BT
Privacy ToolboxJournalProjectsResumeBookmarks
Feed
Privacy Toolbox
Journal
Projects
Resume
Bookmarks
Intel
Threat Actors
Privacy Threats
Dashboard
CVEs
Tags
Intel
Threat ActorsPrivacy ThreatsDashboardCVEsTags

Intel

  • Feed
  • Threat Actors
  • Privacy Threats
  • Dashboard
  • Privacy Toolbox
  • CVEs

Personal

  • Journal
  • Projects

Resources

  • Subscribe
  • Bookmarks
  • Developers
  • Tags
Cybersecurity News & Analysis
github
defconxt
β€’
Β© 2026
β€’
blacktemple.net
  1. Privacy Threats
  2. /CoreLogic
πŸ‡ΊπŸ‡Έ

CoreLogic

Also known as: CoreLogic Inc

data broker62/100
HQ Country
πŸ‡ΊπŸ‡Έ United States
Category
data broker
Threat Score
62/100
Incidents
8
Known Clients
Mortgage lendersInsurance companiesReal estate platformsProperty management firmsU.S. government agenciesTenant screening services
Deployment Countries
πŸ‡ΊπŸ‡Έ USπŸ‡¦πŸ‡Ί AUπŸ‡³πŸ‡Ώ NZπŸ‡¬πŸ‡§ GB
References
FTC Report on Tenant Screening AccuracyCoreLogic $6B Take-Private Deal (2021)CFPB Tenant Screening Investigation

Threat Score Factor Analysis

62/ 100

Overall Threat Score

Overview

CoreLogic is the dominant property data and analytics company in the United States, maintaining what it describes as the nation's most comprehensive property database, covering an estimated 99.9% of all U.S. residential properties. Founded in 2010 as a spinoff from the First American Financial Corporation, the company is headquartered in Austin, Texas and has grown through decades of acquisitions into a critical infrastructure provider for the real estate, mortgage, and insurance industries.

The company's data holdings are staggering in scope: detailed records on approximately 150 million properties in the United States alone, including ownership history, tax assessments, mortgage details, liens, foreclosure records, building permits, and geographic risk data. This property data is supplemented by tenant screening databases, flood risk models, natural hazard assessments, and real estate market analytics that inform decisions affecting where people live, what they pay, and whether they qualify for housing.

In February 2021, CoreLogic was taken private in a $6 billion deal by Stone Point Capital and Insight Partners, ending its time as a publicly traded company. The privatization removed the modest transparency requirements of public reporting, further shielding the company's data practices from scrutiny. Prior to the deal, CoreLogic had revenues exceeding $1.6 billion annually, with approximately 20,000 clients and operations spanning property data, mortgage technology, insurance analytics, and real estate market intelligence.

The First American Financial Corporation, CoreLogic's former parent, is itself significant, it is one of the largest title insurance companies in the United States and was involved in a major data exposure incident in 2019 when approximately 885 million financial documents containing Social Security numbers, bank account information, and mortgage records were found to be publicly accessible on its website. While this breach occurred after the CoreLogic spinoff, it reflects the data security culture of the corporate lineage from which CoreLogic emerged.

CoreLogic employs approximately 5,000 people across its global operations, with major offices in Dallas, San Diego, Sydney, Auckland, and London. The company's technology stack processes millions of data transactions daily, with automated feeds from county recorders, mortgage servicers, and other data sources continuously updating the database in near real-time.

CoreLogic's significance to privacy lies not in dramatic surveillance capabilities but in the mundane, pervasive role it plays as gatekeeper to housing. When a landlord runs a tenant screening report, when a mortgage lender evaluates an application, when an insurance company prices a policy, CoreLogic's data is frequently the invisible engine behind those decisions. Errors in CoreLogic's databases can follow individuals for years, denying them housing, inflating their insurance premiums, or flagging them as risks based on inaccurate or outdated information.

The company operates internationally through subsidiaries in Australia, New Zealand, and the United Kingdom, where it provides similar property data and analytics services adapted to local markets. In Australia, CoreLogic holds a near-monopoly on residential property data, controlling the most widely cited home value indices and providing the data infrastructure for the country's mortgage and real estate industries.

