{"id":19414,"date":"2021-06-15T12:53:23","date_gmt":"2021-06-15T16:53:23","guid":{"rendered":"https:\/\/www.elteni.com\/?p=19414"},"modified":"2021-06-15T12:53:23","modified_gmt":"2021-06-15T16:53:23","slug":"sec-charges-first-american-financial-corporation-with-cybersecurity-disclosure-controls-failures","status":"publish","type":"post","link":"https:\/\/www.elteni.com\/insights\/?p=19414","title":{"rendered":"SEC Charges First American Financial Corporation With Cybersecurity Disclosure Controls Failures"},"content":{"rendered":"

On June 15, 2021 \u201cThe Securities and Exchange Commission (\u201cSEC\u201d) announced settled charges against real estate settlement services company First American Financial Corporation for disclosure controls and procedures violations related to a cybersecurity vulnerability that exposed sensitive customer information.\u201d<\/p>\n

On May 24, 2019, Brian Krebs<\/a> notified First American Financial Corporation of a vulnerability with its Web site used for sharing documents that exposed over 800 million records dating back to 2003, including images containing sensitive personal data such as social security numbers and financial information.<\/p>\n

The SEC stated that First American\u2019s senior executives were not informed that the company\u2019s information security team had identified the vulnerability several months earlier but had failed to remediate it in accordance with their policies. First American also failed to report all of the details of the incident.<\/p>\n

The SEC highlighted that senior management\u2019s lack of visibility of cybersecurity vulnerabilities resulted in improper disclosure. As a result, First American agreed to a cease-and-desist order and to pay a $487,616 penalty.<\/p>\n

Lessons Learned<\/strong><\/p>\n

So, what are the takeaways here?<\/p>\n