Zillow sued over hacked listing of California mansion

Mar.March 08, 2019 08:45 AM

Bruce Makowsky and 924 Bel Air Road (Credit: Wikipedia and Zillow)

What may be the first-ever hijacking of an active real-estate listing online — a palatial mansion overlooking the Pacific Ocean in Bel Air, California — has led to a lawsuit seeking $60 million in damages against home-sale marketing company Zillow.

One or more hackers seized control of the mansion’s listing page on Zillow’s popular Zestimates site in February, causing it to display a series of bogus sales that were tens of millions of dollars below the $150 million asking price, according to the complaint filed in federal district court in Los Angeles. The net effect was to inflict financial damage on the seller by “corrupt[ing] the listing price dramatically,” according to the complaint, making it more difficult to obtain anywhere near the price the seller is seeking.

The newly constructed hilltop house is a knockout, even by Hollywood standards: 12 bedrooms, 21 baths, 38,000 square feet of interior space, 17,000 square feet of “entertainment decks,” three kitchens, five bars, fitness spa, four-lane bowling alley, basketball and tennis courts, wine cellars and an 85-foot “glass-tile infinity pool,” to cite just some of the amenities. It is owned by a limited liability company controlled by Los Angeles luxury builder Bruce Makowsky.

The hijacking occurred when someone using a Chinese IP address and a made-up U.S. phone number managed to successfully claim “ownership” of the mansion on Zillow’s Zestimates page. Zillow, which displays pages on 110 million American homes — properties listed for sale and off the market — offers a feature that allows owners to amend descriptions of their homes on the site. The feature is heavily used by legitimate owners to modify information posted about their house — numbers of bedrooms and baths, for example, or a recent remodeling that affects the property’s market value. To successfully make such a claim, owners must answer questions designed to verify their identity.

In this case, according to the suit, hackers figured out how to get past Zillow’s security questions and began manipulating information on the site. They erroneously reported that the house sold for $110 million on Feb. 4, then for $90.5 million on Feb. 9 and $94.3 million Feb. 10. They also listed an open house for the property on Feb. 8, something that would be unusual in the rarified world of super luxury homes, where showings tend to be exclusively by appointment.

The suit alleges that Zillow was negligent in allowing false and harmful information to be posted on the mansion’s page, despite repeated requests for “over a week” from the seller’s lawyers to pull the plug on the hackers. Zillow does not have adequate “safeguards in place to prevent Internet trolls, criminals” and others “to commit illegal acts” by “logging into their system to post the false information,” the suit alleges.

Asked for comment, Kate Downen, a Zillow spokesperson, said that “while we don’t discuss pending litigation, I can tell you that [the company] goes to great lengths to display current and accurate data.” Downen added that Zillow is “in the process of updating” the verification system for access to owner pages on the Zestimate site.

In an exhibit accompanying the complaint, attorneys for the owner included a copy of an email from Kim Nielsen, senior lead counsel for Zillow Group Inc., in which she says, “Unfortunately if someone is able to provide responses to the verification questions, they are able to claim the home … we do not manually check each time someone attempts to claim a home.” The complaint also quotes Nielsen as saying that “any home on our website can be claimed by the homeowner. There are a series of questions … but if someone attempts to claim [the property] enough times, they will know the questions asked and be able to figure out what information they need to verify their identity.”

Ronald Richards, the seller’s attorney, asked “How is it that someone with a fake phone number (bad area code) and Chinese IP address and email can hijack [a] $150 million house?” In an interview, Richards said “it’s impossible to have a site” like the Zestimate owner-claim page if effectively there are “no security protections.”

So what should homeowners whose house is listed on Zillow make of this suit? Even if your home is not a dazzling palazzo on a hill, the secret is out: Though it’s highly unlikely, your Zillow page can be hacked and stolen by online troublemakers. Until Zillow announces verification reforms, it’s probably worth checking your Zestimate page now and then.

Related Articles

Parkline at MiamiCentral (Credit: Suffolk, iStock)

Suffolk fights back against developer over MiamiCentral delays

Daily Digest Miami

FINCEN renews order looking at cash purchases, Barry Sternlicht is eyeing an economic slowdown: Daily digest

Jared Galbut and Keith Menin are majority owners of Bodega Taqueria y Tequila  

Holy guacamole: Jared Galbut and Keith Menin sued over South Beach taco bar and nearby pizzeria

5900 W. Glades Road and Simon Property Group CEO David Simon (Credit: Google Maps)

Simon Property sues Seritage over Boca Raton Sears

One Ocean

Allegations of shoddy construction pile up at Related’s One Ocean

Edgardo Defortuna, Ritz-Carlton Residences Sunny Isles Beach

Ritz-Carlton Residences Sunny Isles developers face second lawsuit from Tropicana

Angelo Bianco and a rendering of Midtown Boca (Credit: Patrick McMullan | Getty Images)

Crocker Partners withdraws plans and two lawsuits tied to Midtown Boca

1515 Sunset Drive and Facundo Bacardi

Bacardi-owned company sues construction firm for defects and delays at Coral Gables office development