Real Estate Mogul data breach: 307K accounts exposed
Severity: medium · Patch status: no-fix-needed · Since 2018-09-24
In September 2016, the real estate investment site Real Estate Mogul had a Mongo DB instance compromised and 5GB of data downloaded by an unauthorised party. The data contained real estate listings including addresses and the names, phone numbers and 308k unique email addresses of the sellers. Real Estate Mogul was advised of the incident in September 2018 and stated that they "found no instance of user account credentials like usernames and passwords nor billing information within this file". Exposed data: email addresses, names, phone numbers, physical addresses. The breach dates from Sep 6, 2016; Have I Been Pwned loaded it on Sep 24, 2018.
What to do
- If you had a Real Estate Mogul account, change its password and the password of any other account that reused it.
- Turn on multi-factor authentication wherever it is offered.
- Check whether your addresses are in this breach at https://haveibeenpwned.com.
- Expect targeted phishing that quotes the leaked details; verify any unexpected contact out of band.
Sources
All live incidents on Threat Watch