U.S. real estate title insurance company First American Financial Corp. said on Friday it had learned of a design defect in one of its production applications that had made possible unauthorized access to customer data.

The statement was sent in response to a report by security news website Krebs on Security, which said First American’s website had exposed about 885 million files dating back to 2003.