First American Financial Corp
Dec 2023 · Graded Verified · Financial Services · Government record
Incident summary
First American Financial CorpDec 2023
$11M
Spent responding & recovering
Direct expense
First American took its website, email, and much of its network offline in late December 2023 after intruders reached certain non-production servers, copied their contents, and encrypted the rest. The company never named the group, the vector, or the ransom, so the architecture speaks for itself: the names and driver's license numbers of about 44,000 people sat on machines it classified as non-production. Non-production is a label about the server, not the people whose identities lived on it.
Verified: the linked document states this figure.
SEC 8-K, Item 1.05
Initial attack type not disclosed · Impact ransomware confirmed + data theft
Quantified 54 days after disclosure.
What the company has said it cost
The company’s own disclosed figure, as it changed over time. The categorized loss on the record carries its own source.
About this record
This incident is on the public government record: an SEC 8-K filing or a state-regulator notification, graded Verified. Every figure links to the source it was read from; if we have read one wrong, tell us at info@hackerinahoodie.com. This index never sums figures across incidents. See the methodology.