Social EngineeringFinancial ServicesFinancePhishingStolen CredentialsCapture App DataMulti-Stage ChainTargetedCustomer Data InvolvedEmployee Data InvolvedWire FraudGovernment IDFinancial accountFinancial credentialsIdentity (basic)MediumContained

FIDELITY NATIONAL FINANCIAL, INC.

bd_bd30108080352613 · schema v1 · pii pii-v1

Severity

Medium

Discovered

—

Filed

Oct 24, 2014

To disclose

—

Affected

Not disclosed

Confidence

84%

Full breach record for FIDELITY NATIONAL FINANCIAL, INC. →4 incidents on file

In April 2014, Fidelity National Financial (FNF) employees were targeted by a phishing attack that led to attackers obtaining username and password credentials for a small number of employee email accounts hosted by a third-party provider. Attackers logged into accounts intermittently April 14–16, 2014. Potentially exposed data includes SSN, bank account numbers, credit/debit card numbers, and driver's license numbers. The apparent purpose was to redirect scheduled money transfers. FNF notified federal law enforcement and engaged a third-party security expert.

J jump to incidentP pin to compareR raw source

Incident timeline

Apr 14, 2014

Begins

Oct 24, 2014

Filed

Tracked as a single-filing incident — the only disclosure on record for this event so far.ConfirmedView incident

Name: FIDELITY NATIONAL FINANCIAL, INC.
norm: fidelity national financial
Domain: fnf.com

Name: FIDELITY NATIONAL FINANCIAL, INC.
norm: fidelity national financial
Domain: fnf.com
Industry: Financial Servicesllm

Discovered: —
Breach occurred: Apr 14, 2014 – Apr 16, 2014
Materiality determined: —
Notification sent: Sep 23, 2014
Affected individuals: Not disclosed
Data types: Government IDFinancial accountFinancial credentialsIdentity (basic)
Attack vector: Phishing
MITRE ATT&CK: T1566 PhishingT1078 Valid AccountsT1114 Email Collection
Threat actor: ExternalFinancial
Regulator citations: Notified federal law enforcement
Initial access: phishing_attachment

During the incident: Notified federal law enforcement upon learning of this attack
Began an investigation
Worked with a third-party security expert to determine the scope of the attack
Arranged to have AllClear ID protect affected individuals' identity for 12 months at no cost
Changes made: Implemented enhanced security measures with respect to our employees' email accounts
Provided information and training to our employees
Source: Quoted from the filing itself, not independently verified.

Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://oag.ca.gov/ecrime/databreach/reports/sb24-47112
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Oct 24, 2014
Raw hash: 084628969870244e98544bb394c30e36b51a783cdf262dbae1a371b59b3149c5

Reporting entityFIDELITY NATIONAL FINANCIAL, INC.

Victim entityFIDELITY NATIONAL FINANCIAL, INC.

IncidentPhishing

Stated responseNotified federal law enforcement upon learning of this attack

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenanceoag.ca.gov