Redfin Reports Data Breach to Massachusetts Regulators. Redfin has reported a data breach affecting Massachusetts residents. A report based on the regulatory filing says sensitive personal information may have been exposed, but the national scope remains unknown. Continue Reading Redfin Reports Data Breach to Massachusetts Regulators Summary. Redfin has reported a data breach affecting Massachusetts residents. A report based on the regulatory filing says 55 state residents were identified and sensitive personal information may have been exposed; WRE News has not independently verified those details from the underlying notice, and no national total has been established. Redfin Corporation has reported a data breach affecting Massachusetts residents, according to a state breach-notification record and a report based on the filing. The incident was reported to the Massachusetts Office of Consumer Affairs and Business Regulation on Sept. 24. Claim Depot, which published details from the notice, reported that 55 Massachusetts residents were identified and that information potentially exposed included Social Security numbers, financial-account information and driver's-license numbers. WRE News was able to verify Massachusetts' breach-reporting framework and the existence of the Redfin regulatory record, but the state's document server did not allow WRE to retrieve the underlying Redfin notice for an independent line-by-line review Friday. The specific count and categories of affected information are therefore attributed to the report based on that filing rather than presented as independently established by WRE. 55 is not a national victim count. The distinction matters. Under Massachusetts breach-notification requirements, an entity's regulatory notice must state the number of Massachusetts residents affected at the time of notification and identify the type of personal information compromised. The state's breach-reporting program says companies are legally required to report incidents affecting Massachusetts residents' private data. That means the reported figure of 55 should not be read as the nationwide scope of the Redfin incident. WRE News found no authoritative disclosure establishing a national total. Claim Depot also reported that Redfin is offering affected individuals two years of identity-protection services through IDX, with enrollment available through Dec. 23. WRE has not independently verified those terms from the underlying consumer notice. Massachusetts says companies must provide affected residents with free credit monitoring when Social Security numbers of Massachusetts residents are compromised. The state's guidance says the monitoring period must be at least 18 months for covered entities other than consumer reporting agencies. What remains unknown. Publicly available information reviewed by WRE did not establish when the unauthorized access began, when it ended, when Redfin discovered the incident or how many people may have been affected outside Massachusetts. WRE also found no evidence that the incident disrupted Redfin's brokerage operations, website or other customer-facing services. WRE did not locate a public statement from Redfin or parent company Rocket Companies addressing the incident as of publication. Redfin's privacy policy describes the company's handling and security of personal information but does not provide details about this incident. Redfin is part of Rocket Companies and operates a national residential brokerage and real estate search platform. The reported breach is significant because the categories of information described in the Massachusetts-related report can be used in identity theft and financial fraud if obtained by an unauthorized party. WRE News will update this report if Redfin, Rocket Companies or regulators provide additional information establishing the cause, timeline or broader scope of the incident. WRE NEWS - READER SUPPORT Help support the news that keeps you ahead. If WRE News brings value to your day, consider supporting the reporting that keeps its industry informed.

Redfin Corp.: Redfin Data Breach Exposes Social Security numbers. Redfin Data Breach Exposes Sensitive Consumer Information Redfin Corp., a Seattle-based real estate technology company, has reported a data breach that may have compromised the personal information of consumers. The company, which operates a leading U.S. real estate brokerage platform offering home search, mortgage, and settlement services, disclosed the incident to the Massachusetts Office of Consumer Affairs and Business Regulation on September 24, 2026, identifying 55 affected Massachusetts residents. The breach involved unauthorized third-party access to sensitive data, though the exact timeline of the intrusion remains undisclosed. Exposed information includes Social Security numbers, financial account details, and driver's license numbers data that could facilitate identity theft or fraudulent account openings. In response, Redfin is providing affected individuals with two years of free identity protection services through IDX. Those notified can enroll by December 23, 2026, using a unique code via the IDX enrollment page or a QR code in their notification letter. Support is available at 1-888-204-3205 (Monday-Friday, 9 a.m.-9 p.m. ET). The full scope of the breach and its impact on other users is still under investigation. "id": "red1790375257", "linkid": "redfin", "type": "Breach", "date": "9/2026", "severity": "85", "impact": "4", "explanation": "Attack with significant impact with customers data leaks" {'affected_entities': [{'customers_affected': '55 (Massachusetts residents ' 'only, full scope under ' 'investigation)', 'industry': 'Real Estate, Technology', 'location': 'Seattle, Washington, USA', 'name': 'Redfin Corp.', 'type': 'Real estate technology company'}], 'customer_advisories': 'Two years of free identity protection services ' 'through IDX, enrollment deadline: December 23, 2026. ' 'Support contact: 1-888-204-3205 (Monday-Friday, 9 ' 'a.m.-9 p.m. ET).', 'data_breach': {'number_of_records_exposed': '55 (Massachusetts residents ' 'only, full scope under ' 'investigation)', 'personally_identifiable_information': 'Social Security ' 'numbers, driver's ' 'license numbers', 'sensitivity_of_data': 'High', 'type_of_data_compromised': 'Personal Identifiable ' 'Information (PII), Financial ' 'Data'}, 'date_publicly_disclosed': '2026-09-24', 'description': 'Redfin Corp., a Seattle-based real estate technology company, ' 'reported a data breach that may have compromised the personal ' 'information of consumers. The breach involved unauthorized ' 'third-party access to sensitive data, including Social ' 'Security numbers, financial account details, and driver's ' 'license numbers.', 'impact': {'data_compromised': 'Social Security numbers, financial account ' 'details, driver's license numbers', 'identity_theft_risk': 'High', 'payment_information_risk': 'High'}, 'investigation_status': 'Ongoing', 'references': [{'source': 'Massachusetts Office of Consumer Affairs and ' 'Business Regulation'}], 'regulatory_compliance': {'regulatory_notifications': 'Massachusetts Office ' 'of Consumer Affairs ' 'and Business ' 'Regulation'}, 'response': {'communication_strategy': 'Notification letters with QR codes, ' 'enrollment page for identity ' 'protection services', 'third_party_assistance': 'IDX (identity protection services)'}, 'threat_actor': 'Unauthorized third-party', 'title': 'Redfin Data Breach Exposes Sensitive Consumer Information', 'type': 'Data Breach'} Published by Kiteworks Urges Immediate Shutdown of MFT Servers Over Zero-Day Threat Kiteworks, a provider of secure managed file transfer (MFT) solutions,... Sep 25, 2026 Cybersecurity Roundup: Major Threats, Vulnerabilities, and Industry Shifts This week's cybersecurity landscape saw high-profile feuds, novel attack techniques, and... Sep 25, 2026 Kiteworks Urges Customers to Shut Down Systems Amid Imminent Cyberattack Threat Kiteworks, a technology firm specializing in secure file transfers... Sep 25, 2026