SINKING

First American Financial Corp. Inadvertently Exposed Hundreds of Millions of Mortgage Documents Online

The company’s website allegedly exposed sensitive personal data over a period of 16 years.

The website for insurance giant First American Financial Corp. leaked hundreds of millions of documents related to mortgage deals onto the internet over a period of several years, KrebsOnSecurity reports. First American reportedly did not know about the massive leak until Krebs notified them. The website allegedly exposed approximately 885 million files, with the earliest dating back to 2003. The documents included bank account numbers and statements, mortgage and tax records, Social Security numbers, wire transaction receipts, and drivers license images. All of the documents were allegedly available to anyone with access to a web browser, Krebs reports. First American acknowledged in a statement Friday that a “design defect” had possibly allowed “unauthorized access to customer data” but gave no details on the scale of the breach.

First American is a leading provider of title insurance and settlement services to the real estate and mortgage industries. The leak is said to have allowed anyone who knew the URL for a document on the website to view other documents by simply modifying a single digit in the link. This hole in security could also potentially apply to anyone who’s ever been sent a document link via email by the company. First American is one of the most widely-used companies for closing real estate deals.