The New York State Department of Financial Services said Tuesday that First American Title Insurance Co. will pay a $1 million penalty in a settlement with the department for violating its cybersecurity regulation in connection with a major cybersecurity breach in 2019.
The department said that in addition to the penalty, the Santa Ana, California-based company, which is the nation’s second-largest title insurer, will implement significant remedial measures to better secure consumer data.
This follows a fine paid to the US Securities and Exchange Commission last year in connection with the same breach.
In a statement, the department said First American’s senior management first learned in May 2019 of a vulnerability in its proprietary EaglePro application that allowed individuals to access other people’s documents in unrelated transactions, in addition to their own.
The insurer said it did not maintain and implement effective governance and classification, access controls and identity management, and risk assessment policies and producers.
As a result, it said it did not have sufficient access controls in place to prevent unauthorised users from gaining access to consumers’ non-public information.
In a statement, First Amendment said it was “pleased that this matter has been resolved”.
In June 2021, First American agreed, without admitting or denying the SEC’s findings, to pay a $487,616 penalty to the agency for allegedly failing to disclose a cybersecurity vulnerability.
In September 2021, the US District Court in Los Angeles dismissed a cybersecurity lawsuit brought against the insurer by a pension fund in connection with the breach.
