The commission said First American's information security personnel spotted the vulnerability months earlier, but didn't fix it or notify company brass.
Sitting before the Senate Banking, Housing and Urban Affairs Committee, Clayton fielded questions about the SEC breach as well as the Equifax breach last month.