Incident Details
First American Title Insurance Company agrees to pay a $1 million penalty to New York State for violations of DFS's Cybersecurity Regulation due to a large-scale breach in May 2019, exposing consumers' nonpublic information.
Incident
How Did the Breach Happen?
First American's proprietary EaglePro application had a vulnerability that allowed unauthorized access to sensitive documents without authentication, affecting individuals in unrelated transactions.
What Data has been Compromised?
Consumers' nonpublic personal and financial information stored in the EaglePro application, including documents related to title insurance.
Why Did the company's Security Measures Fail?
First American failed to maintain effective governance, access controls, identity management, and risk assessment policies as required by DFS's Cybersecurity Regulation.
What Immediate Impact Did the Breach Have on the company?
The breach led to a $1 million penalty, implementation of remedial measures, and damage to the company's reputation and consumer trust.
How could this have been prevented?
- Regular security audits and vulnerability assessments
- Implementation of strong access controls and authentication mechanisms
- Employee training on cybersecurity best practices
What have we learned from this data breach?
- The importance of strict adherence to cybersecurity regulations
- The need for continuous monitoring of systems for vulnerabilities
- The significance of prompt remediation of identified security gaps
Summary of Coverage
First American Title Insurance Company faced a cybersecurity breach in May 2019, leading to a $1 million penalty and the implementation of remedial measures due to violations of DFS's Cybersecurity Regulation.