Home buyers, sellers, real estate agents, and listing websites throughout the US have been stymied for five days by a cyberattack on a California company that provides a crucial online service used to track home listings.

The attack, which commenced last Wednesday, hit Rapottoni, a software and services provider that supplies Multiple Listing Services to regional real estate groups nationwide. Better known as MLS, it provides instant access to data on which homes are coming to the market, purchase offers, and sales of listed homes. MLS has become essential for connecting buyers to sellers and to the agents and listing websites serving them.

“If you’re an avid online refresher on any real estate website, you may have noticed a real nosedive in activity the last couple of days,” Peg King, a realty agent in California’s Sonoma County, wrote in an email newsletter she sent clients on Friday. “Real estate MLS systems across the country have been unusable since Wednesday after a massive cyberattack against major MLS provider, Rapattoni Corporation. This means that real estate markets (like ours!) can’t list new homes, change prices, mark homes as pending/contingent/sold, or list open houses.”

Rapattoni does not provide a way for reporters to contact representatives. In a memo sent to regional MLS providers and reported by Cincinnati TV station WCPO, Rapattoni representatives wrote:

As we have previously communicated, Rapattoni’s production network was hit by a cyberattack and we are working diligently around the clock to get systems restored as soon as possible.

We are actively investigating the nature and scope of the event. The confidentiality, privacy, and security of information in our care is one of our highest priorities.

All technical resources are devoted to this effort. We do not have an ETA at this time, but we will continue to update you and keep you informed of our efforts.

On Sunday, Rapattoni wrote: “We are continuing to investigate the nature and scope of the cyberattack that has caused a system outage and we are working diligently to get systems restored as soon as possible. All technical resources at our disposal are continuing to work around the clock through the weekend until this matter is resolved. We still do not have an ETA at this time, but we will continue to update you and keep you informed of our efforts.”

While Rapattoni has referred to the incident as a cyberattack, it has been widely reported that the event is a ransomware attack, in which criminals gain unauthorized access to a victim’s network, encrypt or download crucial data and demand payment in exchange for decrypting the data or promising not to publish it. Rapattoni has so far not said publicly what sort of attack shut it down or other details. Rapattoni has yet to say whether personal information has been compromised.

The outage is a potent reminder of the real-world disruptions that cyberattacks can impose on large numbers of people or businesses that depend on a service that gets hacked. On Monday, people continued to make do as best they could. In an email, King wrote:

We are having more in person meetings where we share new listings, price reductions, buyer needs, etc. And obviously we do this by phone as well but on a more individual basis. For instance, I am showing clients two properties tomorrow. I had to call/text/email each agent to track them down to see if the status was still accurate—luckily they are both available to be shown. When MLS is working correctly, I wouldn’t have had to make those calls as the MLS tells me which properties are available/in contract/sold. So that ate up an extra 10 minutes that I normally don’t have to do.

We find ourselves scouring the public websites (Zillow/Trulia, etc) and MLS (as of 8/8/23 @ 10pm) for new information, open houses, price reductions, etc. It all just takes a couple extra minutes to get the correct information.

As far as updating listings, we still have no way of doing this. We can search via a reciprocal MLS (MetroList) but are unable to enter new listings ourselves or change current listings. So, the public really isn’t getting the latest/greatest information. It trickles out but it’s delayed and slow.

The president and CEO of BAREIS, a broker-owned multiple listing service serving realty professionals in Northern California, said that the MLS data it provides hasn’t been updated since August 8. She has received no estimate from Rapattoni on when updated data will become available.

“BAREIS has created many workarounds to allow BAREIS members to stay informed, including access to alternative databases with MLS data for their counties,” KB Holmgren wrote. “We have established temporary systems for posting new listings, open houses, and broker tours.”

Not all regional listing services are affected because some use data vendors other than Rapattoni. The damage the outage is causing to agents, buyers, renters, and sellers could get worse unless services are restored in the next few days.