First American Financial Corp

Item 1.05 Material Cybersecurity Incidents. As disclosed in the Original Report, the Company recently identified unauthorized activity on certain of its information technology systems. Upon detection of the unauthorized activity, the Company took steps in an effort to contain, assess and remediate the incident. On December 20, 2023, the Company elected to isolate systems from the Internet. The Company has retained leading experts, worked with law enforcement and notified certain regulatory authorities. As of the date of this filing, the Company believes it has contained the incident. The Company is in the process of restoring access to its systems and resuming normal business operations. Though the incident is still under investigation, the Company believes the perpetrator of the activity accessed certain Company systems, exfiltrated data and encrypted data on certain non-production systems. The Company continues to assess whether the incident will have a material impact on the Company’s financial condition or results of operations, which at this point cannot be determined. Forward-Looking Statements This Current Report on Form 8-K contains “forward-looking statements” within the meaning of the Private Securities Litigation Reform Act of 1995, Section 27A of the Securities Act of 1933, as amended, and Section 21E of the Securities Exchange Act of 1934, as amended. These forward-looking statements are based on management’s current expectations and assumptions, are not based on historical facts and are subject to risks and uncertainties, and other important factors that could cause actual results to differ materially from those expressed or implied in the forward-looking statements and can be identified by the fact that they do not relate strictly to historical or current