Cybersecurity incident disclosed by First American Financial Corp in a Form 8-K (December 2023)

Material Cybersecurity Incidents. First American Financial Corporation (the “Company”) recently identified unauthorized activity on certain of its information technology systems. Upon detection of the unauthorized activity, the Company took steps in an effort to contain, assess and remediate the incident. On December 20, 2023, the Company elected to isolate systems from the Internet. The Company is working diligently to restore those systems and resume normal operations as soon as possible, but cannot estimate the duration or extent of the disruption at this time. The Company has retained leading experts, is working with law enforcement and notified certain regulatory authorities. During the disruption, the Company's primary website may be inaccessible or inoperative. The Company has created a special website for communications about the incident at the following URL: www.firstamupdate.com. Please access that site for further information. The Company is also assessing the impact of the incident and whether it may have a material impact on its financial condition and results of operations, which at this point cannot be determined. Forward-Looking Statements This Current Report on Form 8-K contains “forward-looking statements” within the meaning of the Private Securities Litigation Reform Act of 1995, Section 27A of the Securities Act of 1933, as amended, and Section 21E of the Securities Exchange Act of 1934, as amended. These forward-looking statements are based on management’s current expectations and assumptions, are not based on historical facts and are subject to risks and uncertainties, and other important factors that could cause actual results to differ materially from those expressed or implied in the forward-looking statements and can be identified by the fact that they do not relate strictly to historical or current facts and may contain the words “expect,” “estimate,” “will,” or other similar words and phrases or future or conditional verbs such as…

Material Cybersecurity Incidents. As disclosed in the Original Report, the Company recently identified unauthorized activity on certain of its information technology systems. Upon detection of the unauthorized activity, the Company took steps in an effort to contain, assess and remediate the incident. On December 20, 2023, the Company elected to isolate systems from the Internet. The Company has retained leading experts, worked with law enforcement and notified certain regulatory authorities. As of the date of this filing, the Company believes it has contained the incident. The Company is in the process of restoring access to its systems and resuming normal business operations. Though the incident is still under investigation, the Company believes the perpetrator of the activity accessed certain Company systems, exfiltrated data and encrypted data on certain non-production systems. The Company continues to assess whether the incident will have a material impact on the Company’s financial condition or results of operations, which at this point cannot be determined. Forward-Looking Statements This Current Report on Form 8-K contains “forward-looking statements” within the meaning of the Private Securities Litigation Reform Act of 1995, Section 27A of the Securities Act of 1933, as amended, and Section 21E of the Securities Exchange Act of 1934, as amended. These forward-looking statements are based on management’s current expectations and assumptions, are not based on historical facts and are subject to risks and uncertainties, and other important factors that could cause actual results to differ materially from those expressed or implied in the forward-looking statements and can be identified by the fact that they do not relate strictly to historical or current facts and may contain the words “believe,” “expect,” “estimate,” “will,” or other similar words and phrases or future or conditional verbs such as “may,” “would,” or “could.”

Material Cybersecurity Incidents. As disclosed in the Original Report, the Company identified unauthorized activity on certain of its information technology systems. Upon detection, the Company acted to contain, assess and remediate the incident. On December 20, 2023, the Company elected to isolate systems from the Internet. The Company retained leading experts, worked with law enforcement and notified certain regulatory authorities. The Company believes it has contained the incident and has resumed business operations. As a result of the incident, certain transactions that would have been consummated in the fourth quarter of 2023 were delayed and, consequently, revenue from those transactions will not be recognized until the first quarter of 2024. Certain other transactions that would have been consummated in the fourth quarter of 2023 were moved to other providers, which resulted in a loss of revenue. In addition, the Company recognizes revenue from its agents when a notice of title policy issuance is received. As a result of the incident, receipt of notices of the issuance of certain title policies have been delayed and, as a result, related revenue that would have been recognized in the fourth quarter of 2023 will not be recognized until the first quarter of 2024. In the fourth quarter of 2023 the Company also incurred one-time expenses as a result of the incident. While the Company expects the incident to have a material impact on the fourth quarter of 2023 results of operations, the Company does not believe the incident will have a material impact on the Company’s overall financial condition or on its ongoing results of operations. Forward-Looking Statements This Current Report on Form 8-K contains “forward-looking statements” within the meaning of the Private Securities Litigation Reform Act of 1995, Section 27A of the Securities Act of 1933, as amended, and Section 21E of the Securities Exchange Act of 1934, as amended. These forward-looking statements are…