Actor claims sale of 17.1 million Zillow-linked records
A threat actor on a dark web forum claims to sell a database of about 17.1 million records tied to Zillow: 13.6 million US and 3.5 million Canadian, with names, emails, phone numbers and real estate lead details. The source notes the fields look like lead or CRM data, possibly from a third-party tool, rather than account credentials; Zillow has not confirmed an incident. Validated emails and phone numbers still enable targeted phishing and SMS scams, so treat contacts posing as agents or listings with suspicion.
What happened
A threat actor on a dark web forum claims to sell a database of about 17.1 million records tied to Zillow, the US online real estate marketplace. The claim covers about 13.6 million US records and 3.5 million Canadian records with names, emails, phone numbers and lead details. Zillow has not confirmed an incident and the source classifies the information as an unverified threat-actor claim.
Why it matters
If the data is real, validated emails and phone numbers enable targeted phishing and SMS scams posing as real estate agents or listings. The source assesses the fields look like lead or CRM data, possibly from a third-party tool, rather than account credentials, which lowers the risk of direct account access. Customers and leads named in the claimed database could still face fraud attempts.
What to do
No patch applies. Monitor email and SMS phishing attempts that use names, property details or purchase context, and alert staff and clients about contacts posing as agents. Wait for Zillow confirmation before treating this as a confirmed breach.
For the technical team
- Affected
- Zillow, mercado imobiliário online dos EUA; base alegada de usuários e leads · Claimed database of about 17.1 million records tied to Zillow: about 13.6 million US and 3.5 million Canadian. Claimed fields: first and last names, email addresses, phone numbers, lead status, deal type, lead source, and email and phone validation flags.
- Exploitation
- No exploitation reported. Sale claim on a dark web forum, surfaced by DailyDarkWeb; no sample published and no confirmation from Zillow.
- Fix
- Not applicable (claimed leak). Mitigation: vigilance against phishing and SMS scams aimed at customers and leads.
- Vector
- No technical vector described. This is a claimed database sale, with no details on how the data was obtained. The source notes the fields (lead status, lead source, email and phone validation flags) look like lead or CRM data; the data may come from a third-party lead tool or be aggregated, with no indication it came from Zillow's own systems.
- More details
- Analyst note from the source: the fields look like real estate lead or CRM data rather than account credentials; the data may come from a third-party lead tool or be aggregated. Validated emails and phone numbers are still useful for targeted phishing and SMS scams posing as agents or listings. Zillow has not confirmed an incident; unverified threat-actor claim, not confirmation of a breach.
Timeline
First report: actor claims sale of 17.1 million Zillow user and lead records.
Sources 1 source
- @DailyDarkWeb @DailyDarkWeb