CoreLogic's journey to dominance was built through acquisition. The company absorbed dozens of smaller data providers over the past two decades, including Marshall & Swift (building cost data), DataQuick (property transaction records), and Dorado (flood determination services). Each acquisition eliminated a competitor and consolidated more property data under a single corporate roof, creating a data monopoly that is now functionally impossible to replicate.

The company's economic moat is its data, decades of historical records that cannot be recreated, relationships with thousands of county recording offices that feed new records into the system daily, and a network of institutional clients that have built their operations around CoreLogic's data feeds. This creates a lock-in effect for the entire housing industry: mortgage lenders, insurers, and real estate platforms cannot practically switch to an alternative because no alternative with comparable coverage exists. The result is a natural monopoly in property data, one that emerged through decades of systematic data accumulation and competitor acquisition.

Data Collection Practices

CoreLogic's data collection spans virtually every source of property and housing-related information available in the United States:

Property records form the backbone of the database, systematically collected from county recorders, assessors, and tax authorities across all 3,100+ U.S. counties:

  • Deed transfers and full ownership history chains
  • Property tax assessments and payment records (current and historical)
  • Mortgage origination and servicing data
  • Liens, judgments, and foreclosure filings
  • Building permits and code violations
  • Zoning and land use classifications
  • Property characteristics (square footage, lot size, year built, features)

Tenant screening data represents one of CoreLogic's most privacy-sensitive operations. The company maintains databases used to evaluate prospective tenants, incorporating:

  • Eviction court records from jurisdictions nationwide
  • Criminal background check data
  • Credit-related information and rental payment history
  • Prior address history and identity verification
  • Records from previous landlords and property managers

Tenant screening data disproportionately affects low-income renters and communities of color. Research by the National Consumer Law Center and Princeton University's Eviction Lab has documented that eviction records are frequently inaccurate, reflect dismissed or sealed cases, and perpetuate housing discrimination by creating permanent black marks from temporary financial hardship.

The eviction data problem is compounded by the legal system itself. In many jurisdictions, landlords file eviction cases as a routine part of rent collection, only to have the cases dismissed when tenants pay. But the filing itself, even when dismissed, appears in CoreLogic's database as an eviction record, potentially following the tenant for years. Research published in the Housing Policy Debate journal found that over 40% of eviction filings in some jurisdictions do not result in an eviction judgment, yet these non-adjudicated filings still appear in tenant screening reports.

Mortgage and financial data is collected through CoreLogic's relationships with thousands of mortgage lenders, servicers, and secondary market participants. This includes loan origination data, payment performance, delinquency indicators, and refinancing activity.

Natural hazard and risk data includes flood zone designations, wildfire risk assessments, earthquake hazard models, and climate risk projections. While ostensibly geographic rather than personal, this data directly affects individuals through insurance pricing and availability decisions. CoreLogic's catastrophe modeling division estimates potential losses from hurricanes, earthquakes, wildfires, and floods, models that insurance companies use to determine whether to offer coverage in specific areas, at what price, and under what conditions.

As climate change intensifies the frequency and severity of natural disasters, CoreLogic's hazard data becomes increasingly consequential. The company's models effectively determine which communities remain insurable and which face coverage withdrawal, a decision with enormous implications for property values, community viability, and individual financial security. Areas that CoreLogic's models flag as high-risk may see insurance costs rise dramatically or coverage become unavailable, potentially triggering property value declines and community disinvestment.

Market analytics and valuations are derived from proprietary models that estimate property values, forecast market trends, and assess investment risk. CoreLogic's automated valuation models (AVMs) are widely used in the mortgage industry and increasingly influence whether individuals can buy, sell, or refinance homes. These AVMs determine home values in seconds using algorithmic analysis of comparable sales, property characteristics, and market conditions, replacing or supplementing human appraisers in many mortgage transactions.

The accuracy of CoreLogic's AVMs has direct financial consequences for homeowners. An AVM that undervalues a property can prevent a homeowner from qualifying for refinancing, while an overvaluation can lead to excessive insurance premiums. Research has documented that AVMs can perpetuate neighborhood-level racial disparities in home valuations, as the models rely on historical sales data that reflects decades of discriminatory lending and housing practices.

