A website security fluke on Redfin.com momentarily exposed past users’ data when others logged onto listings. The glitch lasted for less than a week, the company confirmed.
When the portal’s users viewed real estate listings and a contact information form popped up, the form would briefly be completed with information from past users of the site, including their names, email addresses and phone numbers — then disappear.
If viewers looked at listings on the site without JavaScript enabled, however, that contact information would stay visible. JavaScript is a programming language that creates dynamic or interactive content on websites, and can be turned off.
“We recently identified a technical error on the website that temporarily made it possible for the e-mail address and/or phone number of a previous visitor to be visible to another user on a rental listing page,” a Redfin spokesperson told Inman in an email. “The error was active for less than a week and was remediated as soon as we were made aware of it. We do not collect sensitive information or financial data on this website.”
The website issue only revealed the contact information of one past user at a time, but current users hypothetically could have gathered contact information for multiple past users by visiting property listings on the site repeatedly.
The email addresses and phone numbers were also confirmed to belong to actual users, The Intercept, which first reported the website issue, discovered by using reverse phone number and email search databases.
Redfin is allowed to share private information, according to its privacy policy, but only when the request for that information comes with a disclosure. The property contact form on the company’s website does not include a disclosure regarding shared data.
The website glitch was first discovered on the real estate company’s desktop browser, and after Redfin initially fixed the problem there, it continued to be an issue on its mobile listings until The Intercept contacted Redfin a second time, the news outlet said.
Redfin’s portal receives about 50 million monthly users, according to Rocket, which acquired the real estate company last spring.
Update: This story has been updated with a comment Redfin sent to Inman.
