Tenant screening and security: distinct events and corrections

the questionWhat do the records establish about screening and security outside rental-pricing litigation?

1Screening accuracy and the 2018 settlement

analysisRealPage’s annual report describes an FTC inquiry into procedures for the accuracy of tenant-screening reports. The company reported settling in October 2018, paying $3 million and agreeing to continued FCRA compliance while maintaining that its practices were lawful. This concerns applicant screening, not the later antitrust theories about rent recommendations. ¹

documentedRealPage’s annual report describes an FTC investigation into tenant-screening accuracy under the Fair Credit Reporting Act, followed by an October 2018 settlement and $3 million payment. RealPage maintained that its practices did not violate the law and said the settlement required no change to then-current practices. ¹

qualification: The description of the settlement here is company-reported in its filing and does not resolve unrelated pricing-software allegations.

sources in this section

RealPage annual report for 2020 U.S. Securities and Exchange Commission

2The revised advisory controls the technical description

analysisChirp’s ownership connection to RealPage is documented separately from the vulnerability. CISA’s revised advisory describes a hard-coded beacon password and an attacker within Bluetooth range changing beacon configuration, disrupting proximity notifications. It explicitly says the variable cannot change door-reader or lockset settings or affect authorised mobile users’ ability to operate access points. ¹ ² ³

documentedCISA’s revised May 2024 advisory for Chirp Access, CVE-2024-2197, describes a hard-coded beacon password. An attacker within Bluetooth range could change beacon settings and disrupt proximity notifications; the advisory says the variable cannot change door-reader or lockset settings or affect authorised users’ ability to lock and unlock access points. The revised CVSS v3.1 score was 4.3. ¹ ²

qualification: The revised advisory narrows the earlier high-severity remote-unlocking account. The retained advisory reports no known exploitation.

documentedThe 2020 annual report records Buildium acquired for $569.645 million in December 2019 and Rentlytics for $54.815 million in October 2018. It also records 2020 acquisitions of Stratis IoT for $64.8 million, Chirp for $16.8 million and WhiteSky for $64.9 million, including specified deferred or contingent components. ³

qualification: Amounts are reported purchase consideration, not estimates of current business value.

analysisThat narrower account must travel with any mention of the earlier alarm. The revised CVSS v3.1 score was 4.3 and the retained advisory reported no known exploitation. Repeating the initial remote-unlocking description without the correction would materially overstate what the later official text supports. ¹ ²

sources in this section

Media source · s-d264 identified by category only · Media
CISA advisory ICSA-24-067-01, revised May 2024 Cybersecurity and Infrastructure Security Agency
RealPage annual report for 2020 U.S. Securities and Exchange Commission

3A loss suffered by the company

analysisThe annual report’s reconciliation identifies a May 2018 phishing incident. Separate reporting described employee credentials being used to steal $10.5 million and quoted the company on recoveries. Those reports concern RealPage as victim; the cited annual-report fragment alone does not substantiate every number in the media account. ¹ ²

attributedRealPage’s 2020 filing describes a May 2018 targeted email attack that diverted funds intended for three clients, with approximately $6 million lost net of recoveries. A later reported account gives $10.5 million stolen and $4.5 million recovered according to the company. ¹ ²

qualification: The filing gives a net figure; the reported gross loss and recoveries are separate measures. These records describe RealPage as the victim, not a perpetrator.
outcome: The filing records a partial insurance payment in January 2019 and a continuing coverage dispute; its final outcome is not established here.

sources in this section

Media source · s-d259 identified by category only · Media
RealPage annual report for 2020 U.S. Securities and Exchange Commission