Hackers reportedly steal millions from real estate tech company RealPage

The hackers are believed to be based in Nigeria

RealPage, a growing real estate software company based in Richardson, Texas, was the victim of hackers that apparently stole $10.5 million from the company.

In a statement, the company told HousingWire that $10.5 was initially stolen, but the company recovered $4.5 million of that amount.

Additionally, the company stated that it is working with authorities to reclaim the remaining funds.

“As previously disclosed almost two years ago, in May 2018, RealPage was the subject of a targeted email phishing campaign that led to a business email compromise. An unauthorized party gained access to an external third-party system that was used by a subsidiary acquired by RealPage in 2017, resulting in the initial diversion of approximately $10.5 million,” the company said in a statement.

“RealPage worked closely with law enforcement to recover the funds that were fraudulently misdirected. Net of funds recovered shortly after the incident, approximately $6 million in funds intended for disbursement to three clients were diverted. Approximately $2.9 million of the diverted funds were successfully frozen but not immediately returned to RealPage, and the U.S. Attorney’s Office for the Northern District of Texas is now pursuing the process to enable RealPage to reclaim these frozen funds,” the company continued.

“RealPage maintains insurance coverage to limit losses related to criminal and network security events and has thus far recovered an additional $1 million through insurance. RealPage’s clients experienced no loss from this event and all amounts were deposited in full into the client accounts,” the company concluded.

According to Dallas TV station NBC 5, RealPage fell victim to hackers who obtained the login credentials of an employee and accessed the company’s online financial accounts.

From there, the hackers sent money to “money mules,” people who were employed by the fraudsters to launder their ill-gotten gains by moving the funds into other accounts that are difficult to trace.

Here are more details from NBC 5:

A Secret Service agent said the hackers are unknown but in at least one case, an American “money mule” was instructed to transfer the money to a Nigerian account.

Investigators said they tracked the stolen money to 88 different accounts at 42 banks nationwide.

“The investigation to date has revealed a large network of money mules who have been communicating by telephone and internet with individuals whom they thought were legitimate businesses or entrepreneurs sending funds that were proceeds of business or real estate transactions,” the agent wrote.

Issues of hackers and money mules are now becoming more common in the real estate industry.

In 2018, the government conducted a massive sweep and arrested nearly 75 people who allegedly participated in schemes designed to intercept and hijack wire transfers from businesses and individuals, including those involving real estate transactions.

The action targeted “Business Email Compromise” schemes, wherein hackers attempt to gain access to the email accounts of employees who have access to company finances, businesses working with foreign suppliers, or businesses that regularly perform wire transfer payments.

The schemes also target individual victims, including real estate buyers, by impersonating someone involved in a real estate transaction and convincing them to make wire transfers to bank accounts controlled by the hackers.

In recent years, there has been an increase in hackers targeting real estate transactions and stealing funds from both unsuspecting buyers and companies alike.

And now, one of real estate industry’s own has fallen victim to hackers.

[Update: This article is updated to clarify the dollar amount recovered by RealPage thus far. Additionally, this article is updated with a response from RealPage.]

Most Popular Articles

3d rendering of a row of luxury townhouses along a street

Log In

Forgot Password?

Don't have an account? Please