--- title: "Tenant screening and security: distinct events and corrections" language: en canonical: https://osint.v3rta.com/dossiers/realpage/screening-and-security/ as_of: 2026-10-10 keywords: ["RealPage","Thoma Bravo","rental software","revenue management","YieldStar","Lease Rent Options","AIRM","rental housing","antitrust litigation","Stephen Winn"] --- # Tenant screening and security: distinct events and corrections **Question.** What do the records establish about screening and security outside rental-pricing litigation? **Answer.** The record includes an FTC screening settlement, a phishing loss and a revised Chirp advisory; each has a different subject and evidential scope. ## Screening accuracy and the 2018 settlement - Analysis: RealPage’s annual report describes an FTC inquiry into procedures for the accuracy of tenant-screening reports. The company reported settling in October 2018, paying $3 million and agreeing to continued FCRA compliance while maintaining that its practices were lawful. This concerns applicant screening, not the later antitrust theories about rent recommendations. [s-d50] - Documented: RealPage’s annual report describes an FTC investigation into tenant-screening accuracy under the Fair Credit Reporting Act, followed by an October 2018 settlement and $3 million payment. RealPage maintained that its practices did not violate the law and said the settlement required no change to then-current practices. [s-d50] - Qualification: The description of the settlement here is company-reported in its filing and does not resolve unrelated pricing-software allegations. ## The revised advisory controls the technical description - Analysis: Chirp’s ownership connection to RealPage is documented separately from the vulnerability. CISA’s revised advisory describes a hard-coded beacon password and an attacker within Bluetooth range changing beacon configuration, disrupting proximity notifications. It explicitly says the variable cannot change door-reader or lockset settings or affect authorised mobile users’ ability to operate access points. [s-d264] [s-d266] [s-d50] - Documented: CISA’s revised May 2024 advisory for Chirp Access, CVE-2024-2197, describes a hard-coded beacon password. An attacker within Bluetooth range could change beacon settings and disrupt proximity notifications; the advisory says the variable cannot change door-reader or lockset settings or affect authorised users’ ability to lock and unlock access points. The revised CVSS v3.1 score was 4.3. [s-d264] [s-d266] - Qualification: The revised advisory narrows the earlier high-severity remote-unlocking account. The retained advisory reports no known exploitation. - Documented: The 2020 annual report records Buildium acquired for $569.645 million in December 2019 and Rentlytics for $54.815 million in October 2018. It also records 2020 acquisitions of Stratis IoT for $64.8 million, Chirp for $16.8 million and WhiteSky for $64.9 million, including specified deferred or contingent components. [s-d50] - Qualification: Amounts are reported purchase consideration, not estimates of current business value. - Analysis: That narrower account must travel with any mention of the earlier alarm. The revised CVSS v3.1 score was 4.3 and the retained advisory reported no known exploitation. Repeating the initial remote-unlocking description without the correction would materially overstate what the later official text supports. [s-d264] [s-d266] ## A loss suffered by the company - Analysis: The annual report’s reconciliation identifies a May 2018 phishing incident. Separate reporting described employee credentials being used to steal $10.5 million and quoted the company on recoveries. Those reports concern RealPage as victim; the cited annual-report fragment alone does not substantiate every number in the media account. [s-d259] [s-d50] - Attributed: RealPage’s 2020 filing describes a May 2018 targeted email attack that diverted funds intended for three clients, with approximately $6 million lost net of recoveries. A later reported account gives $10.5 million stolen and $4.5 million recovered according to the company. [s-d259] [s-d50] - Qualification: The filing gives a net figure; the reported gross loss and recoveries are separate measures. These records describe RealPage as the victim, not a perpetrator. - Outcome: The filing records a partial insurance payment in January 2019 and a continuing coverage dispute; its final outcome is not established here. ## Sources - [s-d50] RealPage annual report for 2020, U.S. Securities and Exchange Commission - [s-d264] Media source · s-d264 - [s-d266] CISA advisory ICSA-24-067-01, revised May 2024, Cybersecurity and Infrastructure Security Agency - [s-d259] Media source · s-d259