Acquisition-derived data from CoreLogic's extensive M&A history brings additional data streams:

  • Marshall & Swift/Boeckh provides building cost estimation data used by insurance companies to determine replacement cost values, the data that determines how much insurance a homeowner needs and what they pay for it
  • DataQuick's historical transaction database provides decades of sales records, price trends, and market analytics
  • Dorado's flood determination services connect property locations to FEMA flood maps, directly influencing insurance requirements and mortgage terms
  • Multiple Appraisal Management Companies (AMCs) provide property valuation data and appraisal reports

The aggregation of these data streams creates a comprehensive profile of every residential property in America, and by extension, the financial lives and housing security of the people who own, rent, or seek to occupy those properties. The privacy harm is not merely theoretical: a single inaccurate eviction record in CoreLogic's tenant screening database can prevent a family from securing housing, while an incorrect property valuation can block a homeowner from refinancing their mortgage.

Known Clients & Government Contracts

CoreLogic's client base encompasses the major institutional players in the U.S. housing ecosystem:

Mortgage lenders and servicers: The largest U.S. mortgage originators, including Wells Fargo, JPMorgan Chase, Bank of America, and United Wholesale Mortgage, rely on CoreLogic's property data, appraisal platforms, and fraud detection tools. CoreLogic processes data for an estimated 75% of U.S. mortgage transactions, making it the single most important data infrastructure provider for the American mortgage industry. The company's Loan Performance database tracks mortgage payment data on over 85% of U.S. first-lien mortgage loans, providing lenders and investors with detailed visibility into borrower payment behavior nationwide.

Government-sponsored enterprises: Fannie Mae, Freddie Mac, and Ginnie Mae use CoreLogic data for loan underwriting, quality control, and market surveillance. These relationships give CoreLogic effective infrastructure status within the government-backed mortgage system. When the federal government guaranteed trillions of dollars in mortgage-backed securities during and after the 2008 financial crisis, the data underlying those guarantees was largely supplied by CoreLogic. The government's reliance on CoreLogic data for housing market monitoring and mortgage risk assessment creates a dependency that gives the company leverage in regulatory discussions, the same dynamic seen with credit bureaus.

Title and closing services: Through its title data subsidiaries, CoreLogic provides the title search data that determines whether properties have clear ownership, outstanding liens, or other title defects. These searches are required for virtually every residential real estate transaction in the United States, making CoreLogic an essential participant in the mechanics of property transfer.

Insurance companies: Property and casualty insurers including State Farm, Allstate, Liberty Mutual, and USAA use CoreLogic's data for risk assessment, claims processing, and catastrophe modeling. The company's natural hazard data influences insurance availability and pricing for millions of homeowners. CoreLogic's Weather Verification Services division provides insurers with historical weather data used to validate or deny claims, determining whether a hailstorm or windstorm actually occurred at the claimed time and location. This data-driven claims validation gives CoreLogic a role in determining whether individual insurance claims are paid.

Tenant screening services: Landlords and property management companies use CoreLogic's tenant screening products (including the SafeRent brand) to evaluate prospective tenants. These reports can determine whether someone is approved for housing, making CoreLogic a de facto gatekeeper to rental housing for millions of Americans.

Real estate platforms: Zillow, Realtor.com, Redfin, and other real estate websites license CoreLogic's property data to power their listings, valuations, and market analytics.

Government agencies: CoreLogic provides data and analytics to federal agencies including FEMA (flood mapping and disaster response), the Department of Housing and Urban Development (housing market analysis), and various state and local government entities for tax assessment and land use planning. The FEMA relationship is particularly significant: CoreLogic's flood determination data is used to enforce the National Flood Insurance Program's mandatory purchase requirements, meaning CoreLogic's data directly triggers legal obligations for millions of homeowners.

Acquisitions expanding data reach: CoreLogic has acquired numerous companies to expand its data holdings, including LandSafe (appraisal services, acquired from Bank of America), Symbility Solutions (insurance claims technology), and multiple regional title and tax data companies. Each acquisition brought additional data assets and client relationships into CoreLogic's ecosystem. The acquisition strategy also eliminated potential competitors, further consolidating CoreLogic's position as the sole comprehensive source of U.S. property data.

International operations: CoreLogic Australia (formerly RP Data) is the dominant property data provider in Australia, maintaining records on over 4 million residential properties. The company's data powers Australia's most widely cited home value indices and is used by every major Australian bank for mortgage lending decisions. In New Zealand, CoreLogic provides similar property data services covering the national housing market. The UK subsidiary, CoreLogic UK, provides property data and automated valuation models to the British mortgage and insurance industries.

