Ransomware attack on Rapattoni disrupts real estate listings in the US

A ransomware attack has caused widespread disruption to property listings across the United States in a major blow to the real estate industry. The attack targeted Rapattoni, a California-based data services company that hosts crucial multiple listing services (MLS) databases, affecting real estate agent’s ability to list and update property information.

MLS databases serve as the lifeblood of the real estate industry, enabling different brokers to collaborate by sharing property information. This information is pivotal for powering listing websites and facilitating cooperation among brokers to market each other’s properties effectively.

The incident unfolded on August 8, when an attack on Rapattoni triggered a system outage. The company promptly acknowledged the issue on social media, with a post on X (formerly known as Twitter), stating, "The attack caused a system outage, and we are working diligently to get systems restored as soon as possible. We still do not have an ETA at this time."

As of Tuesday afternoon, Rapattoni’s production system remained offline, leaving real estate professionals in limbo. While the company has not confirmed whether the attack involved ransomware, the incident’s repercussions are already visible.

Regional MLS providers depend on Rapattoni’s services to manage property information, identify new listings, and facilitate buyer-seller interactions. The attack disrupted these automated processes, forcing many MLS providers to resort to manual workarounds.

One such instance is the Cincy MLS, which serves over 7,500 real estate agents in Cincinnati. Due to the disruption caused by the Rapattoni attack, Cincy MLS agents have been compelled to manually share listing information through a dedicated Facebook page, according to local ABC affiliate WCPO.

The far-reaching consequences of the attack extend beyond the MLS realm. Popular house listing platforms, including Zillow, have been affected, necessitating manual data entry due to the incident, as reported by the local broadcaster.