On July 22, 2020, the New York Department of Financial Services (DFS), announced that it had commenced a regulatory enforcement action against First American Title Insurance Company (First American), which according to the DFS, is the second largest title insurance provider in the United States. In the action, DFS alleges that First American violated the DFS’s Cybersecurity Requirements for Financial Services Companies (or the “Cybersecurity Regulation”), which first took effect on March 1, 2017, and generally requires, among other things, all entities regulated by the DFS, such as banks and insurance companies, to adopt a cybersecurity program to protect consumers’ private information. Specifically, DFS alleges that First American exposed hundreds of millions of documents over the course of several years as a result of a vulnerability in First American’s information systems, which may have exposed documents containing consumers’ private information, including bank account numbers, mortgage and tax records, Social Security numbers, and drivers’ license images.
The DFS’s enforcement action is noteworthy for several reasons. It is the first such action commenced under the Cybersecurity Regulation. Additionally, the manner in which the private information was allegedly exposed is noteworthy, as the exposure was not due to an outside hacker compromising First American’s cybersecurity protections, but rather, because of a purported flaw in a web-based document delivery system which allowed anyone to gain unauthorized access to private information. Further, the number of documents allegedly exposed in this manner is, in the words of the DFS’s complaint, “staggering”—more than 850 million documents were accessible according to the DFS.
