HackingFinancial ServicesFinanceStolen CredentialsPhishingSupply Chain (3P Vendor)Customer Data InvolvedEmployee Data InvolvedIdentity (basic)Government IDPIIMediumActive

FIDELITY NATIONAL FINANCIAL, INC.

bd_d7bc170bc2748da6 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Mar 2, 2017

Filed

May 4, 2017

To disclose

9 weeks

Affected · nationwide

2361 in this filing

Linked

2 filings

Confidence

66%

Full breach record for FIDELITY NATIONAL FINANCIAL, INC. →4 incidents on file

Fidelity National Financial (FNF) notified the NH AG of a third-party breach involving its tax service vendor, Ceridian. A fraudster created unauthorized accounts in Ceridian's W-2 portal using stolen employee PII (name, SSN, zip) between Jan 11 and Feb 23, 2017. FNF discovered the incident on March 2, 2017, after IRS alerted employees to fraudulent tax returns. 236 employees were affected; 1 NH resident identified. FNF is offering credit monitoring and ID restoration.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 50 days

discovery → filing · 9 weeks / 63 days

Jan 11, 2017

Begins

Mar 2, 2017

Discovered

May 4, 2017

Filed

vs. sector median

+1 wks slower

This filing is one of 2 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (1) · sorted by filing gap

Massachusetts State AGbd_611cec14e9f785462017-05-04Verified

Name: FIDELITY NATIONAL FINANCIAL, INC.
norm: fidelity national financial
Domain: fnf.com

Name: FIDELITY NATIONAL FINANCIAL, INC.
norm: fidelity national financial
Domain: fnf.com
Industry: Financial Servicesllm

Discovered: Mar 2, 2017
Breach occurred: Jan 11, 2017 – Feb 23, 2017
Undetected for: 50 daysoccurrence → discovery
Materiality determined: —
Notification sent: May 4, 2017
Affected individuals: 236state + nationwide
Data types: Identity (basic)Government IDPII
Data elements: Social Security number
Attack vector: Third-Party / Supply Chain
MITRE ATT&CK: T1078 Valid AccountsT1114 Email Collection
Threat actor: ExternalFinancial
Regulator citations: Notified the IRSIRS intends to refer the incident to the Federal Bureau of Investigation
Initial access: valid_credentials

During the incident: Ceridian disabled FNF employee access to the online portal on March 3, 2017
Ceridian disabled the ability for users to create new online accounts to the portal on March 4, 2017
FNF notified the IRS and has been cooperating in its investigation
FNF contacted impacted employees for additional information
FNF offered identity theft services to impacted employees
FNF established a call center in connection with the incident
FNF changed the vendor code
Changes made: Partnered with Experian Consumer Direct to provide impacted employees with a free one-year membership to Experian Consumer Direct's CreditCheck Basic
Arranged for employees to utilize Equifax's ID Restoration service
Changed the FNF vendor code
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 9 weeks(63 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 2 filings · 2 states

View merged incident ↗

Massachusetts State AGMay 4 · first

New Hampshire State AGMay 4 · first · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/fidelity-national-financial-20170504.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: May 4, 2017
Raw hash: eb7fbfa9dac82b851d23043a02103cf86988f37aaa65ac6c9fca56efa43314fe

Linked disclosures

Regulatory filings (1) · sorted by filing gap

Reporting entityFIDELITY NATIONAL FINANCIAL, INC.

Victim entityFIDELITY NATIONAL FINANCIAL, INC.

Incidentdiscovered Mar 2, 2017

Stated responseCeridian disabled FNF employee access to the online portal on March 3, 2017

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov