← First American Financial

2019 document exposure — 885M records

2019 885.0M records affected Share on X

Data compromised

Financial data

Technical writeup

First American Financial exposed hundreds of millions of title insurance and mortgage documents via an insecure direct object reference. Anyone with a URL could access other customers' records.

Root cause

Insecure direct object reference (IDOR) in document application; no authentication on sequential document URLs.

References