First American Financial Corp. Leaked Hundreds of Millions of Insurance Records
1–10 of 171 posts
Re: First American Financial Corp. Leaked Hundreds of Millions of Insurance Records
#2It seems that the stock price (under the ticker FAF) hasn't suffered very much. This was revealed on 5/19, and the response has been tepid.There isn't likely going to be very much backlash on the stock, unfortunately.
Re: First American Financial Corp. Leaked Hundreds of Millions of Insurance Records
#3By the sounds of it, another breach from a well-known, not new web application security vulnerability, "Insecure Direct Object Reference".
That vuln has been an explicit part of the OWASP Top 10 since 2007...
Unlike other common web app vulns (e.g. XSS SQLi) IDOR usually can't be fixed by a development framework (e.g. ASP.Net or Rails), it needs app. specific coding for proper Authentication/Authorization checks.
Re: First American Financial Corp. Leaked Hundreds of Millions of Insurance Records
#4It seems that the stock price (under the ticker FAF) hasn't suffered very much. This was revealed on 5/19, and the response has been tepid.There isn't likely going to be very much backlash on the stock, unfortunately.
Markets are closed, down slightly after hours, but after hours volumes are weird.
Re: First American Financial Corp. Leaked Hundreds of Millions of Insurance Records
#5It seems that the stock price (under the ticker FAF) hasn't suffered very much. This was revealed on 5/19, and the response has been tepid.There isn't likely going to be very much backlash on the stock, unfortunately.
Mainstream media haven't picked up the story yet. It only just broke.
Re: First American Financial Corp. Leaked Hundreds of Millions of Insurance Records
#6That is an incredibly low friction interface to our documents. /s
What are the odds they have access logs going back to 2003?
Re: First American Financial Corp. Leaked Hundreds of Millions of Insurance Records
#7>At First American, security, privacy and confidentiality are of the highest priority and we are committed to protecting our customers’ information.
is such a meme.
Things will continue this way until there are serious repercussions for entities carelessly handling data.
Re: First American Financial Corp. Leaked Hundreds of Millions of Insurance Records
#8It seems that the stock price (under the ticker FAF) hasn't suffered very much. This was revealed on 5/19, and the response has been tepid.There isn't likely going to be very much backlash on the stock, unfortunately.
I think that's May 2019, not May 19th. From the bottom: This entry was posted on Friday, May 24th, 2019
Re: First American Financial Corp. Leaked Hundreds of Millions of Insurance Records
#9That is an incredibly low friction interface to our documents. /s What are the odds they have access logs going back to 2003?
Pretty good, everything was probably set up and configured with default settings by that unpaid intern they had running their infrastructure back in 2003.
Re: First American Financial Corp. Leaked Hundreds of Millions of Insurance Records
#10It seems that the stock price (under the ticker FAF) hasn't suffered very much. This was revealed on 5/19, and the response has been tepid.There isn't likely going to be very much backlash on the stock, unfortunately.
I don't think there will be, we're well into "breach fatigue" territory now, and here there's not even currently any evidence of malicious use.
Unless/until this breach results in a large financial hit to the company (possibly via a class action suit) I doubt it'll have any impact and I'm not even sure a class action suit could show damages without evidence of misuse.