Real Estate Giant First American Exposes 885 Million Financial Records Online
A massive website design flaw allows unauthorized access to hundreds of millions of sensitive mortgage and banking documents without any password requirement.
Security reporter Brian Krebs reveals that Fortune 500 company First American exposes approximately 885 million sensitive records due to a major website bug. The real estate insurance giant’s site stores and displays bank account numbers, tax records, Social Security numbers, and driver’s license images without requiring any authentication or password checks.
The vulnerability relies on a simple sequential numbering system for document web addresses, meaning anyone with a valid link simply changes a single digit to access other customers' private files. This exposed data goes back as far as 2003 and includes detailed wire transaction records from property buyers and sellers, affecting the company which earns $5.8 billion in annual revenue.
First American responds by immediately shutting down external access to the application and hiring an outside forensic firm to investigate potential unauthorized access. However, security researchers note that thousands of these sensitive documents remain visible through cached search engine results, prompting the company to take steps to remove this lingering exposed data.