Confirmed breach. Intrusion Dec 18, 2023–Jan 2, 2024, discovered Dec 18, 2023 — the first regulatory filing landed 175 days later (flagged late). 42,501 individuals reported across the linked filings.
Regulatory clocksOregon✗ OR AG >45dMaine✗ ME AG >90d · 175dVermont✗ VT AG >45 bdayWashington✗ WA AG >90dFull clock table in Litigation Timeline
State AGConfirmedLifecycle stage 2 of 3: ConfirmedUnverified claimConfirmedEnforcedhigh sensitivity
Affected (total reported)
42,501
Data types
1
Government ID
1days
Time between earliest and latest filing
Not recorded for this incident
Leak precedence · Materiality delta · SEC filing delay — no leak-site claim in this cluster; no SEC 8-K in this cluster.
Jurisdictions
8
CA IN ME MT NH OR VT WA
Linked filings
8
all State AG
Sensitive data
identity_government
Affected residents by state
per-filing reported counts
IN41,683
OR41,638
WA706
MT72
ME55
NH30
State AGs report only their own residents; bars show per-filing counts.
Timeline
Earliest sighting first · deep chronology in Litigation Timeline
8 filings across 8 jurisdictions · Jun 10, 2024 – Jun 11, 2024 · 2 milestones
Breach window
Dec 18, 2023
When the intrusion reportedly occurred, per the linked filings
Breach discoveredletter-grounded
Dec 18, 2023
Reported by OREGON AG, MAINE AG, VERMONT AG, WASHINGTON AG, NEW HAMPSHIRE AG filings
175 days
8 State AG filingsJun 10, 2024 – Jun 11, 2024ExpandCollapse
MEORVTINCAWAMTNH
About this clustering
DisclosureLens links filings into incidents through layered matchers: deterministic rules (same source document, multistate filings of one breach, tight-window same-victim pairs), a weighted-similarity scorer for cross-source candidates, and an operator review queue for everything uncertain. Each link records its own method and confidence — shown per filing in the timeline below. The system defaults to NOT merging when uncertain, because a false merge (collapsing two unrelated breaches) is more harmful than a false split (showing related filings separately); uncertain pairs route to human review instead of auto-merging. Filing summaries shown in the timeline are AI-generated extracts — verify each against its linked source.
First American Financial Corporation reported an external system breach (hacking) that occurred and was discovered on December 18, 2023. The breach affected 55 Maine residents, compromising their names in combination with their driver's license or non-driver identification card numbers. The company notified the affected individuals on June 10, 2024, and offered 24 months of complimentary credit monitoring and identity theft restoration services through Experian.
Affected (this filing): 55
ME AG >90d · 175dME resident >60d · 175d
🦫Oregon State AGlinked via multistate filing link · 100%
First American Financial Corporation reported a data breach to the Oregon Attorney General. The breach was reported on 2024-06-10. The breach occurred during 12/18/2023 - 1/2/2024. The breach was discovered on 12/18/2023. 41,638 individuals were affected. Notice was sent on 6/10/2024.
Affected (this filing): 41,638
OR AG >45d
🍁Vermont State AGlinked via multistate filing link · 100%
First American Financial Corporation notified Vermont AG of a cybersecurity incident discovered on Dec 18, 2023, involving unauthorized access to IT systems. The breach may have exposed names and other personal info. First American engaged external experts, worked with law enforcement, and offered 24 months of credit monitoring.
VT AG >45 bday
🏎️Indiana State AGlinked via multistate filing link · 100%
First American Financial Corporation reported a data breach to the Indiana Attorney General. The breach occurred on 2023-12-18 and was reported on 2024-06-10. 2,926 Indiana residents were affected. 41,683 individuals affected in total.
Affected (this filing): 41,683
🐻California State AGlinked via multistate filing link · 100%
First American Financial Corporation reported a data security incident occurring on December 18, 2023. The company retained cybersecurity experts, strengthened network security, and notified law enforcement and regulators. Affected individuals were offered 24 months of credit monitoring and identity theft restoration services via Experian. The specific nature of the breach and data types are not detailed in the provided notification letter excerpt, though identity data is implied by the remediation offered.
🌲Washington State AGlinked via multistate filing link · 100%
First American Financial Corporation, a finance sector entity reported a ransomware incident to the Washington Attorney General. The organization became aware of the incident on 2023-12-18 and filed notice on 2024-06-10. 706 Washington residents were affected. 175 days elapsed between awareness and notification. 0 days to identify the breach. 15 days to contain the breach.
First American Financial Corporation reported a data breach to the Montana Attorney General. The breach was reported on 2024-06-10. The breach occurred on 12/18/2023. 72 Montana residents were affected.
Affected (this filing): 72
⛰️New Hampshire State AGlinked via multistate filing link · 100%
First American Financial Corporation notified the New Hampshire Attorney General of a data event affecting approximately 30 NH residents. Unauthorized activity was identified on Dec 18, 2023, leading to system isolation on Dec 20, 2023, due to an imminent ransomware attack. Personal information was accessed. The company engaged forensic experts, notified law enforcement, and is offering credit monitoring services.