First American Financial Corp

Item 1.05 Material Cybersecurity Incidents. First American Financial Corporation (the “Company”) recently identified unauthorized activity on certain of its information technology systems. Upon detection of the unauthorized activity, the Company took steps in an effort to contain, assess and remediate the incident. On December 20, 2023, the Company elected to isolate systems from the Internet. The Company is working diligently to restore those systems and resume normal operations as soon as possible, but cannot estimate the duration or extent of the disruption at this time. The Company has retained leading experts, is working with law enforcement and notified certain regulatory authorities. During the disruption, the Company's primary website may be inaccessible or inoperative. The Company has created a special website for communications about the incident at the following URL: www.firstamupdate.com. Please access that site for further information. The Company is also assessing the impact of the incident and whether it may have a material impact on its financial condition and results of operations, which at this point cannot be determined. Forward-Looking Statements This Current Report on Form 8-K contains “forward-looking statements” within the meaning of the Private Securities Litigation Reform Act of 1995, Section 27A of the Securities Act of 1933, as amended, and Section 21E of the Securities Exchange Act of 1934, as amended. These forward-looking statements are based on management’s current expectations and assumptions, are not based on historical facts and are subject to risks and uncertainties, and other important factors that could cause actual results to differ materially from those expressed or implied in the forward-looking statements and can be identified by