These international operations extend CoreLogic's data monopoly model across multiple jurisdictions, each with their own regulatory frameworks and consumer protection standards. The challenge for regulators is that CoreLogic's market dominance in each country means there is no practical alternative, lenders and insurers cannot switch to a competitor because no competitor offers comparable data coverage.

In Australia, CoreLogic's home value index is the most widely cited measure of property prices, appearing daily in media coverage and government policy discussions. This gives the company influence over public perception of the housing market itself, a position of informational power that extends beyond data brokerage into market-shaping capability. When CoreLogic reports that home values have risen or fallen, it directly affects consumer confidence, buying decisions, and policy debates.

In New Zealand, CoreLogic's data is similarly embedded in the housing market infrastructure, providing property valuations and market analytics to the country's banks, real estate agents, and government agencies. The company's expansion across Australasia demonstrates the replicability of its data monopoly model in countries with relatively small, concentrated property markets.

Privacy Incidents & Litigation

FTC Scrutiny of Tenant Screening Accuracy: The Federal Trade Commission has investigated the accuracy of tenant screening reports produced by companies including CoreLogic. The FTC's research found that tenant screening reports frequently contain errors, including records belonging to different individuals with similar names, expunged or sealed records that should not appear, and outdated eviction filings that were dismissed or resolved.

These inaccuracies disproportionately harm Black and Hispanic renters, who are more likely to have common surnames that generate false matches and more likely to have eviction records due to systemic housing discrimination. The FTC's 2016 report "Big Data: A Tool for Inclusion or Exclusion?" specifically identified tenant screening as an area where data inaccuracies perpetuate discrimination.

CFPB Enforcement and Investigation: The Consumer Financial Protection Bureau has scrutinized CoreLogic's tenant screening and credit reporting practices. In 2022, the CFPB issued guidance emphasizing that tenant screening companies are subject to the Fair Credit Reporting Act (FCRA) and must ensure the accuracy of their reports, provide dispute resolution mechanisms, and notify consumers when adverse actions are taken based on their data.

CoreLogic's compliance with these requirements has been questioned by consumer advocates who document cases where individuals were denied housing based on inaccurate screening reports and faced significant obstacles in disputing errors. The CFPB's investigation found that the tenant screening industry broadly failed to match records accurately to the correct individuals, relied on incomplete court data, and did not maintain effective dispute resolution processes.

National Association of Realtors Antitrust Implications: CoreLogic's dominance over property data has drawn attention in the broader context of antitrust scrutiny of the real estate industry. When the NAR settled a landmark antitrust lawsuit over broker commissions in 2024, analysts noted that CoreLogic's data monopoly represents a different but equally significant competition concern, the company controls the data infrastructure that makes the real estate market function, with no viable alternative for market participants.

Flood Determination Controversies: CoreLogic's flood determination services, which identify whether properties fall within FEMA-designated flood zones, directly affect homeowners' mortgage terms and insurance requirements. Properties incorrectly identified as being in flood zones face mandatory flood insurance requirements that can add thousands of dollars annually to housing costs. Conversely, properties incorrectly excluded from flood zones may leave homeowners exposed to catastrophic uninsured losses.

SafeRent Algorithmic Bias Allegations: CoreLogic's SafeRent tenant screening system has faced allegations of algorithmic discrimination. In 2022, a federal lawsuit alleged that SafeRent's scoring algorithm disproportionately rejected Black and Hispanic rental applicants by using factors that serve as proxies for race, including credit history and income sources.

The case raised fundamental questions about whether automated tenant screening tools launder human biases through algorithmic processes, producing discriminatory outcomes while appearing facially neutral. The Department of Justice and the Department of Housing and Urban Development have both signaled interest in algorithmic discrimination in housing, and CoreLogic's SafeRent system has been identified as a case study in how automated tools can perpetuate Fair Housing Act violations.

In 2023, HUD published guidance clarifying that housing providers can be held liable under the Fair Housing Act for using screening tools that have a disparate impact on protected classes, even if the housing provider did not design the algorithm. This guidance placed new pressure on tenant screening companies including CoreLogic to demonstrate that their algorithms do not produce discriminatory results, a burden that companies accustomed to treating their algorithms as proprietary trade secrets are reluctant to accept.

