On May 27, 2019, a class action complaint was filed in United States District Court, Central District of California, against First American Financial Corporation and First American Title Company (collectively, “First American”) alleging, among other things, that First American, “[d]espite explicitly promising customers robust data security as part of the high cost of title services, . . . allowed anyone to access the sensitive files of millions of customers.”
According to the complaint:
First American made it incredibly easy for the public to access this private information by failing to implement even rudimentary security measures. Suppose that you are a First American customer. The company provides you with a URL to access your documents on its website. That URL might end in “DocumentID= 000000075.”
Now suppose you want to access someone else’s personal file. Type the same URL but alter the Document ID number by one digit—say, “DocumentID= 000000076”—and someone else’s personal file will appear. Change the numbers again (and again), and you will reveal still more personal files.
It took no computer sleuthing to uncover numbers that will pull personal data; First American’s document identification numbers were sequential. Follow that sequence 885 million times—1, 2, 3, 4, and so forth—and you could access all 885 million documents.
Because First American breached promises and was negligent in its data security, the American dream of home ownership is now a financial security nightmare, as individuals who did business with this company face a serious threat of identity theft or other financial harms. [Emphasis added.]
Moreover, according to the complaint:
First American’s document storage solutions were not secure. On May 24, 2019, cybersecurity researcher Brian Krebs announced that 885 million files were available on First American’s website for anyone to access. The files contained bank account numbers, Social Security numbers, financial and tax records, and images of drivers’ licenses. [Emphasis added.]
The class action was filed on behalf of a proposed class of “[a]ll persons who utilized First American’s title insurance or other closing services in a real estate transaction that involved mortgage financing.”
For additional information, see “First American Financial Corp. Leaked Hundreds of Millions of Title Insurance Records.”