Fidelity National Financial is the largest title insurance company in the United States. Its businesses sit inside a huge share of American home purchases and refinances.
On November 19, 2023, FNF found attackers in its systems. To contain them, it blocked access to parts of its network, and title, escrow and mortgage services went down with them.
The Fidelity National Financial cyber attack lasted about a week and exposed data on roughly 1.3 million consumers, many of them customers of its loan servicing subsidiary, LoanCare. The ALPHV/BlackCat ransomware group claimed responsibility.
This teardown walks the timeline, what FNF disclosed about the chain, why title and escrow firms are such attractive targets and how to test for the same path.
What CodeAnt AI solves here: CodeAnt AI continuously tests the portals, APIs and cloud systems that title, escrow and mortgage platforms expose. It proves whether a stolen credential or a broken access check reaches consumer and transaction data, with a working proof of exploit for each high or critical finding.
What Happened in the Fidelity National Financial Cyber Attack
The timeline below comes from FNF's original 8-K, its amended 8-K and its 2023 annual report.
Date | What happened |
|---|---|
November 19, 2023 | FNF becomes aware of a cybersecurity incident and blocks access to certain systems. |
November 20, 2023 | The last confirmed date of attacker activity in FNF's network. |
November 21, 2023 | FNF files an 8-K saying an unauthorized party accessed systems and acquired certain credentials. |
November 26, 2023 | The incident is contained. |
December 13, 2023 | FNF completes its forensic investigation. |
Around December 22, 2023 | LoanCare customers begin receiving breach notices. |
January 9, 2024 | FNF's amended 8-K says about 1.3 million potentially affected consumers were notified. |
September 2025 | A $5.9 million class action settlement with FNF and LoanCare receives final court approval. |
FNF confirmed attacker activity through November 20. Containing it disrupted the business for about a week.
What Data Was Exposed
FNF's filings did not list the data types. The consolidated class action, covering LoanCare customers, said the exposed data included the following.
Identity data: Names, addresses and Social Security numbers.
Loan data: Mortgage loan numbers.
That combination is well suited to mortgage and payment fraud. A borrower who receives a convincing message quoting their real loan number has little reason to doubt it.
The Attack Chain, Technically
FNF has not published how the attackers first got in. What its filings do confirm is enough to reconstruct the shape of the chain.
Stage 1. Initial access and credential theft
FNF's first 8-K said an unauthorized third party accessed certain systems and acquired certain credentials. The entry point was not disclosed. ALPHV affiliates commonly started with stolen credentials, remote access services and social engineering. Credential theft early in the intrusion let the attackers act as legitimate users inside FNF's environment.
Stage 2. Malware deployment
The forensic investigation found the attackers deployed malware that was not self-propagating. It did not spread on its own from machine to machine. That detail suggests a hands-on operator placing tools deliberately, which is standard for ransomware affiliates who map a network before acting.
Stage 3. Data exfiltration
FNF confirmed the attackers exfiltrated certain data before being cut off. LoanCare's servicing records, holding borrower identity and loan data, were part of what was taken. Loan servicing systems concentrate exactly the data fraudsters want. Every record links a person to a property, a lender and a monthly payment.
Stage 4. Containment that took the business offline
FNF blocked access to parts of its network to stop the attack. Title insurance, escrow, mortgage transaction services and technology it provides to the real estate industry were all affected. That is the trade-off every incident responder faces. Shutting systems down stops the attacker and stops the business at the same time, and FNF's majority-owned insurer, F&G, was not affected.
Stage 5. Extortion on a leak site
ALPHV listed FNF on its leak site and taunted the company publicly. Law enforcement disrupted ALPHV's infrastructure the following month, and the group reappeared soon after. FNF has not said whether it paid a ransom.
Why Title and Escrow Firms Are High-Value Targets
Title and escrow companies sit at the point where large sums of money change hands. FNF alone reported $13.5 billion in customer escrow balances at the end of 2023.
That position creates two kinds of risk. Attackers can steal consumer and loan data for fraud, and they can disrupt closings to pressure a company that cannot afford downtime. The FNF attack landed in the middle of a wave. Mr. Cooper, First American and loanDepot all disclosed cyberattacks between October 2023 and January 2024, and mortgage closings were disrupted across the country.