Data Accuracy Litigation: Multiple lawsuits have been filed against CoreLogic by individuals who were denied housing or employment based on inaccurate background check reports. Common complaints include criminal records attributed to the wrong person, eviction records from cases that were dismissed, and failure to update records after disputes.

Privatization and Reduced Transparency (2021): CoreLogic's $6 billion take-private deal by Stone Point Capital and Insight Partners removed the company from public reporting requirements. As a private company, CoreLogic is no longer required to file quarterly and annual reports with the SEC, reducing public visibility into its financial practices, data security investments, and regulatory compliance.

Privacy advocates expressed concern that privatization would reduce accountability at a time when CoreLogic's data practices were facing increasing scrutiny from regulators and civil rights organizations. Private equity ownership also raises concerns about potential cost-cutting in data quality and security, areas that generate costs but not revenue, and that private equity firms may be inclined to reduce in pursuit of higher returns.

Australian Operations: CoreLogic's Australian subsidiary, which maintains the country's most comprehensive property database, has faced questions about data accuracy and the use of property data in automated decision-making systems that affect lending and insurance outcomes for Australian consumers.

Hostile Takeover Attempt (2020-2021): Before the eventual take-private deal, CoreLogic faced a hostile acquisition attempt from CoStar Group in late 2020, valued at approximately $6.9 billion. CoreLogic's board initially rejected the offer, triggering a proxy fight. The episode highlighted how CoreLogic's data assets, particularly the 99.9% property coverage, made the company an extraordinarily attractive acquisition target. The eventual sale to Stone Point Capital and Insight Partners at $6 billion closed in June 2021.

COVID-19 Eviction Data Concerns: During the pandemic eviction moratorium period (2020-2021), housing advocates raised concerns that CoreLogic's tenant screening databases would reflect eviction filings from the pre-moratorium period while failing to account for the extraordinary economic circumstances. When federal and state eviction moratoriums expired, there was evidence that screening databases carried forward pandemic-era records that created barriers for renters seeking new housing.

Threat Score Analysis

CoreLogic receives a composite threat score of 62/100, reflecting its role as a critical but largely invisible infrastructure provider whose data errors can have severe consequences for individuals' housing access:

  • Data Collection (78/100): CoreLogic maintains the most comprehensive property database in the United States, covering 99.9% of residential properties with detailed records extending to ownership history, tax data, mortgage information, and building characteristics. The tenant screening databases add a deeply personal dimension, eviction records, criminal background data, and rental history that directly determine housing access. The breadth of collection is near-total within its domain.

  • Third-Party Sharing (70/100): CoreLogic's business model is built on licensing data to thousands of clients across the real estate, mortgage, insurance, and property management industries. While sharing is less indiscriminate than consumer data brokers, clients are typically institutional rather than individual, the downstream impact is significant because the data directly influences housing, lending, and insurance decisions affecting millions of people.

  • Breach History (45/100): CoreLogic has not experienced a catastrophic public data breach comparable to major consumer data brokers. However, the sensitivity of its data holdings, property records, tenant screening reports, mortgage data, means that any breach would expose deeply personal financial information. The company's acquisitions of numerous smaller data companies increase the attack surface.

  • Government Contracts (40/100): CoreLogic provides data to federal agencies including FEMA and HUD, but government contracts are not the primary revenue driver. The company's role is more accurately described as infrastructure for the housing system rather than a direct government surveillance tool. However, the data's availability to government entities for purposes beyond its original collection remains a concern.

  • Transparency (40/100): As a now-private company, CoreLogic has limited public reporting obligations. Tenant screening processes are opaque to the individuals they evaluate, and disputing errors in CoreLogic's databases is documented as difficult and time-consuming. The company does provide some consumer-facing tools for viewing property data, but the tenant screening and risk assessment systems that most directly affect individuals remain largely black boxes. The $6 billion privatization further reduced what limited visibility existed under SEC reporting requirements.

Weighted calculation: (78 * 0.25) + (70 * 0.25) + (45 * 0.20) + (40 * 0.15) + (40 * 0.15) = 19.5 + 17.5 + 9.0 + 6.0 + 6.0 = 58.0, adjusted to 62 due to CoreLogic's monopolistic position in U.S. property data and the outsized impact that data errors have on individuals' ability to secure housing.

