Massive Data Leak at First American Title Company

First American, a financial company that deals with real estate title insurances for Fortune 500 companies, leaked hundreds of millions of documents related to the deals as reported by Brian Krebs. The May 24 2019 report outlined a disclosure by a real estate developer to Brian Krebs after the company failed to respond to the developer. The trove of documents dated back to as early as 2003, and contained sensitive PII as well as financial documents related to title deals for the company.

Recommendations

• If not already enabled, turn on the compromised credentials rule for all relevant entities and ensure relevant emails are entered for those entities, or reach out to [email protected] for assistance
• If one of your entities receives an alert ZeroFOX recommends immediate password changes for the affected account
• Enable 2-factor authentication for all of your organizational accounts to help mitigate phishing and credential stuffing attacks
• Remain alert to potential spear phishing attacks through email and social media.

Details

The website was supposedly vulnerable to a traversal attack. If an attacker knew just one linke with an ID on the website, for example ?id=500, then they could increment or decrement the counter to retrieve every single document stored in the system. Krebs did not have any proof that this data was used by fraudsters, but commented that this could be a gold mine for BEC criminals. The criminals trick victims into fraudulently wiring money to attacker controlled accounts by impersonating legitimate people, such as executives or in this case, real estate brokers.