The multiple listing service, which boasts approximately 42,000 subscribers, notified its members on Thursday, 11 days after the attack.

Georgia MLS, which boasts approximately 42,000 subscribers, was hit by ransomware on August 16 that may have resulted in the unauthorized disclosure of subscribers’ login and contact information. The MLS notified its members of the data breach on Thursday, 11 days later.

The breach involved GAMLS’s membership management server, which holds its membership database and stores subscribers’ MLS login details, according to the notification sent to members. The membership server contains each subscriber’s user name, email address, phone number, password for Georgia MLS, real estate license number, and any mailing address the MLS may have on file.

John Ryan, Georgia MLS’s chief marketing officer, told Inman via email that on the afternoon of August 16 an employee detected unusual activity on the server and the MLS believes the breach occurred that day.

Asked why GAMLS members were notified 11 days after the breach, Ryan said, “Our first concern was to mitigate the activity and protect our infrastructure from further intrusion, assess the area the criminals accessed, and gauge the effect on our operations. We wanted to fully understand the extent of the breach so we could make an informed statement to our members.”

Partial screen shot of Georgia MLS’s data breach notification to subscribers, August 27, 2020

According to Georgia MLS, its technology team identified the criminal code, immediately replaced the server and restored it back operationally. That affected the MLS’s ability to make agent roster changes for one business day, but no data was lost during the downtime, the MLS said.

Georgia MLS believes the ransomeware strain that struck its server to be called Dharma and has notified the FBI and local authorities, which will be investigating, Ryan said. The MLS is also in the process of working with a forensic cyber security firm, he added.

“A full evaluation is ongoing and we are working with outside cyber security firms to harden our infrastructure,” he said.

Asked whether Georgia MLS was storing subscribers’ passwords in plain text or whether they were encrypted, GAMLS declined to comment. Storing passwords in plain text (meaning exactly as they were typed in) is generally considered bad security practice.

It also does not appear that GAMLS will institute a forced password change as a result of the breach. GAMLS’s notification to members says members will be required to change their password, but its instructions leave agents to make that change at their discretion.

Partial screen shot of Georgia MLS’s data breach notification to subscribers, August 27, 2020

Asked why Georgia MLS will not require a forced password change and whether the MLS had enough staff to cover agent call volume for a forced password change, the MLS declined to comment.

“Georgia MLS takes the role of safe guarding our member’s data in the uppermost regard. Whether it is personal information, or listing data contained in our platforms, we will be vigilant in protecting our members against the attacks of cyber criminals,” Ryan said.

Georgia MLS is not the first MLS to be hacked. On June 11, 2019, MetroList, the largest MLS in Northern California, was hit by a cyberattack and allegedly paid a $10,000 ransom to free itself. MetroList informed its members of the attack the same day it happened.

According to Ryan, Georgia MLS was able to free itself without paying a ransom.

“It was a ransomware attack, but through our recovery protocols no contact was made, nor any money paid out,” he said.

Editor’s note: This story has been updated with an additional comment from Georgia MLS stating the company did not pay a ransom.

Email Andrea V. Brambila.
Like me on Facebook | Follow me on Twitter

Show Comments Hide Comments


Sign up for Inman’s Morning Headlines
What you need to know to start your day with all the latest industry developments
By submitting your email address, you agree to receive marketing emails from Inman.
Thank you for subscribing to Morning Headlines.
Back to top
Only 3 days left to register for Inman Connect Las Vegas before prices go up! Don't miss the premier event for real estate pros.Register Now ×
Limited Time Offer: Get 1 year of Inman Select for $199SUBSCRIBE×
Log in
If you created your account with Google or Facebook
Don't have an account?
Forgot your password?
No Problem

Simply enter the email address you used to create your account and click "Reset Password". You will receive additional instructions via email.

Forgot your username? If so please contact customer support at (510) 658-9252

Password Reset Confirmation

Password Reset Instructions have been sent to

Subscribe to The Weekender
Get the week's leading headlines delivered straight to your inbox.
Top headlines from around the real estate industry. Breaking news as it happens.
15 stories covering tech, special reports, video and opinion.
Unique features from hacker profiles to portal watch and video interviews.
Unique features from hacker profiles to portal watch and video interviews.
It looks like you’re already a Select Member!
To subscribe to exclusive newsletters, visit your email preferences in the account settings.
Up-to-the-minute news and interviews in your inbox, ticket discounts for Inman events and more
1-Step CheckoutPay with a credit card
By continuing, you agree to Inman’s Terms of Use and Privacy Policy.

You will be charged . Your subscription will automatically renew for on . For more details on our payment terms and how to cancel, click here.

Interested in a group subscription?
Finish setting up your subscription