Insurer's huge data exposure draws charges from New York state

The complaint is the first action under new Department of Financial Services regulations.

New York regulators have charged an insurer with violating state cybersecurity law for allegedly exposing hundreds of millions of documents that included Americans’ personal data, including Social Security numbers and financial information.

The New York State Department of Financial Services announced legal action Wednesday against the First American Title Insurance Company, the second-largest real estate title insurer in the U.S. The company is accused of exposing customers’ Social Security numbers, bank account information, driver’s license numbers and mortgage and tax records through a software vulnerability that went undetected between May 2014 and December 2018. Upon discovering the flaw during a routine security test, the insurance company failed to fix it, DFS alleged.

“After the data exposure was discovered by an internal penetration test in December 2018, First American failed to conduct a reasonable investigation into the scope and cause of the exposure, reviewing only 10 of the millions of documents exposed and thereby grossly underestimating the seriousness of the vulnerability,” state regulators said in a statement.

First American said it “strongly disagrees” with the charges in a statement Wednesday.

The vulnerability in First American’s website exposed roughly 885 million files, KrebsOnSecurity first reported last year. A real estate developer who uncovered the issue told KrebsOnSecurity that anyone with access to a section of the First American website could modify the URL, then view a huge number of other documents.

First American said it fixed the issue following the Krebs report.

If found guilty of the DFS charges, First American could face fines of up to $1,000 for every exposed record.

The complaint marks the first enforcement of new New York rules that spell out the way financial firms operating in the state must protect data. Requirements include regular security tests, policies around device management, network monitoring and the appointment of a chief information security officer, or equivalent position, in covered entities. Given the concentration of large financial firms in New York, the state laws cover a large portion of the U.S. industry.

New York sues Allstate and subsidiaries for back-to-back data breaches

A pair of data breaches in late 2020 and early 2021 exposed driver’s license numbers of almost 200,000 people.

SEC settles with First American over massive data leak for nearly $500,000

How Arkady Bukh, a New York-based immigrant from the former Soviet bloc, emerged as the go-to defense lawyer for the cybercrime underworld.

Government

• FBI officials say AI is bolstering adversaries, emphasizing need to focus on cyber basics, patching

• Feds accuse China of ‘systematic’ distillation of U.S. AI models

• CIA’s Michael Ellis says cyber intelligence is changing how the agency operates

• The G7 tells industry to hurry up and prep for post-quantum encryption

Technology

• European parliament members call for slowdown of Serbia’s EU entry over spyware use

• FCC proposes public scorecard to rate telecoms on anti-robocall efforts

• Pegasus, NoviSpy variant spyware found on devices of Serbian activists

• Wyden seeks upgraded NSA security guidance on commercial VPN use

Threats

• Chinese espionage groups swarm to exploit triple-link chain of zero-days

• Microsoft discloses two actively exploited zero-days among 974 vulnerabilities

• Attackers exploit zero-days in consistently besieged SonicWall product

• Jail time for Maine child in 764 marks turning point in federal law enforcement

Policy

• Whistleblower says USPS deploying new, ‘untested’ IT systems governing mail-in ballots

• ‘Watershed 250’ test program in Texas looks to private sector for water cybersecurity help

• Former sexual abuse victims say Grok used their images, videos to train deepfake capabilities

• Cyber threats nudge Trump to sign executive order on foreign equipment in U.S. energy infrastructure