Fidelity National Financial is notifying an undisclosed number of individuals that their personal information – including Social Security numbers, bank account numbers and payment card numbers – may have been accessible after a small number of employees had their email accounts compromised in a targeted phishing attack.
How many victims? Undisclosed. Fidelity National Financial did not immediately respond to a SCMagazine.com request for the information.
What type of personal information? Social Security numbers, bank account numbers, payment card numbers and driver's license numbers were among the data that may have been accessible during the attack.
What happened? A small number of employees were the subject of a targeted phishing attack in which attackers obtained usernames and passwords for the employee email accounts. The attackers logged into a subset of those accounts, and the personal information may have been accessible.
What was the response? Federal law enforcement was notified and a third-party security expert aided Fidelity National Financial in determining the scope of the attack. Steps taken to reduce the likelihood of a similar occurrence include implementing enhanced security measures with respect to employee email accounts, and providing information and training to employees. All impacted individuals are being notified, and offered a free year of identity protection services.
Details: The attackers logged into a subset of the compromised email accounts – which are hosted by a recognized third-party service provider – intermittently from April 14 through April 16. The investigation revealed no evidence that the attackers penetrated Fidelity National Financial's internal network or systems, and also has revealed no evidence that the attackers accessed personal information. The notification letter is dated Sept. 23, and the incident was reported to California on Oct. 24.
Exactly who was impacted was not made explicit, but the notification states that Fidelity National Financial is the parent company of Ticor Title Company of Oregon, Ticor Title of Nevada, Inc., Lawyers Title Company, and Lawyers Title of Oregon, LLC, which provide title insurance and real estate settlement services in Oregon, Nevada, and/or California.
Quote: “Our third-party security expert has advised us that the apparent purpose of the attackers' activity was to obtain information about ongoing business transactions in order to redirect scheduled money transfers,” Paul Perez, chief compliance officer with Fidelity National Financial, wrote in the notification letter. “The third-party security expert has further advised us that the attackers' behavior was not designed to access or acquire large volumes of personal information.”
Source: oag.ca.gov, “Fidelity National Financial, Inc.,” Sept. 23, 2014.
