Technology

Details: The flaw, which has been repaired, appears to have been in an online system the firm used to link to files in private communications. Users would be sent to a website whose web address included a file number.

• However, the files themselves were not individually protected. By changing the file number, you could access any one of the documents.
• Krebs was alerted to the data exposure by developer Ben Shoval.

Threat level: There's no public evidence at this point that anyone maliciously accessed the files" to read "Threat level: There's no public evidence at this point that anyone maliciously accessed the files - though First American is investigating with the help of an outside forensics firm."

What they're saying:

In a statement, First American wrote "Security, privacy and confidentiality are of the highest priority and we are committed to protecting our customers’ information. Therefore, the company took immediate action to address the situation and shut down external access to the application."

Background: Recent cyberattacks linked to Russian state actors have targeted the campaign emails of French President Emmanuel Macron, Germany’s parliament and government agencies, the Netherlands-based Organization for the Prevention of Chemical Weapons (which was investigating the attack on Sergei Skripal), and Estonia’s government, businesses and media outlets.

• Chinese hackers recently attacked the EU’s communication network, while North Korean and Iranian hackers have targeted businesses and governments across Europe.

Between the lines: The policy would impose visa bans and asset freezes on state and non-state actors who use cyber tools to cripple information networks. It would likely allow the EU to match U.S. sanctions on cyberattack perpetrators in cases of shared foreign policy and security interests.

Yes, but: While the new framework is robust, some EU member states, notably France, have often been reluctant to publicly attribute cyberattacks to a specific actor, preferring instead to communicate with alleged offenders through diplomatic channels. In their view, perpetrators often cover their trails, making it difficult to gather evidence tying an attack to a particular attacker.

• For the new framework to prove effective, EU policymakers will need to act decisively to publicly expose offending actors.

The bottom line: This more muscular stance by Brussels sends a stronger deterrence signal to authoritarian regimes targeting democratic institutions.

David Salvo is deputy director of the Alliance for Securing Democracy at the German Marshall Fund.