Fidelity National Financial (FNF) Risk Factors

Our operations are highly dependent upon the effective operation of our computer systems. We use our computer systems to receive, process, store and transmit sensitive personal consumer data (such as names and addresses, social security numbers, driver's license numbers, and bank account information) and important business information of our customers. We also electronically manage substantial cash, investment assets and escrow account balances on behalf of ourselves and our customers, as well as financial information about our businesses generally. The integrity of our computer systems and the protection of the information that resides on such systems are important to our successful operation. If we fail to maintain an adequate security infrastructure, adapt to emerging security threats such as ransomware or follow our internal business processes with respect to security, the information or assets we hold could be compromised. Further, even if we, or third parties to which we outsource certain information technology services, maintain a reasonable, industry-standard information security infrastructure to mitigate these risks, the inherent risk that unauthorized access to information or assets remains. This risk is increased by transmittal of information over the internet and the increased threat and sophistication of cyber criminals. While, to date, we believe that we have not experienced a material breach of our computer systems, the occurrence or scope of such events is not always apparent. Examples of security threats that represent significant inherent risk with little to no warning include the MoveIT security incident affecting F&G, in which F&G activated its crisis management protocols to adequately manage the investigation, impact, and response to this incident. In November 2023, we experienced a cybersecurity incident where an unauthorized third-party accessed certain of our systems, deployed a type of malware that is not self-propagating, and exfiltrated certain data. We promptly commenced an investigation, retained leading experts to assist the Company, notified law enforcement authorities, regulatory authorities and other stakeholders and followed our incident response plans. Although we believe we have remediated the significant exposures related to these incidents, there remains potential for future losses associated with litigation and damage to our reputation. If additional information regarding an event previously considered immaterial is discovered, or a new event were to occur, it could potentially have a material adverse effect on our operations or financial condition. In addition, some laws and certain of our contracts require notification of various parties, including regulators, consumers or customers, in the event that confidential or personal information has or may have been taken or accessed by unauthorized parties. Such notifications can potentially result, among other things, in adverse publicity, diversion of management and other resources, the attention of regulatory authorities, the imposition of fines, and disruptions in business operations, the effects of which may be material. Any inability to prevent security or privacy breaches, or the perception that such breaches may occur, could inhibit our ability to retain or attract new clients and/or result in financial losses, litigation, increased costs, negative publicity, or other adverse consequences to our business. While we currently maintain cybersecurity insurance, such insurance may not be sufficient in type or amount to cover us against claims related to cybersecurity breaches or attacks, failures or other data security-related incidents, and we cannot be certain that cyber insurance will continue to be available to us on economically reasonable terms, or at all, or that an insurer will not deny coverage as to any future claim. The successful assertion of one or more claims against us that exceed available insurance coverage, or the occurrence of changes in our insurance policies, including premium increases or the imposition of large deductibles, could materially and adversely affect our financial condition, results of operations and cash flows. Further, our financial institution clients have obligations to safeguard their information technology systems and the confidentiality of customer information. In certain of our businesses, we are bound contractually and/or by regulation to comply with the same requirements. If we fail to comply with these regulations and requirements, we could be exposed to lawsuits for breach of contract, governmental proceedings or the imposition of fines. In addition, future adoption of more restrictive privacy laws, rules or industry security requirements by federal or state regulatory bodies or by a specific industry in which we do business could have an adverse impact on us through increased costs or restrictions on business processes.

Rapidly evolving technologies and innovations in software and financial technology could drive changes in how real estate transactions are recorded and processed throughout the mortgage life cycle. There is no guarantee that we will be able to effectively adapt to and utilize changing technology.  Existing or new competitors may be able to utilize or create technology more effectively than us, which could result in the loss of market share.