Transparency & Accountability

CoreLogic operates in a transparency gap that is characteristic of the data infrastructure industry, companies whose data fundamentally shapes life outcomes but whose practices are largely invisible to the individuals they affect.

The company's 2021 privatization further reduced accountability. As a publicly traded company, CoreLogic was required to file SEC reports detailing financial performance, risk factors, and material legal proceedings. Private ownership eliminated these disclosure requirements, leaving regulators, researchers, and the public with less visibility into the company's practices.

For tenant screening, the transparency deficit is particularly acute:

  • Prospective tenants typically do not know that CoreLogic generated the report used to evaluate them
  • The specific data points, algorithms, and scoring criteria used in screening decisions are proprietary
  • Disputing inaccuracies requires navigating a process that consumer advocates describe as deliberately burdensome
  • There is no mechanism for individuals to proactively review their CoreLogic tenant screening profile before it is used against them

The FCRA requires that consumer reporting agencies maintain reasonable procedures to ensure accuracy and allow consumers to dispute errors. However, enforcement has been inconsistent, and the burden of identifying and correcting errors falls on individuals who may not even know which company generated the report that denied them housing.

CoreLogic has made some efforts toward corporate responsibility, publishing sustainability reports and participating in industry groups focused on data quality. However, these initiatives are voluntary and do not address the structural power imbalance between a company that controls 99.9% of U.S. property data and the individuals whose housing access depends on that data's accuracy.

Regulatory oversight is fragmented across federal agencies (FTC, CFPB), state attorneys general, and fair housing enforcement bodies. No single regulator has comprehensive authority over CoreLogic's full range of data practices, creating gaps that allow problematic practices to persist.

The fundamental accountability challenge is CoreLogic's market dominance. When a single company controls nearly all U.S. property data, the market cannot provide the competitive discipline that might otherwise incentivize better data accuracy, consumer access, and transparency. Individuals and institutions alike are effectively captive to CoreLogic's data, there is no meaningful alternative for the mortgage, insurance, and rental industries that depend on it.

The White House Blueprint for an AI Bill of Rights (2022) identified algorithmic discrimination in housing as a priority concern, with tenant screening algorithms cited as examples of automated systems that perpetuate discrimination. CoreLogic's SafeRent system is precisely the type of technology this framework targets, yet voluntary principles without enforcement mechanisms have limited practical impact.

State-level legislative efforts offer some hope for accountability. Several states have enacted or proposed legislation restricting the use of eviction records in tenant screening, limiting how far back criminal records can be considered, and requiring that screening companies provide free copies of reports to applicants. These patchwork reforms address specific symptoms of the broader problem but do not resolve the structural power imbalance between a data monopolist and the individuals whose lives depend on its data accuracy.

CoreLogic's transition to private ownership, combined with its near-total market dominance and the life-altering consequences of its data products, makes it one of the most consequential yet least visible data companies in America. The 150 million property records and millions of tenant screening reports it generates annually shape the housing outcomes of a nation, yet the company operates with less public scrutiny than consumer-facing technology companies with far less direct impact on individuals' daily lives.

The coming years will test whether the emerging patchwork of state privacy laws, federal regulatory action by the CFPB and FTC, and growing public awareness of algorithmic discrimination in housing will create meaningful constraints on CoreLogic's data practices. Until then, the company remains the invisible arbiter of American housing, a private entity with public-utility power and private-sector accountability.

The essential paradox of CoreLogic is that the company provides genuinely important infrastructure for the housing market, mortgage lenders need property data, insurers need hazard assessments, and governments need market analytics. But the monopolistic concentration of this infrastructure in a single private company, combined with the expansion into privacy-sensitive tenant screening and algorithmic decision-making, creates risks that the current regulatory framework is not equipped to address.

A public utility model, treating property data infrastructure as a regulated monopoly with mandated accuracy standards, transparency requirements, and consumer access rights, has been suggested by some housing policy researchers. Whether such a model is politically achievable given CoreLogic's lobbying resources and institutional client relationships remains an open question. What is clear is that the status quo, a private data monopoly with public-utility power and minimal accountability, serves CoreLogic's shareholders at the expense of the millions of Americans whose housing outcomes depend on the accuracy and fairness of the company's data.

All Companies