MalwareFinancial ServicesFinanceRansomwareRansom DemandedCustomer Data InvolvedPIIIdentity (basic)LowContained

FIRST AMERICAN FINANCIAL CORPORATION

bd_383f35344a3929d1 · schema v1 · pii pii-v1

Severity

Low

Discovered

Dec 18, 2023

Filed

Jun 11, 2024

To disclose

25 weeks

Affected

30state residents only

Linked

11 filings

Confidence

67%

Full breach record for FIRST AMERICAN FINANCIAL CORPORATION →2 incidents on file

First American Financial Corporation notified the NH Attorney General of a data event affecting approximately 30 New Hampshire residents. On December 18, 2023, the company identified unauthorized activity and detected evidence of a potentially imminent ransomware attack on December 20, 2023. Systems were isolated, and the actor was eradicated. Personal information may have been accessed, but there is no evidence of internet exposure. Credit monitoring services are being offered.

J jump to incidentP pin to compareR raw source

Incident timeline

discovery → filing · 25 weeks / 176 days

Dec 18, 2023

Discovered

Jun 11, 2024

Filed

vs. sector median

+17 wks slower

This filing is one of 11 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (10) · sorted by filing gap

Massachusetts State AGbd_1ab5e2b17c58412e2024-06-11Verified
Maine State AGbd_03c54138ce498d6e2024-06-10 · +1dCandidate
Oregon State AGbd_2c2d994f154ddba82024-06-10 · +1dVerified
Vermont State AGbd_71b5952cfc0bcda62024-06-10 · +1dVerified

Show 6 more filings ↓up to 14d gap

Indiana State AGbd_8859929ee6e3d9cd2024-06-10 · +1dVerified
California State AGbd_925be77b47ede7b02024-06-10 · +1dVerified
Washington State AGbd_e54d5f458060513b2024-06-10 · +1dVerified
Montana State AGbd_eb86e3765537060c2024-06-10 · +1dCandidate
Illinois State AGbd_47489894a5eca95b2024-06-01 · +10dVerified
SEC 8-Kbd_9ad6d444f232d5fe2024-05-28 · +14dVerified

Name: FIRST AMERICAN FINANCIAL CORPORATION
norm: first american financial
Domain: firstam.com

Name: FIRST AMERICAN FINANCIAL CORPORATION
norm: first american financial
Domain: firstam.com
Industry: Financial Servicesllm

Discovered: Dec 18, 2023
Materiality determined: —
Notification sent: Jun 10, 2024
Affected individuals: 30state-resident count only
Data types: PIIIdentity (basic)
Attack vector: Ransomware
MITRE ATT&CK: T1486 Data Encrypted for Impact
Threat actor: ExternalFinancial
Regulator citations: Notified law enforcement and applicable regulatory authorities

During the incident: Took steps to contain, assess, and remediate the incident
Isolated its systems from the Internet
Launched an investigation with the assistance of leading external cybersecurity experts
Eradicated the actor from its network
Notified law enforcement and applicable regulatory authorities
Retained leading cybersecurity experts to support the investigation and remediation of the incident
Further strengthened its already-robust network security
Offering impacted individuals access to complimentary credit monitoring and identity theft restoration services through Experian
Changes made: Further strengthened its already-robust network security
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 25 weeks(176 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 11 filings · 10 states

View merged incident ↗

SEC 8-KMay 28 · first

Illinois State AG+4d

Maine State AG+13d

Oregon State AG+13d

Vermont State AG+13d

Indiana State AG+13d

California State AG+13d

Washington State AG+13d

Montana State AG+13d

Massachusetts State AG+14d

New Hampshire State AG+14d · this page

Pattern: first filing May 28, last Jun 11 (NH) — a 14-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/first-american-financial-20240611.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jun 11, 2024
Raw hash: 28c588d8f2fb787a883480242165d6dac422dd19a5c522f35206a48f5042615e

Linked disclosures

Regulatory filings (10) · sorted by filing gap

Reporting entityFIRST AMERICAN FINANCIAL CORPORATION

Victim entityFIRST AMERICAN FINANCIAL CORPORATION

Incidentdiscovered Dec 18, 2023

Stated responseTook steps to contain, assess, and remediate the incident

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov