Weekly Real Estate News
Summary
Redfin has reported a data breach affecting Massachusetts residents. A report based on the regulatory filing says 55 state residents were identified and sensitive personal information may have been exposed; WRE News has not independently verified those details from the underlying notice, and no national total has been established.
Redfin Corporation has reported a data breach affecting Massachusetts residents, according to a state breach-notification record and a report based on the filing.
The incident was reported to the Massachusetts Office of Consumer Affairs and Business Regulation on Sept. 24. Claim Depot, which published details from the notice, reported that 55 Massachusetts residents were identified and that information potentially exposed included Social Security numbers, financial-account information and driver’s-license numbers.
WRE News was able to verify Massachusetts’ breach-reporting framework and the existence of the Redfin regulatory record, but the state’s document server did not allow WRE to retrieve the underlying Redfin notice for an independent line-by-line review Friday. The specific count and categories of affected information are therefore attributed to the report based on that filing rather than presented as independently established by WRE.
55 is not a national victim count
The distinction matters. Under Massachusetts breach-notification requirements, an entity’s regulatory notice must state the number of Massachusetts residents affected at the time of notification and identify the type of personal information compromised. The state’s breach-reporting program says companies are legally required to report incidents affecting Massachusetts residents’ private data.
That means the reported figure of 55 should not be read as the nationwide scope of the Redfin incident. WRE News found no authoritative disclosure establishing a national total.
Claim Depot also reported that Redfin is offering affected individuals two years of identity-protection services through IDX, with enrollment available through Dec. 23. WRE has not independently verified those terms from the underlying consumer notice.
Massachusetts says companies must provide affected residents with free credit monitoring when Social Security numbers of Massachusetts residents are compromised. The state’s guidance says the monitoring period must be at least 18 months for covered entities other than consumer reporting agencies.
What remains unknown
Publicly available information reviewed by WRE did not establish when the unauthorized access began, when it ended, when Redfin discovered the incident or how many people may have been affected outside Massachusetts. WRE also found no evidence that the incident disrupted Redfin’s brokerage operations, website or other customer-facing services.
WRE did not locate a public statement from Redfin or parent company Rocket Companies addressing the incident as of publication. Redfin’s privacy policy describes the company’s handling and security of personal information but does not provide details about this incident.
Redfin is part of Rocket Companies and operates a national residential brokerage and real estate search platform. The reported breach is significant because the categories of information described in the Massachusetts-related report can be used in identity theft and financial fraud if obtained by an unauthorized party.
WRE News will update this report if Redfin, Rocket Companies or regulators provide additional information establishing the cause, timeline or broader scope of the incident.
