The verdict is in — the old way of doing business is over. Join us at Inman Connect New York Jan. 23-25, when together we’ll conquer today’s market challenges and prepare for tomorrow’s opportunities. Defy the market and bet big on your future.

Fidelity National Financial (FNF), the nation’s biggest title insurer, continues to cope with the impacts of a reported ransomware attack that left the company’s public-facing website dark Monday and is disrupting the provision of title and escrow services.

Other title-related services, mortgage transaction services, and technology that FNF provides to the real estate and mortgage industries have also been affected, the company said in disclosing a “cybersecurity incident” in a Nov. 21 Securities and Exchange Commission filing.

The company has not responded to inquiries from Inman or other news media outlets that have reported FNF is the target of a ransomware attack. Affected FNF subsidiaries include mortgage loan subservicer LoanCare and 1031 exchange facilitator IPX1031, TechCrunch reported.

Representatives for IPX1031 and LoanCare’s parent company, ServiceLink, did not immediately respond to Inman’s requests for comment.

The Register, a publication for information technology professionals, reported that a ransomware group known as ALPHV (BlackCat) claimed responsibility for the attack on Nov. 22.

On Nov. 21 — the same day that FNF disclosed that it was responding to a cybersecurity incident — the FBI and the Department of Homeland Security’s Cybersecurity and Infrastructure Security Agency (CISA) issued a joint cybersecurity advisory with other agencies warning of a software vulnerability being exploited by “multiple threat actor groups.”

The ransomware groups include LockBit 3.0 and affiliates, which have become “the world’s top ransomware threat,” targeting more than 1,700 American organizations in industries including financial services, food, schools, transportation and governments, Reuters reported, hitting big companies like Boeing, ION and the Industrial & Commercial Bank of China this year.

Ransomware groups typically target companies by installing malicious code that encrypts data and then demand payment of ransom to unlock the data.

In their Nov. 21 advisory, the FBI and CISA said ransomware groups are exploiting Citrix Bleed, a vulnerability that affects Citrix’s NetScaler web application delivery control (ADC) and NetScaler Gateway appliances. Many companies including FNF are thought to have patched the Citrix Bleed vulnerability but not before hackers gained access to sensitive systems.

FNF said in its SEC filing only that an “unauthorized third party accessed certain FNF systems and acquired certain credentials.” The company “promptly commenced an investigation, retained leading experts to assist the company, notified law enforcement authorities, and implemented certain measures to assess and contain the incident. Among other containment measures, we blocked access to certain of our systems, which resulted in disruptions to our business.”

While FNF’s company website was down Monday, the websites of subsidiaries Chicago Title, Fidelity National Title and Commonwealth Land Title were up and running. In addition to title and escrow services, FNF facilitates the production and management of mortgage loans through its subsidiary ServiceLink Holdings.

FNF said another majority-owned subsidiary, insurance provider F&G Annuities & Life, was not impacted by the incident.

Get Inman’s Mortgage Brief Newsletter delivered right to your inbox. A weekly roundup of all the biggest news in the world of mortgages and closings delivered every Wednesday. Click here to subscribe.

Email Matt Carter

Show Comments Hide Comments
Sign up for Inman’s Morning Headlines
What you need to know to start your day with all the latest industry developments
By submitting your email address, you agree to receive marketing emails from Inman.
Thank you for subscribing to Morning Headlines.
Back to top
Only 3 days left to register for Inman Connect Las Vegas before prices go up! Don't miss the premier event for real estate pros.Register Now ×
Limited Time Offer: Get 1 year of Inman Select for $199SUBSCRIBE×
Log in
If you created your account with Google or Facebook
Don't have an account?
Forgot your password?
No Problem

Simply enter the email address you used to create your account and click "Reset Password". You will receive additional instructions via email.

Forgot your username? If so please contact customer support at (510) 658-9252

Password Reset Confirmation

Password Reset Instructions have been sent to

Subscribe to The Weekender
Get the week's leading headlines delivered straight to your inbox.
Top headlines from around the real estate industry. Breaking news as it happens.
15 stories covering tech, special reports, video and opinion.
Unique features from hacker profiles to portal watch and video interviews.
Unique features from hacker profiles to portal watch and video interviews.
It looks like you’re already a Select Member!
To subscribe to exclusive newsletters, visit your email preferences in the account settings.
Up-to-the-minute news and interviews in your inbox, ticket discounts for Inman events and more
1-Step CheckoutPay with a credit card
By continuing, you agree to Inman’s Terms of Use and Privacy Policy.

You will be charged . Your subscription will automatically renew for on . For more details on our payment terms and how to cancel, click here.

Interested in a group subscription?
Finish setting up your subscription