Fidelity National Financial falls to a BlackCat ransomware attack

Fidelity National Financial (FNF) has officially acknowledged a cyberattack that the BlackCat ransomware gang claimed in November last year. Based on reports, the attack exposed the data of 1.3 million FNF customers.

FNF, one of the most critical institutions related to the American title insurance and transaction services sector for real estate and mortgages, has a substantial market presence with over $10 billion in annual revenue, a market capitalisation of $13.3 billion, and a workforce exceeding 23,000 employees.

In their initial report in December, the company revealed that the attackers gained unauthorised access to the network using stolen credentials. As a result, FNF implemented preventive measures that made them temporarily shut down and isolate specific IT systems, causing disruptions to business services.

 

Fidelity National Financial claimed that they contained the attack in under a week.

 

In an amended SEC Form 8-K filing released recently, Fidelity National Financial confirmed that they successfully contained the cyberattack on November 19, 2023, seven days later. The hackers leveraged non-propagating malware capable of extracting data from compromised systems. The investigation concluded on December 13, 2023, unveiled that data belonging to 1.3 million customers had been stolen.

According to the SEC filing, FNF has notified affected customers, state attorneys general, and regulators and contacted approximately 1.3 million potentially impacted consumers. Fortunately, the company offers credit monitoring, web monitoring, and identity theft protection services while addressing consumer inquiries.

The filing indicates that the company isolated the breach in one of the FNF systems and did not extend to any customer-owned systems. Fidelity National Financial insisted that it does not expect any substantial impact on its financial status and operations due to the incident.

Though FNF did not explicitly mention it, the BlackCat ransomware gang had previously claimed responsibility for the attack, listing the company on their data leak site. The threat actors, however, did not confirm whether data had been stolen, noting that they awaited contact from FNF.

Since November, the Fidelity National Financial breach has been part of cyberattacks targeting the mortgage and housing industry, affecting companies like First American, loanDepot, and Mr. Cooper. Therefore, this particular industry should be more cautious of these cyberattacks as they are primary targets for these threat actors.