Kicklighter Realty: 8,818 Plaintext Passwords Compromised 2018

In August 2018, Kicklighter Realty Inc., a family-owned real estate brokerage in Georgia, suffered a database breach that exposed 8,818 customer and employee credentials. The passwords were stored in plain text, which means anyone who got the dataset could immediatley start logging into accounts. Seven years later, these credentials are still being tested by automated attacks on email, banking, and other services.

The Immediate Risk: Plain text passwords are a criminal's dream. No cracking, no computational resources needed, just pure exploitation. Real estate brokerages hold personal information about clients including financial details, property addresses, and family information. Attackers could impersonate agents, access financial information, or use client details for fraud and harassment.

What Happened: A database containing user credentials wasn't properly secured or encrypted. Someone accessed it and dumped the contents on a hacking forum. The data was probably exfiltrated through SQL injection, a weak admin password, or a compromized employee account. Whatever the method, the plaintext storage was the critical failure that made the breach so damaging.

The Scope of Exposure: 8,818 records with email addresses and plaintext passwords. For a regional realty business, this represents a significant portion of active clients and staff. Real estate transactions can be targets for fraud, money laundering, and identity theft, so compromized credentials in this sector are more valuable to criminals than in some other industries.

Protect Yourself if Affected: If you ever worked with or used Kicklighter Realty, check your email on Have I Been Pwned. If it shows up in the breach, change that password everywhere immediatly. Alert your bank and credit card companies that your info may have been exposed. Consider placing a fraud alert with credit bureaus. Enable multi-factor authentication on email and banking. Monitor your credit reports for suspicious activity. If you're a realtor, inform your brokerage about the breach and any unusual login activity on your accounts.