Anywhere Real Estate Data Breach

On or about November 24, 2025, Anywhere Real Estate Inc. (“Anywhere”) discovered a cybersecurity incident involving its Oracle E‑Business Suite (“Oracle EBS”) environment. According to the notice, an unauthorized third party exploited a then‑unknown “zero‑day” Oracle software vulnerability to gain access to Anywhere’s Oracle EBS system and download certain data.

Upon discovering the incident, Anywhere launched a detailed investigation with the assistance of third‑party cybersecurity experts to determine the nature and scope of the breach and to confirm that the vulnerability had been remediated. Anywhere reported that it worked swiftly with Oracle to address the issue and secure its systems.

Following a comprehensive review of the impacted data, Anywhere determined that the incident affected certain personal information belonging to current and former employees of the Anywhere Real Estate group, formerly known as Realogy. Affected entities include Anywhere Real Estate, Inc., Cartus, NRT (also known as National Realty Trust), Title Resource Group, and Real Estate Franchise Group.

After completing its investigation, Anywhere began issuing written notification letters to impacted individuals. The notification letters were dated January 30, 2026, and included information about the incident, the types of data involved, and available identity protection services.

Anywhere Real Estate Inc. is a national real estate services company that maintains sensitive personal information in connection with employment and business operations.

The breach occurred within a third‑party enterprise software environment and involved unauthorized access by an external actor.

Following the incident, Anywhere stated it is taking steps to minimize the risk of similar incidents in the future and is providing impacted individuals with twenty‑four (24) months of complimentary credit monitoring and identity protection services through Experian.

If you received a Notice of Data Breach letter from Anywhere Real Estate, it confirms that your personal information may have been involved in this cybersecurity incident.

What information is involved in the Anywhere Real Estate Data Breach?

Compromised information may include:

Your Personally Identifiable Information (PII) includes information that can be used to identify you. Employers and companies that store sensitive personal data are legally required to safeguard this information. When PII is exposed in a data breach, it can be used to commit identity theft, financial fraud, or other forms of misuse.

A specific subset of PII is Protected Health Information (PHI), which includes medical and health insurance data. PHI is protected under both federal and state privacy laws, including HIPAA and related state statutes. When PHI is exposed in a data breach, it can be used in conjunction with other personal data to commit identity theft, medical fraud, and insurance fraud.

The exposure of Social Security numbers and employment‑related data significantly increases the risk of identity theft, including fraudulent credit activity, tax fraud, and unauthorized account creation.

If your information was involved in this data breach, it is important to carefully review credit reports, financial account statements, and other personal records for suspicious activity. Impacted individuals are encouraged to follow the instructions provided in the Anywhere notification letter regarding enrollment in complimentary Experian IdentityWorks credit monitoring and identity protection services.

Residents of California benefit from enhanced privacy protections under the California Consumer Privacy Act (CCPA), which grants additional rights related to the collection, storage, and protection of personal information. California residents may also have additional legal remedies depending on the nature of the compromised data.

If you received a Notice of Data Breach letter related to the Anywhere Real Estate data breach, your personal, financial, and employment‑related information may be at risk.

Contact the Data Breach Lawyers at Emery | Reddy, PC for a Free Case Review today.