t been compromised. Likewise, accepting your IT administrator’s assurances of complete security should be met with scrutiny,” he said. “It’s important to read, assess, and reevaluate security measures regularly. If you are doing the same thing for IT security today that you were doing three years ago, then you are falling behind.”
Some of the most effective ways Fox suggests to mitigate risk include advanced email security services, multi-factor authentication, and a 24/7 security operations center. Also, have a plan in place for when an incident like what First American faced happens.
“In today's cyber landscape, it's not a question of 'if' but 'when' a cyber event will occur. The key is preventing it from becoming a systemic issue with rapid detection and response preparation,” Fox said. “Have a plan in place for what to do when the bad guys get the best of your defenses. Ensure these components work seamlessly together by conducting thorough research on the products you implement. Remember, your employees are the initial line of defense, so prioritize their training."
First American created a new landing page for updates about the incident. It currently reads, “First American has experienced a cybersecurity incident. In response, we have taken certain systems offline and are working to return to normal business operations as soon as possible.”
The company said its email system is offline and warned “any recipient of an email purporting to be from First American, First American Title or from FirstAm.com should be vigilant about cybersecurity risks and avoid clicking on unknown or suspect links.”