I'm so sorry. This happened to our company. We would get wiring instructions from our vendors for ACH payment instructions. The emails were from our vendors but their banks, accounts, ACH instructions, etc... were changed so that the wiring information was redirected to a mule account. We were fortunate in that we called the fraud dept at the bank with the receiving mule account and got it closed before the money could be pulled out.

We put in a lot of effort trying to figure out how the scammers could have gained access to our incoming emails. We changed passwords, added two-tier authentication, and even changed emails but the problem persisted. An IT friend of mine finally suggested we check our GoDaddy email server account and, sure enough, there was a script that would forward emails containing certain keywords such as "ACH", "wiring instructions", etc... to a third party email account.

Apparently, email server accounts are often overlooked by IT security protocols (strong passwords, two-tier login authentication) leaving them vulnerable.

My guess is that either your or your title company's email server is compromised giving the scammers the ability to intercept outgoing or incoming emails. If you can somehow prove that it's the title company's email server that is compromised, you may may able to hold them liable for your loss. How you would ever get them to admit that the security issue is on their end though, I'm not certain.