Risk | Why it matters for title and escrow |
|---|---|
Consumer data theft | Identity, property and loan data feed mortgage fraud and targeted phishing. |
Wire fraud | Attackers who see transaction details can send convincing fake wiring instructions. |
Operational disruption | A shutdown during closing season delays transactions for buyers, sellers and lenders. |
Regulatory exposure | Title insurers answer to state insurance regulators, NYDFS Part 500 and the GLBA Safeguards Rule. |
Access control failures have hit this sector before. In 2019, First American Financial exposed hundreds of millions of title documents through a website that let anyone read other customers' files by changing a number in the URL, a classic insecure direct object reference. NYDFS later fined the company $1 million under Part 500.
What a Real Test Against This Chain Looks Like
FNF's entry point is not public, so a useful test covers the common ones and then measures what a foothold reaches.
Chain link | What the test checks | Evidence it produces |
|---|---|---|
Leaked credentials | Company accounts circulating in breach dumps and infostealer logs | Exposed accounts, flagged if still valid |
Internet-facing access | Every remote access gateway, portal and SSO login, and whether MFA is enforced | Per-endpoint proof of MFA enforcement |
Portal and API authorization | Whether one customer, agent or partner can read another's files or loans | Proof of any IDOR or broken object level authorization |
Post-login reach | What a compromised internal identity can touch in apps and cloud | A path from foothold to servicing and transaction data |
Detection | Whether credential misuse and bulk access trigger alerts fast | Time to detect for each stage |
Our API penetration testing guide covers how the partner and agent APIs behind title and escrow platforms get tested. For the outside-in and assumed-breach balance, see our breakdown of black box, white box and gray box testing.
Lessons for Title, Escrow and Mortgage Companies
The Fidelity National Financial cyber attack leaves lessons for every company handling property transactions.
Protect credentials first: FNF's attackers acquired credentials early. Phishing-resistant MFA and leaked-credential monitoring shrink that opening.
Segment servicing from operations: Loan servicing data and closing systems should not share a flat network where one foothold reaches both.
Plan containment in advance: Decide ahead of time which systems can go dark and how closings continue when they do.
Test portal authorization: Agent, lender and consumer portals need tests proving one user cannot read another's documents.
Notify quickly across subsidiaries: LoanCare customers were notified weeks after FNF's public disclosure, and the delay became part of the litigation.
Map to your regulators: Title insurers answer to NYDFS Part 500, the NAIC Insurance Data Security Model Law and the GLBA Safeguards Rule.
Our guide to how insurance companies get breached through portals, APIs and vendors covers the wider pattern across insurance lines.
The Legal and Regulatory Fallout
At least eight lawsuits were filed against FNF and LoanCare within weeks, and they were consolidated in federal court in Florida. The parties reached a $5.9 million settlement, which received final approval in September 2025.
FNF told investors it did not expect the incident to have a material impact on the company. For the 1.3 million people notified, the exposure of Social Security and loan numbers lasts far longer than a week of downtime.
How CodeAnt Would Have Caught This
FNF has not disclosed how the attackers got in or which systems they reached first. So we won't claim CodeAnt would have prevented this attack.
What CodeAnt tests is the ground a credential-driven intrusion depends on.
Continuous external mapping: Attack surface management maps every domain, IP, open port and exposed service from more than thirty data sources, so forgotten portals and gateways show up.
Leaked credential discovery: Reconnaissance surfaces company credentials already circulating on the open internet, before an attacker uses them.
Portal and API authorization testing: Code-aware and gray box testing proves whether agents, lenders or consumers can reach each other's files, with a working proof of exploit for each high or critical finding.
Continuous coverage: New integrations and portal releases get tested as they ship, instead of waiting for next year's engagement.
The walkthrough of how AI penetration testing traces a data leak shows a full chain end to end.
The Fix
A short intrusion at FNF became a week of stopped closings and 1.3 million notification letters. The credentials came first, and everything else followed. Find the credentials already exposed, prove your portals enforce MFA and authorization, and know which systems can go dark before you have to decide.
Run a free black box scan on one URL to see your exposed surface the way an attacker maps it. For the compliance side, start with our guide to penetration testing for insurance companies.
